Christian Nennemann
0bdc222724
Phase 1 — Foundation: - Constant-time token comparison via subtle::ConstantTimeEq (Fix 11) - Structured error codes E001–E020 in new error_codes.rs (Fix 15) - Remove dead envelope.capnp code and related types (Fix 16) Phase 2 — Auth Hardening: - Registration collision check via has_user_record() (Fix 5) - Auth required on uploadHybridKey/fetchHybridKey RPCs (Fix 1) - Identity-token binding at registration and login (Fix 2) - Session token expiry with 24h TTL and background reaper (Fix 3) - Bounded pending logins with 5-minute timeout (Fix 4) Phase 3 — Resource Limits: - Rate limiting: 100 enqueues/60s per token (Fix 6) - Queue depth cap at 1000 + 7-day message TTL/GC (Fix 7) - Partial queue drain via limit param on fetch/fetchWait (Fix 8) Phase 4 — Crypto Fixes: - OPAQUE KSF switched from Identity to Argon2id (Fix 10) - Random AEAD nonce in hybrid KEM instead of HKDF-derived (Fix 12) - Zeroize secret fields in HybridKeypairBytes (Fix 13) - Encrypted client state files via QPCE format (Fix 9) Phase 5 — Protocol: - Commit fan-out to all existing members on invite (Fix 14) - Add member_identities() to GroupMember Breaking: existing OPAQUE registrations invalidated (Argon2 KSF). Schema: added auth to hybrid key ops, identityKey to OPAQUE finish RPCs, limit to fetch/fetchWait. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
46 lines
1.4 KiB
TOML
46 lines
1.4 KiB
TOML
[package]
|
|
name = "quicnprotochat-core"
|
|
version = "0.1.0"
|
|
edition = "2021"
|
|
description = "Crypto primitives, MLS state machine, and hybrid post-quantum KEM for quicnprotochat."
|
|
license = "MIT"
|
|
|
|
[dependencies]
|
|
# Crypto — classical
|
|
x25519-dalek = { workspace = true }
|
|
ed25519-dalek = { workspace = true }
|
|
sha2 = { workspace = true }
|
|
hkdf = { workspace = true }
|
|
chacha20poly1305 = { workspace = true }
|
|
zeroize = { workspace = true }
|
|
rand = { workspace = true }
|
|
|
|
# Crypto — post-quantum hybrid KEM (M7)
|
|
ml-kem = { workspace = true }
|
|
|
|
# Crypto — OPAQUE password-authenticated key exchange
|
|
opaque-ke = { workspace = true }
|
|
argon2 = { workspace = true }
|
|
|
|
# Crypto — MLS (M2)
|
|
openmls = { workspace = true }
|
|
openmls_rust_crypto = { workspace = true }
|
|
openmls_traits = { workspace = true }
|
|
tls_codec = { workspace = true }
|
|
serde = { workspace = true }
|
|
bincode = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
|
|
# Serialisation
|
|
capnp = { workspace = true }
|
|
quicnprotochat-proto = { path = "../quicnprotochat-proto" }
|
|
|
|
# Async runtime
|
|
tokio = { workspace = true }
|
|
|
|
# Error handling
|
|
thiserror = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
tokio = { workspace = true }
|