modules encapsulate from each other

core/src/crypto/aead.rs

@@ -1,6 +1,6 @@
 use bytes::{Bytes, BytesMut};
 
-pub trait AeadPacker {
+pub(crate) trait AeadPacker {
     fn encrypt(&mut self, data: &mut BytesMut) -> Result<Bytes, chacha20poly1305::aead::Error>;
     fn decrypt(&mut self, data: &mut BytesMut) -> Result<Bytes, chacha20poly1305::aead::Error>;
 }

core/src/crypto/chacha.rs

@@ -3,8 +3,7 @@ use chacha20poly1305::aead::generic_array::GenericArray;
 use chacha20poly1305::{AeadInPlace, ChaCha20Poly1305, Key, KeyInit, Nonce};
 
 use crate::crypto::aead::AeadPacker;
-
-pub struct NonceState {
+struct NonceState {
     counter: u64,
     base_iv: [u8; 12],
 }
@@ -32,10 +31,10 @@ impl NonceState {
 }
 
 pub struct ChaChaCipher {
-    pub encrypt_cipher: ChaCha20Poly1305,
-    pub decrypt_cipher: ChaCha20Poly1305,
-    pub encrypt_state: NonceState,
-    pub decrypt_state: NonceState,
+    encrypt_cipher: ChaCha20Poly1305,
+    decrypt_cipher: ChaCha20Poly1305,
+    encrypt_state: NonceState,
+    decrypt_state: NonceState,
 }
 
 impl ChaChaCipher {

core/src/crypto/ecdh.rs

@@ -1,12 +1,12 @@
 use aead::OsRng;
 use x25519_dalek::{EphemeralSecret, PublicKey};
-pub struct ECDH {
+pub(crate) struct ECDH {
     pub public_key: PublicKey,
     pub private_key: Option<EphemeralSecret>,
 }
 
 impl ECDH {
-    pub fn new() -> Self {
+    pub(crate) fn new() -> Self {
         let secret = EphemeralSecret::random_from_rng(&mut OsRng);
         let public = PublicKey::from(&secret);
         Self {
@@ -15,7 +15,7 @@ impl ECDH {
         }
     }
 
-    pub fn get_shared(&mut self, public: &PublicKey) -> Option<[u8; 32]> {
+    pub(crate) fn get_shared(&mut self, public: &PublicKey) -> Option<[u8; 32]> {
         let private_key = self.private_key.take()?;
         let shared = private_key.diffie_hellman(&public);
         Some(*shared.as_bytes())

core/src/crypto/hkdf.rs

@@ -1,15 +1,15 @@
 use hkdf::Hkdf;
 use sha2::Sha256;
 
-pub struct HKDF;
+pub(crate) struct HKDF;
 
 impl HKDF {
-    pub fn extract_key(salt: &[u8], ikm: &[u8]) -> Hkdf<Sha256> {
+    pub(crate) fn extract_key(salt: &[u8], ikm: &[u8]) -> Hkdf<Sha256> {
         let extracted_key = Hkdf::<Sha256>::new(Some(salt), ikm);
         extracted_key
     }
 
-    pub fn expand_key<const N: usize>(
+    pub(crate) fn expand_key<const N: usize>(
         extracted_key: &Hkdf<Sha256>,
         mark: &[u8],
     ) -> Result<[u8; N], String> {

core/src/crypto/mod.rs

@@ -1,5 +1,9 @@
-pub mod aead;
-pub mod chacha;
+mod aead;
+mod chacha;
 mod ecdh;
 mod hkdf;
-pub mod session;
+mod session;
+
+pub(crate) use aead::AeadPacker;
+pub(crate) use chacha::ChaChaCipher;
+pub(crate) use session::SessionKeys;

core/src/crypto/session.rs

@@ -2,7 +2,7 @@ use x25519_dalek::PublicKey;
 
 use crate::{
     crypto::{ecdh::ECDH, hkdf::HKDF},
-    tlseng::extension::ExtensionStack,
+    tlseng::ExtensionStack,
 };
 
 use hmac::{Hmac, Mac};
@@ -12,14 +12,14 @@ type HmacSha256 = Hmac<Sha256>;
 
 use aead::{rand_core::RngCore, OsRng};
 
