Refactor + demo against updated spec by rocodes · Pull Request #164 · freedomofpress/securedrop-protocol

rocodes · 2026-01-28T21:12:43Z

Closes #140
Towards #115
Refs #138

(WIP, more explanation tk)

Refactor encrypt_decrypt.rs (single file benchmark impl) and merge with jen scaffold impl. Update scaffold tests.

Test Plan

CI
Visual review
? Code walkthrough
Feedback from n >= 1 fpf rustacean

mlkem, derive Copy for DHPublicKey. Refactor our key structs into typed() helper fn. bugfix: Fixup DH shared secret in primitives/x25519. Add test. bugfix: Fix mlkem768 deterministic_keygen seed size. Add from_bytes deterministic keygen fn.

…key. Refactor into new types. Add Api and (restricted) JournalistApi and implement. Remove source constructor without passphrase.

types, and Client, JournalistClient, and SourceClient (now handled by api.rs). Remove unused methods and structs from primitives.rs.

…Deprecate ServerMessageStore and use new wrapped wasm type for de/serializing hashmaps in wasm. Add uuid with js features as a dependency.

Avoid dyn User.

…repare for splitting into multiple files. Add passphrase function for source testing purposes.

server.rs: use primitives constant for number of fetch challenges

…and JournalistClient. Use new 0.3 functions.

rocodes · 2026-02-03T00:46:22Z

This is out of draft mode and feedback is welcome. There's a little more I'll do on the setup / core tests, so the goal is feedback, not merge :)

rocodes · 2026-02-03T17:18:10Z

securedrop-protocol/protocol-minimal/src/primitives/x25519.rs

 ) -> Result<DHSharedSecret, Error> {
    let mut shared_secret_bytes = [0u8; 32];
-    libcrux_curve25519::ecdh(&mut shared_secret_bytes, &private_scalar, &public_key.0)
+    ecdh(&mut shared_secret_bytes, &public_key.0, &private_scalar)


from https://docs.rs/libcrux-curve25519/latest/libcrux_curve25519/fn.ecdh.html, param order

pub fn ecdh( out: &mut [u8; 32], pk: &[u8; 32], sk: &[u8; 32], ) -> Result<(), Error>

cfm · 2026-02-03T23:49:07Z

securedrop-protocol/protocol-minimal/src/primitives/xwing.rs

    // Validate key sizes (XWING should have consistent sizes)
    if private_key_bytes.len() != XWING_PRIVATE_KEY_LEN
        || public_key_bytes.len() != XWING_PUBLIC_KEY_LEN
    {
        return Err(anyhow::anyhow!(
            "Unexpected XWING key sizes: private={}, public={}",
            private_key_bytes.len(),
            public_key_bytes.len()
        ));
    }


This kind of logic might be good low-hanging fruit for #154: i.e., proving—

private_key_bytes.len() == XWING_PRIVATE_KEY_LEN public_key_bytes.len() == XWING_PUBLIC_KEY_LEN

—as invariants of these typed() helpers that they can't violate. Likewise various sanity-checking assertions, if we can make them pre- and post-conditions on function boundaries.

I've started this in #167.

cfm · 2026-02-04T00:24:17Z

securedrop-protocol/protocol-minimal/src/server.rs

        request
-            .journalist_verifying_key
-            .verify(&signed_message, &bundle.signature)
+            .bundles
+            .iter()
+            .try_for_each(|k| request.vk.verify(&k.0.as_bytes(), &k.1.as_signature()))
            .map_err(|_| anyhow::anyhow!("Invalid signature on ephemeral keys"))?;

        // Store the ephemeral keys for the journalist
        self.storage
-            .add_ephemeral_keys(journalist_id, Vec::from([bundle]));


This is probably premature overengineering, but I'll mention it just for the sake of starting the discussion early and concretely: This codebase may be a good candidate for the typestate pattern, e.g. "only save keys whose signatures have been verified".

cfm · 2026-02-04T00:27:37Z

Exciting to see this! I've read through and left a few comments on possible typing and verifying patterns—more ideas for future reference than feedback per se.

securedrop_protocol_minimal::primitives::xwing::typed per <freedomofpress#164 (comment)>.

cfm · 2026-02-17T19:19:28Z

Discussed today: @rocodes will rebase this from main, and then I'll review it for merge. No reason not to land this and refine it incrementally.

securedrop_protocol_minimal::primitives::xwing::typed per <freedomofpress#164 (comment)>.

cfm · 2026-02-23T23:45:55Z

securedrop-protocol/protocol-minimal/src/api.rs

+/// Common client functionality for source and journalist clients
+pub trait Api {


I like this pattern, and I think it's a good foundation for exposing the source/journalist asymmetry at the API level. However, in #167 I've just discovered that hax's F* back end doesn't yet support it. We probably don't care for this module, which is high-level enough that we're unlikely to prove much of it in hax, but just FYI.

cfm · 2026-02-24T00:33:32Z

securedrop-protocol/protocol-minimal/src/types.rs

+    fn fetch_keypair(&self) -> (&DHPrivateKey, &DHPublicKey);
+    fn message_auth_keypair(&self) -> (&DhAkemPrivateKey, &DhAkemPublicKey);
+    fn build_message(&self, message: Vec<u8>) -> Plaintext;
+    fn keybundles(&self) -> impl Iterator<Item = &MessageKeyBundle>;


This (nice!) pattern crashes hax pending cryspen/hax#1965.

