beaconcrypt 0.3.2__tar.gz → 0.3.5__tar.gz

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/.github/workflows/python.yml

@@ -31,6 +31,11 @@ jobs:
         run: |
           sudo apt install capnproto
 
+      - name: Run Python tests
+        run: |
+          uv run --group dev maturin develop --bindings pyo3 --features pybinds
+          uv run --group dev pytest tests
+
       - name: Build source distribution
         run: uvx maturin sdist --out dist
 

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/Cargo.lock

@@ -84,7 +84,7 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "beaconcrypt"
-version = "0.3.2"
+version = "0.3.5"
 dependencies = [
  "capnp",
  "capnpc",

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "beaconcrypt"
-version = "0.3.2"
+version = "0.3.5"
 edition = "2024"
 license-file = "LICENSE"
 readme = "README.md"

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: beaconcrypt
-Version: 0.3.2
+Version: 0.3.5
 Classifier: Programming Language :: Rust
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/README.md

@@ -46,14 +46,29 @@ Test the C interface
 # Reference implementation
 I don't use rust a lot, so the code is probably fairly naive. It provides both a beacon and server implementation with C bindings through `cbindgen`. Ideally more bindings would be built on top of that so it can be used in the mythic server-side.
 
+The reference implementation expects that all beacons are compiled with the server's public key, and that beaconcrypt is initialized with it.
+
+The server is currently not very usable as it doesn't support saving the state of any individual beacon. This means that if your server goes down, you will not be able to communicate with any previously-registered beacons anymore. The server doesn't support being initialized with an Ed25519 seed (32 random bytes). Users wishing to use the server in practical cases should use this interface to ensure their server keeps its identity across reboots.
+
 ## Building
 You will need [Capn'Proto](https://capnproto.org/install.html) (just the binaries) and a recent version of rust for every build.
 
 For windows, I prefer building with stable-gnu for normal usage, and nightly-gnu for release builds. You can find the exact arguments I use to the the static library as small as possible in [release.yml](/.github\workflows\release.yml). The MSVC toolchain is expected to work just as well, I just like mingw.
 
+Build and run all tests:
+```bash
+cargo test
+cargo build --target x86_64-pc-windows-gnu
+go test ./...
+uv run maturin build --features pybinds --uv
+uv run --no-sync pytest tests
+```
+
 ## Profiles
 The reference implementation has two profiles: `PQXDH` and `CNSA2`. Profiles are controlled by cargo features. The CNSA2 profile only exists as a test for now. It uses a simple ML-KEM encapsulation for key exchange and the underlying libraries are not FIPS-approved. It is experimental and is likely broken. PQXDH is the intended target and the default.
 
+**CNSA2 is currently completely broken**
+
 ## Usage
 The reference implementation is a library that can currently be used either from rust or through C FFI. The C interface is currently not tested.
 

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/beaconcrypt.go

@@ -33,7 +33,9 @@ beaconcrypt_go_buffer beaconcrypt_go_process_initial_message(void *handle, const
 beaconcrypt_go_buffer beaconcrypt_go_encrypt_to_beacon(void *handle, uint64_t key_id, const uint8_t *ptr, uintptr_t len);
 beaconcrypt_go_buffer beaconcrypt_go_encrypt_to_beacon_signed(void *handle, uint64_t key_id, const uint8_t *ptr, uintptr_t len);
 beaconcrypt_go_buffer beaconcrypt_go_decrypt_beacon_message(void *handle, uint64_t key_id, const uint8_t *ptr, uintptr_t len);
+beaconcrypt_go_buffer beaconcrypt_go_decrypt_beacon_message_signed(void *handle, const uint8_t *ptr, uintptr_t len);
 beaconcrypt_go_buffer beaconcrypt_go_encrypt_to_server(void *handle, const uint8_t *ptr, uintptr_t len);
+beaconcrypt_go_buffer beaconcrypt_go_encrypt_to_server_signed(void *handle, const uint8_t *ptr, uintptr_t len);
 beaconcrypt_go_buffer beaconcrypt_go_decrypt_server_message(void *handle, const uint8_t *ptr, uintptr_t len);
 beaconcrypt_go_buffer beaconcrypt_go_decrypt_server_message_signed(void *handle, const uint8_t *ptr, uintptr_t len);
 */
@@ -203,6 +205,15 @@ func (s *Server) DecryptBeaconMessage(keyID uint64, ciphertext []byte) ([]byte,
 	})
 }
 
+func (s *Server) DecryptBeaconMessageSigned(ciphertext []byte) ([]byte, error) {
+	if s == nil || s.handle == nil {
+		return nil, ErrClosed
+	}
+	return callUnary(ciphertext, func(ptr *C.uint8_t, len C.uintptr_t) C.beaconcrypt_go_buffer {
+		return C.beaconcrypt_go_decrypt_beacon_message_signed(s.handle, ptr, len)
+	})
+}
+
 func (b *Beacon) EncryptToServer(plaintext []byte) ([]byte, error) {
 	if b == nil || b.handle == nil {
 		return nil, ErrClosed
@@ -212,6 +223,15 @@ func (b *Beacon) EncryptToServer(plaintext []byte) ([]byte, error) {
 	})
 }
 
