@node Handshake
+@cindex Handshake
+@cindex Handshake protocol
+@cindex Diffie-Hellman
+@cindex ed25519
+@cindex curve25519
+@cindex Elligator
+@cindex Perfect Forward Secrecy
+@cindex PFS
+@cindex IDtag
+@cindex Shared key
+@cindex DH-EKE
+@cindex DH
+@cindex EKE
+@cindex A-EKE
+@cindex DH-A-EKE
@section Handshake protocol
@verbatiminclude handshake.utxt
a key. It is used to transmit identity and to mark packet as handshake
message.
-If @ref{Noise} is enabled, then junk data is inserted before
-@code{IDtag} to full up packet to MTU's size.
+If @ref{Noise, noise} is enabled, then data is padded to fill up packet
+to MTU's size.
@strong{Preparation stage}:
@enumerate
@item
Client knows only his identity and passphrase written somewhere in the
-human. Server knows his identity and
+human readable form. Server knows his identity and
@ref{Verifier structure, verifier}: @code{DSAPub}.
@item
Client computes verifier which produces @code{DSAPriv} and
-@code{DSAPub}. @code{H()} is @emph{HSalsa20} hash function.
+@code{DSAPub}. @code{H()} is @emph{BLAKE2b-256} hash function.
@item
Client generates DH keypair: @code{CDHPub} and @code{CDHPriv}.
Also it generates random 64-bit @code{R} that is used as a nonce for
-symmetric encryption. @code{El()} is Elligator point encoding algorithm.
+symmetric encryption. @code{El()} is Elligator point encoding (and vice
+versa) algorithm.
@end enumerate
@strong{Interaction stage}:
has 128-bit security margin and that is why are not in use except in
handshake process. @code{R*} are required for handshake randomization
and two-way authentication.
+
+In @ref{Encless, encryptionless mode} each @code{enc()} is replaced with
+AONT and chaffing function over the noised data.