ouroboros, branch be

build: Make re-key watermark configurable

2026-06-29T06:33:00+00:00

KEY_REKEY_WM_CHECK_BITS now controls the watermark check, once per 2^n flow writes (FLOW_WM_CHECK in dev.c). Now the configuration check (check watermark < outstanding packets) is contained in lib.cmake instead of assuming the value of FLOW_WM_CHECK. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Wipe unpacked session key after copy

2026-06-29T06:33:00+00:00

Zeroize the symmetric key in the unpacked IRM message once it has been copied into the crypt context, in both flow__irm_result_des and flow_rekey__irm_result_des, so key material does not linger in the protobuf buffer until it is freed. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

oap: Rename kex_config loaders to sec_config

2026-06-29T06:33:00+00:00

Leftover from the kex_config->enc_config->sec_config rename. Finished by renames load_kex_config and the cli/srv variants to load_sec_config, the kcfg variables to scfg, and fixes the "KEX config"/"encryption config" comments. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Harden OAP handshake and add cert-less re-key

2026-06-29T06:33:00+00:00

Adds support for: Server key confirmation: the session key is bound to the negotiated algorithm via the HKDF info. The server returns a key-confirmation tag (rsp_tag, replacing the bare request-hash echo), so a cipher downgrade or key desync is detected. The cleartext path keeps a request echo, compared in constant time. Sealed server identity: AEAD-seal the certificate, signature and piggybacked data in the encrypted response (kex and rsp_tag move ahead as AAD), hiding the server identity and response sizes. Cert-less re-key: let the client omit its certificate, verifying the peer against the cached certificate. On PQC flows, ephemeral server-encap KEX (preserving forward secrecy) is used, even if the original flow allocation was client-encap. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Reject unsupported OAP kex and cipher

2026-06-29T06:33:00+00:00

Validate the configured key exchange and cipher against the supported ranks (returning ENOTSUP) instead of only rejecting an undefined cipher NID, so an unsupported algorithm is caught at config load. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Bound crc_check against short packets

2026-06-29T06:33:00+00:00

Reject a packet shorter than head_skip + CRCLEN before computing the CRC, instead of hashing over an underflowed length when the buffer is too small to hold the trailer. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

irmd: Complete bidirectional flow re-keying

2026-06-29T06:32:59+00:00

Extend re-key delivery beyond the locally-initiated watermark path: Handle peer-initiated re-key requests, allowing one request and one response per flow at a time. The client side wins if both ends try to re-key at the same time. Caches the peer certificate to support cert-less authenticated/signed re-keys. After a rekey, the initiator promotes first (timer) and starts sending under the new key. The responder observes the new key (peer_synced) and then the responder promotes. The responder will self-decide to use the new keys if it exhausted the older set in the case where it never sees the peer (unidirectional flow). Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Add constant-time comparison helper

2026-06-29T06:32:59+00:00

Add a function crypt_ct_cmp() that wraps CRYPTO_memcmp (OpenSSL) with a volatile-loop fallback, for comparing authentication tags without leaking timing. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

lib: Group sec_config authentication fields

2026-06-29T06:32:59+00:00

Nest the flat req_auth and cacert members of struct sec_config into a sub-struct a { req; cacert; }, keeping the authentication settings together. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders

config: Rename enc.conf to sec.conf

2026-06-29T06:32:59+00:00

The per-name config file holds more than encryption settings (KEX, cipher, KDF, peer authentication), so renamed it from enc.conf to sec.conf and the code internals to match. Signed-off-by: Dimitri Staessens Signed-off-by: Sander Vrijders