Function decrypt_pq_ciphertext

src/dnscrypt.rs:141–191

Decrypt a PQ query that carries an X-Wing ciphertext, and prepare a freshly issued resumption ticket for the response.

(
    wrapped_packet: &[u8],
    params: &Arc<DNSCryptEncryptionParams>,
    pq_ticket_key: &pq::TicketKey,
)

/// Decrypt a PQ query that carries an X-Wing ciphertext, and prepare a
/// freshly issued resumption ticket for the response.
fn decrypt_pq_ciphertext(
    wrapped_packet: &[u8],
    params: &Arc<DNSCryptEncryptionParams>,
    pq_ticket_key: &pq::TicketKey,
) -> Result<(EncryptionParams, Vec<u8>), Error> {
    let pq_params = params.pq().ok_or_else(|| anyhow!("No PQ params"))?;
    let cm = DNSCRYPT_QUERY_MAGIC_SIZE;
    let ct_len = pq::XWING_CT_SIZE;
    let nonce_size = DNSCRYPT_QUERY_NONCE_SIZE;
    ensure!(
        wrapped_packet.len() >= cm + ct_len + nonce_size + DNSCRYPT_MAC_SIZE + DNS_HEADER_SIZE,
        "Short PQ query"
    );
    let mut client_magic = [0u8; 8];
    client_magic.copy_from_slice(&wrapped_packet[..cm]);
    let ct = &wrapped_packet[cm..cm + ct_len];
    let client_nonce = &wrapped_packet[cm + ct_len..cm + ct_len + nonce_size];
    let encrypted_packet = &wrapped_packet[cm + ct_len + nonce_size..];

    let kem_ss = pq_params.keypair().decapsulate(ct)?;
    let cert_ctx = pq_params.cert_context();
    let es_version = pq_params.es_version();
    let shared_key = pq::derive_shared_key(&kem_ss, &es_version, &client_magic, cert_ctx, ct);

    let mut nonce = [0u8; DNSCRYPT_FULL_NONCE_SIZE];
    nonce[..nonce_size].copy_from_slice(client_nonce);
    let packet = shared_key.decrypt(&nonce, encrypted_packet)?;

    let sk_bytes = *shared_key.as_raw_bytes();
    let rs = pq::resume_secret(&sk_bytes, &client_magic, client_nonce);
    let mut ticket_nonce = [0u8; pq::TICKET_NONCE_SIZE];
    rand::rng().fill_bytes(&mut ticket_nonce);
    let ticket_expiry = now().saturating_add(pq::PQ_TICKET_LIFETIME);
    let peh = pq_params.profile_extension_hash();
    let serial = pq_params.serial();
    let ts_end = pq_params.ts_end();
    let tp = pq::ticket_plain(&rs, &es_version, &client_magic, &serial, &ts_end, ticket_expiry, &peh);
    let ticket = pq::seal_ticket(pq_ticket_key, &ticket_nonce, &tp);
    let control = pq::control_block(pq::PQ_TICKET_LIFETIME, &ticket);
    debug!("PQ X-Wing query decapsulated; resumption ticket issued");

    rand::rng().fill_bytes(&mut nonce[nonce_size..]);
    Ok((
        EncryptionParams::Pq {
            shared_key,
            nonce,
            control,
        },
        packet,
    ))
}

/// Decrypt a resumed PQ query, validating its ticket and deriving the
/// per-query key without a KEM decapsulation.