Secured session#

use pamoja_session::{AgreementKey, Role, Session};

// Each device is provisioned with a 32-byte seed and publishes the key it derives. A
// real seed comes from the factory or a secure element; any 32 bytes stand in here.
let node = AgreementKey::from_seed(&[7u8; 32]);
let gateway = AgreementKey::from_seed(&[9u8; 32]);

// Neither side sends the session key. Both derive it from the shared secret, a salt
// that travels in the clear, and both public keys, with opposite roles.
//
// The salt must be fresh for every session: reusing one derives the same key from the
// same pair of devices twice. The initiator draws it and sends it in the clear, so the
// responder uses the salt it received rather than one of its own.
let mut salt = [0u8; 16];
getrandom::fill(&mut salt).expect("the system random source");
let mut uplink = Session::establish(&node, &gateway.public(), &salt, Role::Initiator);
let mut downlink = Session::establish(&gateway, &node.public(), &salt, Role::Responder);
println!("agreed    both sides derived a key without sending one");

// The pump id is authenticated but not encrypted, so a router still reads it while any
// change to it fails the tag. Sealing replaces the plaintext in the buffer it is given.
let mut frame = *b"flow=41.2";
let sealed = uplink.seal(&mut frame, b"pump-3");
let hidden = if frame != *b"flow=41.2" {
    "no longer"
} else {
    "still"
};
println!(
    "sealed    counter {}, and what goes on the wire is {hidden} the reading",
    sealed.counter
);

// The gateway opens it back into the same buffer.
let mut replayed = frame;
downlink
    .open(&sealed, &mut frame, b"pump-3")
    .expect("authentic and fresh");
println!("opened    {}", String::from_utf8_lossy(&frame));

// The anti-replay window refuses a counter it has already accepted, so a frame
// captured off the air and sent again is not delivered a second time.
match downlink.open(&sealed, &mut replayed, b"pump-3") {
    Ok(()) => println!("a replayed frame was accepted, which should never happen"),
    Err(error) => println!("replay    refused: {error}"),
}

// A router that rewrites the pump id breaks the tag, so the gateway refuses the frame
// rather than file the reading under the wrong pump. A frame that fails to open leaves
// its counter unused.
let mut later = *b"flow=41.3";
let later_sealed = uplink.seal(&mut later, b"pump-3");
let mut rewritten = later;
match downlink.open(&later_sealed, &mut rewritten, b"pump-4") {
    Ok(()) => println!("a rewritten pump id was accepted, which should never happen"),
    Err(error) => println!("altered   refused: {error}"),
}

// Radio frames can arrive out of order. The window accepts any counter it has not seen
// among the 64 below the newest, so the frame that was held up still opens.
let mut newest = *b"flow=41.5";
let newest_sealed = uplink.seal(&mut newest, b"pump-3");
downlink
    .open(&newest_sealed, &mut newest, b"pump-3")
    .expect("the newest frame");
downlink
    .open(&later_sealed, &mut later, b"pump-3")
    .expect("a late frame inside the window");
println!(
    "late      counter {} opened first, then counter {}: {}, then {}",
    newest_sealed.counter,
    later_sealed.counter,
    String::from_utf8_lossy(&newest),
    String::from_utf8_lossy(&later)
);

// The gateway answers on the same session. Its frames carry the other direction in
// their nonce, so a reply can never be taken for, or replayed as, one from the node.
let mut order = *b"valve=close";
let order_sealed = downlink.seal(&mut order, b"pump-3");
uplink
    .open(&order_sealed, &mut order, b"pump-3")
    .expect("the gateway's reply");
println!(
    "reply     {}, sealed by the gateway and opened by the node",
    String::from_utf8_lossy(&order)
);

import { AgreementKey, Role, Session } from '@pamoja/session'

// Each device is provisioned with a 32-byte seed and publishes the key it derives. A real
// seed comes from the factory or a secure element; any 32 bytes stand in here.
const node = new AgreementKey(Buffer.alloc(32, 7))
const gateway = new AgreementKey(Buffer.alloc(32, 9))

