Struct PendingSession 

pub struct PendingSession { /* private fields */ }

Initiator A’s pending session: it holds the ephemeral private key and waits for the joiner’s Msg1.

Single use, guaranteed by the type system

PendingSession::accept takes self rather than &self, so the same session cannot be accepted twice. The constraint does not rely on the caller’s discipline:

• replaying the same Msg1 a second time does not compile, because there is no session left to pass it to;
• reopening the pairing screen yields a new PendingSession with a different nonce and ephemeral public key, so an Msg1 captured in a previous round cannot be decrypted.

The ephemeral private key is erased on Drop by p256 (EphemeralSecret implements ZeroizeOnDrop).

Implementations

impl PendingSession

pub const fn payload(&self) -> &QrPayload

What the QR code should display.

pub fn accept(self, msg1: &[u8], master: &MasterKey) -> Result<Adoption>

Accept the joiner’s Msg1, confirm the peer’s identity, and produce the Msg2 that carries the master key.

Parameters

• msg1: the joiner’s complete Msg1 ciphertext (the return value of JoinerSession::request).
• master: the initiator’s own master key. It goes into the receipt as ciphertext.

Returns

Adoption: the joiner’s device identity public key, the session identifier, and the Msg2 to send back to the joiner.

Errors

Every authentication failure returns Error::PairingAuthenticationFailed, without distinguishing “the ciphertext was tampered with”, “the message came from another session” and “the joiner used the wrong public key”. Telling them apart would help an attacker and gives the user nothing to act on: the answer to all three is “this pairing failed, scan again”.

The whole ciphertext body — the trailing AEAD tag included — is handed to decrypt_in_place, which strips the last TAG_LEN bytes itself. After decryption the joiner’s device identity public key is checked for curve membership before it is reported in Adoption; a point off the curve would otherwise make later signature verification fail for reasons far from the cause.

Trait Implementations

impl Debug for PendingSession

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.