SKDP: Symmetric Key Distribution Protocol 1.1.0.0 (A1)
Encrypted tunneling protocol using pre-shared keys
|
The SKDP settings. More...
#include "common.h"
#include "../../QSC/QSC/sha3.h"
Go to the source code of this file.
Data Structures | |
struct | skdp_master_key |
The SKDP master key structure. More... | |
struct | skdp_server_key |
The SKDP server key structure. More... | |
struct | skdp_device_key |
The SKDP device key structure. More... | |
struct | qsmp_keep_alive_state |
The SKDP keep alive state structure. More... | |
struct | skdp_network_packet |
The SKDP network packet structure. More... | |
Macros | |
#define | SKDP_CONFIG_SIZE 26 |
The size of the protocol configuration string. | |
#define | SKDP_ERROR_SIZE 1 |
The size of a system error message. | |
#define | SKDP_EXP_SIZE 8 |
The size (in bytes) of the expiration field. | |
#define | SKDP_HEADER_SIZE 21 |
The SKDP packet header size in bytes. | |
#define | SKDP_KEEPALIVE_MESSAGE 8 |
The size (in bytes) of the keep alive integer message. | |
#define | SKDP_KEEPALIVE_STRING 20 |
The keep alive string size in bytes. | |
#define | SKDP_KEEPALIVE_TIMEOUT (300 * 1000) |
The keep alive timeout in milliseconds (5 minutes). | |
#define | SKDP_MESSAGE_SIZE 1024 |
The message size (in bytes) used during a communications session. | |
#define | SKDP_MESSAGE_MAX (SKDP_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The maximum message size in bytes (may exceed MTU). | |
#define | SKDP_SERVER_PORT 2201 |
The default SKDP server port number. | |
#define | SKDP_MID_SIZE 4 |
The master key identity size in bytes. | |
#define | SKDP_SID_SIZE 8 |
The server ID size in bytes. | |
#define | SKDP_DID_SIZE 12 |
The device ID size in bytes. | |
#define | SKDP_TID_SIZE 4 |
The session ID size in bytes. | |
#define | SKDP_KID_SIZE 16 |
The SKDP key identity size in bytes. | |
#define | SKDP_SEQUENCE_TERMINATOR 0xFFFFFFFF |
The sequence number of a packet that closes a connection. | |
#define | SKDP_PROTOCOL_SEC256 |
The 256-bit security strength configuration flag. | |
#define | SKDP_CPRKEY_SIZE 32 |
The symmetric cipher key size (in bytes) for 256-bit security. | |
#define | SKDP_DDK_SIZE 32 |
The device derivation key size (in bytes) for 256-bit security. | |
#define | SKDP_DTK_SIZE 32 |
The device token key size (in bytes) for 256-bit security. | |
#define | SKDP_HASH_SIZE 32 |
The output size (in bytes) of the hash function for 256-bit security. | |
#define | SKDP_MACKEY_SIZE 32 |
The MAC key size (in bytes) for 256-bit security. | |
#define | SKDP_MACTAG_SIZE 32 |
The MAC tag size (in bytes) for 256-bit security. | |
#define | SKDP_MDK_SIZE 32 |
The master derivation key size (in bytes) for 256-bit security. | |
#define | SKDP_PERMUTATION_RATE QSC_KECCAK_256_RATE |
The rate at which Keccak processes data for 256-bit security. | |
#define | SKDP_SDK_SIZE 32 |
The server derivation key size (in bytes) for 256-bit security. | |
#define | SKDP_STK_SIZE 32 |
The session token key size (in bytes) for 256-bit security. | |
#define | SKDP_STH_SIZE 32 |
The session token hash size (in bytes) for 256-bit security. | |
#define | SKDP_STOK_SIZE 32 |
The session token size (in bytes) for 256-bit security. | |
#define | SKDP_EXCHANGE_MAX_MESSAGE_SIZE (SKDP_KID_SIZE + SKDP_CONFIG_SIZE + SKDP_STOK_SIZE + SKDP_HEADER_SIZE) |
The maximum message size used in the key exchange (exchange stage) for 256-bit security. | |
#define | SKDP_KEY_DURATION_DAYS 365 |
The number of days a key remains valid. | |
#define | SKDP_PACKET_TIME_THRESHOLD 60 |