// Neither side sends the session key. Both derive it from the shared secret, a salt that
// travels in the clear, and both public keys, with opposite roles.
//
// The salt must be fresh for every session: reusing one derives the same key from the same
// pair of devices twice. The initiator draws it and sends it in the clear, so the responder
// uses the salt it received rather than one of its own.
const salt = randomBytes(16)
const uplink = new Session(node, gateway.publicKey(), salt, Role.Initiator)
const downlink = new Session(gateway, node.publicKey(), salt, Role.Responder)
console.log('agreed    both sides derived a key without sending one')

// The pump id is authenticated but not encrypted, so a router still reads it while any
// change to it fails the tag.
const pump = Buffer.from('pump-3')
const reading = Buffer.from('flow=41.2')
const sealed = uplink.seal(reading, pump)
const hidden = sealed.ciphertext.equals(reading) ? 'still' : 'no longer'
console.log(`sealed    counter ${sealed.counter}, and what goes on the wire is ${hidden} the reading`)
console.log(`opened    ${downlink.open(sealed, pump).toString()}`)

// The anti-replay window refuses a counter it has already accepted, so a frame captured
// off the air and sent again is not delivered a second time.
try {
  downlink.open(sealed, pump)
  console.log('a replayed frame was accepted, which should never happen')
} catch (error) {
  console.log(`replay    refused: ${(error as Error).message}`)
}

// A router that rewrites the pump id breaks the tag, so the gateway refuses the frame
// rather than file the reading under the wrong pump. A frame that fails to open leaves its
// counter unused.
const later = uplink.seal(Buffer.from('flow=41.3'), pump)
try {
  downlink.open(later, Buffer.from('pump-4'))
  console.log('a rewritten pump id was accepted, which should never happen')
} catch (error) {
  console.log(`altered   refused: ${(error as Error).message}`)
}

// Radio frames can arrive out of order. The window accepts any counter it has not seen
// among the 64 below the newest, so the frame that was held up still opens.
const newest = uplink.seal(Buffer.from('flow=41.5'), pump)
const first = downlink.open(newest, pump).toString()
const second = downlink.open(later, pump).toString()
console.log(`late      counter ${newest.counter} opened first, then counter ${later.counter}: ${first}, then ${second}`)

// The gateway answers on the same session. Its frames carry the other direction in their
// nonce, so a reply can never be taken for, or replayed as, one from the node.
const order = downlink.seal(Buffer.from('valve=close'), pump)
console.log(`reply     ${uplink.open(order, pump).toString()}, sealed by the gateway and opened by the node`)

import os

from pamoja.core import PamojaError
from pamoja.session import AgreementKey, Role, Session

# Each device is provisioned with a 32-byte seed and publishes the key it derives. A real
# seed comes from the factory or a secure element; any 32 bytes stand in here.
node = AgreementKey(bytes([7]) * 32)
gateway = AgreementKey(bytes([9]) * 32)

# Neither side sends the session key. Both derive it from the shared secret, a salt that
# travels in the clear, and both public keys, with opposite roles.
#
# The salt must be fresh for every session: reusing one derives the same key from the same
# pair of devices twice. The initiator draws it and sends it in the clear, so the responder
# uses the salt it received rather than one of its own.
salt = os.urandom(16)
uplink = Session(node, gateway.public_key, salt, Role.INITIATOR)
downlink = Session(gateway, node.public_key, salt, Role.RESPONDER)
print("agreed    both sides derived a key without sending one")

# The pump id is authenticated but not encrypted, so a router still reads it while any
# change to it fails the tag.
sealed = uplink.seal(b"flow=41.2", b"pump-3")
hidden = "still" if sealed.ciphertext == b"flow=41.2" else "no longer"
print(f"sealed    counter {sealed.counter}, and what goes on the wire is {hidden} the reading")
print(f"opened    {downlink.open(sealed, b'pump-3').decode()}")

# The anti-replay window refuses a counter it has already accepted, so a frame captured
# off the air and sent again is not delivered a second time.
try:
    downlink.open(sealed, b"pump-3")
    print("a replayed frame was accepted, which should never happen")
except PamojaError as error:
    print(f"replay    refused: {error}")

# A router that rewrites the pump id breaks the tag, so the gateway refuses the frame rather
# than file the reading under the wrong pump. A frame that fails to open leaves its counter
# unused.
later = uplink.seal(b"flow=41.3", b"pump-3")
try:
    downlink.open(later, b"pump-4")
    print("a rewritten pump id was accepted, which should never happen")
except PamojaError as error:
    print(f"altered   refused: {error}")

