Crate umsh_crypto 

Cryptographic traits and UMSH-specific key/packet operations.

This crate separates algorithm providers from protocol logic. The low-level traits such as AesProvider and Sha256Provider can be backed either by software implementations or hardware accelerators, while CryptoEngine implements the UMSH-specific derivation and packet-authentication rules.

Example

use umsh_crypto::software::{SoftwareAes, SoftwareIdentity, SoftwareSha256};
use umsh_crypto::{CryptoEngine, NodeIdentity};

let alice = SoftwareIdentity::from_secret_bytes(&[0x11; 32]);
let bob = SoftwareIdentity::from_secret_bytes(&[0x22; 32]);
let shared = alice.shared_secret_with(bob.public_key()).unwrap();
let engine = CryptoEngine::new(SoftwareAes, SoftwareSha256);
let keys = engine.derive_pairwise_keys(&shared);

assert_ne!(keys.k_enc, [0u8; 32]);
assert_ne!(keys.k_mic, [0u8; 32]);

Re-exports

pub use software::*;

Modules

pool

Persisted entropy pool: a flash-seeded, hash-ratcheted CSPRNG.

replay

Replay detection for secure traffic, as specified in the protocol’s Security chapter (§Replay Detection, §Duplicate Acknowledgement Window).

software

Structs

CmacState

Incremental AES-CMAC state.

CryptoEngine

UMSH protocol crypto engine.

DerivedChannelKeys

Derived multicast or channel transport keys.

PairwiseKeys

Derived pairwise transport keys.

S2vState

Incremental RFC 5297 §2.4 S2V state.

SharedSecret

Raw X25519 shared secret.

Enums

ChannelNameError

Error returned when a channel name cannot be canonicalized for key derivation (see multicast-channels.md § Named Channels).

CryptoError

Protocol-level crypto failures.

Constants

MAX_CHANNEL_NAME_LEN

Maximum channel-name length accepted by CryptoEngine::derive_named_channel_key.

Traits

AesCipher

AES block-cipher instance used by the protocol engine.

AesProvider

Factory for keyed AES cipher instances.

NodeIdentity

Node identity capable of signing and key agreement.

Sha256Provider

SHA-256 and HMAC-SHA-256 provider.

Functions

hkdf_sha256

HKDF-SHA256 over any Sha256Provider, for callers that have no CryptoEngine — the entropy pool derives keys before any AES provider exists.