The maximum number of seconds a packet is considered valid. | |
#define | SKDP_KEY_DURATION_SECONDS (SKDP_KEY_DURATION_DAYS * 24 * 60 * 60) |
The number of seconds a key remains valid. | |
#define | SKDP_DEVKEY_ENCODED_SIZE (SKDP_KID_SIZE + SKDP_DDK_SIZE + SKDP_EXP_SIZE) |
The size (in bytes) of the encoded device key. | |
#define | SKDP_MSTKEY_ENCODED_SIZE (SKDP_KID_SIZE + SKDP_MDK_SIZE + SKDP_EXP_SIZE) |
The size (in bytes) of the encoded master key. | |
#define | SKDP_SRVKEY_ENCODED_SIZE (SKDP_KID_SIZE + SKDP_SDK_SIZE + SKDP_EXP_SIZE) |
The size (in bytes) of the encoded server key. | |
#define | SKDP_CONNECT_REQUEST_MESSAGE_SIZE (SKDP_KID_SIZE + SKDP_CONFIG_SIZE + SKDP_STOK_SIZE) |
The size (in bytes) of the connection request message during the key exchange. | |
#define | SKDP_CONNECT_REQUEST_PACKET_SIZE (SKDP_CONNECT_REQUEST_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the connection request packet. | |
#define | SKDP_EXCHANGE_REQUEST_MESSAGE_SIZE (SKDP_DTK_SIZE + SKDP_MACKEY_SIZE) |
The size (in bytes) of the key exchange request message. | |
#define | SKDP_EXCHANGE_REQUEST_PACKET_SIZE (SKDP_EXCHANGE_REQUEST_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the key exchange request packet. | |
#define | SKDP_ESTABLISH_REQUEST_MESSAGE_SIZE (SKDP_STH_SIZE + SKDP_MACTAG_SIZE) |
The size (in bytes) of the establish request message. | |
#define | SKDP_ESTABLISH_REQUEST_PACKET_SIZE (SKDP_ESTABLISH_REQUEST_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the establish request packet. | |
#define | SKDP_CONNECT_RESPONSE_MESSAGE_SIZE (SKDP_KID_SIZE + SKDP_CONFIG_SIZE + SKDP_STOK_SIZE) |
The size (in bytes) of the connection response message. | |
#define | SKDP_CONNECT_RESPONSE_PACKET_SIZE (SKDP_CONNECT_RESPONSE_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the connection response packet. | |
#define | SKDP_EXCHANGE_RESPONSE_MESSAGE_SIZE (SKDP_DTK_SIZE + SKDP_MACKEY_SIZE) |
The size (in bytes) of the key exchange response message. | |
#define | SKDP_EXCHANGE_RESPONSE_PACKET_SIZE (SKDP_EXCHANGE_RESPONSE_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the key exchange response packet. | |
#define | SKDP_ESTABLISH_RESPONSE_MESSAGE_SIZE (SKDP_HASH_SIZE + SKDP_MACTAG_SIZE) |
The size (in bytes) of the establish response message. | |
#define | SKDP_ESTABLISH_RESPONSE_PACKET_SIZE (SKDP_ESTABLISH_RESPONSE_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the establish response packet. | |
#define | SKDP_ESTABLISH_VERIFY_MESSAGE_SIZE (SKDP_HASH_SIZE + SKDP_MACTAG_SIZE) |
The size (in bytes) of the establish verify message. | |
#define | SKDP_ESTABLISH_VERIFY_PACKET_SIZE (SKDP_ESTABLISH_VERIFY_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the establish verify packet. | |
Typedefs | |
typedef SKDP_EXPORT_API struct skdp_master_key | skdp_master_key |
typedef SKDP_EXPORT_API struct skdp_server_key | skdp_server_key |
typedef SKDP_EXPORT_API struct skdp_device_key | skdp_device_key |
typedef SKDP_EXPORT_API struct qsmp_keep_alive_state | skdp_keep_alive_state |
typedef SKDP_EXPORT_API struct skdp_network_packet | skdp_network_packet |
typedef SKDP_EXPORT_API enum skdp_errors | skdp_errors |
typedef SKDP_EXPORT_API enum skdp_flags | skdp_flags |
Functions | |
SKDP_EXPORT_API void | skdp_deserialize_device_key (skdp_device_key *dkey, const uint8_t input[SKDP_DEVKEY_ENCODED_SIZE]) |
Deserialize a client device key. | |
SKDP_EXPORT_API void | skdp_serialize_device_key (uint8_t output[SKDP_DEVKEY_ENCODED_SIZE], const skdp_device_key *dkey) |
