gnunet-service-core_kx.c

Go to the documentation of this file.

/*
     This file is part of GNUnet.
     Copyright (C) 2009-2013, 2016, 2024-2026 GNUnet e.V.
 
     GNUnet is free software: you can redistribute it and/or modify it
     under the terms of the GNU Affero General Public License as published
     by the Free Software Foundation, either version 3 of the License,
     or (at your option) any later version.
 
     GNUnet is distributed in the hope that it will be useful, but
     WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     Affero General Public License for more details.
 
     You should have received a copy of the GNU Affero General Public License
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
     SPDX-License-Identifier: AGPL3.0-or-later
 */
 
#include "platform.h"
#include "gnunet_common.h"
#include "gnunet_util_lib.h"
#include "gnunet-service-core_kx.h"
#include "gnunet_transport_core_service.h"
#include "gnunet-service-core_sessions.h"
#include "gnunet-service-core.h"
#include "gnunet_constants.h"
#include "gnunet_protocols.h"
#include "gnunet_pils_service.h"
 
#define DEBUG_KX 0
 
#define DECRYPTION_FAILURES_LOG_LEVEL GNUNET_ERROR_TYPE_DEBUG
 
#define RESEND_MAX_TRIES 5
 
#define AEAD_KEY_BYTES crypto_aead_xchacha20poly1305_ietf_KEYBYTES
 
#define AEAD_NONCE_BYTES crypto_aead_xchacha20poly1305_ietf_NPUBBYTES
 
#define AEAD_TAG_BYTES crypto_aead_xchacha20poly1305_ietf_ABYTES
 
#define RESEND_TIMEOUT \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 1)
 
#define RESEND_TIMEOUT_MAX \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 60)
 
#define REPLAY_WINDOW_SIZE 64
 
#define HEARTBEAT_PROBE_FREQUENCY \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 30)
 
#define MAX_UNANSWERED_HEARTBEATS 3
 
#define MIN_HEARTBEAT_FREQUENCY \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_SECONDS, 5)
 
#define HEARTBEAT_FREQUENCY \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 12)
 
#define MAX_EPOCHS 10
 
#define EPOCH_EXPIRATION \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_HOURS, 12)
 
#define REKEY_TOLERANCE \
        GNUNET_TIME_relative_multiply (GNUNET_TIME_UNIT_MINUTES, 5)
 
#define EARLY_DATA_STR "early data"
 
#define R_HS_TRAFFIC_STR "r hs traffic"
 
#define I_HS_TRAFFIC_STR "i hs traffic"
 
#define R_AP_TRAFFIC_STR "r ap traffic"
 
#define I_AP_TRAFFIC_STR "i ap traffic"
 
#define DERIVED_STR "derived"
 
#define R_FINISHED_STR "r finished"
 
#define I_FINISHED_STR "i finished"
 
#define CAKE_LABEL "cake10"
 
#define KEY_STR "key"
 
#define TRAFFIC_UPD_STR "traffic upd"
 
#define IV_STR "iv"
 
 
enum GSC_KX_Role
{
  /* Peer is supposed to initiate the key exchange */
  ROLE_INITIATOR = 0,
 
  /* Peer is supposed to wait for the key exchange */
  ROLE_RESPONDER = 1,
};
 
 
struct GSC_KeyExchangeInfo
{
  struct GSC_KeyExchangeInfo *next;
 
  struct GSC_KeyExchangeInfo *prev;
 
  struct GNUNET_PeerIdentity peer;
 
  struct GNUNET_MQ_Handle *mq;
 
  struct GNUNET_MQ_Envelope *resend_env;
 
  struct GNUNET_MessageStreamTokenizer *mst;
 
  // TODO check ordering - might make it less confusing
  // TODO consistent naming: ss_e, shared_secret_e or ephemeral_shared_secret?
  // TODO consider making all the structs here pointers
  //        - they can be checked to be NULL
  //        - valgrind can detect memory issues better (I guess?)
 
