beaconcrypt 0.2.0__tar.gz → 0.3.1__tar.gz

beaconcrypt-0.3.1/.github/workflows/go.yml

@@ -0,0 +1,136 @@
+name: Go Module
+
+on:
+  push:
+    tags:
+      - "[0-9]*.[0-9]*.[0-9]*"
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+  GOPROXY: https://proxy.golang.org
+  GONOSUMDB: ""
+
+jobs:
+  test:
+    name: Test Go module on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - ubuntu-24.04-arm
+          - macos-latest
+          - windows-latest
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+
+      - name: Set up MinGW on Windows
+        if: runner.os == 'Windows'
+        uses: msys2/setup-msys2@v2
+        with:
+          install: mingw-w64-x86_64-gcc
+
+      - name: Install cap'n proto on Linux
+        if: runner.os == 'Linux'
+        run: sudo apt update && sudo apt install capnproto
+
+      - name: Install cap'n proto on macOS
+        if: runner.os == 'macOS'
+        run: brew install capnp
+
+      - name: Install cap'n proto on Windows
+        if: runner.os == 'Windows'
+        run: |
+          "C:\msys64\mingw64\bin" >> $env:GITHUB_PATH
+          curl.exe -O https://capnproto.org/capnproto-c++-win32-1.5.0.zip
+          Expand-Archive capnproto-c++-win32-1.5.0.zip
+          "$pwd\capnproto-c++-win32-1.5.0\capnproto-tools-win32-1.5.0" >> $env:GITHUB_PATH
+
+      - name: Build native library
+        if: runner.os != 'Windows'
+        run: cargo build --verbose
+
+      - name: Build native library on Windows
+        if: runner.os == 'Windows'
+        env:
+          CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER: gcc
+        run: |
+          rustup target add x86_64-pc-windows-gnu
+          cargo build --verbose --target x86_64-pc-windows-gnu
+
+      - name: Test Go module
+        if: runner.os != 'Windows'
+        env:
+          CGO_ENABLED: 1
+        run: go test ./...
+
+      - name: Test Go module on Windows
+        if: runner.os == 'Windows'
+        env:
+          CGO_ENABLED: 1
+          CC: gcc
+        run: go test ./...
+
+  publish:
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+
+      - name: Publish module to Go proxy
+        run: |
+          module_path="$(go list -m)"
+          version="${GITHUB_REF_NAME}"
+          go_version="v${version}"
+
+          git fetch origin "refs/tags/${go_version}:refs/tags/${go_version}" || true
+          if ! git rev-parse --verify --quiet "refs/tags/${go_version}" >/dev/null; then
+            git tag "${go_version}" "${GITHUB_SHA}"
+            git push origin "refs/tags/${go_version}"
+          fi
+
+          tag_visible=false
+          for attempt in {1..30}; do
+            if git ls-remote --exit-code --tags origin "refs/tags/${go_version}" >/dev/null; then
+              tag_visible=true
+              break
+            fi
+            sleep 10
+          done
+          if [ "${tag_visible}" != "true" ]; then
+            echo "Timed out waiting for ${go_version} to become visible on origin" >&2
+            exit 1
+          fi
+
+          GOPROXY=direct go list -m "${module_path}@${go_version}"
+
+          for attempt in {1..30}; do
+            if go list -m "${module_path}@${go_version}"; then
+              exit 0
+            fi
+            sleep 10
+          done
+
+          go list -m "${module_path}@${go_version}"

