2 @unnumbered Packet format
5 @url{https://tools.ietf.org/html/rfc4506, XDR}-encoded structures.
9 * Encrypted packet: Encrypted.
15 Plain packet contains either the whole file, or file request (freq), or
16 transition packet or email message. It is called "plain", because it
17 contains plaintext, but plain packets would never be stored on your hard
22 +--------------------------------------+--...---+
23 | MAGIC | TYPE | NICE | PATHLEN | PATH | PAYLOAD|
24 +--------------------------------------+--...---+
27 @multitable @columnfractions 0.2 0.3 0.5
28 @headitem @tab XDR type @tab Value
29 @item Magic number @tab
30 8-byte, fixed length opaque data @tab
31 @verb{|N N C P P 0x00 0x00 0x01|}
32 @item Payload type @tab
34 0 (file), 1 (freq), 2 (mail), 3 (transition)
37 1-255, preferred packet @ref{Niceness, niceness} level
38 @item Path length @tab
40 actual length of @emph{path} field's payload
42 255 byte, fixed length opaque data @tab
44 @item UTF-8 encoded destination path for file transfer
45 @item UTF-8 encoded source path for file request
46 @item UTF-8 encoded, space separated, email recipients list
47 @item Node's id the transition packet must be relayed on
51 Path has fixed size because of hiding its actual length -- it is
52 valuable metadata. Payload is appended to the header -- it is not stored
53 as XDR field, because most XDR libraries will store all that data in the
56 Depending on the packet's type, payload could store:
60 @item Destination path for freq
61 @item @url{http://zlib.net/, zlib} compressed email
62 @item Whole encrypted packet we need to relay on
65 Also depending on packet's type, niceness level means:
68 @item Preferable niceness level for files sent by freq
69 @item @env{NNCP_NICE} variable's value passed during
70 @ref{CfgSendmail} invocation.
74 @section Encrypted packet
76 Encrypted packets are the only files found in spools, in exchangeable
77 storages and that are synchronized between TCP daemons.
79 Each encrypted packet has the following header:
82 +------------ HEADER --------------------+ +-------- ENCRYPTED --------+
84 +--------------------------------------------+------------+----...-----------+------+
85 | MAGIC | NICE | SENDER | RCPT | EPUB | SIGN | SIZE | MAC | CIPHERTEXT | MAC | JUNK |
86 +-------------------------------------/------\------------+----...-----------+------+
88 +-------------------------------------+
89 | MAGIC | NICE | SENDER | RCPT | EPUB |
90 +-------------------------------------+
93 @multitable @columnfractions 0.2 0.3 0.5
94 @headitem @tab XDR type @tab Value
95 @item Magic number @tab
96 8-byte, fixed length opaque data @tab
97 @verb{|N N C P E 0x00 0x00 0x03|}
100 1-255, packet @ref{Niceness, niceness} level
102 32-byte, fixed length opaque data @tab
105 32-byte, fixed length opaque data @tab
107 @item Exchange public key @tab
108 32-byte, fixed length opaque data @tab
109 Ephemeral curve25519 public key
111 64-byte, fixed length opaque data @tab
112 ed25519 signature for that packet's header
115 Signature is calculated over all previous fields.
117 All following encryption is done using @url{https://cr.yp.to/chacha.html,
118 ChaCha20} algorithm. Data is splitted on 128 KiB blocks. Each block is
119 encrypted with increasing nonce counter. @url{https://blake2.net/,
120 BLAKE2b-256} MAC is appended to the ciphertext.
122 After the headers comes an encrypted payload size and MAC of that size.
124 @multitable @columnfractions 0.2 0.3 0.5
125 @headitem @tab XDR type @tab Value
127 unsigned hyper integer @tab
131 Next comes the actual encrypted payload with corresponding MAC.
133 Each node has static @strong{exchange} and @strong{signature} keypairs.
134 When node A want to send encrypted packet to node B, it:
137 @item generates ephemeral @url{http://cr.yp.to/ecdh.html, curve25519} keypair
138 @item prepares structure for signing
139 @item signs that structure using private
140 @url{http://ed25519.cr.yp.to/, ed25519} signature key
141 @item takes remote node's exchange public key and performs
142 Diffie-Hellman computation on this remote static public key and
143 private ephemeral one
144 @item derive the keys:
146 @item initialize @url{https://blake2.net/, BLAKE2Xb} XOF with
147 derived ephemeral key and 224-byte output length
148 @item feed @verb{|N N C P E 0x00 0x00 0x03|} magic number to XOF
149 @item read 32-bytes of "size" encryption key (for ChaCha20)
150 @item read 64-bytes of "size" authentication key (for BLAKE2b-MAC)
151 @item read 32-bytes of payload encryption key
152 @item read 64-bytes of payload authentication key
153 @item optionally read 32-bytes pad generation key (for ChaCha20)
155 @item encrypts size, appends its ciphertext to the header
156 @item appends MAC tag over that ciphertext
157 @item encrypts and appends payload ciphertext
158 @item appends MAC tag over that payload ciphertext
159 @item possibly appends any kind of "junk" noise data to hide real
160 payload's size from the adversary