111 lines
12 KiB
Markdown
111 lines
12 KiB
Markdown
# Concealed protocol: 0.9.0-SNAPSHOT qualification
|
|
|
|
2026-10-22. This is the continuation point for the first snapshot release. It records completed checks and their limits, separate from the historical [design](CONCEALED-PROTOCOL-DESIGN.md), [wire specification](CONCEALED-PROTOCOL-WIRE.md), [API guide](CONCEALED-PROTOCOL-IMPLEMENTATION.md) and earlier [timing assessment](CONCEALED-PROTOCOL-TIMING.md).
|
|
|
|
## 1. Release decision
|
|
|
|
Publish **0.9.0-SNAPSHOT**, with the concealed flavor opt-in on separate endpoints. Existing protocol 2 remains available; the lightweight TypeScript client stays at 0.8.0. The project now requires Kotlin 2.4.0 and consumes crypto2 0.9.6-SNAPSHOT. This is the first distributed concealed implementation, not a frozen stable protocol or a universal runtime qualification.
|
|
|
|
No new crypto runtime dependency was added. The explicit libsodium binding is already the crypto2 backend; the independent Python reference is a development tool only.
|
|
|
|
## 2. Independent composition verification
|
|
|
|
The [reference and fixture guide](CONCEALED-PROTOCOL-VECTORS.md) records 52 deterministic fixture fields and their SHA-256. Python independently implements the protocol labels, lengths, hashes, ordered KX derivation, signatures, F1–F4 envelopes, stream cursor and UDP encoding. Its continuous ChaCha20 implementation is pure Python; trusted curve/box/signature primitives use system libsodium.
|
|
|
|
Three common tests passed on JVM, Kotlin/JS and Linux Native. They compare exact production component output with the reference, exercise partial cipher-mask boundaries at offsets 27/121/148, decode reordered UDP, and pass independent F1 through the real server state machine. Fixed F2–F4 comparisons exercise components; complete client/server state machines are additionally covered by randomized integration tests. No production entropy override was added.
|
|
|
|
Source review checked exact HELO binding, the signed server core, role-assigned session keys, client signature/token binding, h3/traffic-key association and authentication-before-replay-state updates. It found no new composition defect. This is source review and executable cross-checking, not an external audit of the primitives or protocol.
|
|
|
|
## 3. Adversarial and sustained-load tests
|
|
|
|
`ExtendedConcealedQualificationTest` is enabled with `KILOPARSEC_EXTENDED_TESTS=1` and passed all four campaigns:
|
|
|
|
1. **10,000 malformed inputs**, seed `0x237d404`: 2,500 random unauthenticated datagrams, 2,500 authenticated inconsistent inner lengths, 2,500 modified stream records and 2,500 truncated stream records. No unauthenticated object was delivered; invalid datagrams did not consume replay state; stream failures were terminal. Inputs and allocation sizes were bounded.
|
|
2. **12,800 UDP records**, seed `0x51a7`: 11,636 delivered, 1,164 intentionally dropped, 2,327 duplicate drops, plus tag forgery before each delivered packet and a stale replay after window eviction. Shuffling retained at most 128 packets at a time.
|
|
3. **Admission campaign:** 10,000 attempts respected a global burst of 200; refill admitted 100 in the next simulated second; a 64-entry source table rejected rotating new sources until idle expiry. This targets the actual admission implementation directly, not 10,000 expensive full HELO decryption attempts.
|
|
4. **60-second duplex priority run:** eight RPC workers and a low-priority push worker over 16-capacity channels. Low-priority calls and pushes made progress in every 10-second interval. Explicit item and byte queue saturation rejected excess admission, and shutdown completed within its deadline. Results are workload-specific, not a general throughput guarantee.
|
|
|
|
## 4. Real socket payload capture
|
|
|
|
`ConcealedTrafficCaptureTest` passed eight fresh TCP and eight fresh UDP sessions through forwarding proxies, with five duplex echo calls per session. It captured actual loopback socket payloads without privileged packet access. All 16 first-flight representative prefixes differed. Neither the repeated synthetic RPC plaintext marker nor either identity public key nor the static server encryption public key appeared in captured directional payload streams.