{beaconcrypt-0.2.0 → beaconcrypt-0.3.1}/.github/workflows/python.yml

@@ -11,7 +11,7 @@ name: Upload Python Package
 on:
   push:
     tags:
-      - "**"
+      - "[0-9]*.[0-9]*.[0-9]*"
 
 permissions:
   contents: read

{beaconcrypt-0.2.0 → beaconcrypt-0.3.1}/.github/workflows/release.yml

@@ -2,7 +2,8 @@ name: Release
 
 on:
   push: 
-    tags: '*'
+    tags:
+      - "[0-9]*.[0-9]*.[0-9]*"
 
 env:
   CARGO_TERM_COLOR: always

{beaconcrypt-0.2.0 → beaconcrypt-0.3.1}/.gitignore

@@ -70,3 +70,8 @@ docs/_build/
 
 # Pyenv
 .python-version
+
+.gocache/
+.go-appdata/
+.go-localappdata/
+.gotelemetry/

{beaconcrypt-0.2.0 → beaconcrypt-0.3.1}/Cargo.lock

@@ -84,7 +84,7 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "beaconcrypt"
-version = "0.2.0"
+version = "0.3.1"
 dependencies = [
  "capnp",
  "capnpc",
@@ -99,9 +99,9 @@ dependencies = [
 
 [[package]]
 name = "bitflags"
-version = "2.13.0"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
 [[package]]
 name = "bumpalo"
@@ -181,18 +181,18 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.6.1"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
+checksum = "dd059f9da4f5c36b3787f65d38ccaab1cc315f07b01f89abc8359ee6a8205011"
 dependencies = [
  "clap_builder",
 ]
 
 [[package]]
 name = "clap_builder"
-version = "4.6.0"
+version = "4.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
+checksum = "f09628afdcc538b57f3c6341e9c8e9970f18e4a481690a64974d7023bd33548b"
 dependencies = [
  "anstream",
  "anstyle",
@@ -978,9 +978,9 @@ checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
 [[package]]
 name = "simd-adler32"
-version = "0.3.9"
+version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
 
 [[package]]
 name = "slab"
@@ -996,9 +996,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "syn"
-version = "2.0.118"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1166,9 +1166,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.5"
+version = "1.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea5fab0d6c3c01ae70085a09cb03d4c7a1d6314e2b3e075392783396d724ca0a"
+checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
 dependencies = [
  "getrandom",
  "js-sys",

{beaconcrypt-0.2.0 → beaconcrypt-0.3.1}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "beaconcrypt"
-version = "0.2.0"
+version = "0.3.1"
 edition = "2024"
 license-file = "LICENSE"
 readme = "README.md"
@@ -10,7 +10,7 @@ repository = "https://github.com/0xd6cb6d73/beaconcrypt"
 
 [lib]
 name = "beaconcrypt"
-crate-type = ["cdylib", "rlib"]
+crate-type = ["cdylib", "staticlib", "rlib"]
 
 [build-dependencies]
 capnpc = "0.26"

{beaconcrypt-0.2.0 → beaconcrypt-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: beaconcrypt
-Version: 0.2.0
+Version: 0.3.1
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy

{beaconcrypt-0.2.0 → beaconcrypt-0.3.1}/README.md

@@ -46,6 +46,11 @@ Test the C interface
 # Reference implementation
 I don't use rust a lot, so the code is probably fairly naive. It provides both a beacon and server implementation with C bindings through `cbindgen`. Ideally more bindings would be built on top of that so it can be used in the mythic server-side.
 
+## Building
+You will need [Capn'Proto](https://capnproto.org/install.html) (just the binaries) and a recent version of rust for every build.
+
+For windows, I prefer building with stable-gnu for normal usage, and nightly-gnu for release builds. You can find the exact arguments I use to the the static library as small as possible in [release.yml](/.github\workflows\release.yml). The MSVC toolchain is expected to work just as well, I just like mingw.
+
 ## Profiles
 The reference implementation has two profiles: `PQXDH` and `CNSA2`. Profiles are controlled by cargo features. The CNSA2 profile only exists as a test for now. It uses a simple ML-KEM encapsulation for key exchange and the underlying libraries are not FIPS-approved. It is experimental and is likely broken. PQXDH is the intended target and the default.
 

