mirror of
https://github.com/luxfi/zwing.git
synced 2026-09-24 00:24:38 +00:00
zeekay
f21120ce2f
Z-Wing is the canonical Lux post-quantum secure channel. One construction,
one wire format, no negotiation. Layered design exposes a net.Conn so
luxfi/api/zap (and any other stream protocol) runs unchanged on top.
KEM: X-Wing (X25519 + ML-KEM-768, IETF draft-connolly-cfrg-xwing-kem
SHA3-256 combiner: "\./" || "X-Wing" || ssM || ssX || ctX || pkX)
Identity: Ed25519 + ML-DSA-65 hybrid signatures
AEAD: ChaCha20-Poly1305 with sequence-numbered nonces (per direction)
Transport: TCP (RNS routing is a follow-up package)
Public API: GenerateIdentity / Dial / Listen / Client / Server.
Six tests cover the spec end-to-end: handshake round-trip, TCP dial+listen,
ExpectedRemote pinning, key-zero-after-handshake forward secrecy, sequenced
nonces, and ZAP-over-Z-Wing application round-trip.
44 lines
1.2 KiB
Go
44 lines
1.2 KiB
Go
// Copyright (C) 2020-2026, Lux Industries Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
package zwing
|
|
|
|
import "net"
|
|
|
|
// Listener is a Z-Wing listener. Accepted connections are post-handshake
|
|
// net.Conns ready for application traffic.
|
|
type Listener struct {
|
|
raw net.Listener
|
|
cfg *Config
|
|
}
|
|
|
|
// Listen binds a TCP listener at addr that performs Z-Wing handshakes
|
|
// before yielding connections.
|
|
func Listen(addr string, cfg *Config) (*Listener, error) {
|
|
if cfg == nil || cfg.LocalIdentity == nil {
|
|
return nil, ErrConfigMissingID
|
|
}
|
|
raw, err := net.Listen("tcp", addr)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &Listener{raw: raw, cfg: cfg}, nil
|
|
}
|
|
|
|
// Accept returns the next handshaken connection. If a handshake fails
|
|
// the underlying conn is closed and Accept returns the error; callers
|
|
// that want to keep listening should call Accept again.
|
|
func (l *Listener) Accept() (net.Conn, error) {
|
|
raw, err := l.raw.Accept()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return serverHandshake(raw, l.cfg)
|
|
}
|
|
|
|
// Close closes the underlying TCP listener.
|
|
func (l *Listener) Close() error { return l.raw.Close() }
|
|
|
|
// Addr returns the listener's TCP address.
|
|
func (l *Listener) Addr() net.Addr { return l.raw.Addr() }
|