2 @unnumbered Developer manual
4 Pay attention how to get @ref{Sources, development source code}.
7 @item Nonce and identity encryption
8 @url{http://www.cix.co.uk/~klockstone/xtea.pdf, XTEA}.
10 @url{http://cr.yp.to/snuffle.html, Salsa20}.
11 @item Message authentication
12 @url{http://cr.yp.to/mac.html, Poly1305}.
13 @item Password authenticated key agreement
14 DH-A-EKE powered by @url{http://cr.yp.to/ecdh.html, Curve25519}
15 and @url{http://ed25519.cr.yp.to/, Ed25519}.
16 @item DH elliptic-curve point encoding for public keys
17 @url{http://elligator.cr.yp.to/, Elligator}.
18 @item Verifier password hashing algorithm
19 @url{https://password-hashing.net/#argon2, Argon2d}.
20 @item Encryptionless confidentiality preserving encoding
21 @url{http://people.csail.mit.edu/rivest/chaffing-980701.txt,
22 Chaffing-and-Winnowing} (two Poly1305 MACs for each bit of message)
24 @url{http://theory.lcs.mit.edu/~cis/pubs/rivest/fusion.ps,
25 All-Or-Nothing-Transformed} (based on
26 @url{http://cseweb.ucsd.edu/~mihir/papers/oaep.html, OAEP} using
27 Salsa20 with @url{https://blake2.net/, BLAKE2b-256} based
28 @url{http://crypto.stanford.edu/~dabo/abstracts/saep.html, SAEP+}
29 checksums) data with 128-bits of feeded random.
31 25 bytes per packet. Plus 4128 bytes and noise in encryptionless mode.
32 @item Handshake overhead
33 4 UDP (2 from client, 2 from server) packets (round-trips for TCP).
34 264 bytes total payload, 20680 in encryptionless mode.
35 @item Entropy required
36 832 bits in average on client, 832 bits in average on server side
37 per handshake. 128 bits for each outgoing packet in encryptionless
42 * Verifier structure::
43 * Transport protocol: Transport.
44 * Handshake protocol: Handshake.
47 @include verifierstruct.texi
48 @include transport.texi
49 @include handshake.texi