+func (b *Beacon) EncryptToServerSigned(plaintext []byte) ([]byte, error) {
+	if b == nil || b.handle == nil {
+		return nil, ErrClosed
+	}
+	return callUnary(plaintext, func(ptr *C.uint8_t, len C.uintptr_t) C.beaconcrypt_go_buffer {
+		return C.beaconcrypt_go_encrypt_to_server_signed(b.handle, ptr, len)
+	})
+}
+
 func (b *Beacon) DecryptServerMessage(ciphertext []byte) ([]byte, error) {
 	if b == nil || b.handle == nil {
 		return nil, ErrClosed
@@ -240,10 +260,13 @@ func callUnary(data []byte, call func(*C.uint8_t, C.uintptr_t) C.beaconcrypt_go_
 }
 
 func copyBuffer(buffer C.beaconcrypt_go_buffer) ([]byte, error) {
-	if buffer.ptr == nil || buffer.len == 0 {
+	if buffer.ptr == nil {
 		return nil, ErrCrypto
 	}
 	defer C.beaconcrypt_go_free_buffer(buffer)
+	if buffer.len == 0 {
+		return []byte{}, nil
+	}
 	return C.GoBytes(unsafe.Pointer(buffer.ptr), C.int(buffer.len)), nil
 }
 

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/beaconcrypt_test.go

@@ -11,27 +11,34 @@ func registerBeacon(t *testing.T, server *Server, beacon *Beacon) []byte {
 	t.Helper()
 
 	message := bytes.Repeat([]byte{0xff}, 32)
-	phase1, err := beacon.GenerateRegistration()
+	regOut := registerBeaconWithInitial(t, server, beacon, message)
+
+	phase2, err := beacon.ProcessInitialMessage(regOut.Serialized)
 	if err != nil {
 		t.Fatal(err)
 	}
+	if !bytes.Equal(phase2, message) {
+		t.Fatalf("initial message mismatch: got %x want %x", phase2, message)
+	}
+	return phase2
+}
 
-	regOut, err := server.RegisterBeacon(phase1, message)
+func registerBeaconWithInitial(t *testing.T, server *Server, beacon *Beacon, message []byte) *RegistrationResponse {
+	t.Helper()
+
+	phase1, err := beacon.GenerateRegistration()
 	if err != nil {
 		t.Fatal(err)
 	}
-	if regOut.KeyID == 0 {
-		t.Fatal("expected non-zero beacon key id")
-	}
 
-	phase2, err := beacon.ProcessInitialMessage(regOut.Serialized)
+	regOut, err := server.RegisterBeacon(phase1, message)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !bytes.Equal(phase2, message) {
-		t.Fatalf("initial message mismatch: got %x want %x", phase2, message)
+	if regOut.KeyID == 0 {
+		t.Fatal("expected non-zero beacon key id")
 	}
-	return phase2
+	return regOut
 }
 
 func newServer(t *testing.T) *Server {
@@ -58,17 +65,43 @@ func newBeacon(t *testing.T, serverPK []byte) *Beacon {
 
 func TestRegister(t *testing.T) {
 	server := newServer(t)
-	beacon := newBeacon(t, nil)
+	serverPK, err := server.IdentityPK()
+	if err != nil {
+		t.Fatal(err)
+	}
+	beacon := newBeacon(t, serverPK)
 
 	if registerBeacon(t, server, beacon) == nil {
 		t.Fatal("expected registration to return initial message")
 	}
 }
 
+func TestRegisterWithoutInitialMessage(t *testing.T) {
+	server := newServer(t)
+	serverPK, err := server.IdentityPK()
+	if err != nil {
+		t.Fatal(err)
+	}
+	beacon := newBeacon(t, serverPK)
+
+	regOut := registerBeaconWithInitial(t, server, beacon, nil)
+	phase2, err := beacon.ProcessInitialMessage(regOut.Serialized)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(phase2) != 0 {
+		t.Fatalf("expected empty initial message, got %x", phase2)
+	}
+}
+
 func TestEncryptToMultiple(t *testing.T) {
 	server := newServer(t)
-	b1 := newBeacon(t, nil)
-	b2 := newBeacon(t, nil)
+	serverPK, err := server.IdentityPK()
+	if err != nil {
+		t.Fatal(err)
+	}
+	b1 := newBeacon(t, serverPK)
+	b2 := newBeacon(t, serverPK)
 	message := bytes.Repeat([]byte{0x01}, 32)
 
 	b1Initial := registerBeacon(t, server, b1)
@@ -92,7 +125,11 @@ func TestEncryptToMultiple(t *testing.T) {
 
