Struct MessageSession 

pub struct MessageSession { /* private fields */ }

MessageSession manages the cryptographic state for secure message exchange between two parties using post-quantum cryptographic algorithms.

Each session contains:

• A digital signature keypair for signing our messages
• A verifier for validating messages from the other party
• One chain key and one counter per direction, derived from the ML-KEM shared secret, so both parties can send at the same time without nonce reuse
• A transcript hash of the handshake that every message signature is bound to

Every message is encrypted with its own key, derived from the chain key, after which the chain key moves forward and the old one is wiped. Someone who steals the session (or a stored to_bytes() copy) can’t decrypt the messages that came before.

Messages must be validated in the order they were crafted.

Implementations

impl MessageSession

pub fn to_bytes(&self) -> Zeroizing<Vec<u8>>

Serializes the session to a byte array

Returns

The serialized session (wiped when dropped)

Security Note

The serialized data contains sensitive cryptographic material including private keys. It should be stored securely and only deserialized in a trusted environment.

pub fn from_bytes(bytes: &[u8]) -> Result<Self, CryptoError>

Deserializes a session from a byte array

Arguments

• bytes - The serialized session bytes

Returns

• Result<Self, CryptoError>: The deserialized session or an error

Errors

Returns an error if the byte array is not the correct length, version or format

pub fn new_initiator( my_signer: SignerPair, base_nonce: [u8; 24], target_prekey: &SignedPrekey, target_verifier: &PublicKeyBytes, ) -> Result<(Self, [u8; 1568]), CryptoError>

Creates a new session as the initiator

Send the responder everything it needs to call MessageSession::new_responder: the returned ciphertext, target_prekey.id(), the base nonce and your FN-DSA public key.

Arguments

• my_signer - Your own signer pair
• base_nonce - Base nonce (0..16 session id, 16..24 counter), shared with the responder
• target_prekey - A signed prekey of the target
• target_verifier - FN-DSA public key of the target. Get it from a source you trust: it is what proves the prekey really belongs to the target.

Returns

• Result<(Self, [u8; pair::CIPHERTEXT_BYTES]), CryptoError>: The session and ciphertext for the responder, or InvalidSignature if the prekey was not signed by target_verifier

Examples found in repository

examples/full_exchange.rs (lines 20-25)

fn main() {
    let alice_signer = SignerPair::create();
    let mut bob_signer = SignerPair::create();

    // Bob creates a one-time prekey and signs its public part, which he shares with Alice
    let bob_prekey = KEMPair::create();
    let bob_signed_prekey = SignedPrekey::new(&mut bob_signer, &bob_prekey).unwrap();

    // Create a base nonce with a new session id, and a counter of 0
    let base_nonce = create_nonce(&gen_session_id(), 0);

    // Lets create the message session for Alice first. This checks that the prekey
    // was signed by Bob.
    let (mut alice_session, ciphertext) = MessageSession::new_initiator(
        alice_signer.clone(),
        base_nonce,
        &bob_signed_prekey,
        bob_signer.pub_key_bytes(), // Bob's public signer key
    )
    .unwrap();

    // Now for Bob it would look like this
    let mut bob_session = MessageSession::new_responder(
        &bob_prekey,
        bob_signer.clone(),
        base_nonce,
        &ciphertext,
        alice_signer.pub_key_bytes(), // Alice's public signer key
    )
    .unwrap();

    // The prekey was one-time, so Bob deletes it now (dropping it wipes it from memory)
    drop(bob_prekey);

    // Both sessions now hold one chain key per direction, derived from the shared secret.
    // Every message gets its own key, and the chain moves forward after each one.