...and will not be supported. I imagine we very much will want proofs for our types, key bundles among them, and when we do we'll need to use a different pattern here. (But #164 takes an incremental approach precisely so that we can decide when—in this case, when the refactoring work will be worth the proving benefit.)

cfm

Approving after discussing with @redshiftzero—follow-up refinements welcome!

securedrop_protocol_minimal::primitives::xwing::typed per <freedomofpress#164 (comment)>.

cfm added this to SecureDrop Jan 28, 2026

cfm moved this to Ready For Review in SecureDrop Jan 28, 2026

cfm self-assigned this Jan 28, 2026

cfm self-requested a review January 28, 2026 22:15

cfm assigned rocodes Jan 28, 2026

cfm moved this from Ready For Review to In Progress in SecureDrop Jan 28, 2026

rocodes force-pushed the one-crab-to-rule-them-all branch from f4003f7 to 7713e14 Compare February 3, 2026 00:21

rocodes added 12 commits February 2, 2026 19:37

refactor: (WIP) split encrypt_decrypt into types

d9e0151

refactor: Use dh_keygen instead of random_scalar keygen for fetching …

0337365

…key. Refactor into new types. Add Api and (restricted) JournalistApi and implement. Remove source constructor without passphrase.

refactor: (WIP) encrypt_decrypt using new types

2b15fe0

refactor: Remove old journalist and source key types, v0.2 message

6142abd

types, and Client, JournalistClient, and SourceClient (now handled by api.rs). Remove unused methods and structs from primitives.rs.

benchmarks: Update benchmarks against new encrypt/decrypt and types. …

fff5e0e

…Deprecate ServerMessageStore and use new wrapped wasm type for de/serializing hashmaps in wasm. Add uuid with js features as a dependency.

refactor: use Plaintext instead of plaintext bytes in encrypt().

ea45089

Avoid dyn User.

types.rs: add SignedLongtermKeyBytes type, reorder items in file to p…

4d2d390

…repare for splitting into multiple files. Add passphrase function for source testing purposes.

sign.rs: implement copy

d32cafb

refactor: use 0.3 encrypt, decrypt in storage.rs and server.rs

6730938

server.rs: use primitives constant for number of fetch challenges

tests: refactor to use Source and Journalist instead of SourceClient …

a8e442f

…and JournalistClient. Use new 0.3 functions.

chore: Update cargo.lock

22a6846

rocodes force-pushed the one-crab-to-rule-them-all branch from 7713e14 to 22a6846 Compare February 3, 2026 00:38

rocodes changed the title ~~[wip] Refactor + demo against updated spec~~ Refactor + demo against updated spec Feb 3, 2026

rocodes marked this pull request as ready for review February 3, 2026 00:42

rocodes requested review from a team as code owners February 3, 2026 00:42

rocodes commented Feb 3, 2026

View reviewed changes

cfm reviewed Feb 3, 2026

View reviewed changes

cfm reviewed Feb 4, 2026

View reviewed changes

cfm removed their assignment Feb 4, 2026

cfm added a commit to cfm/securedrop-protocol that referenced this pull request Feb 14, 2026

chore(hax): extract a single function to start

c7086a7

securedrop_protocol_minimal::primitives::xwing::typed per <freedomofpress#164 (comment)>.

cfm mentioned this pull request Feb 14, 2026

proof: extract a single pattern to start #167

Merged

cfm added a commit to cfm/securedrop-protocol that referenced this pull request Feb 23, 2026

build(hax): extract a single function to start

03440f1

securedrop_protocol_minimal::primitives::xwing::typed per <freedomofpress#164 (comment)>.

cfm reviewed Feb 23, 2026

View reviewed changes

cfm reviewed Feb 24, 2026

View reviewed changes

cfm mentioned this pull request Feb 27, 2026

securedrop-protocol-minimal hax blockers #169

Open

Merge branch 'main' into one-crab-to-rule-them-all

c6fba1e

cfm approved these changes Feb 27, 2026

View reviewed changes

cfm added this pull request to the merge queue Feb 27, 2026

Merged via the queue into main with commit d53d8f4 Feb 27, 2026
16 checks passed

github-project-automation bot moved this from In Progress to Done in SecureDrop Feb 27, 2026

cfm mentioned this pull request Feb 27, 2026

proof: extract a single pattern to start #170

Merged

cfm added a commit to cfm/securedrop-protocol that referenced this pull request Feb 27, 2026

build(hax): extract a single function to start

e82d00a

securedrop_protocol_minimal::primitives::xwing::typed per <freedomofpress#164 (comment)>.

nathandyer removed this from SecureDrop Mar 2, 2026

redshiftzero mentioned this pull request Mar 8, 2026

refactor: reorganize types module #179

Open

		/// Common client functionality for source and journalist clients
		pub trait Api {

Conversation

rocodes commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rocodes commented Feb 3, 2026

Uh oh!

rocodes Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

cfm Feb 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cfm Feb 14, 2026

Choose a reason for hiding this comment

Uh oh!

cfm Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cfm commented Feb 4, 2026

Uh oh!

cfm commented Feb 17, 2026

Uh oh!

cfm Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cfm Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

cfm Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

cfm Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

cfm Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

cfm left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rocodes commented Jan 28, 2026 •

edited

Loading

cfm Feb 3, 2026 •

edited

Loading

cfm Feb 4, 2026 •

edited

Loading

cfm Feb 23, 2026 •

edited

Loading