 func TestEncryptMultiple(t *testing.T) {
 	server := newServer(t)
-	b1 := newBeacon(t, nil)
+	serverPK, err := server.IdentityPK()
+	if err != nil {
+		t.Fatal(err)
+	}
+	b1 := newBeacon(t, serverPK)
 	message := bytes.Repeat([]byte{0x01}, 32)
 
 	registerBeacon(t, server, b1)
@@ -112,7 +149,11 @@ func TestEncryptMultiple(t *testing.T) {
 
 func TestDecryptMultiple(t *testing.T) {
 	server := newServer(t)
-	beacon := newBeacon(t, nil)
+	serverPK, err := server.IdentityPK()
+	if err != nil {
+		t.Fatal(err)
+	}
+	beacon := newBeacon(t, serverPK)
 	message := bytes.Repeat([]byte{0x01}, 32)
 
 	registerBeacon(t, server, beacon)
@@ -143,7 +184,11 @@ func TestDecryptMultiple(t *testing.T) {
 
 func TestDecryptMultipleSigned(t *testing.T) {
 	server := newServer(t)
-	beacon := newBeacon(t, nil)
+	serverPK, err := server.IdentityPK()
+	if err != nil {
+		t.Fatal(err)
+	}
+	beacon := newBeacon(t, serverPK)
 	message := bytes.Repeat([]byte{0x01}, 32)
 
 	registerBeacon(t, server, beacon)
@@ -206,3 +251,116 @@ func TestDecryptCatchUp(t *testing.T) {
 		t.Fatalf("catch-up decrypt mismatch: got %x and %x want %x", plain1, plain2, message)
 	}
 }
+
+func TestBeaconEncryptsToServer(t *testing.T) {
+	server := newServer(t)
+	serverPK, err := server.IdentityPK()
+	if err != nil {
+		t.Fatal(err)
+	}
+	beacon := newBeacon(t, serverPK)
+	message := []byte("beacon to server")
+
+	registerBeacon(t, server, beacon)
+	ciphertext, err := beacon.EncryptToServer(message)
+	if err != nil {
+		t.Fatal(err)
+	}
+	plaintext, err := server.DecryptBeaconMessage(1, ciphertext)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(plaintext, message) {
+		t.Fatalf("beacon-to-server decrypt mismatch: got %x want %x", plaintext, message)
+	}
+}
+
+func TestBeaconEncryptsToServerSigned(t *testing.T) {
+	server := newServer(t)
+	serverPK, err := server.IdentityPK()
+	if err != nil {
+		t.Fatal(err)
+	}
+	beacon := newBeacon(t, serverPK)
+	message := []byte("signed beacon to server")
+
+	registerBeacon(t, server, beacon)
+	signed, err := beacon.EncryptToServerSigned(message)
+	if err != nil {
+		t.Fatal(err)
+	}
+	plaintext, err := server.DecryptBeaconMessageSigned(signed)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(plaintext, message) {
+		t.Fatalf("signed beacon-to-server decrypt mismatch: got %x want %x", plaintext, message)
+	}
+}
+
+func TestSignedServerMessageRejectsTampering(t *testing.T) {
+	server := newServer(t)
+	serverPK, err := server.IdentityPK()
+	if err != nil {
+		t.Fatal(err)
+	}
+	beacon := newBeacon(t, serverPK)
+
+	registerBeacon(t, server, beacon)
+	signed, err := server.EncryptToBeaconSigned(1, []byte("server to beacon"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	signed[len(signed)-1] ^= 0x01
+
+	if _, err := beacon.DecryptServerMessageSigned(signed); err == nil {
+		t.Fatal("expected tampered signed message to be rejected")
+	}
+}
+
+func TestBeaconCannotDecryptMessageForDifferentBeacon(t *testing.T) {
+	server := newServer(t)
+	serverPK, err := server.IdentityPK()
+	if err != nil {
+		t.Fatal(err)
+	}
+	b1 := newBeacon(t, serverPK)
+	b2 := newBeacon(t, serverPK)
+
+	registerBeacon(t, server, b1)
+	registerBeacon(t, server, b2)
+	ciphertext, err := server.EncryptToBeacon(1, []byte("for b1 only"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := b2.DecryptServerMessage(ciphertext); err == nil {
+		t.Fatal("expected message for another beacon to be rejected")
+	}
+}
+
+func TestCiphertextCannotBeReplayed(t *testing.T) {
+	server := newServer(t)
+	serverPK, err := server.IdentityPK()
+	if err != nil {
+		t.Fatal(err)
+	}
+	beacon := newBeacon(t, serverPK)
+	message := []byte("one shot")
+
+	registerBeacon(t, server, beacon)
+	ciphertext, err := server.EncryptToBeacon(1, message)
+	if err != nil {
+		t.Fatal(err)
+	}
+	plaintext, err := beacon.DecryptServerMessage(ciphertext)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(plaintext, message) {
+		t.Fatalf("replay setup decrypt mismatch: got %x want %x", plaintext, message)
+	}
+	if _, err := beacon.DecryptServerMessage(ciphertext); err == nil {
+		t.Fatal("expected replayed ciphertext to be rejected")
+	}
+}