    // Alice creates a message and prepares to send it to Bob
    let message = b"Hello, Bob! This is a secret message.";
    let encrypted_message = alice_session.craft_message(message).unwrap();

    // Bob decrypts and verifies Alice's message
    let raw_message = bob_session.validate_message(&encrypted_message).unwrap();

    // Both message and raw_message are equal, let's print them out to illustrate
    let message_str = String::from_utf8_lossy(message);
    let raw_message_str = String::from_utf8_lossy(&raw_message);

    println!("[1] Alice's message: {}", message_str);
    println!("[2] Bob's decrypted message: {}", raw_message_str);

    // Bob crafts a reply message to Alice
    let reply = b"Hello, Alice! I received your message safely.";
    let encrypted_reply = bob_session.craft_message(reply).unwrap();

    // Alice decrypts and verifies Bob's reply
    let raw_reply = alice_session.validate_message(&encrypted_reply).unwrap();

    // Both reply and raw_reply are equal, let's print them again
    let reply_str = String::from_utf8_lossy(reply);
    let raw_reply_str = String::from_utf8_lossy(&raw_reply);

    println!("[3] Bob's reply: {}", reply_str);
    println!("[4] Alice's decrypted reply: {}", raw_reply_str);
}

examples/prekey_server.rs (lines 54-59)

fn main() {
    let mut server = PrekeyServer::new();

    // --- Bob's device: create prekeys, keep the secrets, publish the signed public parts
    let mut bob_signer = SignerPair::create();
    let bob_last_resort = KEMPair::create();
    let bob_last_resort_signed = SignedPrekey::new(&mut bob_signer, &bob_last_resort).unwrap();

    let mut bob_one_time: HashMap<PrekeyId, KEMPair> = HashMap::new();
    let mut published = Vec::new();
    for _ in 0..3 {
        let prekey = KEMPair::create();
        let signed = SignedPrekey::new(&mut bob_signer, &prekey).unwrap();
        bob_one_time.insert(signed.id(), prekey);
        published.push(signed);
    }
    server
        .publish(
            "bob",
            *bob_signer.pub_key_bytes(),
            bob_last_resort_signed.clone(),
            published,
        )
        .unwrap();
    println!(
        "Bob published 3 one-time prekeys and a last-resort prekey ({} one-time left)",
        server.one_time_remaining(&"bob")
    );

    // --- Alice's device: fetch Bob's bundle and start a session
    let alice_signer = SignerPair::create();
    let bundle = server.fetch(&"bob").unwrap();

    // In a real app Alice checks Bob's identity key against a copy she trusts
    // (for example by comparing safety numbers in person)
    assert_eq!(&bundle.identity, bob_signer.pub_key_bytes());

    let base_nonce = create_nonce(&gen_session_id(), 0);
    let (mut alice_session, ciphertext) = MessageSession::new_initiator(
        alice_signer.clone(),
        base_nonce,
        &bundle.prekey,
        &bundle.identity,
    )
    .unwrap();

    // Alice sends Bob: the ciphertext, the prekey id, the base nonce and her identity key
    let prekey_id = bundle.prekey.id();

    // --- Bob's device: find the prekey Alice used and set up his side
    let mut bob_session = if let Some(prekey) = bob_one_time.remove(&prekey_id) {
        // One-time prekey: it is removed from Bob's store above and wiped when dropped
        // at the end of this block, which gives the session forward secrecy
        MessageSession::new_responder(
            &prekey,
            bob_signer.clone(),
            base_nonce,
            &ciphertext,
            alice_signer.pub_key_bytes(),
        )
        .unwrap()
    } else if prekey_id == bob_last_resort_signed.id() {
        // Last-resort prekey: kept until Bob rotates it
        MessageSession::new_responder(
            &bob_last_resort,
            bob_signer.clone(),
            base_nonce,
            &ciphertext,
            alice_signer.pub_key_bytes(),
        )
        .unwrap()
    } else {
        panic!("unknown prekey");
    };
    println!(
        "Session set up; Bob has {} one-time prekey secrets left on his device",
        bob_one_time.len()
    );

