Module token_v2 

Address-validation tokens bound to (PeerId||CID||nonce) Token v2: bind address-validation tokens to (PeerId || CID || nonce).

This module provides secure token encryption using AES-256-GCM with proper authenticated encryption. Tokens are bound to specific peer IDs and connection IDs to prevent token replay and spoofing attacks.

Security features:

• AES-256-GCM authenticated encryption
• 12-byte nonces for uniqueness
• Authentication tags to prevent tampering
• Proper nonce handling to avoid reuse

Not wired into transport yet; used by tests and for upcoming integration.

Structs

RetryTokenDecoded

The decoded contents of a retry token after successful decryption and validation. Contains the peer identity, connection ID, and nonce used for address validation.

TokenKey

A 256-bit key used for encrypting and authenticating retry tokens. Used with AES-256-GCM for authenticated encryption of token contents.

Functions

decode_retry_token

Decode and validate a retry token, returning the contained peer information. Decrypts the token using the provided key and validates the contents. Returns None if decryption fails or the token format is invalid.

encode_retry_token

encode_retry_token_with_rng

Encode a retry token containing peer ID, connection ID, and a fresh nonce. Encrypts the token contents using AES-256-GCM with the provided key. Returns the encrypted token as bytes, including authentication tag and nonce.

test_key_from_rng

Generate a random token key for testing purposes. Fills a 32-byte array with random data from the provided RNG.

validate_token

Validate a retry/validation token against the expected peer and connection ID. Returns true if the token decodes and matches both identifiers.