secure: use HKDF for session key derivation

Use HKDF-based secure-session key derivation bound to the session transcript, full static peer public keys, ephemeral keys, protocol kind, and explicit secure-session versioning.

Includes focused tests for transcript consistency, key separation, full public key binding, and version mismatch handling. A final cleanup signs the secure-session version, restores the file header, and uses the standard library HKDF helper.

Note: the stable gate currently fails on the existing Linux workflow dependency gap for libXxf86vm; this PR intentionally leaves workflow changes out because the current token cannot merge workflow file updates.

Author: SonOfTroll

internal/secure/session.go

@@ -8,6 +8,7 @@ import (
 	"crypto/cipher"
 	"crypto/ecdh"
 	"crypto/ed25519"
+	"crypto/hkdf"
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
@@ -24,7 +25,10 @@ import (
 const maxHandshakeSize = 8 * 1024
 const maxChunkSize = 32 * 1024
 
+const sessionVersion = uint8(2)
+
 type hello struct {
+	Version   uint8  `json:"version"`
 	NodeID    string `json:"node_id"`
 	PublicKey string `json:"public_key"`
 	Ephemeral string `json:"ephemeral"`
@@ -74,6 +78,10 @@ func handshake(conn net.Conn, kind byte, id identity.Identity, initiator bool) (
 		return nil, err
 	}
 
+	if remoteHello.Version != sessionVersion {
+		return nil, fmt.Errorf("secure: peer uses session version %d, we require %d", remoteHello.Version, sessionVersion)
+	}
+
 	if !initiator {
 		if err := writeHello(conn, localHello); err != nil {
 			return nil, err
@@ -93,8 +101,21 @@ func handshake(conn net.Conn, kind byte, id identity.Identity, initiator bool) (
 		return nil, fmt.Errorf("derive shared key: %w", err)
 	}
 
-	key := sha256.Sum256(append(shared, kind))
-	block, err := aes.NewCipher(key[:])
+	localStaticPub := []byte(id.PublicKey)
+	remoteStaticPub, err := base64.StdEncoding.DecodeString(remoteHello.PublicKey)
+	if err != nil {
+		return nil, fmt.Errorf("decode remote static public key: %w", err)
+	}
+
+	localEph := priv.PublicKey().Bytes()
+	transcript := buildTranscript(kind, localEph, remoteEph, localStaticPub, remoteStaticPub, initiator)
+
+	key, err := deriveKey(shared, transcript)
+	if err != nil {
+		return nil, fmt.Errorf("derive session key: %w", err)
+	}
+
+	block, err := aes.NewCipher(key)
 	if err != nil {
 		return nil, fmt.Errorf("create cipher: %w", err)
 	}
@@ -119,6 +140,42 @@ func handshake(conn net.Conn, kind byte, id identity.Identity, initiator bool) (
 	return c, nil
 }
 
+func deriveKey(sharedSecret, transcript []byte) ([]byte, error) {
+	salt := sha256.Sum256(transcript)
+	key, err := hkdf.Key(sha256.New, sharedSecret, salt[:], "vx6-session-v2", 32)
+	if err != nil {
+		return nil, err
+	}
+	return key, nil
+}
+
+func buildTranscript(kind byte, localEph, remoteEph, localStaticPub, remoteStaticPub []byte, initiator bool) []byte {
+	var clientEph, serverEph, clientPub, serverPub []byte
+	if initiator {
+		clientEph = localEph
+		serverEph = remoteEph
+		clientPub = localStaticPub
+		serverPub = remoteStaticPub
+	} else {
+		clientEph = remoteEph
+		serverEph = localEph
+		clientPub = remoteStaticPub
+		serverPub = localStaticPub
+	}
+
+	var out []byte
+	out = append(out, []byte("vx6-transcript-v2\n")...)
+	out = append(out, kind)
+	out = append(out, '\n')
+	out = append(out, clientPub...)
+	out = append(out, '\n')
+	out = append(out, serverPub...)
+	out = append(out, '\n')
+	out = append(out, clientEph...)
+	out = append(out, serverEph...)
+	return out
+}
+
 func (c *Conn) LocalNodeID() string {
 	return c.localNodeID
 }
@@ -165,8 +222,9 @@ func (c *Conn) Write(p []byte) (int, error) {
 }
 