beaconcrypt-0.3.1/beaconcrypt.go

@@ -0,0 +1,256 @@
+// SPDX-License-Identifier: 0BSD
+
+package beaconcrypt
+
+/*
+#cgo windows LDFLAGS: -L${SRCDIR}/target/x86_64-pc-windows-gnu/debug -l:libbeaconcrypt.a -lbcrypt -lws2_32 -luserenv -ldbghelp -lntdll
+#cgo linux LDFLAGS: -L${SRCDIR}/target/debug -l:libbeaconcrypt.a
+#cgo darwin LDFLAGS: ${SRCDIR}/target/debug/libbeaconcrypt.a
+#include <stdint.h>
+#include <stdlib.h>
+
+typedef struct {
+	uint8_t *ptr;
+	uintptr_t len;
+	uintptr_t cap;
+} beaconcrypt_go_buffer;
+
+typedef struct {
+	beaconcrypt_go_buffer response;
+	beaconcrypt_go_buffer beacon_pk;
+	uint64_t key_id;
+} beaconcrypt_go_registration_response;
+
+void beaconcrypt_go_free_buffer(beaconcrypt_go_buffer buffer);
+void *beaconcrypt_go_server_new(uint64_t server_kid);
+void *beaconcrypt_go_server_new_from_seed(uint64_t server_kid, const uint8_t *seed_ptr, uintptr_t seed_len);
+void *beaconcrypt_go_beacon_new(uint64_t server_kid, const uint8_t *server_pk_ptr, uintptr_t server_pk_len);
+void beaconcrypt_go_free(void *handle);
+beaconcrypt_go_buffer beaconcrypt_go_identity_pk(const void *handle);
+beaconcrypt_go_buffer beaconcrypt_go_generate_registration(void *handle);
+beaconcrypt_go_registration_response beaconcrypt_go_register_beacon(void *handle, const uint8_t *reg_ptr, uintptr_t reg_len, const uint8_t *msg_ptr, uintptr_t msg_len);
+beaconcrypt_go_buffer beaconcrypt_go_process_initial_message(void *handle, const uint8_t *ptr, uintptr_t len);
+beaconcrypt_go_buffer beaconcrypt_go_encrypt_to_beacon(void *handle, uint64_t key_id, const uint8_t *ptr, uintptr_t len);
+beaconcrypt_go_buffer beaconcrypt_go_encrypt_to_beacon_signed(void *handle, uint64_t key_id, const uint8_t *ptr, uintptr_t len);
+beaconcrypt_go_buffer beaconcrypt_go_decrypt_beacon_message(void *handle, uint64_t key_id, const uint8_t *ptr, uintptr_t len);
+beaconcrypt_go_buffer beaconcrypt_go_encrypt_to_server(void *handle, const uint8_t *ptr, uintptr_t len);
+beaconcrypt_go_buffer beaconcrypt_go_decrypt_server_message(void *handle, const uint8_t *ptr, uintptr_t len);
+beaconcrypt_go_buffer beaconcrypt_go_decrypt_server_message_signed(void *handle, const uint8_t *ptr, uintptr_t len);
+*/
+import "C"
+
+import (
+	"errors"
+	"runtime"
+	"unsafe"
+)
+
+var (
+	ErrClosed    = errors.New("beaconcrypt: handle is closed")
+	ErrCrypto    = errors.New("beaconcrypt: cryptographic operation failed")
+	ErrSeedSize  = errors.New("beaconcrypt: server seed must be 32 bytes")
+	ErrEmptyData = errors.New("beaconcrypt: input must not be empty")
+)
+
+type Server struct {
+	handle unsafe.Pointer
+}
+
+type Beacon struct {
+	handle unsafe.Pointer
+}
+
+type RegistrationResponse struct {
+	Serialized []byte
+	BeaconPK   []byte
+	KeyID      uint64
+}
+
+func NewServer(serverKID uint64) (*Server, error) {
