mirror of
https://github.com/luxfi/zwing.git
synced 2026-09-24 00:24:38 +00:00
zeekay
f21120ce2f
Z-Wing is the canonical Lux post-quantum secure channel. One construction,
one wire format, no negotiation. Layered design exposes a net.Conn so
luxfi/api/zap (and any other stream protocol) runs unchanged on top.
KEM: X-Wing (X25519 + ML-KEM-768, IETF draft-connolly-cfrg-xwing-kem
SHA3-256 combiner: "\./" || "X-Wing" || ssM || ssX || ctX || pkX)
Identity: Ed25519 + ML-DSA-65 hybrid signatures
AEAD: ChaCha20-Poly1305 with sequence-numbered nonces (per direction)
Transport: TCP (RNS routing is a follow-up package)
Public API: GenerateIdentity / Dial / Listen / Client / Server.
Six tests cover the spec end-to-end: handshake round-trip, TCP dial+listen,
ExpectedRemote pinning, key-zero-after-handshake forward secrecy, sequenced
nonces, and ZAP-over-Z-Wing application round-trip.
31 lines
1.3 KiB
Go
31 lines
1.3 KiB
Go
// Copyright (C) 2020-2026, Lux Industries Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
// Package zwing implements Z-Wing, the canonical Lux post-quantum secure
|
|
// channel. It provides an authenticated, forward-secret, hybrid PQ tunnel
|
|
// that exposes a net.Conn so application protocols (e.g. luxfi/api/zap)
|
|
// run unchanged on top.
|
|
//
|
|
// Layering:
|
|
//
|
|
// Application: ZAP RPC (luxfi/api/zap) <- unchanged
|
|
// Channel: Z-Wing (this package)
|
|
// KEM: X-Wing (X25519 + ML-KEM-768, IETF draft-connolly-cfrg-xwing-kem)
|
|
// Identity: Ed25519 + ML-DSA-65 hybrid signatures
|
|
// AEAD: ChaCha20-Poly1305, sequence-numbered nonces
|
|
// Routing: Plain TCP (this version) or RNS (follow-up package)
|
|
//
|
|
// Z-Wing is one construction. There are no alternates, no build tags, no
|
|
// cipher negotiation. The point of standardising is that two endpoints
|
|
// either speak Z-Wing v1 or they don't talk.
|
|
//
|
|
// Public API:
|
|
//
|
|
// id, _ := zwing.GenerateIdentity()
|
|
// ln, _ := zwing.Listen(":9999", &zwing.Config{LocalIdentity: id})
|
|
// conn, _ := zwing.Dial(ctx, "host:9999", &zwing.Config{LocalIdentity: clientID})
|
|
//
|
|
// `conn` and the result of `ln.Accept()` both implement net.Conn and can be
|
|
// passed to zap.NewConn, http.Serve, or anything else that wants a stream.
|
|
package zwing
|