Module nested 

Nested encryption for the restreamer (A2 / A3).

Three layers, outside-in:

1. WireGuard (transport; see wg module)
2. Outer AEAD on C2’s key — stripped by C2, reveals the opaque envelope
3. Inner Noise_NK session node↔HQ on the relayed recipient key — stripped only by core

Handshake and transport are separate steps (multiplex DATA frames in production). C2 never holds the HQ recipient private key.

Structs

HqRecipientSecret

HQ-side private material (core only). Never constructed on C2.

NestedSeal

Result of a nested seal for tests / one-shot helpers.

NoiseInitiator

Node-side Noise initiator (knows HQ static public key).

NoiseResponder

HQ-side Noise responder (holds recipient private key).

NoiseTransport

Post-handshake Noise transport.

PublicKeyBytes

32-byte public key as handed to a node (upstream keys from C2).

RestreamerKeys

Key material C2 holds and relays.

Enums

CryptoError

Constants

NOISE_MAX_MESSAGE

Largest Noise transport message (ciphertext incl. tag).

NOISE_MAX_PLAINTEXT

Largest plaintext carried by one Noise transport message.

NOISE_PATTERN

Noise pattern: node (initiator) knows HQ’s static public key (relayed by C2).

Functions

c2_cannot_complete_as_hq

C2 cannot complete a Noise_NK responder handshake as HQ: wrong static key.

c2_cannot_open_inner

Legacy name kept for call sites: C2 cannot decrypt inner transport ciphertext without the HQ Noise session (attempt with a fresh wrong-key responder fails).

c2_strip_outer

C2 strips the outer layer; returns opaque inner bytes (Noise ciphertext or handshake).

core_open_inner

Decrypt with an established HQ transport (production path after handshake).

node_seal_outer

Node seals already-inner bytes (handshake or transport, tagged) for C2’s outer layer.

noise_session_seal

Run Noise_NK handshake, encrypt plaintext, wrap with C2 outer layer.