kiloparsec/CONCEALED-PROTOCOL-VECTORS.md

Concealed protocol: independent composition vectors

2026-10-22. These are qualification fixtures for experimental suite 1, not a cryptographic audit or a claim of indistinguishability.

Independent implementation

tools/concealed-vectors/reference.py generates 52 fixture fields without importing Kotlin source, executing Kotlin output, or reading the generated fixture file. All private keys, identity seeds, IVs and plaintexts in these files are deliberately public synthetic test inputs. Never use them for a connection.

The reference uses Python's standard-library hashlib.blake2b for hashes, KDFs, MACs, and the explicit crypto_kx derivation (BLAKE2b-512(X25519 || clientPublic || serverPublic)). Its original ChaCha20 implementation is plain Python with a 64-bit counter and 64-bit nonce. It uses the installed system libsodium through ctypes for X25519, XSalsa20-Poly1305 and Ed25519. Thus the protocol composition and stream-cursor implementation are independent, while the underlying trusted curve, box and signature primitives are intentionally shared. There are no added production dependencies or downloaded Python packages.

Reproduce from the repository root:

python3 tools/concealed-vectors/reference.py
sha256sum tools/concealed-vectors/fixtures.json

Expected JSON SHA-256:

7a7acacb100b028a8f78ad933b904cc97afd0f57eac9b1513c9ca6bb01ef0a27

Regeneration also writes IndependentWireFixtures.kt, consumed on JVM, Kotlin/JS and Native by IndependentWireVectorsTest.

Checks performed by the Kotlin tests

1. Exact F1 bytes, public representative decoding, bootstrap DH, bootstrap root and h1. A real ServerHandshake accepts this independently generated HELO and obtains the expected client DH public key. Changing either ignored representative top bit preserves its mathematical point but fails authentication because the exact encoding is bound into the KDF.
2. Exact F2 bytes, server signature, reply KDF and h2.
3. Independent explicit KX derivation agrees with both Kotlin libsodium role APIs; c2s and s2c assignment, token and both finished keys match.
4. Exact client signature, F3, h3 and F4 bytes.
5. Both directional stream bases, salts, MAC keys and UDP keys agree with makeSession.
6. Three complete TCP records match the pure-Python ChaCha20/MAC composition byte for byte. Record ends are at offsets 27, 121 and 148, deliberately crossing and retaining partial 64-byte cipher masks. Decoding succeeds at chunk sizes 1, 3, 63, 64, 65 and the entire stream.
7. Independently encrypted UDP records are accepted in order 2, 0, 1; duplicates are discarded and a modified ciphertext is rejected.

Padding is disabled for these byte-exact fixtures. Object bytes are opaque record-engine inputs; they are not examples of valid application RPC serialization. The fixed HELO is for the stream carrier; UDP record fixtures independently exercise datagram protection.

Scope limits

F2–F4 fixture comparisons exercise the production envelope, signature, KDF and session-material components with fixed inputs. They do not force the production client/server state machines to use deterministic secret keys or IVs. The actual state machines continue to obtain entropy exclusively from libsodium, and separate randomized four-flight and connection integration tests cover their operation. No public or internal production entropy override was added to obtain vectors.

These checks target encoding, key ordering, transcript coverage and cursor errors. They do not prove the custom stream/MAC composition secure, quantify a timing adversary, establish traffic indistinguishability, or replace review of application trust provisioning. The bootstrap private-key compromise boundary remains as designed: recorded bootstrap flights become readable, whereas independently authenticated fresh session DH protects client identity and application traffic, subject to ephemeral-secret erasure.