 func buildHello(id identity.Identity, kind byte, eph []byte) (hello, error) {
-	sig := ed25519.Sign(id.PrivateKey, signingPayload(kind, id.NodeID, eph))
+	sig := ed25519.Sign(id.PrivateKey, signingPayload(sessionVersion, kind, id.NodeID, eph))
 	return hello{
+		Version:   sessionVersion,
 		NodeID:    id.NodeID,
 		PublicKey: base64.StdEncoding.EncodeToString(id.PublicKey),
 		Ephemeral: base64.StdEncoding.EncodeToString(eph),
@@ -201,7 +259,7 @@ func readHello(r io.Reader, kind byte) (hello, error) {
 	if identity.NodeIDFromPublicKey(ed25519.PublicKey(pub)) != h.NodeID {
 		return hello{}, fmt.Errorf("handshake node id mismatch")
 	}
-	if !ed25519.Verify(ed25519.PublicKey(pub), signingPayload(kind, h.NodeID, eph), sig) {
+	if !ed25519.Verify(ed25519.PublicKey(pub), signingPayload(h.Version, kind, h.NodeID, eph), sig) {
 		return hello{}, fmt.Errorf("handshake signature verification failed")
 	}
 
@@ -224,9 +282,11 @@ func (h hello) ephemeralBytes() ([]byte, error) {
 	return eph, nil
 }
 
-func signingPayload(kind byte, nodeID string, eph []byte) []byte {
+func signingPayload(version uint8, kind byte, nodeID string, eph []byte) []byte {
 	var out []byte
 	out = append(out, []byte("vx6-secure\n")...)
+	out = append(out, version)
+	out = append(out, '\n')
 	out = append(out, kind)
 	out = append(out, '\n')
 	out = append(out, []byte(nodeID)...)

