Module handshake

Expand description

Unified Phantom Handshake Protocol

Combines PQC security (Hybrid KEM/Sign) with Staged state machine for optimistic start, Early Data, and 0-RTT resumption.

Structs§

ClientHello: Client hello message (initiates handshake).
HandshakeClient: Handshake Client State Machine
HandshakeServer: Handshake Server State Machine
HelloRetryRequest: Hello Retry Request (Server demands PoW or Cookie)
ServerHello: Server hello message (response to ClientHello)
ServerReject: Typed handshake rejection the server returns instead of silently dropping the connection when it structurally cannot satisfy a ClientHello — today, an unknown version. It gives a forward/backward-incompatible peer an actionable signal (the version the server speaks) rather than a bare connection reset.

EARLY_DATA_MAX_LEN: Maximum 0-RTT early-data plaintext, in bytes. The client constructor rejects a larger payload; the server drops an oversized blob and continues as a normal 1-RTT handshake. Caps the work an unauthenticated peer can force before the handshake completes.
PROTOCOL_VARIANT: Handshake processing stages Compile-time protocol-variant tag, baked into every ClientHello (cleartext field) and the signed handshake transcript. Peers reject mismatched variants up front with HandshakeError::ProtocolVariantMismatch; even an attacker who rewrites the cleartext field cannot escape detection because the transcript signature is computed over the build’s own variant.
PROTOCOL_VERSION: The sole protocol version carried in ClientHello.version and bound into the handshake transcript. Pinned to one value — the protocol is not negotiated (pre-1.0, no users). It is a tamper-check anchor and a hook for a future, deliberate version increment.
REJECT_UNSUPPORTED_VERSION: ServerReject::code: the client’s ClientHello.version is one this server does not speak. supported_version carries the version it does speak.
SERVER_REJECT_MARKER: Marker leading a ServerReject frame. The client disambiguates the three possible server replies by trial-deserialization; the marker (plus the fixed, tiny size of a reject vs. the multi-KiB ServerHello) makes a reject unmistakable and immune to a false-positive parse as a HelloRetryRequest.