+	handle := C.beaconcrypt_go_server_new(C.uint64_t(serverKID))
+	if handle == nil {
+		return nil, ErrCrypto
+	}
+	server := &Server{handle: handle}
+	runtime.SetFinalizer(server, (*Server).Close)
+	return server, nil
+}
+
+func NewServerFromSeed(serverKID uint64, seed []byte) (*Server, error) {
+	if len(seed) != 32 {
+		return nil, ErrSeedSize
+	}
+	ptr, free := cBytes(seed)
+	defer free()
+	handle := C.beaconcrypt_go_server_new_from_seed(C.uint64_t(serverKID), ptr, C.uintptr_t(len(seed)))
+	if handle == nil {
+		return nil, ErrCrypto
+	}
+	server := &Server{handle: handle}
+	runtime.SetFinalizer(server, (*Server).Close)
+	return server, nil
+}
+
+func NewBeacon(serverKID uint64, serverPK []byte) (*Beacon, error) {
+	ptr, free := cBytes(serverPK)
+	defer free()
+	handle := C.beaconcrypt_go_beacon_new(C.uint64_t(serverKID), ptr, C.uintptr_t(len(serverPK)))
+	if handle == nil {
+		return nil, ErrCrypto
+	}
+	beacon := &Beacon{handle: handle}
+	runtime.SetFinalizer(beacon, (*Beacon).Close)
+	return beacon, nil
+}
+
+func (s *Server) Close() {
+	if s != nil && s.handle != nil {
+		C.beaconcrypt_go_free(s.handle)
+		s.handle = nil
+		runtime.SetFinalizer(s, nil)
+	}
+}
+
+func (b *Beacon) Close() {
+	if b != nil && b.handle != nil {
+		C.beaconcrypt_go_free(b.handle)
+		b.handle = nil
+		runtime.SetFinalizer(b, nil)
+	}
+}
+
+func (s *Server) IdentityPK() ([]byte, error) {
+	if s == nil || s.handle == nil {
+		return nil, ErrClosed
+	}
+	return copyBuffer(C.beaconcrypt_go_identity_pk(s.handle))
+}
+
+func (b *Beacon) GenerateRegistration() ([]byte, error) {
+	if b == nil || b.handle == nil {
+		return nil, ErrClosed
+	}
+	return copyBuffer(C.beaconcrypt_go_generate_registration(b.handle))
+}
+
+func (s *Server) RegisterBeacon(registration, initialMessage []byte) (*RegistrationResponse, error) {
+	if s == nil || s.handle == nil {
+		return nil, ErrClosed
+	}
+	if len(registration) == 0 {
+		return nil, ErrEmptyData
+	}
+	regPtr, regFree := cBytes(registration)
+	defer regFree()
+	msgPtr, msgFree := cBytes(initialMessage)
+	defer msgFree()
+	response := C.beaconcrypt_go_register_beacon(
+		s.handle,
+		regPtr,
+		C.uintptr_t(len(registration)),
+		msgPtr,
+		C.uintptr_t(len(initialMessage)),
+	)
+	serialized, err := copyBuffer(response.response)
+	if err != nil {
+		C.beaconcrypt_go_free_buffer(response.beacon_pk)
+		return nil, err
+	}
+	beaconPK, err := copyBuffer(response.beacon_pk)
+	if err != nil {
+		return nil, err
+	}
+	return &RegistrationResponse{
+		Serialized: serialized,
+		BeaconPK:   beaconPK,
+		KeyID:      uint64(response.key_id),
+	}, nil
+}
+
+func (b *Beacon) ProcessInitialMessage(data []byte) ([]byte, error) {
+	if b == nil || b.handle == nil {
+		return nil, ErrClosed
+	}
+	return callUnary(data, func(ptr *C.uint8_t, len C.uintptr_t) C.beaconcrypt_go_buffer {
