excised zssp

zssp/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+authors = ["ZeroTier, Inc. <contact@zerotier.com>", "Adam Ierymenko <adam.ierymenko@zerotier.com>"]
+edition = "2021"
+license = "MPL-2.0"
+name = "zerotier-zssp"
+version = "0.1.0"
+
+[dependencies]
+zerotier-utils = { path = "../utils" }
+zerotier-crypto = { path = "../crypto" }
+pqc_kyber = { path = "../third_party/kyber", features = ["kyber1024", "reference"], default-features = false }
+#ed25519-dalek = { version = "1.0.1", features = ["std", "u64_backend"], default-features = false }
+#foreign-types = "0.3.1"
+#lazy_static = "^1"
+#poly1305 = { version = "0.8.0", features = [], default-features = false }
+#pqc_kyber = { path = "../third_party/kyber", features = ["kyber1024", "reference"], default-features = false }
+#pqc_kyber = { version = "^0", features = ["kyber1024", "reference"], default-features = false }
+#rand_core = "0.5.1"
+#rand_core_062 = { package = "rand_core", version = "0.6.2" }
+#subtle = "2.4.1"
+#x25519-dalek = { version = "1.2.0", features = ["std", "u64_backend"], default-features = false }
+
+#[target."cfg(windows)".dependencies]
+#openssl = { version = "^0", features = ["vendored"], default-features = false }
+#winapi = { version = "^0", features = ["handleapi", "ws2ipdef", "ws2tcpip"] }
+
+#[target."cfg(not(windows))".dependencies]
+#openssl = { version = "^0", features = [], default-features = false }
+#libc = "^0"
+#signal-hook = "^0"
+
+#[dev-dependencies]
+#criterion = "0.3"
+#sha2 = "^0"
+#hex-literal = "^0"

zssp/ZSSP.md

@@ -0,0 +1,8 @@
+ZeroTier Secure Socket Protocol
+======
+
+**NOTE: this protocol and code have not yet been formally audited and should not be used in anything production.**
+
+ZSSP (ZeroTier Secure Socket Protocol) is an implementation of the Noise_IK pattern using FIPS/NIST compliant primitives. After Noise_IK negotiation is complete ZSSP also adds key ratcheting and optional (enabled by default) support for quantum data forward secrecy with Kyber1024.
+
+It's general purpose and could be used with any system but contains a few specific design choices to make it optimal for ZeroTier and easy to distinguish from legacy ZeroTier V1 traffic for backward compatibility.

zssp/changes.txt

@@ -0,0 +1,9 @@
+zssp has been moved into it's own crate.
+
+zssp has been cut up into several files, only the new zssp.rs file contains the critical security path..
+
+zssp was inconsistently using a local/remote vs alice/bob naming convention, all names have been switched to a local/remote convention.
+
+Standardized the naming conventions for security variables throughout zssp.
+
+Implemented a safer version of write_all for zssp to use. This has 3 benefits: it completely prevents unknown io errors, making error handling easier and self-documenting; it completely prevents src from being truncated in dest, putting in an extra barrier to prevent catastrophic key truncation; and it has slightly less performance overhead than a write_all.

zssp/rustfmt.toml

@@ -0,0 +1 @@
+../rustfmt.toml

zssp/src/lib.rs

@@ -0,0 +1,2 @@
+
+pub mod zssp;