Module crypto 

Modules

code_join

Code-join wrap-key derivation.

dm

huddle 0.7.1: End-to-end DM key derivation via Ed25519→X25519 ECDH.

mldsa

huddle 2.0.6 (WS2-a): ML-DSA-65 (FIPS 204) signatures for hybrid post-quantum authentication.

mnemonic

huddle 2.0: BIP39 seed-phrase encoding of the 32-byte Ed25519 identity seed (F6).

passphrase

Passphrase-derived key wrapping for Megolm session keys.

pqc

huddle 1.3: post-quantum hybrid key-agreement primitives (ML-KEM-768).

sas

Short-Authentication-String (SAS) verification — Phase G.

Constants

SIGNED_ENVELOPE_WINDOW_MS

huddle 0.7.11: max accepted skew between signed_at_ms on a signed envelope and the receiver’s wall clock. Anything outside the window is rejected as a replay (or as a clock that’s drifted too far).

Functions

sign_message

Wrap a RoomMessage into a SignedRoomMessage using the given identity’s signing key. Mirror of verify_signed; symmetric helper so phase B/F/G/etc. don’t each open-code the base64 dance.

sign_message_at

Same as sign_message but with an explicit timestamp — used by the replay-window unit tests so the clock isn’t a hidden dependency.

sign_message_hybrid_pq

huddle 2.0.6 (WS2-a): like sign_message, but ALSO attaches a composite ML-DSA-65 post-quantum signature over the same signed_bytes, plus the sender’s ML-DSA public key. For low-frequency identity/authority envelopes (announces, owner/ban grants, invites) — the ML-DSA signature is ~3.3 KB, so it is not put on every chat line. Backward-compatible: a peer that doesn’t pin the sender’s ML-DSA key simply ignores the extra fields and verifies classically.

sign_message_hybrid_pq_at

Deterministic-timestamp variant of sign_message_hybrid_pq for tests.

verify_signed

Verify a SignedRoomMessage envelope:

verify_signed_at

Same as verify_signed but with an explicit clock and window — kept public for tests that want to exercise the replay-window logic deterministically without a SystemTime detour.

verify_signed_mldsa

huddle 2.0.6 (WS2-a): verify an envelope’s composite ML-DSA-65 signature against a pinned ML-DSA public key (the caller’s durable record of this signer’s PQ-auth key, learned from a prior signed announce). The Ed25519 layer is checked separately by verify_signed; this is the additional post-quantum check, gated on having pinned the signer’s key.