|
|
|
|
Local artifacts are under `build/concealed-qualification/traffic/`: binary chunks, `capture.csv` with monotonic timestamps/sizes/directions, and `summary.txt`. TCP boundaries here are proxy read chunks; UDP boundaries are complete datagrams. This is not an IP-level packet capture or a traffic-classifier evaluation. Endpoints, timing, volume and statistical length/flight patterns remain observable. WebSocket upgrade visibility remains documented and its real Netty regression tests passed, but it was not included in this payload-capture campaign.
|
|
|
|
The first capture fixture incorrectly expected a locally cancelled socket read to leave an empty terminal diagnostic after deliberate shutdown. The assertion now checks connection health before shutdown, and all subsequent captures and the full suite passed. No protocol code was changed to obtain that result.
|
|
|
|
## 5. Platform results
|
|
|
|
The final combined command passed:
|
|
|
|
| Check | Result |
|
|
| --- | --- |
|
|
| Full JVM suite, extended tests enabled | 127 passed |
|
|
| Full Kotlin/JS Node suite | 90 passed |
|
|
| Full Linux x64 Native suite | 94 passed |
|
|
| Android release and Wasm | Compilation passed |
|
|
| Linux arm64, Windows x64 | Compilation passed |
|
|
| macOS arm64/x64, iOS arm64/x64/simulator arm64 | Compilation passed |
|
|
| Dokka HTML | Generated successfully |
|
|
| TypeScript unit suite | 38 passed, one ordinary-command interop skip |
|
|
| Live TypeScript/JVM interoperability | Passed pinned identity, duplex RPC, pushes, errors, parallel calls and reconnect |
|
|
|
|
Compilation is not browser/device runtime qualification or final Apple application linking. Existing unrelated compiler/deprecation and Dokka link warnings remain non-fatal.
|
|
|
|
```sh
|
|
KILOPARSEC_EXTENDED_TESTS=1 ./gradlew \
|
|
'-Dorg.gradle.jvmargs=-Xmx2g -XX:MaxMetaspaceSize=1g' \
|
|
jvmTest jsNodeTest linuxX64Test compileKotlinWasmJs compileReleaseKotlinAndroid \
|
|
compileKotlinLinuxArm64 compileKotlinMingwX64 compileKotlinMacosArm64 \
|
|
compileKotlinMacosX64 compileKotlinIosArm64 compileKotlinIosX64 \
|
|
compileKotlinIosSimulatorArm64 dokkaGeneratePublicationHtml --console=plain
|
|
```
|
|
|
|
## 6. Optimized Native measurements
|
|
|
|
The optimized Linux x64 test binary was linked using `NativeBuildType.RELEASE`, through an explicit optional Gradle test run. The timing report identifies it as release and is stored separately from the debug run (`build/concealed-timing/linuxX64-release.csv`). Sampling used 256 measurements per class after 64 warmup rounds on the same Intel Core Ultra 9 host, with no simultaneous load test or other benchmark from this task. CPU frequency scaling and unrelated workstation activity were not disabled.
|
|
|
|
| Operation | Native release median | p99 | Maximum |
|
|
| --- | ---: | ---: | ---: |
|
|
| Decode random public representative | 6.741 ms | 8.765 ms | 8.986 ms |
|
|
| Encode representable coordinate | 12.736 ms | 14.772 ms | 15.187 ms |
|
|
| Reject unrepresentable coordinate | 5.954 ms | 7.382 ms | 8.052 ms |
|
|
| Generate fresh Elligator key pair | 14.603 ms | 57.171 ms | 59.791 ms |
|
|
|
|
The corresponding earlier debug generation median/p99 were 154.524/537.195 ms. The optimized result is about 10.6 times faster at the median; neither run sets a universal deadline. Inverse-map rejection counts still produce expected generation tails. This is a Linux x64 measurement, not an Apple/Android performance claim.
