xah30
a070da0be9
Lays the foundation for sing-box mobile clients (Option B from
docs/sing-box.md): an independent Go module that speaks the AuraVPN wire
protocol byte-for-byte. Proof of equivalence is in KAT tests cross-loaded
from a Rust-side deterministic vector exporter.
- tools/export-kat (new Rust bin in workspace): captures a handshake +
derived keys + a sealed datagram record + a knock token using seeded
RNGs (rand::rngs::StdRng + ml-kem's *_deterministic public API), emits
JSON. Reproducible byte-for-byte.
- singbox-aura/ (new Go module, ~3000 LOC, 22 files):
- aura/frame: 5-byte protocol header + Frame{Data,Ping,Pong,Close,
Control} + magic envelope (0xAA,0xAA,0xC0,0x01) — encode/decode
matching aura-proto::frame.
- aura/crypto: hybrid X25519 + ML-KEM-768 (stdlib crypto/ecdh +
crypto/mlkem on Go 1.24+; falls back to circl on older Go via a
documented swap), HKDF-SHA256 derive_session_keys, ChaCha20-Poly1305
with the **LE(u64 counter) || [0;4]** nonce scheme that matches
aura-crypto::AeadKey/AeadSession.
- aura/handshake: client_handshake state machine reproducing protocol.md
§6.2 exactly (CH→SH→ServerAuth→ClientAuth→Finished×2; transcript hash;
ECDSA-P256 transcript signature; HMAC-SHA256 Finished).
- aura/session: DatagramSender/Receiver + 64-wide sliding replay window.
- aura/transport: reliable HS-adapter (DTLS-flight retransmit) + UDP
datagram data path + 16-byte HMAC port-knock with ±1-minute window.
- aura/outbound: sing-box-shaped shim (interface signatures only — sing-
box upstream registration is one more step, documented in README).
- cmd/aura-client: standalone Go binary; reads client.toml via
pelletier/go-toml/v2 and connects to a real aura server. Validates
end-to-end interop with the Rust side.
- KAT: 6 comparisons against Rust vectors — session_keys (HKDF), hybrid
KEM ek/encaps roundtrip, c2s + s2c Finished HMAC, sealed datagram
record at seq=2 (incl. 16-byte Poly1305 tag), knock token. All byte-
for-byte.
Go: 29 tests across 5 packages, all green. Only deps: golang.org/x/crypto
and pelletier/go-toml/v2. Rust: 293 tests still green; tools/export-kat
added to workspace members.
v1 limits documented in singbox-aura/README.md: UDP-only (no TCP/QUIC
fallback yet), no cell padding / cover traffic, no relay/exit role, no
multi-hop, sing-box upstream-registration sketch (vendor sagernet/sing-box +
init() RegisterOutbound) for follow-up.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
36 lines
935 B
Go
36 lines
935 B
Go
package transport
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/binary"
|
|
"time"
|
|
)
|
|
|
|
// KnockLen is the length in bytes of the truncated HMAC-SHA256 port-knock token.
|
|
const KnockLen = 16
|
|
|
|
// KnockForMinute derives the 16-byte port-knock token for a given Unix minute under the shared
|
|
// 32-byte key.
|
|
//
|
|
// Wire formula (mirrors aura-transport/src/udp.rs):
|
|
//
|
|
// HMAC-SHA256(key, u64_be(minute))[..16]
|
|
//
|
|
// The server validates against floor(now/60) and ±1 minute (~3-minute acceptance window).
|
|
func KnockForMinute(key [32]byte, minute uint64) [KnockLen]byte {
|
|
var mb [8]byte
|
|
binary.BigEndian.PutUint64(mb[:], minute)
|
|
m := hmac.New(sha256.New, key[:])
|
|
m.Write(mb[:])
|
|
tag := m.Sum(nil)
|
|
var out [KnockLen]byte
|
|
copy(out[:], tag[:KnockLen])
|
|
return out
|
|
}
|
|
|
|
// CurrentUnixMinute returns floor(now/60). Used by the client to compute the knock for "now".
|
|
func CurrentUnixMinute() uint64 {
|
|
return uint64(time.Now().Unix() / 60)
|
|
}
|