Modern cryptography replacing Udanax-Gold's placeholder crypto — Ed25519, X25519, ChaCha20-Poly1305, Argon2id, and signed key rotation
Phase 12 replaced the original Udanax-Gold placeholder crypto (NoEncrypter/NoScrambler) with production-grade modern cryptography. Every primitive comes from the RustCrypto project — pure Rust with no C dependencies, auditable and FFI-free.
cargo audit clean — zero known vulnerabilities.
Digital signatures for server identity, data signing, and key rotation proofs. 64-byte signatures, 32-byte keys.
Curve25519 Diffie-Hellman key exchange. Double-DH (static + ephemeral) for forward secrecy in challenge-response.
Authenticated encryption with associated data (AEAD). Monotonic nonce counter per session. Separate direction keys.
Key derivation with domain separation. Labels: xudanu/v1/handshake, xudanu/v1/aead/..., xudanu/v1/challenge-key.
Password hashing with OWASP parameters (19456 KiB, 2 iterations, 1 lane). PHC format. Constant-time verification.
Content fingerprinting for transclusion identity. Already used throughout — not new in Phase 12 but part of the crypto foundation.
aead.rs)ChaCha20-Poly1305 with per-session monotonic nonce counter. The SessionCipher maintains separate direction labels (client-to-server vs server-to-client) so the same key material can't be replayed across directions. SealedEnvelope provides a versioned wire format. Session keys are zeroized on drop.
sign.rs)Thin Ed25519 wrappers: sign_bytes(), verify_signature(), generate_signing_key(). Keys are generated with secure randomness and zeroized on drop.
kex.rs)X25519 with double-DH (combining static and ephemeral keys). The transcript hash (BLAKE3 of both ephemeral public keys) binds the handshake to prevent man-in-the-middle attacks. SharedSecret zeroizes on drop.
kdf.rs)HKDF-SHA256 with domain-separated labels. Derives separate inbound/outbound session keys from the shared secret + handshake hash. Each label is prefixed xudanu/v1/ to prevent cross-protocol attacks.
password.rs)Argon2id with OWASP-recommended parameters. Stores hashes in PHC format ($argon2id$v=19$...). Verification uses subtle::constant_time_eq to prevent timing attacks.
keys.rs)ServerKeyPair holds Ed25519 signing + X25519 kex keys with key_id, validity window, and active status. KeyHistory stores the full rotation chain — each new key is signed by the previous key, creating a tamper-evident history from the genesis key.
Gold's lock system had placeholder crypto. Phase 12 replaced both lock types:
| Lock Type | Before (Gold) | After (Xudanu) |
|---|---|---|
MatchLock | Plaintext == comparison | Argon2id PHC hash + constant-time verify |
ChallengeLock | Placeholder vec![0u8; 32] | X25519 ECDH → HKDF → ChaCha20-Poly1305 |
xudanu/v1/challenge-keyephemeral_public_key || ciphertextThe server holds a ServerKeyPair (Ed25519 + X25519) and maintains a KeyHistory — an ordered chain of key entries where each rotation is signed by the previous key.
verify_rotation_chain() validates the entire history from the genesis key. Time-based validity (not_before/not_after) on each entry. Admin-triggered rotation via crypto_key_rotation operation.
Five operations (opcodes 0x1201–0x1205) expose crypto functionality:
| Operation | Opcode | Auth | Returns |
|---|---|---|---|
crypto_get_public_key | 0x1201 | None | key_id, signing_key[32], kex_key[32], server_id |
crypto_sign_data | 0x1202 | Admin | signature[64], key_id |
crypto_verify_signature | 0x1203 | None | valid (bool) |
crypto_key_rotation | 0x1204 | Admin | new_key_id |
crypto_key_history | 0x1205 | None | server_id, current_key_id, entries[] |
How Gold's placeholder crypto maps to Xudanu's real implementations:
| C++ Component | Rust Replacement |
|---|---|
NoEncrypter (stub) | ChaCha20-Poly1305 AEAD |
NoScrambler (stub) | Argon2id password hashing |
Encrypter::make() factory | ServerKeyPair::generate() |
MatchLock::encryptedPassword() | MatchLockSmith with Argon2id PHC |
ChallengeLock (stub) | X25519 ECDH + AEAD challenge |
| Snefru S-boxes | BLAKE3 content fingerprints |
| Asset | Protection |
|---|---|
| Passwords | Argon2id (OWASP params), PHC format, constant-time verify |
| Transport | X25519 ECDH, HKDF-derived keys, AEAD-encrypted challenges |
| Signatures | Ed25519 for identity, data signing, key rotation proofs |
| Documents | ChaCha20-Poly1305, monotonic nonces, direction-separated keys |
| Key material | zeroize on drop for all secret types |
All HKDF derivations use xudanu/v1/ prefixed labels. Session keys are split into separate inbound/outbound. AEAD AAD includes the direction label. This prevents cross-protocol and cross-direction attacks.
cargo audit clean: Zero known vulnerabilities in dependencies. Scans Cargo.lock against RustSec advisory database.
23 crypto known-value tests verify that Ed25519 signatures, BLAKE3 hashes, and KDF outputs match expected byte-for-byte values. These catch regressions in the crypto implementation.
All from RustCrypto — pure Rust, no C dependencies, no OpenSSL:
| Crate | Version | Purpose |
|---|---|---|
chacha20poly1305 | 0.10 | AEAD authenticated encryption |
x25519-dalek | 2.0 | Curve25519 Diffie-Hellman |
ed25519-dalek | 2.1 | Ed25519 digital signatures |
sha2 | 0.10 | SHA-256 for HKDF |
hkdf | 0.12 | HKDF-SHA256 key derivation |
argon2 | 0.5 | Argon2id password hashing |
subtle | 2.5 | Constant-time comparison |
zeroize | 1.8 | Secure memory zeroization |
blake3 | 1.5 | Content fingerprinting |
ring | 0.17 | TLS / additional primitives |