RustCrypto: crypto_secretstream

Pure Rust implementation of libsodium's crypto_secretstream primitive, providing an AEAD using ChaCha20 and Poly1305.

It is tested against sodiumoxide, a Rust libsodium bindings.

Documentation

About

Imagine Alice wants to open a safe channel of communication with Bob, one that can't be read or modified by anyone else.

One way she can do this is by first agreeing with Bob on a shared secret key (such as one generated via a key exchange protocol), then she opens a normal/unsafe channel of communication and sends her messages, encrypted under this shared key. Then, when Bob receives these messages, he can decrypt each one and the mere knowledge of this shared key ensures that it was indeed sent by Alice.

Under the hood, the first message is postfixed with a random number, called a nonce, generated by Alice, which is taken into account during encryption and decryption. It is then incremented for each new message.

It also allows for additional data to be sent with each message. This data is not encrypted but used in the encryption process thus it is needed to be known in advance by the receiver. It can be useful for adding another layer of security, and is not of a fixed size as the key is.

License

Licensed under either of:

• Apache License, Version 2.0
• MIT license

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

Caveats

• auto-rekeying on counter overflow is not tested
• Tag::Final doesn't actually do anything, as libsodium does but not sodiumoxide
• Key and Nonce aren't zeroize, maybe it should
• MAC check in PullStream is not constant time