-pub struct SaltPair {
+pub(crate) struct SaltPair {
     local_salt: [u8; 32],
     remote_salt: [u8; 32],
     is_initiator: bool,
 }
 
 impl SaltPair {
-    pub fn new(is_initiator: bool) -> Self {
+    pub(crate) fn new(is_initiator: bool) -> Self {
         let mut local_salt = [0u8; 32];
         OsRng.fill_bytes(&mut local_salt);
         Self {
@@ -29,15 +29,15 @@ impl SaltPair {
         }
     }
 
-    pub fn get_local(&self) -> [u8; 32] {
+    pub(crate) fn get_local(&self) -> [u8; 32] {
         self.local_salt
     }
 
-    pub fn set_remote_salt(&mut self, salt: [u8; 32]) {
+    pub(crate) fn set_remote_salt(&mut self, salt: [u8; 32]) {
         self.remote_salt = salt
     }
 
-    pub fn get_total(&self) -> [u8; 64] {
+    pub(crate) fn get_total(&self) -> [u8; 64] {
         let mut salt = [0u8; 64];
         if self.is_initiator {
             salt[..32].copy_from_slice(&self.local_salt);
@@ -52,14 +52,14 @@ impl SaltPair {
 }
 
 pub struct SessionKeys {
-    pub salt: SaltPair,
-    pub ecdh: ECDH,
-    pub auth_key: [u8; 32],
-    pub current_aead: Option<([u8; 32], [u8; 12], [u8; 32], [u8; 12])>,
+    salt: SaltPair,
+    ecdh: ECDH,
+    auth_key: [u8; 32],
+    current_aead: Option<([u8; 32], [u8; 12], [u8; 32], [u8; 12])>,
 }
 
 impl SessionKeys {
-    pub fn new(is_initiator: bool) -> Self {
+    pub(crate) fn new(is_initiator: bool) -> Self {
         Self {
             salt: SaltPair::new(is_initiator),
             ecdh: ECDH::new(),
@@ -68,12 +68,12 @@ impl SessionKeys {
         }
     }
 
-    pub fn get_aead_parameters(&self) -> ([u8; 32], [u8; 12], [u8; 32], [u8; 12]) {
+    pub(crate) fn get_aead_parameters(&self) -> ([u8; 32], [u8; 12], [u8; 32], [u8; 12]) {
         self.current_aead
             .expect("Keys not generated yet. Call update_keys first.")
     }
 
-    pub fn update_keys(
+    pub(crate) fn update_keys(
         &mut self,
         salt: [u8; 32],
         extensions: &ExtensionStack,
@@ -176,7 +176,7 @@ impl SessionKeys {
         tag
     }
 
-    pub fn generate_auth_tag(&self) -> [u8; 16] {
+    pub(crate) fn generate_auth_tag(&self) -> [u8; 16] {
         let now = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)
             .unwrap()
@@ -185,7 +185,7 @@ impl SessionKeys {
         Self::compute_tag(&self.auth_key, now / 60)
     }
 
-    pub fn verify_auth_tag(&self, received_tag: &[u8; 16]) -> bool {
+    pub(crate) fn verify_auth_tag(&self, received_tag: &[u8; 16]) -> bool {
         let now = std::time::SystemTime::now()
             .duration_since(std::time::UNIX_EPOCH)
             .expect("Time went backwards")
@@ -208,4 +208,16 @@ impl SessionKeys {
         );
         false
     }
+
+    pub(crate) fn local_salt(&self) -> [u8; 32] {
+        self.salt.get_local()
+    }
+
+    pub(crate) fn public_key_bytes(&self) -> [u8; 32] {
+        self.ecdh.public_key.to_bytes()
+    }
+
+    pub(crate) fn auth_key_fingerprint(&self) -> String {
+        hex::encode(&self.auth_key[..4])
+    }
 }