crypto.h File Reference

ascii-chat Client Cryptography Handler Interface More...

Go to the source code of this file.

Functions
void	client_crypto_set_mode (uint8_t mode)
	Set crypto mode for handshake (encryption + authentication)
int	client_crypto_init (void)
	Initialize client crypto handshake.
int	client_crypto_handshake (acip_transport_t *transport)
	Perform crypto handshake with server.
bool	crypto_client_is_ready (void)
	Check if crypto handshake is ready.
const crypto_context_t *	crypto_client_get_context (void)
	Get crypto context for encryption/decryption.
int	crypto_client_encrypt_packet (const uint8_t *plaintext, size_t plaintext_len, uint8_t *ciphertext, size_t ciphertext_size, size_t *ciphertext_len)
	Encrypt a packet for transmission.
int	crypto_client_decrypt_packet (const uint8_t *ciphertext, size_t ciphertext_len, uint8_t *plaintext, size_t plaintext_size, size_t *plaintext_len)
	Decrypt a received packet.
void	crypto_client_cleanup (void)
	Cleanup crypto client resources.
bool	crypto_client_should_rekey (void)
	Check if session rekeying should be triggered.
int	crypto_client_initiate_rekey (void)
	Initiate session rekeying (client-initiated)
int	crypto_client_process_rekey_request (const uint8_t *packet, size_t packet_len)
	Process received REKEY_REQUEST packet from server.
int	crypto_client_send_rekey_response (void)
	Send REKEY_RESPONSE packet to server.
int	crypto_client_process_rekey_response (const uint8_t *packet, size_t packet_len)
	Process received REKEY_RESPONSE packet from server.
int	crypto_client_send_rekey_complete (void)
	Send REKEY_COMPLETE packet to server and commit to new key.

Detailed Description

ascii-chat Client Cryptography Handler Interface

Provides client-side cryptographic handshake coordination, key loading, and encryption context management for secure server communication.

Cryptographic Protocol

Key Exchange: X25519 elliptic curve Diffie-Hellman (ephemeral key pairs) Encryption: XSalsa20-Poly1305 AEAD cipher (authenticated encryption) Authentication: Ed25519 digital signatures (optional, can be passwordless) KDF: Argon2i (password-based key derivation, if using password auth)

Authentication Modes

1. Ephemeral DH (default): Encrypted but no identity verification
2. Password Authentication: Shared password + PBKDF → session key
3. SSH Key Authentication: Ed25519 signatures + known_hosts verification
4. Passwordless ECDH: Encryption only, no authentication

Handshake Flow

Client                                  Server
  |------ CLIENT_HELLO (pubkey) ------->|
  |                                      |
  |<----- SERVER_HELLO (pubkey) --------|
  |                                      |
  | [Derive shared secret via ECDH]      |
  |                                      |
  |<---- SERVER_AUTH (signature) -------|
  |                                      |
  |--- CLIENT_AUTH (signature/pass) --->|
  |                                      |
  |<---- SERVER_READY (encrypted) ------|
  |                                      |
  | [Encryption ready for payload]      |

Author

Zachary Fogg me@zf.nosp@m.o.gg

Date

2025

See also

topic_client_crypto "Cryptography Details"

topic_client_connection "Connection Management (which calls handshake)"

Definition in file src/client/crypto.h.