Serialize a client device key. | |
SKDP_EXPORT_API void | skdp_deserialize_master_key (skdp_master_key *mkey, const uint8_t input[SKDP_MSTKEY_ENCODED_SIZE]) |
Deserialize a master key from a byte array. | |
SKDP_EXPORT_API void | skdp_serialize_master_key (uint8_t output[SKDP_MSTKEY_ENCODED_SIZE], const skdp_master_key *mkey) |
Serialize a master key into a byte array. | |
SKDP_EXPORT_API void | skdp_deserialize_server_key (skdp_server_key *skey, const uint8_t input[SKDP_SRVKEY_ENCODED_SIZE]) |
Deserialize a server key from a byte array. | |
SKDP_EXPORT_API void | skdp_serialize_server_key (uint8_t output[SKDP_SRVKEY_ENCODED_SIZE], const skdp_server_key *skey) |
Serialize a server key into a byte array. | |
SKDP_EXPORT_API bool | skdp_generate_master_key (skdp_master_key *mkey, const uint8_t kid[SKDP_KID_SIZE]) |
Generate a master key-set. | |
SKDP_EXPORT_API void | skdp_generate_server_key (skdp_server_key *skey, const skdp_master_key *mkey, const uint8_t kid[SKDP_KID_SIZE]) |
Generate a server key-set. | |
SKDP_EXPORT_API void | skdp_generate_device_key (skdp_device_key *dkey, const skdp_server_key *skey, const uint8_t kid[SKDP_KID_SIZE]) |
Generate a device key-set. | |
SKDP_EXPORT_API void | skdp_packet_clear (skdp_network_packet *packet) |
Clear a SKDP network packet. | |
SKDP_EXPORT_API const char * | skdp_error_to_string (skdp_errors error) |
Return a string description of an SKDP error code. | |
SKDP_EXPORT_API void | skdp_packet_header_deserialize (const uint8_t *header, skdp_network_packet *packet) |
Deserialize a byte array into a SKDP packet header. | |
SKDP_EXPORT_API void | skdp_packet_header_serialize (const skdp_network_packet *packet, uint8_t *header) |
Serialize a SKDP packet header into a byte array. | |
SKDP_EXPORT_API void | skdp_packet_set_utc_time (skdp_network_packet *packet) |
Set the local UTC seconds time in a SKDP packet header. | |
SKDP_EXPORT_API bool | skdp_packet_time_valid (const skdp_network_packet *packet) |
Check if a SKDP packet is received within the valid time threshold. | |
SKDP_EXPORT_API size_t | skdp_packet_to_stream (const skdp_network_packet *packet, uint8_t *pstream) |
Serialize a SKDP packet into a byte array. | |
SKDP_EXPORT_API void | skdp_stream_to_packet (const uint8_t *pstream, skdp_network_packet *packet) |
Deserialize a byte stream into a SKDP network packet. | |
The SKDP settings.
This header defines the configuration parameters, macros, and constants used in the Symmetric Key Distribution Protocol (SKDP). SKDP is designed to securely distribute symmetric keys between a master, server, device, and session while providing forward secrecy. The protocol employs ephemeral keys for each session, ensuring that even if a device or server key is compromised, past communications remain secure.
SKDP is structured into several phases:
In addition, this header defines sizes for configuration strings, error messages, expiration fields, packet headers, keepalive messages, and various key and identity fields, ensuring consistency across SKDP implementations.
#define SKDP_CONNECT_REQUEST_MESSAGE_SIZE (SKDP_KID_SIZE + SKDP_CONFIG_SIZE + SKDP_STOK_SIZE) |
The size (in bytes) of the connection request message during the key exchange.
This message includes the key identity, configuration string, and the session token, which is sent by the client to the server during the initial connection request.
#define SKDP_CONNECT_REQUEST_PACKET_SIZE (SKDP_CONNECT_REQUEST_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the connection request packet.