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/bindings.h

@@ -455,10 +455,18 @@ struct beaconcrypt_GoBuffer beaconcrypt_go_decrypt_beacon_message(struct beaconc
                                                                   const uint8_t *ptr,
                                                                   uintptr_t len);
 
+struct beaconcrypt_GoBuffer beaconcrypt_go_decrypt_beacon_message_signed(struct beaconcrypt_BeaconCryptPqxdh *handle,
+                                                                         const uint8_t *ptr,
+                                                                         uintptr_t len);
+
 struct beaconcrypt_GoBuffer beaconcrypt_go_encrypt_to_server(struct beaconcrypt_BeaconCryptPqxdh *handle,
                                                              const uint8_t *ptr,
                                                              uintptr_t len);
 
+struct beaconcrypt_GoBuffer beaconcrypt_go_encrypt_to_server_signed(struct beaconcrypt_BeaconCryptPqxdh *handle,
+                                                                    const uint8_t *ptr,
+                                                                    uintptr_t len);
+
 struct beaconcrypt_GoBuffer beaconcrypt_go_decrypt_server_message(struct beaconcrypt_BeaconCryptPqxdh *handle,
                                                                   const uint8_t *ptr,
                                                                   uintptr_t len);

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/pyproject.toml

@@ -12,6 +12,10 @@ classifiers = [
 ]
 dynamic = ["version"]
 
+[tool.maturin]
+bindings = "pyo3"
+features = ["pybinds"]
+
 [dependency-groups]
 dev = [
     "black>=26.5.1",

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/src/cnsa2.rs

@@ -320,6 +320,7 @@ impl ProviderBeacon for BeaconCryptCnsa2 {
 		self.init_ratchets(&derived_secret, &info_str, true, srv_key_id);
 
 		match response.get_app_cipher_text() {
+			Ok(ciphertext) if ciphertext.is_empty() => Some(vec![]),
 			Ok(ciphertext) => match self.decrypt_message(ciphertext, srv_key_id, true) {
 				Some(plaintext) => Some(plaintext),
 				None => None,

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/src/lib.rs

@@ -296,6 +296,28 @@ mod gobinds {
 		decrypt(handle, ptr, len, key_id, false)
 	}
 
+	#[unsafe(no_mangle)]
+	pub extern "C" fn beaconcrypt_go_decrypt_beacon_message_signed(
+		handle: *mut BeaconCryptPqxdh,
+		ptr: *const u8,
+		len: usize,
+	) -> GoBuffer {
+		if handle.is_null() {
+			return empty_buffer();
+		}
+		let Some(data) = (unsafe { input(ptr, len) }) else {
+			return empty_buffer();
+		};
+		let provider = unsafe { &mut *handle };
+		match provider.verify_signature(data) {
+			Some(verified) => provider
+				.decrypt_message(&verified.data, verified.key_id, false)
+				.map(into_buffer)
+				.unwrap_or_else(empty_buffer),
+			None => empty_buffer(),
+		}
+	}
+
 	#[unsafe(no_mangle)]
 	pub extern "C" fn beaconcrypt_go_encrypt_to_server(
 		handle: *mut BeaconCryptPqxdh,
@@ -309,6 +331,29 @@ mod gobinds {
 		encrypt(handle, ptr, len, false, provider.server_kid())
 	}
 
+	#[unsafe(no_mangle)]
+	pub extern "C" fn beaconcrypt_go_encrypt_to_server_signed(
+		handle: *mut BeaconCryptPqxdh,
+		ptr: *const u8,
+		len: usize,
+	) -> GoBuffer {
+		if handle.is_null() {
+			return empty_buffer();
+		}
+		let Some(data) = (unsafe { input(ptr, len) }) else {
+			return empty_buffer();
+		};
+		let provider = unsafe { &mut *handle };
+		let srv_kid = provider.server_kid();
+		match provider.encrypt_message(data, false, srv_kid) {
+			Some(ciphertext) => provider
+				.sign_message(ciphertext.as_slice())
+				.map(into_buffer)
+				.unwrap_or_else(empty_buffer),
+			None => empty_buffer(),
+		}
+	}
+
 	#[unsafe(no_mangle)]
 	pub extern "C" fn beaconcrypt_go_decrypt_server_message(
 		handle: *mut BeaconCryptPqxdh,
@@ -475,9 +520,9 @@ pub mod beaconcrypt_py {
 	#[pymethods]
 	impl Beacon {
 		#[new]
-		fn new(server_kid: u64, server_id_pk: Option<&[u8]>) -> Self {
+		fn new(server_kid: u64, server_id_pk: &[u8]) -> Self {
 			Self {
-				_0: BeaconCryptPqxdh::new(true, server_kid, server_id_pk, None),
+				_0: BeaconCryptPqxdh::new(true, server_kid, Some(server_id_pk), None),
 			}
 		}
 