  enum GSC_KX_Role role;
 
  // TODO
  struct GNUNET_ShortHashCode ss_R;
  struct GNUNET_ShortHashCode ss_e;
  struct GNUNET_ShortHashCode ss_I;
 
  struct GNUNET_CRYPTO_HpkePrivateKey sk_e;
 
  struct GNUNET_CRYPTO_HpkePublicKey pk_e;
 
  struct GNUNET_HashCode ih_hash;
 
  struct GNUNET_HashCode rh_hash;
 
  struct GNUNET_HashContext *transcript_hash_ctx;
 
  struct GNUNET_ShortHashCode early_secret_key;
 
  struct GNUNET_ShortHashCode early_traffic_secret; /* Decrypts InitiatorHello */
 
  struct GNUNET_ShortHashCode handshake_secret;
 
  struct GNUNET_ShortHashCode rhts;
 
  struct GNUNET_ShortHashCode ihts;
 
  struct GNUNET_ShortHashCode master_secret;
 
  struct GNUNET_ShortHashCode current_ats;
 
  struct GNUNET_ShortHashCode their_ats[MAX_EPOCHS];
 
  uint64_t current_epoch;
 
  struct GNUNET_TIME_Absolute current_epoch_expiration;
 
  uint64_t their_max_epoch;
 
  uint64_t replay_max[MAX_EPOCHS];
 
  uint64_t replay_bitmap[MAX_EPOCHS];
 
  uint64_t current_sqn;
 
  struct GNUNET_TIME_Absolute timeout;
 
  struct GNUNET_TIME_Absolute last_notify_timeout;
 
  struct GNUNET_SCHEDULER_Task *resend_task;
 
  struct GNUNET_TIME_Relative resend_delay;
 
  unsigned int resend_tries_left;
 
  struct GNUNET_SCHEDULER_Task *heartbeat_task;
 
  unsigned int heartbeats_unanswered;
 
  int has_excess_bandwidth;
 
  int association_up;
 
  enum GNUNET_CORE_KxState status;
 
  enum GNUNET_CORE_PeerClass class;
 
};
 
static struct GNUNET_TRANSPORT_CoreHandle *transport;
 
static struct GSC_KeyExchangeInfo *kx_head;
 
static struct GSC_KeyExchangeInfo *kx_tail;
 
static struct GNUNET_SCHEDULER_Task *rekey_task;
 
static struct GNUNET_NotificationContext *nc;
 
static char *my_services_info = "";
 
static void
buffer_clear (void *buf, size_t len)
{
#if HAVE_MEMSET_S
  memset_s (buf, len, 0, len);
#elif HAVE_EXPLICIT_BZERO
  explicit_bzero (buf, len);
#else
  volatile unsigned char *p = buf;
  while (len--)
    *p++ = 0;
#endif
}
 
 
static void
cleanup_handshake_secrets (struct GSC_KeyExchangeInfo *kx)
{
  buffer_clear (&kx->ihts,
                sizeof kx->ihts);
  buffer_clear (&kx->rhts,
                sizeof kx->rhts);
  buffer_clear (&kx->sk_e,
                sizeof kx->sk_e);
  buffer_clear (&kx->ss_I,
                sizeof kx->ss_I);
  buffer_clear (&kx->ss_R,
                sizeof kx->ss_R);
  buffer_clear (&kx->ss_e,
                sizeof kx->ss_e);
  buffer_clear (&kx->master_secret,
                sizeof kx->master_secret);
  buffer_clear (&kx->early_secret_key,
                sizeof kx->early_secret_key);
  buffer_clear (&kx->early_traffic_secret,
                sizeof kx->early_traffic_secret);
  buffer_clear (&kx->handshake_secret,
                sizeof kx->handshake_secret);
}
 
 
static void
replay_reset (struct GSC_KeyExchangeInfo *kx,
              uint64_t epoch)
{
  kx->replay_max[epoch % MAX_EPOCHS] = 0;
  kx->replay_bitmap[epoch % MAX_EPOCHS] = 0;
}
 