    // --- Talk
    let encrypted = alice_session.craft_message(b"Hi Bob!").unwrap();
    let message = bob_session.validate_message(&encrypted).unwrap();
    println!("Bob received: {}", String::from_utf8_lossy(&message));

    let encrypted = bob_session.craft_message(b"Hi Alice!").unwrap();
    let reply = alice_session.validate_message(&encrypted).unwrap();
    println!("Alice received: {}", String::from_utf8_lossy(&reply));
}

pub fn new_responder( my_prekey: &KEMPair, my_signer: SignerPair, base_nonce: [u8; 24], ciphertext: &[u8; 1568], sender_verifier: &PublicKeyBytes, ) -> Result<Self, CryptoError>

Creates a new session as the responder

If my_prekey is a one-time prekey, delete it everywhere you store it once this returns. That deletion is what gives the session forward secrecy.

Arguments

• my_prekey - The prekey the initiator used (look it up by the id they sent)
• my_signer - Your own signer pair
• base_nonce - Base nonce (0..16 session id, 16..24 counter), shared with the initiator
• ciphertext - KEM ciphertext sent by the initiator
• sender_verifier - FN-DSA public key of the initiator

Returns

• Result<Self, CryptoError>: The session or an error

Examples found in repository

examples/full_exchange.rs (lines 29-35)

fn main() {
    let alice_signer = SignerPair::create();
    let mut bob_signer = SignerPair::create();

    // Bob creates a one-time prekey and signs its public part, which he shares with Alice
    let bob_prekey = KEMPair::create();
    let bob_signed_prekey = SignedPrekey::new(&mut bob_signer, &bob_prekey).unwrap();

    // Create a base nonce with a new session id, and a counter of 0
    let base_nonce = create_nonce(&gen_session_id(), 0);

    // Lets create the message session for Alice first. This checks that the prekey
    // was signed by Bob.
    let (mut alice_session, ciphertext) = MessageSession::new_initiator(
        alice_signer.clone(),
        base_nonce,
        &bob_signed_prekey,
        bob_signer.pub_key_bytes(), // Bob's public signer key
    )
    .unwrap();

    // Now for Bob it would look like this
    let mut bob_session = MessageSession::new_responder(
        &bob_prekey,
        bob_signer.clone(),
        base_nonce,
        &ciphertext,
        alice_signer.pub_key_bytes(), // Alice's public signer key
    )
    .unwrap();

    // The prekey was one-time, so Bob deletes it now (dropping it wipes it from memory)
    drop(bob_prekey);

    // Both sessions now hold one chain key per direction, derived from the shared secret.
    // Every message gets its own key, and the chain moves forward after each one.

    // Alice creates a message and prepares to send it to Bob
    let message = b"Hello, Bob! This is a secret message.";
    let encrypted_message = alice_session.craft_message(message).unwrap();

    // Bob decrypts and verifies Alice's message
    let raw_message = bob_session.validate_message(&encrypted_message).unwrap();

    // Both message and raw_message are equal, let's print them out to illustrate
    let message_str = String::from_utf8_lossy(message);
    let raw_message_str = String::from_utf8_lossy(&raw_message);

    println!("[1] Alice's message: {}", message_str);
    println!("[2] Bob's decrypted message: {}", raw_message_str);

    // Bob crafts a reply message to Alice
    let reply = b"Hello, Alice! I received your message safely.";
    let encrypted_reply = bob_session.craft_message(reply).unwrap();

    // Alice decrypts and verifies Bob's reply
    let raw_reply = alice_session.validate_message(&encrypted_reply).unwrap();

    // Both reply and raw_reply are equal, let's print them again
    let reply_str = String::from_utf8_lossy(reply);
    let raw_reply_str = String::from_utf8_lossy(&raw_reply);

    println!("[3] Bob's reply: {}", reply_str);
    println!("[4] Alice's decrypted reply: {}", raw_reply_str);
}

examples/prekey_server.rs (lines 69-75)

fn main() {
    let mut server = PrekeyServer::new();