This value is the sum of the connection request message size and the SKDP packet header size.
#define SKDP_CONNECT_RESPONSE_PACKET_SIZE (SKDP_CONNECT_RESPONSE_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the connection response packet.
This value is the sum of the connection response message size and the SKDP packet header size.
#define SKDP_ESTABLISH_REQUEST_PACKET_SIZE (SKDP_ESTABLISH_REQUEST_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the establish request packet.
This value is the sum of the establish request message size and the SKDP packet header size.
#define SKDP_ESTABLISH_RESPONSE_PACKET_SIZE (SKDP_ESTABLISH_RESPONSE_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the establish response packet.
This value is the sum of the establish response message size and the SKDP packet header size.
#define SKDP_ESTABLISH_VERIFY_PACKET_SIZE (SKDP_ESTABLISH_VERIFY_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the establish verify packet.
This value is the sum of the establish verify message size and the SKDP packet header size.
#define SKDP_EXCHANGE_REQUEST_PACKET_SIZE (SKDP_EXCHANGE_REQUEST_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the key exchange request packet.
This value is the sum of the exchange request message size and the SKDP packet header size.
#define SKDP_EXCHANGE_RESPONSE_PACKET_SIZE (SKDP_EXCHANGE_RESPONSE_MESSAGE_SIZE + SKDP_HEADER_SIZE) |
The size (in bytes) of the key exchange response packet.
This value is the sum of the exchange response message size and the SKDP packet header size.
#define SKDP_PACKET_TIME_THRESHOLD 60 |
The maximum number of seconds a packet is considered valid.
On networks with a shared (NTP) time source, this may be set to as low as 1 second. On exterior networks, it should be adjusted (typically between 30 and 100 seconds) to account for clock differences.
#define SKDP_PROTOCOL_SEC256 |
The 256-bit security strength configuration flag.
enum skdp_errors |
The SKDP error values.
This enumeration defines the error codes returned by SKDP functions.
enum skdp_flags |
The SKDP packet flag values.
This enumeration defines the flag values used in SKDP packets to indicate the type and purpose of the packet.
SKDP_EXPORT_API void skdp_deserialize_device_key | ( | skdp_device_key * | dkey, |
const uint8_t | input[SKDP_DEVKEY_ENCODED_SIZE] ) |
Deserialize a client device key.
This function deserializes a byte array into a SKDP device key structure.
dkey | The output SKDP device key structure. |
input | The input serialized device key array of size SKDP_DEVKEY_ENCODED_SIZE . |
SKDP_EXPORT_API void skdp_deserialize_master_key | ( | skdp_master_key * | mkey, |
const uint8_t | input[SKDP_MSTKEY_ENCODED_SIZE] ) |
Deserialize a master key from a byte array.
This function deserializes a byte array into a SKDP master key structure.
mkey | The output SKDP master key structure. |
input | The input serialized master key array of size SKDP_MSTKEY_ENCODED_SIZE . |
SKDP_EXPORT_API void skdp_deserialize_server_key | ( | skdp_server_key * | skey, |
const uint8_t | input[SKDP_SRVKEY_ENCODED_SIZE] ) |
Deserialize a server key from a byte array.
This function deserializes a byte array into a SKDP server key structure.
skey | The output SKDP server key structure. |
input | The input serialized server key array of size SKDP_SRVKEY_ENCODED_SIZE . |
SKDP_EXPORT_API const char * skdp_error_to_string | ( | skdp_errors | error | ) |
Return a string description of an SKDP error code.
This function returns a human-readable string corresponding to the provided SKDP error code.
error | The SKDP error code. |
SKDP_EXPORT_API void skdp_generate_device_key | ( | skdp_device_key * | dkey, |
const skdp_server_key * | skey, | ||
const uint8_t | kid[SKDP_KID_SIZE] ) |
Generate a device key-set.
This function generates a new SKDP device key-set using the provided server key. It derives the device key from the server key and sets the key identity and expiration time.
dkey | A pointer to the SKDP device key structure. |
skey | [const] A pointer to the SKDP server key structure. |
kid | [const] The key identity string. |
SKDP_EXPORT_API bool skdp_generate_master_key | ( | skdp_master_key * | mkey, |
const uint8_t | kid[SKDP_KID_SIZE] ) |
Generate a master key-set.
