Wire Protocol (version ½)


The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [RFC2119].

LLARP supports by default an authenticated and framed transport over UTP [1]

Handshake:

Alice establishes a UTP "connection" with Bob.

Alice sends a LIM a_L encrpyted with the initial b_K key

if Bob accepts Alice's router, Bob replies with a LIM b_L encrpyted with the
b_K key.

next the session keys are generated via:

a_h = HS(a_K + a_L.n)
b_h = HS(b_K + b_L.n)
a_K = TKE(A.p, B_a.e, sk, a_h)
b_K = TKE(A.p, B_a.e, sk, b_h)

A.tx_K = b_K
A.rx_K = a_K
B.tx_K = a_K
B.rx_K = B_K

the initial value of a_K is HS(A.k) and b_K is HS(B.k)

608 byte fragments are sent over UTP in an ordered fashion.

The each fragment F has the following structure:

[ 32 bytes blake2 keyed hash of the following 576 bytes (h)]
[ 32 bytes random nonce (n)]
[ 544 bytes encrypted payload (p)]

the recipiant verifies F.h == MDS(F.n + F.p, rx_K) and the UTP session 
is reset if verification fails.

the decrypted payload P has the following structure:

[ 24 bytes random (A) ]
[ big endian unsigned 32 bit message id (I) ]
[ big endian unsigned 16 bit fragment length (N) ]
[ big endian unsigned 16 bit fragment remaining bytes (R) ]
[ N bytes of plaintext payload (X) ]
[ trailing bytes discarded ]

link layer messages fragmented and delievered in any order the sender chooses.

recipaint ensures a buffer for message number P.I exists, allocating one if it
does not exist.

recipiant appends P.X to the end of the buffer for message P.I

if P.R is zero then message number P.I is completed and processed as a link
layer messages. otherwise the recipiant expects P.R additional bytes. 
P.R's value MUST decrease by P.N in the next fragment sent.

message size MUST NOT exceed 8192 bytes.

if a message is not received in 2 seconds it is discarded and any further
fragments for the message are also discarded.

P.I MUST have the initial value 0
P.I MUST be incremeneted by 1 for each new messsage transmitted
P.I MAY wrap around back to 0


after every fragment F the session key K is mutated via:

K = HS(K + P.A)

Periodically the connection initiator MUST renegotiate the session key by
sending a LIM after L.p milliseconds have elapsed.

If the local RC changes while a connection is established they MUST
renegotioate the session keys by sending a LIM to ensure the new RC is sent.


references:

[1] http://www.bittorrent.org/beps/bep_0029.html