    // --- Bob's device: create prekeys, keep the secrets, publish the signed public parts
    let mut bob_signer = SignerPair::create();
    let bob_last_resort = KEMPair::create();
    let bob_last_resort_signed = SignedPrekey::new(&mut bob_signer, &bob_last_resort).unwrap();

    let mut bob_one_time: HashMap<PrekeyId, KEMPair> = HashMap::new();
    let mut published = Vec::new();
    for _ in 0..3 {
        let prekey = KEMPair::create();
        let signed = SignedPrekey::new(&mut bob_signer, &prekey).unwrap();
        bob_one_time.insert(signed.id(), prekey);
        published.push(signed);
    }
    server
        .publish(
            "bob",
            *bob_signer.pub_key_bytes(),
            bob_last_resort_signed.clone(),
            published,
        )
        .unwrap();
    println!(
        "Bob published 3 one-time prekeys and a last-resort prekey ({} one-time left)",
        server.one_time_remaining(&"bob")
    );

    // --- Alice's device: fetch Bob's bundle and start a session
    let alice_signer = SignerPair::create();
    let bundle = server.fetch(&"bob").unwrap();

    // In a real app Alice checks Bob's identity key against a copy she trusts
    // (for example by comparing safety numbers in person)
    assert_eq!(&bundle.identity, bob_signer.pub_key_bytes());

    let base_nonce = create_nonce(&gen_session_id(), 0);
    let (mut alice_session, ciphertext) = MessageSession::new_initiator(
        alice_signer.clone(),
        base_nonce,
        &bundle.prekey,
        &bundle.identity,
    )
    .unwrap();

    // Alice sends Bob: the ciphertext, the prekey id, the base nonce and her identity key
    let prekey_id = bundle.prekey.id();

    // --- Bob's device: find the prekey Alice used and set up his side
    let mut bob_session = if let Some(prekey) = bob_one_time.remove(&prekey_id) {
        // One-time prekey: it is removed from Bob's store above and wiped when dropped
        // at the end of this block, which gives the session forward secrecy
        MessageSession::new_responder(
            &prekey,
            bob_signer.clone(),
            base_nonce,
            &ciphertext,
            alice_signer.pub_key_bytes(),
        )
        .unwrap()
    } else if prekey_id == bob_last_resort_signed.id() {
        // Last-resort prekey: kept until Bob rotates it
        MessageSession::new_responder(
            &bob_last_resort,
            bob_signer.clone(),
            base_nonce,
            &ciphertext,
            alice_signer.pub_key_bytes(),
        )
        .unwrap()
    } else {
        panic!("unknown prekey");
    };
    println!(
        "Session set up; Bob has {} one-time prekey secrets left on his device",
        bob_one_time.len()
    );

    // --- Talk
    let encrypted = alice_session.craft_message(b"Hi Bob!").unwrap();
    let message = bob_session.validate_message(&encrypted).unwrap();
    println!("Bob received: {}", String::from_utf8_lossy(&message));

    let encrypted = bob_session.craft_message(b"Hi Alice!").unwrap();
    let reply = alice_session.validate_message(&encrypted).unwrap();
    println!("Alice received: {}", String::from_utf8_lossy(&reply));
}

pub fn craft_message(&mut self, message: &[u8]) -> Result<Vec<u8>, CryptoError>

Creates a signed and encrypted message for the other party

Arguments

• message - The plaintext message to encrypt

Returns

• Result<Vec<u8>, CryptoError>: The encrypted message or an error

Security Note

This method increments the send counter to ensure a unique nonce for each message, and fails with NonceExhausted instead of ever reusing one.