This function generates a new SKDP master key-set. It populates the provided master key structure with a randomly generated master derivation key and the key identity, and sets the expiration time. The master key serves as the root from which branch keys are derived.
mkey | A pointer to the SKDP master key structure. |
kid | [const] The key identity string. |
SKDP_EXPORT_API void skdp_generate_server_key | ( | skdp_server_key * | skey, |
const skdp_master_key * | mkey, | ||
const uint8_t | kid[SKDP_KID_SIZE] ) |
Generate a server key-set.
This function generates a new SKDP server key-set based on the provided master key. It populates the server key structure with a derived server key and sets the key identity and expiration time.
skey | A pointer to the SKDP server key structure. |
mkey | [const] A pointer to the SKDP master key structure. |
kid | [const] The key identity string. |
SKDP_EXPORT_API void skdp_packet_clear | ( | skdp_network_packet * | packet | ) |
Clear a SKDP network packet.
This function resets the fields of a SKDP network packet to zero, effectively clearing its state.
packet | A pointer to the SKDP network packet to clear. |
SKDP_EXPORT_API void skdp_packet_header_deserialize | ( | const uint8_t * | header, |
skdp_network_packet * | packet ) |
Deserialize a byte array into a SKDP packet header.
This function converts a serialized byte array representing a SKDP packet header into a structured SKDP network packet.
header | A pointer to the input header byte array. |
packet | A pointer to the SKDP network packet structure to populate. |
SKDP_EXPORT_API void skdp_packet_header_serialize | ( | const skdp_network_packet * | packet, |
uint8_t * | header ) |
Serialize a SKDP packet header into a byte array.
This function converts a structured SKDP network packet header into a serialized byte array for transmission.
packet | A pointer to the SKDP network packet structure to serialize. |
header | The output header byte array. |
SKDP_EXPORT_API void skdp_packet_set_utc_time | ( | skdp_network_packet * | packet | ) |
Set the local UTC seconds time in a SKDP packet header.
This function updates the SKDP packet header with the current UTC time (in seconds).
packet | A pointer to the SKDP network packet structure. |
SKDP_EXPORT_API bool skdp_packet_time_valid | ( | const skdp_network_packet * | packet | ) |
Check if a SKDP packet is received within the valid time threshold.
This function compares the UTC time in the SKDP packet header against the local time to verify that the packet was received within the allowed time threshold.
packet | A pointer to the SKDP network packet structure. |
SKDP_EXPORT_API size_t skdp_packet_to_stream | ( | const skdp_network_packet * | packet, |
uint8_t * | pstream ) |
Serialize a SKDP packet into a byte array.
This function converts a SKDP network packet into a contiguous byte stream suitable for network transmission.
packet | A pointer to the SKDP network packet structure. |
pstream | The output byte stream buffer. |
SKDP_EXPORT_API void skdp_serialize_device_key | ( | uint8_t | output[SKDP_DEVKEY_ENCODED_SIZE], |
const skdp_device_key * | dkey ) |
Serialize a client device key.
This function serializes a SKDP device key structure into a byte array.
output | The output byte array to hold the serialized device key. |
dkey | The input SKDP device key structure. |
SKDP_EXPORT_API void skdp_serialize_master_key | ( | uint8_t | output[SKDP_MSTKEY_ENCODED_SIZE], |
const skdp_master_key * | mkey ) |
Serialize a master key into a byte array.
This function serializes a SKDP master key structure into a byte array.
output | The output byte array to hold the serialized master key. |
mkey | The input SKDP master key structure. |
SKDP_EXPORT_API void skdp_serialize_server_key | ( | uint8_t | output[SKDP_SRVKEY_ENCODED_SIZE], |
const skdp_server_key * | skey ) |
Serialize a server key into a byte array.
This function serializes a SKDP server key structure into a byte array.
output | The output byte array to hold the serialized server key. |
skey | The input SKDP server key structure. |
SKDP_EXPORT_API void skdp_stream_to_packet | ( | const uint8_t * | pstream, |
skdp_network_packet * | packet ) |
Deserialize a byte stream into a SKDP network packet.
This function converts a contiguous byte stream into a structured SKDP network packet.
pstream | A pointer to the input byte stream. |
packet | A pointer to the SKDP network packet structure to populate. |