Milestone: session rekey (~120s rotation) + PQ-hybrid handshake path #9

New issue

Open

opened 2026-07-01 13:09:58 +00:00 by vxfemboy · 1 comment

vxfemboy commented

2026-07-01 13:09:58 +00:00

(Migrated from github.com)

The daemon does a single Noise-IK handshake at startup and never rekeys. The design calls for ~120 s session rotation (forward secrecy) and a drop-in path for a Rosenpass-style hybrid PQ handshake.

Scope

Rekey scheduling in the daemon: run a fresh handshake mid-session (~every 120 s) and swap the Session in DataPlane, with an overlap window so in-flight packets under the old epoch still decrypt (route by epoch). yip-crypto already provides the mechanism (a new handshake = a new Session); the daemon must drive the schedule + epoch handling.
conn_tag rotation ties in here (currently static = a linkability signature; M6 carry-forward): rotate per epoch.
PQ-hybrid handshake: the psk modifier on NOISE_PARAMS is reserved but unexercised — wire Classic McEliece + ML-KEM feeding a PSK (Rosenpass model). Likely its own sub-task once classical rekey works.

Notes

Needs its own design → spec → plan. Touches yip-crypto + bin/yipd (tunnel/dataplane epoch handling). Sequence after io_uring Phase B (#7).
Interacts with the unified counter / replay window (each new Session resets counters — the epoch must disambiguate).

The daemon does a single Noise-IK handshake at startup and never rekeys. The design calls for ~120 s session rotation (forward secrecy) and a drop-in path for a Rosenpass-style hybrid PQ handshake. ## Scope - **Rekey scheduling** in the daemon: run a fresh handshake mid-session (~every 120 s) and swap the `Session` in `DataPlane`, with an overlap window so in-flight packets under the old epoch still decrypt (route by epoch). `yip-crypto` already provides the mechanism (a new handshake = a new `Session`); the daemon must drive the schedule + epoch handling. - **conn_tag rotation** ties in here (currently static = a linkability signature; M6 carry-forward): rotate per epoch. - **PQ-hybrid handshake**: the `psk` modifier on `NOISE_PARAMS` is reserved but unexercised — wire Classic McEliece + ML-KEM feeding a PSK (Rosenpass model). Likely its own sub-task once classical rekey works. ## Notes - Needs its own design → spec → plan. Touches `yip-crypto` + `bin/yipd` (tunnel/dataplane epoch handling). Sequence after io_uring Phase B (#7). - Interacts with the unified counter / replay window (each new `Session` resets counters — the epoch must disambiguate).

vxfemboy commented

2026-07-22 04:54:08 +00:00

(Migrated from github.com)

Rekey half of this milestone is merged to main (#90 = 9a classical ~120s rotation + epoch handling; #92 = #91 relay-path rekey completion). Each peer's Noise-IK session now rotates ~120s with old→new epoch overlap and confirmed-switch, on both direct and relay paths, verified loss-free over ~10 rotations in netns (both drivers).

Remaining: the PQ-hybrid handshake (9b). Design in progress — decided so far: inline (KEM material rides the existing msg1/msg2 payload seam, not a separate Rosenpass-style daemon) + scope A (X25519 + ML-KEM ephemeral → PSK via the reserved psk Noise modifier, on the 9a rekey path). Classic McEliece static KEM (~524KB pubkey → config/identity distribution) and stateless biscuits deferred to a 9c follow-up. Open sizing question: ML-KEM-512 vs 768 under the OBF_MTU_BUDGET=1200 ceiling (512 fits msg1+cert with ~75B headroom; 768 overflows). Paused pending throughput/MTU investigation.

Rekey half of this milestone is **merged to main** (#90 = 9a classical ~120s rotation + epoch handling; #92 = #91 relay-path rekey completion). Each peer's Noise-IK session now rotates ~120s with old→new epoch overlap and confirmed-switch, on both direct and relay paths, verified loss-free over ~10 rotations in netns (both drivers). **Remaining: the PQ-hybrid handshake (9b).** Design in progress — decided so far: inline (KEM material rides the existing msg1/msg2 payload seam, not a separate Rosenpass-style daemon) + scope A (X25519 + ML-KEM ephemeral → PSK via the reserved `psk` Noise modifier, on the 9a rekey path). Classic McEliece static KEM (~524KB pubkey → config/identity distribution) and stateless biscuits deferred to a 9c follow-up. Open sizing question: ML-KEM-512 vs 768 under the `OBF_MTU_BUDGET=1200` ceiling (512 fits msg1+cert with ~75B headroom; 768 overflows). Paused pending throughput/MTU investigation.