+		return C.beaconcrypt_go_process_initial_message(b.handle, ptr, len)
+	})
+}
+
+func (s *Server) EncryptToBeacon(keyID uint64, plaintext []byte) ([]byte, error) {
+	if s == nil || s.handle == nil {
+		return nil, ErrClosed
+	}
+	return callUnary(plaintext, func(ptr *C.uint8_t, len C.uintptr_t) C.beaconcrypt_go_buffer {
+		return C.beaconcrypt_go_encrypt_to_beacon(s.handle, C.uint64_t(keyID), ptr, len)
+	})
+}
+
+func (s *Server) EncryptToBeaconSigned(keyID uint64, plaintext []byte) ([]byte, error) {
+	if s == nil || s.handle == nil {
+		return nil, ErrClosed
+	}
+	return callUnary(plaintext, func(ptr *C.uint8_t, len C.uintptr_t) C.beaconcrypt_go_buffer {
+		return C.beaconcrypt_go_encrypt_to_beacon_signed(s.handle, C.uint64_t(keyID), ptr, len)
+	})
+}
+
+func (s *Server) DecryptBeaconMessage(keyID uint64, ciphertext []byte) ([]byte, error) {
+	if s == nil || s.handle == nil {
+		return nil, ErrClosed
+	}
+	return callUnary(ciphertext, func(ptr *C.uint8_t, len C.uintptr_t) C.beaconcrypt_go_buffer {
+		return C.beaconcrypt_go_decrypt_beacon_message(s.handle, C.uint64_t(keyID), ptr, len)
+	})
+}
+
+func (b *Beacon) EncryptToServer(plaintext []byte) ([]byte, error) {
+	if b == nil || b.handle == nil {
+		return nil, ErrClosed
+	}
+	return callUnary(plaintext, func(ptr *C.uint8_t, len C.uintptr_t) C.beaconcrypt_go_buffer {
+		return C.beaconcrypt_go_encrypt_to_server(b.handle, ptr, len)
+	})
+}
+
+func (b *Beacon) DecryptServerMessage(ciphertext []byte) ([]byte, error) {
+	if b == nil || b.handle == nil {
+		return nil, ErrClosed
+	}
+	return callUnary(ciphertext, func(ptr *C.uint8_t, len C.uintptr_t) C.beaconcrypt_go_buffer {
+		return C.beaconcrypt_go_decrypt_server_message(b.handle, ptr, len)
+	})
+}
+
+func (b *Beacon) DecryptServerMessageSigned(ciphertext []byte) ([]byte, error) {
+	if b == nil || b.handle == nil {
+		return nil, ErrClosed
+	}
+	return callUnary(ciphertext, func(ptr *C.uint8_t, len C.uintptr_t) C.beaconcrypt_go_buffer {
+		return C.beaconcrypt_go_decrypt_server_message_signed(b.handle, ptr, len)
+	})
+}
+
+func callUnary(data []byte, call func(*C.uint8_t, C.uintptr_t) C.beaconcrypt_go_buffer) ([]byte, error) {
+	if len(data) == 0 {
+		return nil, ErrEmptyData
+	}
+	ptr, free := cBytes(data)
+	defer free()
+	return copyBuffer(call(ptr, C.uintptr_t(len(data))))
+}
+
+func copyBuffer(buffer C.beaconcrypt_go_buffer) ([]byte, error) {
+	if buffer.ptr == nil || buffer.len == 0 {
+		return nil, ErrCrypto
+	}
+	defer C.beaconcrypt_go_free_buffer(buffer)
+	return C.GoBytes(unsafe.Pointer(buffer.ptr), C.int(buffer.len)), nil
+}
+
+func cBytes(data []byte) (*C.uint8_t, func()) {
+	if len(data) == 0 {
+		return nil, func() {}
+	}
+	ptr := C.CBytes(data)
+	return (*C.uint8_t)(ptr), func() { C.free(ptr) }
+}