# Radio frames can arrive out of order. The window accepts any counter it has not seen
# among the 64 below the newest, so the frame that was held up still opens.
newest = uplink.seal(b"flow=41.5", b"pump-3")
first = downlink.open(newest, b"pump-3").decode()
second = downlink.open(later, b"pump-3").decode()
print(f"late      counter {newest.counter} opened first, then counter {later.counter}: {first}, then {second}")

# The gateway answers on the same session. Its frames carry the other direction in their
# nonce, so a reply can never be taken for, or replayed as, one from the node.
order = downlink.seal(b"valve=close", b"pump-3")
print(f"reply     {uplink.open(order, b'pump-3').decode()}, sealed by the gateway and opened by the node")

// Each device is provisioned with a 32-byte seed and publishes the key it derives.
// A real seed comes from the factory or a secure element; any 32 bytes stand in.
byte[] nodeSeed = new byte[32];
Array.Fill(nodeSeed, (byte)7);
byte[] gatewaySeed = new byte[32];
Array.Fill(gatewaySeed, (byte)9);
using var node = new AgreementKey(nodeSeed);
using var gateway = new AgreementKey(gatewaySeed);

// Neither side sends the session key. Both derive it from the shared secret, a
// salt that travels in the clear, and both public keys, with opposite roles.
//
// The salt must be fresh for every session: reusing one derives the same key from
// the same pair of devices twice. The initiator draws it and sends it in the
// clear, so the responder uses the salt it received rather than one of its own.
byte[] salt = RandomNumberGenerator.GetBytes(16);
using var uplink = new Session(node, gateway.PublicKey, salt, SessionRole.Initiator);
using var downlink = new Session(gateway, node.PublicKey, salt, SessionRole.Responder);
Console.WriteLine("agreed    both sides derived a key without sending one");

// The pump id is authenticated but not encrypted, so a router still reads it while
// any change to it fails the tag.
SealedMessage reading = uplink.Seal("flow=41.2"u8, "pump-3"u8);
string hidden = reading.Ciphertext.SequenceEqual("flow=41.2"u8.ToArray()) ? "still" : "no longer";
Console.WriteLine($"sealed    counter {reading.Counter}, and what goes on the wire is {hidden} the reading");
byte[] opened = downlink.Open(reading, "pump-3"u8);
Console.WriteLine($"opened    {Encoding.UTF8.GetString(opened)}");

// The anti-replay window refuses a counter it has already accepted, so a frame
// captured off the air and sent again is not delivered a second time.
try
{
    downlink.Open(reading, "pump-3"u8);
    Console.WriteLine("a replayed frame was accepted, which should never happen");
}
catch (PamojaException error)
{
    Console.WriteLine($"replay    refused: {error.Message}");
}

// A router that rewrites the pump id breaks the tag, so the gateway refuses the
// frame rather than file the reading under the wrong pump. A frame that fails to
// open leaves its counter unused.
SealedMessage later = uplink.Seal("flow=41.3"u8, "pump-3"u8);
try
{
    downlink.Open(later, "pump-4"u8);
    Console.WriteLine("a rewritten pump id was accepted, which should never happen");
}
catch (PamojaException error)
{
    Console.WriteLine($"altered   refused: {error.Message}");
}

// Radio frames can arrive out of order. The window accepts any counter it has not
// seen among the 64 below the newest, so the frame that was held up still opens.
SealedMessage newest = uplink.Seal("flow=41.5"u8, "pump-3"u8);
string first = Encoding.UTF8.GetString(downlink.Open(newest, "pump-3"u8));
string second = Encoding.UTF8.GetString(downlink.Open(later, "pump-3"u8));
Console.WriteLine($"late      counter {newest.Counter} opened first, then counter {later.Counter}: {first}, then {second}");

// The gateway answers on the same session. Its frames carry the other direction in
// their nonce, so a reply can never be taken for, or replayed as, one from the node.
SealedMessage order = downlink.Seal("valve=close"u8, "pump-3"u8);
string answer = Encoding.UTF8.GetString(uplink.Open(order, "pump-3"u8));
Console.WriteLine($"reply     {answer}, sealed by the gateway and opened by the node");