2 @cindex Developer manual
5 @unnumbered Developer manual
7 Pay attention how to get @ref{Sources, development source code}.
10 @item Nonce and identity encryption
11 @url{http://www.cix.co.uk/~klockstone/xtea.pdf, XTEA}.
13 @url{http://cr.yp.to/snuffle.html, Salsa20}.
14 @item Message authentication
15 @url{http://cr.yp.to/mac.html, Poly1305}.
16 @item Password authenticated key agreement
17 DH-A-EKE powered by @url{http://cr.yp.to/ecdh.html, Curve25519}
18 and @url{http://ed25519.cr.yp.to/, Ed25519}.
19 @item DH elliptic-curve point encoding for public keys
20 @url{http://elligator.cr.yp.to/, Elligator}.
21 @item Verifier password hashing algorithm
22 @url{https://password-hashing.net/#argon2, Argon2d}.
23 @item Encryptionless confidentiality preserving encoding
24 @url{http://people.csail.mit.edu/rivest/chaffing-980701.txt,
25 Chaffing-and-Winnowing} (two Poly1305 MACs for each bit of message)
27 @url{http://theory.lcs.mit.edu/~cis/pubs/rivest/fusion.ps,
28 All-Or-Nothing-Transformed} (based on
29 @url{http://cseweb.ucsd.edu/~mihir/papers/oaep.html, OAEP} using
30 Salsa20 with @url{https://blake2.net/, BLAKE2b-256} based
31 @url{http://crypto.stanford.edu/~dabo/abstracts/saep.html, SAEP+}
32 checksums) data with 128-bits of feeded random.
34 25 bytes per packet. Plus 4128 bytes and noise in encryptionless mode.
35 @item Handshake overhead
36 4 UDP (2 from client, 2 from server) packets (round-trips for TCP).
37 264 bytes total payload, 20680 in encryptionless mode.
38 @item Entropy required
39 832 bits in average on client, 832 bits in average on server side
40 per handshake. 128 bits for each outgoing packet in encryptionless
45 * Verifier structure::
46 * Transport protocol: Transport.
47 * Handshake protocol: Handshake.
50 @include verifierstruct.texi
51 @include transport.texi
52 @include handshake.texi