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/src/pqxdh.rs

@@ -143,7 +143,7 @@ impl CryptoProvider for BeaconCryptPqxdh {
 		let signed = crypto_sign::sign(data, self.identity_sk()).ok()?;
 		builder.set_data(&signed);
 		let mut buffer = vec![];
-		capnp::serialize_packed::write_message(&mut buffer, t_builder.borrow_inner()).unwrap();
+		capnp::serialize_packed::write_message(&mut buffer, t_builder.borrow_inner()).ok()?;
 		Some(buffer)
 	}
 
@@ -315,7 +315,7 @@ impl ProviderBeacon for BeaconCryptPqxdh {
 		bundle.set_pq_key(&pq_sig);
 
 		let mut buffer = vec![];
-		capnp::serialize::write_message(&mut buffer, msg.borrow_inner()).unwrap();
+		capnp::serialize::write_message(&mut buffer, msg.borrow_inner()).ok()?;
 		Some(buffer)
 	}
 
@@ -365,6 +365,7 @@ impl ProviderBeacon for BeaconCryptPqxdh {
 		self.init_ratchets(&derived_secret, &info_str, true, srv_key_id);
 
 		match response.get_app_cipher_text() {
+			Ok(ciphertext) if ciphertext.is_empty() => Some(vec![]),
 			Ok(ciphertext) => self.decrypt_message(ciphertext, srv_key_id, true),
 			Err(_) => Some(vec![0u8; 0]),
 		}
@@ -374,17 +375,16 @@ impl ProviderBeacon for BeaconCryptPqxdh {
 #[cfg(feature = "server")]
 impl ProviderServer for BeaconCryptPqxdh {
 	fn get_shared_secret(&mut self, buffer: &[u8]) -> Option<RegistrationOutput> {
-		let reader = capnp::serialize::read_message(buffer, ReaderOptions::new()).unwrap();
+		let reader = capnp::serialize::read_message(buffer, ReaderOptions::new()).ok()?;
 		let typed_reader = TypedReader::<_, phase1_capnp::init_kex::Owned>::new(reader);
-		let registration = typed_reader.get().unwrap();
+		let registration = typed_reader.get().ok()?;
 
 		let decoded_beacon_id = decode_sign(registration.get_identity_key().ok()?).ok()?;
 		let remote_id = crypto_sign::PublicKey::from_bytes(&decoded_beacon_id).ok()?;
-		let pq_verified = crypto_sign::verify(registration.get_pq_key().ok()?, &remote_id).unwrap();
-		let prekey_verified =
-			crypto_sign::verify(registration.get_pre_key().ok()?, &remote_id).unwrap();
+		let pq_verified = crypto_sign::verify(registration.get_pq_key().ok()?, &remote_id)?;
+		let prekey_verified = crypto_sign::verify(registration.get_pre_key().ok()?, &remote_id)?;
 		let onetime_verified =
-			crypto_sign::verify(registration.get_one_time_key().ok()?, &remote_id).unwrap();
+			crypto_sign::verify(registration.get_one_time_key().ok()?, &remote_id)?;
 
 		let beacon_prekey =
 			crypto_kx::PublicKey::from_bytes(&decode_kem(&prekey_verified).ok()?).ok()?;

