mirror of
https://github.com/luxfi/zwing.git
synced 2026-09-24 00:24:38 +00:00
zeekay
f21120ce2f
Z-Wing is the canonical Lux post-quantum secure channel. One construction,
one wire format, no negotiation. Layered design exposes a net.Conn so
luxfi/api/zap (and any other stream protocol) runs unchanged on top.
KEM: X-Wing (X25519 + ML-KEM-768, IETF draft-connolly-cfrg-xwing-kem
SHA3-256 combiner: "\./" || "X-Wing" || ssM || ssX || ctX || pkX)
Identity: Ed25519 + ML-DSA-65 hybrid signatures
AEAD: ChaCha20-Poly1305 with sequence-numbered nonces (per direction)
Transport: TCP (RNS routing is a follow-up package)
Public API: GenerateIdentity / Dial / Listen / Client / Server.
Six tests cover the spec end-to-end: handshake round-trip, TCP dial+listen,
ExpectedRemote pinning, key-zero-after-handshake forward secrecy, sequenced
nonces, and ZAP-over-Z-Wing application round-trip.
24 lines
741 B
Go
24 lines
741 B
Go
// Copyright (C) 2020-2026, Lux Industries Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
package zwing
|
|
|
|
import "time"
|
|
|
|
// DefaultPort is the canonical Z-Wing TCP port.
|
|
const DefaultPort = 9999
|
|
|
|
// Config configures a Z-Wing dialer or listener.
|
|
type Config struct {
|
|
// LocalIdentity is this endpoint's long-term identity. Required.
|
|
LocalIdentity *Identity
|
|
|
|
// ExpectedRemote pins the peer's expected public identity. If set, the
|
|
// handshake fails with ErrIdentityMismatch when the remote presents a
|
|
// different identity. Leave nil for "any peer with a valid identity".
|
|
ExpectedRemote *IdentityPublic
|
|
|
|
// HandshakeTimeout bounds the handshake itself. Zero means no timeout.
|
|
HandshakeTimeout time.Duration
|
|
}
|