lib-q-duplex-aead

Duplex-sponge AEAD using Keccak-f[1600] (same permutation family as SHA-3). Rate 136 bytes, 256-bit key, 128-bit nonce, 256-bit tag.

Usage

use lib_q_core::{Aead, AeadKey, Nonce};
use lib_q_duplex_aead::DuplexSpongeAead;

let aead = DuplexSpongeAead::new();
let key = AeadKey::new(vec![0u8; 32]);
let nonce = Nonce::new(vec![0u8; 16]);
let ct = aead.encrypt(&key, &nonce, b"message", Some(b"ad")).unwrap();
let pt = aead.decrypt(&key, &nonce, &ct, Some(b"ad")).unwrap();

Features

• std — standard library (default with alloc)
• alloc — heap allocations (default)
• simd-avx2 — optional AVX2 path on x86_64 (runtime detection via std::arch when std is enabled); duplex single-session path remains scalar

Security

The permutation is NIST-standardized; the AEAD mode defined in this crate is custom. Obtain independent review before production deployment.

Part of the lib-Q workspace; pairs with lib-q-core AEAD traits.

Key commitment (CMT-1)

SaturninQcb now applies a committing transform (CTX); no other libQ AEAD is key-committing, and none of the rest claims to be. CMT-1 asks whether one ciphertext can be made to decrypt successfully under two distinct keys, with the nonce and associated data free on each side. That property is not part of the AEAD security goal most of these modes were designed for; outside SaturninQcb, libQ does not provide it.

Do not use any libQ AEAD other than SaturninQcb for multi-recipient encryption, key wrapping / envelope encryption, or password-based decryption as an identification or authorization signal without binding the key externally — e.g. put H(key ‖ context) in the associated data, or carry an explicit key commitment beside the ciphertext (lib-q-mve does the latter: see MVE_COMMIT_LABEL). Even for SaturninQcb, treat this as claimed, not proven: see the table row and the sign-off obligations in lib-q-saturnin/src/commit.rs.

One mode, SaturninShortAead, has a demonstrated break: a test produces one ciphertext that decrypts successfully under two distinct keys. SaturninQcb had a break of the same class; it is retained verbatim as a regression test (lib-q-saturnin/tests/key_commitment.rs) and now fails tag verification on every one of 200 independent instances (see the table). For the other seven a bounded search found nothing, which is not evidence that they commit — read the box under the table before quoting any row of it.

The "no cheap break found" rows are not evidence of key commitment and must never be quoted as if they were. Each comes from 20 000 random (key, nonce, associated-data) trials against a fixed ciphertext. Against a 256-bit tag the expected yield of that search is ~2^{-242 hits, so it returns zero whether or not the mode commits — and it would return zero just the same against a mode with a 2}40 structural break the search does not model. All those rows rule out is the class of break the two Saturnin modes fell into: one cheap enough for ~2^14 trials to stumble onto.

Demonstrating the positive — that a mode is committing — is not achievable by search at these tag sizes at all, however many trials are run. It needs a proof, or a committing transform (bind H(key ‖ nonce ‖ associated data) into the tag) that changes the construction. SaturninQcb now has one (above — claimed, and RED pending sign-off); the rest of libQ does not, which is why no other row above reads "committing".

Reproduce (each prints its own measurements with --nocapture):

# the retained (now-defeated) QCB attack, and the CTX byte-layout / binding gate
cargo test -p lib-q-saturnin --test key_commitment -- --nocapture
cargo test -p lib-q-saturnin --test qcb_ctx_spec -- --nocapture
# the still-live SaturninShortAead break
cargo test -p lib-q-saturnin --features aead-short --lib key_commitment_tests -- --nocapture
# the bounded searches for the registry modes
cargo test -p lib-q-aead \
  --features "saturnin,duplex-sponge-aead,tweak-aead,romulus-n,romulus-m,rocca-s" \
  --test key_commitment -- --nocapture

Sources: lib-q-saturnin/src/commit.rs, lib-q-saturnin/tests/key_commitment.rs, lib-q-saturnin/tests/qcb_ctx_spec.rs, lib-q-saturnin/src/aead_short.rs (key_commitment_tests), lib-q-aead/tests/key_commitment.rs. Card t_16ddf21c.

Nonce extension (XChaCha-style) — evaluated and deliberately not pursued

Every libQ AEAD uses a 128-bit nonce. XChaCha20-Poly1305 exists to stretch a 96-bit nonce to 192 bits so that random nonces stop colliding around 2^{32 messages per key; at 128 bits the birthday bound is already 2}64, beyond any realistic message volume. Nonce extension therefore buys nothing here and is not planned — please do not re-raise it. The adjacent gap that is real is key and context commitment, above.