beaconcrypt-0.3.5/tests/protocol.rs

@@ -0,0 +1,119 @@
+use beaconcrypt::*;
+
+const SERVER_KID: u64 = 0;
+
+fn new_pair() -> (BeaconCryptPqxdh, BeaconCryptPqxdh) {
+	let server = BeaconCryptPqxdh::new(false, SERVER_KID, None, None);
+	let server_id = server.identity_pk().to_owned();
+	let beacon = BeaconCryptPqxdh::new(true, SERVER_KID, Some(server_id.as_bytes()), None);
+	(server, beacon)
+}
+
+fn register_beacon(
+	server: &mut BeaconCryptPqxdh,
+	beacon: &mut BeaconCryptPqxdh,
+	initial_message: Option<&[u8]>,
+) -> RegResponse {
+	let phase_1 = beacon.get_registration_bundle().unwrap();
+	let reg_out = server.get_shared_secret(&phase_1).unwrap();
+	let phase_2 = server
+		.build_registration_response(reg_out, initial_message)
+		.unwrap();
+	let plaintext = beacon.finish_registration(&phase_2.serialized).unwrap();
+	assert_eq!(plaintext, initial_message.unwrap_or(&[]));
+	phase_2
+}
+
+#[test]
+fn registration_can_omit_initial_message() {
+	let (mut server, mut beacon) = new_pair();
+
+	let response = register_beacon(&mut server, &mut beacon, None);
+
+	assert_eq!(response.kid, 1);
+}
+
+#[test]
+fn beacon_can_encrypt_to_server() {
+	let (mut server, mut beacon) = new_pair();
+	let response = register_beacon(&mut server, &mut beacon, Some(&[0xFF; 32]));
+	let message = b"beacon to server";
+
+	let ciphertext = beacon
+		.encrypt_message(message.as_slice(), false, SERVER_KID)
+		.unwrap();
+	let plaintext = server
+		.decrypt_message(&ciphertext, response.kid, false)
+		.unwrap();
+
+	assert_eq!(plaintext, message);
+}
+
+#[test]
+fn beacon_can_encrypt_to_server_signed() {
+	let (mut server, mut beacon) = new_pair();
+	let response = register_beacon(&mut server, &mut beacon, Some(&[0xFF; 32]));
+	let message = b"signed beacon to server";
+
+	let ciphertext = beacon
+		.encrypt_message(message.as_slice(), false, SERVER_KID)
+		.unwrap();
+	let signed = beacon.sign_message(&ciphertext).unwrap();
+	let verified = server.verify_signature(&signed).unwrap();
+	let plaintext = server
+		.decrypt_message(&verified.data, verified.key_id, false)
+		.unwrap();
+
+	assert_eq!(verified.key_id, response.kid);
+	assert_eq!(plaintext, message);
+}
+
+#[test]
+fn signed_server_message_rejects_tampering() {
+	let (mut server, mut beacon) = new_pair();
+	let response = register_beacon(&mut server, &mut beacon, Some(&[0xFF; 32]));
+
+	let ciphertext = server
+		.encrypt_message(b"server to beacon", true, response.kid)
+		.unwrap();
+	let mut signed = server.sign_message(&ciphertext).unwrap();
+	let last = signed.len() - 1;
+	signed[last] ^= 0x01;
+
+	assert!(beacon.verify_signature(&signed).is_none());
+}
+
+#[test]
+fn beacon_cannot_decrypt_message_for_different_beacon() {
+	let mut server = BeaconCryptPqxdh::new(false, SERVER_KID, None, None);
+	let server_id = server.identity_pk().to_owned();
+	let mut b1 = BeaconCryptPqxdh::new(true, SERVER_KID, Some(server_id.as_bytes()), None);
+	let mut b2 = BeaconCryptPqxdh::new(true, SERVER_KID, Some(server_id.as_bytes()), None);
+	let b1_response = register_beacon(&mut server, &mut b1, Some(&[0xFF; 32]));
+	let _ = register_beacon(&mut server, &mut b2, Some(&[0xFF; 32]));
+
+	let ciphertext = server
+		.encrypt_message(b"for b1 only", true, b1_response.kid)
+		.unwrap();
+
+	assert!(b2.decrypt_message(&ciphertext, SERVER_KID, true).is_none());
+}
+
+#[test]
+fn ciphertext_cannot_be_replayed() {
+	let (mut server, mut beacon) = new_pair();
+	let response = register_beacon(&mut server, &mut beacon, Some(&[0xFF; 32]));
+	let message = b"one shot";
+
+	let ciphertext = server.encrypt_message(message, true, response.kid).unwrap();
+	let first = beacon
+		.decrypt_message(&ciphertext, SERVER_KID, true)
+		.unwrap();
+
+	assert_eq!(first, message);
+	assert!(
+		beacon
+			.decrypt_message(&ciphertext, SERVER_KID, true)
+			.is_none()
+	);
+}