Examples found in repository

examples/full_exchange.rs (line 46)

fn main() {
    let alice_signer = SignerPair::create();
    let mut bob_signer = SignerPair::create();

    // Bob creates a one-time prekey and signs its public part, which he shares with Alice
    let bob_prekey = KEMPair::create();
    let bob_signed_prekey = SignedPrekey::new(&mut bob_signer, &bob_prekey).unwrap();

    // Create a base nonce with a new session id, and a counter of 0
    let base_nonce = create_nonce(&gen_session_id(), 0);

    // Lets create the message session for Alice first. This checks that the prekey
    // was signed by Bob.
    let (mut alice_session, ciphertext) = MessageSession::new_initiator(
        alice_signer.clone(),
        base_nonce,
        &bob_signed_prekey,
        bob_signer.pub_key_bytes(), // Bob's public signer key
    )
    .unwrap();

    // Now for Bob it would look like this
    let mut bob_session = MessageSession::new_responder(
        &bob_prekey,
        bob_signer.clone(),
        base_nonce,
        &ciphertext,
        alice_signer.pub_key_bytes(), // Alice's public signer key
    )
    .unwrap();

    // The prekey was one-time, so Bob deletes it now (dropping it wipes it from memory)
    drop(bob_prekey);

    // Both sessions now hold one chain key per direction, derived from the shared secret.
    // Every message gets its own key, and the chain moves forward after each one.

    // Alice creates a message and prepares to send it to Bob
    let message = b"Hello, Bob! This is a secret message.";
    let encrypted_message = alice_session.craft_message(message).unwrap();

    // Bob decrypts and verifies Alice's message
    let raw_message = bob_session.validate_message(&encrypted_message).unwrap();

    // Both message and raw_message are equal, let's print them out to illustrate
    let message_str = String::from_utf8_lossy(message);
    let raw_message_str = String::from_utf8_lossy(&raw_message);

    println!("[1] Alice's message: {}", message_str);
    println!("[2] Bob's decrypted message: {}", raw_message_str);

    // Bob crafts a reply message to Alice
    let reply = b"Hello, Alice! I received your message safely.";
    let encrypted_reply = bob_session.craft_message(reply).unwrap();

    // Alice decrypts and verifies Bob's reply
    let raw_reply = alice_session.validate_message(&encrypted_reply).unwrap();

    // Both reply and raw_reply are equal, let's print them again
    let reply_str = String::from_utf8_lossy(reply);
    let raw_reply_str = String::from_utf8_lossy(&raw_reply);

    println!("[3] Bob's reply: {}", reply_str);
    println!("[4] Alice's decrypted reply: {}", raw_reply_str);
}

examples/prekey_server.rs (line 96)

fn main() {
    let mut server = PrekeyServer::new();

    // --- Bob's device: create prekeys, keep the secrets, publish the signed public parts
    let mut bob_signer = SignerPair::create();
    let bob_last_resort = KEMPair::create();
    let bob_last_resort_signed = SignedPrekey::new(&mut bob_signer, &bob_last_resort).unwrap();

    let mut bob_one_time: HashMap<PrekeyId, KEMPair> = HashMap::new();
    let mut published = Vec::new();
    for _ in 0..3 {
        let prekey = KEMPair::create();
        let signed = SignedPrekey::new(&mut bob_signer, &prekey).unwrap();
        bob_one_time.insert(signed.id(), prekey);
        published.push(signed);
    }
    server
        .publish(
            "bob",
            *bob_signer.pub_key_bytes(),
            bob_last_resort_signed.clone(),
            published,
        )
        .unwrap();
    println!(
        "Bob published 3 one-time prekeys and a last-resort prekey ({} one-time left)",
        server.one_time_remaining(&"bob")
    );

    // --- Alice's device: fetch Bob's bundle and start a session
    let alice_signer = SignerPair::create();
    let bundle = server.fetch(&"bob").unwrap();

    // In a real app Alice checks Bob's identity key against a copy she trusts
    // (for example by comparing safety numbers in person)
    assert_eq!(&bundle.identity, bob_signer.pub_key_bytes());

    let base_nonce = create_nonce(&gen_session_id(), 0);
    let (mut alice_session, ciphertext) = MessageSession::new_initiator(
        alice_signer.clone(),
        base_nonce,
        &bundle.prekey,
        &bundle.identity,
    )
    .unwrap();

    // Alice sends Bob: the ciphertext, the prekey id, the base nonce and her identity key
    let prekey_id = bundle.prekey.id();

