Module handshake 

Secure handshake protocol implementation using Elliptic Curve Diffie-Hellman (ECDH)

This module implements a secure cryptographic handshake based on x25519-dalek with protection against replay attacks using timestamped nonces.

Key Change: Per-Session State Instead of global singletons, handshake state is now managed through session-scoped structures (ClientHandshakeState, ServerHandshakeState) that are passed through the handshake flow. This prevents concurrent handshake state trampling and ensures clean state per connection.

Structs

ClientHandshakeState

Client-side handshake state - passed through the handshake flow

ServerHandshakeState

Server-side handshake state - passed through the handshake flow

Functions

client_derive_session_key

Client derives the session key. Must be called after client_secure_handshake_verify.

client_secure_handshake_init

Initiates secure handshake from the client side. Generates a new key pair and nonce for the client.

client_secure_handshake_verify

Client verifies server response and sends verification message. Updates client state and returns confirmation message.

server_secure_handshake_finalize

Server verifies client’s confirmation and derives session key. Returns the session key if verification succeeds.

server_secure_handshake_response

Generates server response to client handshake initialization. Validates client timestamp, generates server key pair and nonce.

verify_timestamp

Verify that a timestamp is recent enough Default threshold is 30 seconds with a strict 2-second future tolerance for clock skew