beaconcrypt-0.3.5/tests/test_encryption.py

@@ -0,0 +1,168 @@
+from beaconcrypt import BeaconCryptBeacon, BeaconCryptServer
+
+
+def register_beacon(
+    server: BeaconCryptServer,
+    beacon: BeaconCryptBeacon,
+) -> bytes | None:
+    message = bytes([0xFF]) * 32
+    phase_1 = beacon.generate_registration()
+    assert phase_1 is not None
+    reg_out = server.register_beacon(phase_1, message)
+    assert reg_out is not None
+    phase2 = beacon.process_initial_message(reg_out.serialized())
+    assert phase2 is not None
+    assert phase2 == message
+    return phase2
+
+
+def test_encrypt_to_multiple():
+    server = BeaconCryptServer(0, None)
+    server_pk = server.id_pk()
+    b1 = BeaconCryptBeacon(0, server_pk)
+    b2 = BeaconCryptBeacon(0, server_pk)
+    message = bytes([0x1]) * 32
+
+    b1_initial = register_beacon(server, b1)
+    b2_initial = register_beacon(server, b2)
+    assert b2_initial == b1_initial
+
+    b1_m1 = server.encrypt_to_beacon(message, 1)
+    b2_m1 = server.encrypt_to_beacon(message, 2)
+    assert b1_m1 is not None and b2_m1 is not None and b1_m1 != b2_m1
+
+
+def test_encrypt_multiple():
+    server = BeaconCryptServer(0, None)
+    server_pk = server.id_pk()
+    b1 = BeaconCryptBeacon(0, server_pk)
+    message = bytes([0x1]) * 32
+
+    _ = register_beacon(server, b1)
+
+    b1_m1 = server.encrypt_to_beacon(message, 1)
+    b1_m2 = server.encrypt_to_beacon(message, 1)
+    assert b1_m1 is not None and b1_m2 is not None and b1_m1 != b1_m2
+
+
+def test_decrypt_multiple():
+    server = BeaconCryptServer(0, None)
+    server_pk = server.id_pk()
+    beacon = BeaconCryptBeacon(0, server_pk)
+    message = bytes([0x1]) * 32
+
+    _ = register_beacon(server, beacon)
+    m1 = server.encrypt_to_beacon(message, 1)
+    m2 = server.encrypt_to_beacon(message, 1)
+    assert m1 != m2
+
+    plain1 = beacon.decrypt_server_message(m1)
+    plain2 = beacon.decrypt_server_message(m2)
+    assert plain2 is not None and plain1 is not None
+    assert plain2 == plain1 == message
+
+
+def test_decrypt_multiple_signed():
+    server = BeaconCryptServer(0, None)
+    server_pk = server.id_pk()
+    beacon = BeaconCryptBeacon(0, server_pk)
+    message = bytes([0x1]) * 32
+
+    _ = register_beacon(server, beacon)
+    m1 = server.encrypt_to_beacon_signed(message, 1)
+    m2 = server.encrypt_to_beacon_signed(message, 1)
+    assert m1 != m2
+
+    plain1 = beacon.decrypt_server_message_signed(m1)
+    plain2 = beacon.decrypt_server_message_signed(m2)
+    assert plain2 is not None and plain1 is not None
+    assert plain2 == plain1 == message
+
+
+def test_decrypt_catch_up():
+    server = BeaconCryptServer(0, None)
+    server_pk = server.id_pk()
+    beacon = BeaconCryptBeacon(0, server_pk)
+    message = bytes([0x1]) * 32
+
+    _ = register_beacon(server, beacon)
+    m1 = server.encrypt_to_beacon(message, 1)
+    m2 = server.encrypt_to_beacon(message, 1)
+    assert m1 != m2
+
+    plain2 = beacon.decrypt_server_message(m2)
+    plain1 = beacon.decrypt_server_message(m1)
+    assert plain2 is not None and plain1 is not None
+    assert plain2 == plain1 == message
+
+
+def test_beacon_encrypts_to_server():
+    server = BeaconCryptServer(0, None)
+    server_pk = server.id_pk()
+    beacon = BeaconCryptBeacon(0, server_pk)
+    message = b"beacon to server"
+
+    _ = register_beacon(server, beacon)
+    ciphertext = beacon.encrypt_message_to_server(message)
+    assert ciphertext is not None
+
+    plaintext = server.decrypt_beacon_message(ciphertext, 1)
+    assert plaintext == message
+
+
+def test_beacon_encrypts_to_server_signed():
+    server = BeaconCryptServer(0, None)
+    server_pk = server.id_pk()
+    beacon = BeaconCryptBeacon(0, server_pk)
+    message = b"signed beacon to server"
+
+    _ = register_beacon(server, beacon)
+    signed = beacon.encrypt_to_server_signed(message)
+    assert signed is not None
+
+    plaintext = server.decrypt_beacon_message_signed(signed)
+    assert plaintext == message
+
+
+def test_signed_server_message_rejects_tampering():
+    server = BeaconCryptServer(0, None)
+    server_pk = server.id_pk()
+    beacon = BeaconCryptBeacon(0, server_pk)
+    message = b"server to beacon"
+
+    _ = register_beacon(server, beacon)
+    signed = server.encrypt_to_beacon_signed(message, 1)
+    assert signed is not None
+    tampered = bytearray(signed)
+    tampered[-1] ^= 0x01
+
+    assert beacon.decrypt_server_message_signed(bytes(tampered)) is None
+
+
+def test_beacon_cannot_decrypt_message_for_different_beacon():
+    server = BeaconCryptServer(0, None)
+    server_pk = server.id_pk()
+    b1 = BeaconCryptBeacon(0, server_pk)
+    b2 = BeaconCryptBeacon(0, server_pk)
+    message = b"for b1 only"
+
+    _ = register_beacon(server, b1)
+    _ = register_beacon(server, b2)
+    ciphertext = server.encrypt_to_beacon(message, 1)
+    assert ciphertext is not None
+
+    assert b2.decrypt_server_message(ciphertext) is None
+
+
+def test_ciphertext_cannot_be_replayed():
+    server = BeaconCryptServer(0, None)
+    server_pk = server.id_pk()
+    beacon = BeaconCryptBeacon(0, server_pk)
+    message = b"one shot"
+
+    _ = register_beacon(server, beacon)
+    ciphertext = server.encrypt_to_beacon(message, 1)
+    assert ciphertext is not None
+
+    assert beacon.decrypt_server_message(ciphertext) == message
+    assert beacon.decrypt_server_message(ciphertext) is None

