Derive the per-query key for a resumed query from the resumption secret.
(
resume_secret: &[u8; 32],
client_magic: &[u8; 8],
client_nonce: &[u8],
ticket: &[u8],
)
| 163 | |
| 164 | /// Derive the per-query key for a resumed query from the resumption secret. |
| 165 | pub fn resumed_shared_key( |
| 166 | resume_secret: &[u8; 32], |
| 167 | client_magic: &[u8; 8], |
| 168 | client_nonce: &[u8], |
| 169 | ticket: &[u8], |
| 170 | ) -> SharedKey { |
| 171 | let mut salt = Vec::with_capacity(8 + client_nonce.len()); |
| 172 | salt.extend_from_slice(client_magic); |
| 173 | salt.extend_from_slice(client_nonce); |
| 174 | let mut info = Vec::with_capacity(27 + 32); |
| 175 | info.extend_from_slice(b"DNSCrypt-PQ-resumed-query-v1"); |
| 176 | info.extend_from_slice(&sha256(ticket)); |
| 177 | let mut key = [0u8; 32]; |
| 178 | hkdf_sha256(&salt, resume_secret, &info, &mut key); |
| 179 | SharedKey::from_bytes(key) |
| 180 | } |
| 181 | |
| 182 | /// A server-wide ticket key, identified by `id`. |
| 183 | #[derive(Clone)] |