Struct ProverConfirming 

pub struct ProverConfirming<S: Suite> { /* private fields */ }

The prover holding both confirmations, waiting for confirmV.

It is zeroized on drop, and its Debug shows nothing.

Implementations

impl<S: Suite> ProverConfirming<S>

pub fn finish( self, confirm_v: &ConfirmV<S>, ) -> Result<(ConfirmP<S>, SharedKey<S>), Error>

Checks the verifier’s confirmation, in constant time, and only then gives the prover’s confirmation, to send, and the shared key: the order RFC 9383 requires.

Errors

Error::ConfirmationFailed when confirmV does not match: the verifier holds another password, context or identity, or the messages were altered. Send nothing more.

pub fn confirm_first(self) -> (ConfirmP<S>, ProverConfirmedFirst<S>)

Gives the prover’s confirmation before the verifier’s has arrived, for protocols that send it first (TP-Link’s TPAP sends shareP and confirmP together after receiving shareV). The shared key still waits for the verifier’s confirmation.

Security

This departs from RFC 9383, which has the prover check confirmV before sending confirmP. confirmP is a MAC keyed by the password, so an impostor posing as the verifier, who sent its own shareV, can test password guesses against it offline, without ever proving it knows the record. Use it only when the protocol forces this order, and with a password hash slow enough to make those guesses expensive.

Trait Implementations

impl<S: Suite> Debug for ProverConfirming<S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.