    // --- Bob's device: find the prekey Alice used and set up his side
    let mut bob_session = if let Some(prekey) = bob_one_time.remove(&prekey_id) {
        // One-time prekey: it is removed from Bob's store above and wiped when dropped
        // at the end of this block, which gives the session forward secrecy
        MessageSession::new_responder(
            &prekey,
            bob_signer.clone(),
            base_nonce,
            &ciphertext,
            alice_signer.pub_key_bytes(),
        )
        .unwrap()
    } else if prekey_id == bob_last_resort_signed.id() {
        // Last-resort prekey: kept until Bob rotates it
        MessageSession::new_responder(
            &bob_last_resort,
            bob_signer.clone(),
            base_nonce,
            &ciphertext,
            alice_signer.pub_key_bytes(),
        )
        .unwrap()
    } else {
        panic!("unknown prekey");
    };
    println!(
        "Session set up; Bob has {} one-time prekey secrets left on his device",
        bob_one_time.len()
    );

    // --- Talk
    let encrypted = alice_session.craft_message(b"Hi Bob!").unwrap();
    let message = bob_session.validate_message(&encrypted).unwrap();
    println!("Bob received: {}", String::from_utf8_lossy(&message));

    let encrypted = bob_session.craft_message(b"Hi Alice!").unwrap();
    let reply = alice_session.validate_message(&encrypted).unwrap();
    println!("Alice received: {}", String::from_utf8_lossy(&reply));
}

pub fn validate_message( &mut self, ciphertext: &[u8], ) -> Result<Vec<u8>, CryptoError>

Decrypts and validates a message from the other party

Arguments

• ciphertext - The encrypted message

Returns

• Result<Vec<u8>, CryptoError>: The decrypted and validated message or an error

Security Note

Messages must arrive in the order they were crafted. The receive counter only advances for authentic messages, so replayed or forged input is rejected without desynchronizing the session.

Examples found in repository

examples/full_exchange.rs (line 49)

fn main() {
    let alice_signer = SignerPair::create();
    let mut bob_signer = SignerPair::create();

    // Bob creates a one-time prekey and signs its public part, which he shares with Alice
    let bob_prekey = KEMPair::create();
    let bob_signed_prekey = SignedPrekey::new(&mut bob_signer, &bob_prekey).unwrap();

    // Create a base nonce with a new session id, and a counter of 0
    let base_nonce = create_nonce(&gen_session_id(), 0);

    // Lets create the message session for Alice first. This checks that the prekey
    // was signed by Bob.
    let (mut alice_session, ciphertext) = MessageSession::new_initiator(
        alice_signer.clone(),
        base_nonce,
        &bob_signed_prekey,
        bob_signer.pub_key_bytes(), // Bob's public signer key
    )
    .unwrap();

    // Now for Bob it would look like this
    let mut bob_session = MessageSession::new_responder(
        &bob_prekey,
        bob_signer.clone(),
        base_nonce,
        &ciphertext,
        alice_signer.pub_key_bytes(), // Alice's public signer key
    )
    .unwrap();

    // The prekey was one-time, so Bob deletes it now (dropping it wipes it from memory)
    drop(bob_prekey);

    // Both sessions now hold one chain key per direction, derived from the shared secret.
    // Every message gets its own key, and the chain moves forward after each one.

    // Alice creates a message and prepares to send it to Bob
    let message = b"Hello, Bob! This is a secret message.";
    let encrypted_message = alice_session.craft_message(message).unwrap();

    // Bob decrypts and verifies Alice's message
    let raw_message = bob_session.validate_message(&encrypted_message).unwrap();

    // Both message and raw_message are equal, let's print them out to illustrate
    let message_str = String::from_utf8_lossy(message);
    let raw_message_str = String::from_utf8_lossy(&raw_message);

    println!("[1] Alice's message: {}", message_str);
    println!("[2] Bob's decrypted message: {}", raw_message_str);

    // Bob crafts a reply message to Alice
    let reply = b"Hello, Alice! I received your message safely.";
    let encrypted_reply = bob_session.craft_message(reply).unwrap();

