16 lines
2.7 KiB
Markdown
16 lines
2.7 KiB
Markdown
# Kiloparsec 0.9.0-SNAPSHOT
|
|
|
|
This snapshot adds an opt-in Kotlin Multiplatform concealed transport flavor alongside the existing protocol 2. The lightweight TypeScript client remains at 0.8.0 and uses protocol 2. Existing endpoints do not switch flavors automatically.
|
|
|
|
The new flavor protects handshake and RPC metadata with an Elligator bootstrap, independently authenticated fresh session DH, encrypted records and configurable padding. Raw TCP, UDP and binary WebSocket carriers integrate with the existing RPC engine, initialization authorization hooks and bounded priority queue. UDP records decrypt independently and retain replay protection; TCP uses a continuous authenticated stream. Client establishment attempts are finite and do not automatically reissue application operations.
|
|
|
|
Server HELO authentication failures perform one discarded attempt with a mutated copy of a separate throwaway key, under the existing crypto admission limit. This configurable behavior cannot change authentication outcomes or send a response. It is supplementary failure-path work, without a general timing-concealment claim.
|
|
|
|
The existing transport's encrypted-response and complete-block decoding boundaries also use strict BiPack decoding, avoiding an empty-response/null hazard exposed by Native testing.
|
|
|
|
Validation passed: **127 JVM, 90 Kotlin/JS Node and 94 Linux Native tests**. This includes independent Python composition fixtures, 10,000 malformed record cases, 12,800 UDP records under impairment, bounded admission, 60 seconds of duplex/priority load, and actual TCP/UDP payload captures. Android, Wasm and all configured native compilation checks passed. See the [qualification record](CONCEALED-PROTOCOL-QUALIFICATION.md) for measurements, publication verification and precise coverage limits.
|
|
|
|
Use `net.sergeych:kiloparsec:0.9.0-SNAPSHOT` from the existing private Maven repository. The build requires Kotlin **2.4.0** and currently consumes `crypto2:0.9.6-SNAPSHOT`. No additional crypto runtime library was introduced. Initial API use requires `@OptIn(ExperimentalConcealedProtocol::class)`; [examples and configuration](CONCEALED-PROTOCOL-IMPLEMENTATION.md) are available.
|
|
|
|
SNAPSHOT was selected because this is the first distribution of the concealed wire flavor, it consumes a snapshot dependency, and browser/mobile/Apple runtimes have not been qualified. Independent fixtures verify our composition using trusted primitives; they do not constitute an external cryptographic audit or prove traffic indistinguishability. The API and concealed wire format may still change during qualification. Bootstrap-private-key compromise exposes the initial flights, while the separate authenticated fresh session DH protects client identity and application traffic, subject to ephemeral-secret erasure.
|