Function ClientDeferred

control/controlbase/handshake.go:68–101

ClientDeferred initiates a control client handshake, returning the initial message to send to the server and a continuation to finalize the handshake. ClientDeferred is split in this way for RTT reduction: we run this protocol after negotiating a protocol switch from HTTP/HTTPS. If we completely se

(machineKey key.MachinePrivate, controlKey key.MachinePublic, protocolVersion uint16)

// message and a continuation, we can embed the handshake initiation
// into the HTTP protocol switching request and avoid a bit of delay.
func ClientDeferred(machineKey key.MachinePrivate, controlKey key.MachinePublic, protocolVersion uint16) (initialHandshake []byte, continueHandshake HandshakeContinuation, err error) {
	var s symmetricState
	s.Initialize()

	// prologue
	s.MixHash(protocolVersionPrologue(protocolVersion))

	// <- s
	// ...
	s.MixHash(controlKey.UntypedBytes())

	// -> e, es, s, ss
	init := mkInitiationMessage(protocolVersion)
	machineEphemeral := key.NewMachine()
	machineEphemeralPub := machineEphemeral.Public()
	copy(init.EphemeralPub(), machineEphemeralPub.UntypedBytes())
	s.MixHash(machineEphemeralPub.UntypedBytes())
	cipher, err := s.MixDH(machineEphemeral, controlKey)
	if err != nil {
		return nil, nil, fmt.Errorf("computing es: %w", err)
	}
	machineKeyPub := machineKey.Public()
	s.EncryptAndHash(cipher, init.MachinePub(), machineKeyPub.UntypedBytes())
	cipher, err = s.MixDH(machineKey, controlKey)
	if err != nil {
		return nil, nil, fmt.Errorf("computing ss: %w", err)
	}
	s.EncryptAndHash(cipher, init.Tag(), nil) // empty message payload

	cont := func(ctx context.Context, conn net.Conn) (*Conn, error) {
		return continueClientHandshake(ctx, conn, &s, machineKey, machineEphemeral, controlKey, protocolVersion)
	}
	return init[:], cont, nil
}

// Client wraps ClientDeferred and immediately invokes the returned
// continuation with conn.