internal/secure/session_test.go

@@ -1,6 +1,8 @@
 package secure
 
 import (
+	"bytes"
+	"encoding/base64"
 	"io"
 	"net"
 	"testing"
@@ -104,3 +106,167 @@ func TestSessionExposesPeerIdentity(t *testing.T) {
 		}
 	}
 }
+
+func TestTranscriptCanonical(t *testing.T) {
+	t.Parallel()
+
+	idA, _ := identity.Generate()
+	idB, _ := identity.Generate()
+
+	ephA := make([]byte, 32)
+	ephB := make([]byte, 32)
+	for i := range ephA {
+		ephA[i] = byte(i)
+		ephB[i] = byte(i + 64)
+	}
+
+	fromA := buildTranscript(proto.KindServiceConn, ephA, ephB, []byte(idA.PublicKey), []byte(idB.PublicKey), true)
+	fromB := buildTranscript(proto.KindServiceConn, ephB, ephA, []byte(idB.PublicKey), []byte(idA.PublicKey), false)
+
+	if !bytes.Equal(fromA, fromB) {
+		t.Fatal("transcript not canonical: initiator and responder produced different transcripts")
+	}
+}
+
+func TestTranscriptKindSeparation(t *testing.T) {
+	t.Parallel()
+
+	idA, _ := identity.Generate()
+	idB, _ := identity.Generate()
+
+	ephA := make([]byte, 32)
+	ephB := make([]byte, 32)
+
+	t1 := buildTranscript(proto.KindServiceConn, ephA, ephB, []byte(idA.PublicKey), []byte(idB.PublicKey), true)
+	t2 := buildTranscript(proto.KindRendezvous, ephA, ephB, []byte(idA.PublicKey), []byte(idB.PublicKey), true)
+
+	if bytes.Equal(t1, t2) {
+		t.Fatal("different kind values produced identical transcripts")
+	}
+}
+
+func TestTranscriptIdentitySeparation(t *testing.T) {
+	t.Parallel()
+
+	idA, _ := identity.Generate()
+	idB, _ := identity.Generate()
+	idC, _ := identity.Generate()
+
+	eph := make([]byte, 32)
+
+	t1 := buildTranscript(proto.KindServiceConn, eph, eph, []byte(idA.PublicKey), []byte(idB.PublicKey), true)
+	t2 := buildTranscript(proto.KindServiceConn, eph, eph, []byte(idA.PublicKey), []byte(idC.PublicKey), true)
+
+	if bytes.Equal(t1, t2) {
+		t.Fatal("different peer identities produced identical transcripts")
+	}
+}
+
+func TestTranscriptEphemeralSeparation(t *testing.T) {
+	t.Parallel()
+
+	idA, _ := identity.Generate()
+	idB, _ := identity.Generate()
+
+	eph1 := make([]byte, 32)
+	eph2 := make([]byte, 32)
+	eph2[0] = 1
+
+	t1 := buildTranscript(proto.KindServiceConn, eph1, eph1, []byte(idA.PublicKey), []byte(idB.PublicKey), true)
+	t2 := buildTranscript(proto.KindServiceConn, eph2, eph2, []byte(idA.PublicKey), []byte(idB.PublicKey), true)
+
+	if bytes.Equal(t1, t2) {
+		t.Fatal("different ephemerals produced identical transcripts")
+	}
+}
+
+func TestTranscriptBindsFullPublicKey(t *testing.T) {
+	t.Parallel()
+
+	idA, _ := identity.Generate()
+	idB, _ := identity.Generate()
+
+	eph := make([]byte, 32)
+
+	transcript := buildTranscript(proto.KindServiceConn, eph, eph, []byte(idA.PublicKey), []byte(idB.PublicKey), true)
+
+	if !bytes.Contains(transcript, []byte(idA.PublicKey)) {
+		t.Fatal("transcript does not contain full client static public key")
+	}
+	if !bytes.Contains(transcript, []byte(idB.PublicKey)) {
+		t.Fatal("transcript does not contain full server static public key")
+	}
+
+	nodeIDBytes := []byte(idA.NodeID)
+	if bytes.Contains(transcript, nodeIDBytes) {
+		t.Fatal("transcript contains truncated node ID instead of full public key")
+	}
+}
+
+func TestDeriveKeyUnique(t *testing.T) {
+	t.Parallel()
+
+	shared := make([]byte, 32)
+	for i := range shared {
+		shared[i] = byte(i)
+	}
+
+	t1 := []byte("transcript-a")
+	t2 := []byte("transcript-b")
+
+	k1, err := deriveKey(shared, t1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	k2, err := deriveKey(shared, t2)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if bytes.Equal(k1, k2) {
+		t.Fatal("different transcripts derived identical keys")
+	}
+}
+
+func TestVersionMismatchFails(t *testing.T) {
+	t.Parallel()
+
+	clientID, _ := identity.Generate()
+	serverID, _ := identity.Generate()
+
+	left, right := net.Pipe()
+
+	errCh := make(chan error, 2)
+
+	go func() {
+		defer right.Close()
+		_, err := Server(right, proto.KindServiceConn, serverID)
+		errCh <- err
+	}()
+
+	go func() {
+		defer left.Close()
+		staleHello := hello{
+			Version:   sessionVersion - 1,
+			NodeID:    clientID.NodeID,
+			PublicKey: base64.StdEncoding.EncodeToString(clientID.PublicKey),
+			Ephemeral: base64.StdEncoding.EncodeToString(make([]byte, 32)),
+			Signature: base64.StdEncoding.EncodeToString(make([]byte, 64)),
+		}
+		if err := writeHello(left, staleHello); err != nil {
+			errCh <- err
+			return
+		}
+		errCh <- nil
+	}()
+
+	var gotErr error
+	for i := 0; i < 2; i++ {
+		if err := <-errCh; err != nil {
+			gotErr = err
+		}
+	}
+	if gotErr == nil {
+		t.Fatal("expected version mismatch error, got nil")
+	}
+}