    // Alice decrypts and verifies Bob's reply
    let raw_reply = alice_session.validate_message(&encrypted_reply).unwrap();

    // Both reply and raw_reply are equal, let's print them again
    let reply_str = String::from_utf8_lossy(reply);
    let raw_reply_str = String::from_utf8_lossy(&raw_reply);

    println!("[3] Bob's reply: {}", reply_str);
    println!("[4] Alice's decrypted reply: {}", raw_reply_str);
}

examples/prekey_server.rs (line 97)

fn main() {
    let mut server = PrekeyServer::new();

    // --- Bob's device: create prekeys, keep the secrets, publish the signed public parts
    let mut bob_signer = SignerPair::create();
    let bob_last_resort = KEMPair::create();
    let bob_last_resort_signed = SignedPrekey::new(&mut bob_signer, &bob_last_resort).unwrap();

    let mut bob_one_time: HashMap<PrekeyId, KEMPair> = HashMap::new();
    let mut published = Vec::new();
    for _ in 0..3 {
        let prekey = KEMPair::create();
        let signed = SignedPrekey::new(&mut bob_signer, &prekey).unwrap();
        bob_one_time.insert(signed.id(), prekey);
        published.push(signed);
    }
    server
        .publish(
            "bob",
            *bob_signer.pub_key_bytes(),
            bob_last_resort_signed.clone(),
            published,
        )
        .unwrap();
    println!(
        "Bob published 3 one-time prekeys and a last-resort prekey ({} one-time left)",
        server.one_time_remaining(&"bob")
    );

    // --- Alice's device: fetch Bob's bundle and start a session
    let alice_signer = SignerPair::create();
    let bundle = server.fetch(&"bob").unwrap();

    // In a real app Alice checks Bob's identity key against a copy she trusts
    // (for example by comparing safety numbers in person)
    assert_eq!(&bundle.identity, bob_signer.pub_key_bytes());

    let base_nonce = create_nonce(&gen_session_id(), 0);
    let (mut alice_session, ciphertext) = MessageSession::new_initiator(
        alice_signer.clone(),
        base_nonce,
        &bundle.prekey,
        &bundle.identity,
    )
    .unwrap();

    // Alice sends Bob: the ciphertext, the prekey id, the base nonce and her identity key
    let prekey_id = bundle.prekey.id();

    // --- Bob's device: find the prekey Alice used and set up his side
    let mut bob_session = if let Some(prekey) = bob_one_time.remove(&prekey_id) {
        // One-time prekey: it is removed from Bob's store above and wiped when dropped
        // at the end of this block, which gives the session forward secrecy
        MessageSession::new_responder(
            &prekey,
            bob_signer.clone(),
            base_nonce,
            &ciphertext,
            alice_signer.pub_key_bytes(),
        )
        .unwrap()
    } else if prekey_id == bob_last_resort_signed.id() {
        // Last-resort prekey: kept until Bob rotates it
        MessageSession::new_responder(
            &bob_last_resort,
            bob_signer.clone(),
            base_nonce,
            &ciphertext,
            alice_signer.pub_key_bytes(),
        )
        .unwrap()
    } else {
        panic!("unknown prekey");
    };
    println!(
        "Session set up; Bob has {} one-time prekey secrets left on his device",
        bob_one_time.len()
    );

    // --- Talk
    let encrypted = alice_session.craft_message(b"Hi Bob!").unwrap();
    let message = bob_session.validate_message(&encrypted).unwrap();
    println!("Bob received: {}", String::from_utf8_lossy(&message));

    let encrypted = bob_session.craft_message(b"Hi Alice!").unwrap();
    let reply = alice_session.validate_message(&encrypted).unwrap();
    println!("Alice received: {}", String::from_utf8_lossy(&reply));
}

pub fn send_counter(&self) -> u64

Gets the counter of the last message sent

pub fn recv_counter(&self) -> u64

Gets the counter of the last message received