From c635e41d8576f5587d47e51a98dfd4a8920315f0 Mon Sep 17 00:00:00 2001 From: eunhhu Date: Sun, 27 Sep 2026 18:26:33 +0100 Subject: Seal delivered sends to the receiver's key (086) --seal OUTPUT=KEY seals each request's body whole to the receiving node's public key with HPKE (RFC 9180, base mode: X25519, HKDF-SHA256, AES-128-GCM where the CPU has AES, else ChaCha20-Poly1305), bound to the request's source, first number and count; X-Pure-Seal names the suite. A receiver's --key is a raw 32-byte file, made 0600 when missing, held in OpenSSL's secure heap; it opens the body where it lies (400 seal when it does not open) and zeroes the plain text when the request's ticket goes. --sealed-only refuses unsealed deliveries (403 unsealed). The check puts a recording relay between two apps: every order applies once, no body shows an item or a field name, a flipped bit is refused, a replayed request applies nothing twice, and a seal to another key does not open. Its hosts choose their own ports (--port 0). Sealed sends drain at 233-235k a second against 469-470k plain (Raspberry Pi 5): three X25519 operations a request, 164 us each. The plain request path measured the same as before. --- serve/deliver.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'serve/deliver.h') diff --git a/serve/deliver.h b/serve/deliver.h index 2d1da29..70b03b9 100644 --- a/serve/deliver.h +++ b/serve/deliver.h @@ -23,6 +23,10 @@ void pure_wire_trust(const char *ca_file); PureWire *pure_wire_open(const PureModule *m, const char *output, const char *url, const char *source, char *error, size_t size); uint32_t pure_wire_output(const PureWire *); +/* Seal the wire's sends to the receiver's public key (serve/seal.h): each + * request's body, bound to its source, first number and count, goes with + * X-Pure-Seal naming the suite. Before pure_wire_start. */ +void pure_wire_seal(PureWire *, const unsigned char peer[32]); /* The owner's side: queue a saved send numbered after the last queued one * (it is encoded now); false when it cannot be (a bytes field that is not * UTF-8 has no JSON form), and the wire then stops at it. */ -- cgit v1.2.3