{beaconcrypt-0.3.2 → beaconcrypt-0.3.5}/tests/test_registration.py

@@ -5,7 +5,7 @@ def register_beacon(
     server: BeaconCryptServer,
     beacon: BeaconCryptBeacon,
 ) -> bytes | None:
-    message = bytes(0xFF * 32)
+    message = bytes([0xFF]) * 32
     phase_1 = beacon.generate_registration()
     assert phase_1 is not None
     reg_out = server.register_beacon(phase_1, message)
@@ -18,6 +18,21 @@ def register_beacon(
 
 def test_register():
     server = BeaconCryptServer(0, None)
-    beacon = BeaconCryptBeacon(0, None)
+    server_pk = server.id_pk()
+    beacon = BeaconCryptBeacon(0, server_pk)
 
     assert register_beacon(server, beacon) is not None
+
+
+def test_register_without_initial_message():
+    server = BeaconCryptServer(0, None)
+    server_pk = server.id_pk()
+    beacon = BeaconCryptBeacon(0, server_pk)
+
+    phase_1 = beacon.generate_registration()
+    assert phase_1 is not None
+    reg_out = server.register_beacon(phase_1, None)
+    assert reg_out is not None
+
+    phase_2 = beacon.process_initial_message(reg_out.serialized())
+    assert phase_2 == b""

beaconcrypt-0.3.2/tests/test_encryption.py

@@ -1,92 +0,0 @@
-from beaconcrypt import BeaconCryptBeacon, BeaconCryptServer
-
-
-def register_beacon(
-    server: BeaconCryptServer,
-    beacon: BeaconCryptBeacon,
-) -> bytes | None:
-    message = bytes(0xFF * 32)
-    phase_1 = beacon.generate_registration()
-    assert phase_1 is not None
-    reg_out = server.register_beacon(phase_1, message)
-    assert reg_out is not None
-    phase2 = beacon.process_initial_message(reg_out.serialized())
-    assert phase2 is not None
-    assert phase2 == message
-    return phase2
-
-
-def test_encrypt_to_multiple():
-    server = BeaconCryptServer(0, None)
-    b1 = BeaconCryptBeacon(0, None)
-    b2 = BeaconCryptBeacon(0, None)
-    message = bytes(0x1 * 32)
-
-    b1_initial = register_beacon(server, b1)
-    b2_initial = register_beacon(server, b2)
-    assert b2_initial == b1_initial
-
-    b1_m1 = server.encrypt_to_beacon(message, 1)
-    b2_m1 = server.encrypt_to_beacon(message, 2)
-    assert b1_m1 is not None and b2_m1 is not None and b1_m1 != b2_m1
-
-
-def test_encrypt_multiple():
-    server = BeaconCryptServer(0, None)
-    b1 = BeaconCryptBeacon(0, None)
-    message = bytes(0x1 * 32)
-
-    _ = register_beacon(server, b1)
-
-    b1_m1 = server.encrypt_to_beacon(message, 1)
-    b1_m2 = server.encrypt_to_beacon(message, 1)
-    assert b1_m1 is not None and b1_m2 is not None and b1_m1 != b1_m2
-
-
-def test_decrypt_multiple():
-    server = BeaconCryptServer(0, None)
-    beacon = BeaconCryptBeacon(0, None)
-    message = bytes(0x1 * 32)
-
-    _ = register_beacon(server, beacon)
-    m1 = server.encrypt_to_beacon(message, 1)
-    m2 = server.encrypt_to_beacon(message, 1)
-    assert m1 != m2
-
-    plain1 = beacon.decrypt_server_message(m1)
-    plain2 = beacon.decrypt_server_message(m2)
-    assert plain2 is not None and plain1 is not None
-    assert plain2 == plain1 == message
-
-
-def test_decrypt_multiple_signed():
-    server = BeaconCryptServer(0, None)
-    beacon = BeaconCryptBeacon(0, None)
-    message = bytes(0x1 * 32)
-
-    _ = register_beacon(server, beacon)
-    m1 = server.encrypt_to_beacon_signed(message, 1)
-    m2 = server.encrypt_to_beacon_signed(message, 1)
-    assert m1 != m2
-
-    plain1 = beacon.decrypt_server_message_signed(m1)
-    plain2 = beacon.decrypt_server_message_signed(m2)
-    assert plain2 is not None and plain1 is not None
-    assert plain2 == plain1 == message
-
-
-def test_decrypt_catch_up():
-    server = BeaconCryptServer(0, None)
-    server_pk = server.id_pk()
-    beacon = BeaconCryptBeacon(0, server_pk)
-    message = bytes(0x1 * 32)
-
-    _ = register_beacon(server, beacon)
-    m1 = server.encrypt_to_beacon(message, 1)
-    m2 = server.encrypt_to_beacon(message, 1)
-    assert m1 != m2
-
-    plain2 = beacon.decrypt_server_message(m2)
-    plain1 = beacon.decrypt_server_message(m1)
-    assert plain2 is not None and plain1 is not None
-    assert plain2 == plain1 == message