|
|
|
|
```sh
|
|
KILOPARSEC_TIMING_PROBE=1 KILOPARSEC_TIMING_FLAVOR=release \
|
|
KILOPARSEC_TIMING_SAMPLES=256 KILOPARSEC_TIMING_WARMUP=64 \
|
|
./gradlew '-Dorg.gradle.jvmargs=-Xmx2g -XX:MaxMetaspaceSize=1g' \
|
|
-PconcealedNativeBenchmark=true linuxX64ConcealedBenchmarkTest \
|
|
--tests '*ElligatorTimingNativeTest*' --console=plain
|
|
```
|
|
|
|
An additional HotSpot per-thread allocation probe measured 128 real generation/destroy operations after 32 warmups: **17,621,495 mean bytes**, **11,529,472 median**, **34,325,888 p95**, **74,474,504 maximum**. These are temporary managed allocations, including bignum work and varying rejection counts. They exclude other threads and native libsodium allocations, and do not measure retained heap or Native allocation counts. Profiling/optimization is worthwhile for high connection rates; no fixed-field arithmetic rewrite was introduced in this release. Raw output is `build/concealed-timing/allocations-jvm.csv`.
|
|
|
|
Enable this branch of the existing JVM timing probe with `KILOPARSEC_TIMING_PROBE=1 KILOPARSEC_ALLOCATION_PROBE=1 KILOPARSEC_TIMING_SAMPLES=128 KILOPARSEC_TIMING_WARMUP=32`, filtering `jvmTest --tests '*ElligatorTimingJvmTest*'`. It does not overwrite the timing sample CSV.
|
|
|
|
The unshrunk candidate JVM JAR is **834,461 bytes**, compared with the published 0.8.0 baseline's 537,671 bytes: **+296,790 bytes (about 290 KiB)**. This includes compiler/metadata/coroutine classes and carriers, not just crypto code. It is not a native executable/APK/browser bundle measurement. Test/reference tools are absent from runtime artifacts.
|
|
|
|
## 7. Distribution verification
|
|
|
|
Published all **13 Maven publications** to Maven Local and the private SergeychWorks repository. Every one of **58 files** (JAR/AAR/KLIB, POM, Gradle module metadata, sources, tooling JSON and Apple metadata bridge artifacts) was downloaded from private Maven and matched against the local artifact by SHA-256. The initial timestamped build is `0.9.0-20261021.223610-1`; the normal dependency coordinate is `net.sergeych:kiloparsec:0.9.0-SNAPSHOT`.
|
|
|
|
Canonical JVM JAR: 834,461 bytes, SHA-256:
|
|
|
|
```text
|
|
dfa3e2123d614eb432b8b949e2d4eac35d2b6a51b904b61f1fcd1e8e66296575
|
|
```
|
|
|
|
A standalone Kotlin/JVM application resolved **only published dependencies**, with no composite/source substitution and no Maven Local repository. It authenticated both peers, completed bidirectional RPC over actual loopback TCP, and loaded the JAR from Gradle's downloaded private-Maven cache. That JAR's SHA-256 matches the verified publication. The first consumer fixture omitted the existing YoungBlood backend repository; adding it resolved the dependency and the README example was corrected. This was a consumer repository configuration gap, not a missing published Kiloparsec artifact.
|
|
|
|
The API site was deployed using `bin/pubdocs` with strict existing SSH trust. Live index, concealed connection and handshake-options HTML were downloaded and matched to the generated pages by SHA-256. [Published API documentation](https://code.sergeych.net/docs/kiloparsec/kiloparsec/net.sergeych.kiloparsec.concealed/index.html).
|
|
|
|
Local receipts: `build/concealed-qualification/publication.json`, `docs-publication.json`, `final-functional-results/`, and the standalone consumer/build logs under `/tmp`. Source publication includes this report and the deterministic fixtures; raw test captures and operational receipts remain ignored local artifacts. The source release is committed/pushed separately from Maven artifact creation; Git revision records the exact implementation and version declaration.
|
|
|
|
## 8. Remaining scope
|
|
|
|
The current evidence supports a controlled SNAPSHOT trial. Remaining work includes real browser/mobile/Apple runtimes, Internet-path deployment behavior and prolonged application-specific load, broader state-machine cross-implementation coverage, and independent review where required for production assurance. Timing variation in public-coordinate mapping is not a demonstrated server-private-key leak. The decoy decryption is supplementary bounded work; effectiveness against a particular Intel microarchitectural attack was not measured here.
|
|
|
|
The extended suites are opt-in so ordinary tests remain quick. Raw captures, timing samples and publication receipts are ignored build artifacts; this document and the deterministic fixtures preserve reproducible evidence in source control. No real application credentials or customer data were used.
|