Module crypto 

Entropy is always an input. Nothing here generates randomness, so the engine stays deterministic.

Modules

ratchets

Structs

BadKeyLength

BufferTooShort

Ed25519PublicKey

Ed25519SecretKey

Ed25519Signature

Ed25519Verifier

Decompresses the Edwards point once, for performance reasons. VerifyingKey::from_bytes per proof was a measured ~8% of a firehose initiator’s CPU.

HkdfOutputTooLong

The requested output exceeds HKDF-SHA256’s 255 * 32 byte ceiling (RFC 5869).

HmacSha256Stream

hmac_sha256_verify for a message arriving in spans; the tag comparison stays constant-time.

InvalidMac

InvalidPublicKey

The bytes are not a decompressible Edwards point, so no signature under this key can verify.

InvalidSignature

Sha256PrefixState

The absorbed prefix of sha256_prefix_and_digest_suffix, held apart so one pass over the payload can serve many suffix attempts.

SharedPrefixDigests

TokenKey

TokenOpenStream

token_open_in_place for a token landing in contiguous spans: absorb_to authenticates and decrypts each span in place as it grows, and finalize verifies the MAC in constant time before inspecting any padding, then names the plaintext. The final ciphertext block waits for that verdict too, so nothing padding-shaped is ever examined ahead of authentication. Callers must not release a decrypted byte before finalize.

X25519PublicKey

X25519SecretKey

X25519SharedSecret

Enums

TokenOpenError

Constants

SHA256_OUTPUT_LEN

TOKEN_OVERHEAD

RNS 1.4.2 Identity.TOKEN_OVERHEAD: the 16-byte IV and 32-byte HMAC around every sealed payload.

Functions

ed25519_public_key

ed25519_sign

(deterministic, RFC 8032).

ed25519_verify

hkdf_sha256

HKDF-SHA256 (RFC 5869); salt/info map to RNS’s salt/context.

hkdf_sha256_into

RNS masks derive a stream as long as the packet, so the length is runtime-sized.

hmac_sha256

hmac_sha256_chunks

hmac_sha256_verify

The tag comparison is constant-time; == against a computed tag would leak where it mismatched.

sealed_len

PKCS#7 always pads (1..=BLOCK_LEN bytes), so a sealed token strictly outgrows its plaintext.

sha256

sha256_chunks

sha256_prefix_and_digest_suffix

One pass over the prefix chunks feeds both digests: the midstate is cloned, not rehashed. Two independent hashes would walk the shared prefix twice, and callers pass resource-sized payloads.

token_is_authentic

The mutation-free prefix of token_open_in_place, for ratchet trials before the one in-place decrypt.

token_open

Verifies the MAC (constant time) before decrypting. out must hold the whole ciphertext (token.len() - TOKEN_OVERHEAD); padding is only stripped after the in-place decrypt.

token_open_in_place

MAC-verified (constant time) then decrypted in place; the plaintext is a sub-slice of token.

token_seal

token_seal_chunks

chunks seal exactly as if concatenated.

token_seal_in_place

token_seal_chunks for a plaintext already sitting in out at its sealed offset (IV_LEN..IV_LEN + plain_len): pads, encrypts, and MACs in place, skipping the staging copy.

x25519_diffie_hellman

The shared secret of secret with peer (RFC 7748 clamping applied).

x25519_keys_for_seal

x25519_public_key