mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-06 11:38:24 +00:00
Johnathan Corgan
b3119527d5
The initiator matches a rekey msg2 to its rekey by an index that the rekey msg1 carries in cleartext, so anyone on the path can answer first. A msg2 that did not authenticate, whose negotiation payload did not decrypt, or that carried a valid handshake under another static key made the initiator abandon the cycle, freeing its index and dropping the msg2 dispatch entry, so the peer's genuine msg2 was dropped and rotation could be suppressed for as long as the forgeries continued. complete_rekey_msg2 now reads msg2 with rollback, decrypts the payload and runs the static-key gate before it consumes the handshake, and restores the pre-read handshake when the read, the payload or the gate fails. Only an allowed install takes the handshake, writes msg3 and clears the msg1 resend state. handle_msg2 keeps the cycle, its index and its dispatch entry on a rejected or unreadable msg2, still counting them as rekey_static_mismatch and bad_state, and removes the dispatch entry only when the cycle installs or is abandoned. The msg1 resend budget still ends a cycle that never completes. The foreign-static test now expects the cycle kept and completes it with the responder's own msg2; new tests cover a msg2 that fails to authenticate, checked on both ends of the completed rekey, and one whose negotiation payload is corrupt.