 
static void
replay_reset_all (struct GSC_KeyExchangeInfo *kx)
{
  memset (kx->replay_max, 0, sizeof kx->replay_max);
  memset (kx->replay_bitmap, 0, sizeof kx->replay_bitmap);
}
 
 
static enum GNUNET_GenericReturnValue
replay_check (const struct GSC_KeyExchangeInfo *kx,
              uint64_t epoch,
              uint64_t sqn)
{
  unsigned int idx = epoch % MAX_EPOCHS;
  uint64_t max = kx->replay_max[idx];
  uint64_t behind;
 
  if (sqn > max)
    return GNUNET_OK;     /* to the right of the window */
  behind = max - sqn;
  if (behind >= REPLAY_WINDOW_SIZE)
    return GNUNET_SYSERR;     /* too old to tell, so assume replay */
  if (0 != (kx->replay_bitmap[idx] & (1ULL << behind)))
    return GNUNET_SYSERR;     /* seen before */
  return GNUNET_OK;
}
 
 
static void
replay_commit (struct GSC_KeyExchangeInfo *kx,
               uint64_t epoch,
               uint64_t sqn)
{
  unsigned int idx = epoch % MAX_EPOCHS;
  uint64_t max = kx->replay_max[idx];
  uint64_t shift;
 
  if (sqn > max)
  {
    shift = sqn - max;
    kx->replay_bitmap[idx] = (shift >= REPLAY_WINDOW_SIZE)
                             ? 0
                             : (kx->replay_bitmap[idx] << shift);
    kx->replay_bitmap[idx] |= 1ULL;
    kx->replay_max[idx] = sqn;
    return;
  }
  kx->replay_bitmap[idx] |= (1ULL << (max - sqn));
}
 
 
static void
snapshot_transcript (const struct GNUNET_HashContext *ts_hash,
                     struct GNUNET_HashCode *snapshot)
{
  struct GNUNET_HashContext *tmp;
 
  tmp = GNUNET_CRYPTO_hash_context_copy (ts_hash);
  GNUNET_CRYPTO_hash_context_finish (tmp, snapshot);
}
 
 
static void
monitor_notify_all (struct GSC_KeyExchangeInfo *kx)
{
  struct MonitorNotifyMessage msg;
 
  msg.header.type = htons (GNUNET_MESSAGE_TYPE_CORE_MONITOR_NOTIFY);
  msg.header.size = htons (sizeof(msg));
  msg.state = htonl ((uint32_t) kx->status);
  msg.peer = kx->peer;
  msg.timeout = GNUNET_TIME_absolute_hton (kx->timeout);
  GNUNET_notification_context_broadcast (nc, &msg.header, GNUNET_NO);
  kx->last_notify_timeout = kx->timeout;
}
 
 
static void
restart_kx (struct GSC_KeyExchangeInfo *kx);
 
static void
send_heartbeat (void *cls)
{
  struct GSC_KeyExchangeInfo *kx = cls;
  struct GNUNET_TIME_Relative retry;
  struct GNUNET_TIME_Relative left;
  struct Heartbeat hb;
 
  kx->heartbeat_task = NULL;
  left = GNUNET_TIME_absolute_get_remaining (kx->timeout);
  /* A heartbeat is a probe, not a formality: #handle_heartbeat() answers
     every one of them with an Ack, and that Ack is a record whose
     deprotection runs #update_timeout() and clears the counter below.  So
     #MAX_UNANSWERED_HEARTBEATS of them in a row without a single record
     coming back means the association is gone, whatever @e timeout still
     says.  Waiting for @e timeout regardless is what made a lost session
     cost #GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT (5 min) to notice -- and
     up to twice that to repair, because the peer that gives up first tears
     its session down silently and the other one then has to run its own
     full idle timeout before #restart_kx() gets a chance to re-run the
     exchange over the virtual link that was there the whole time. */
  if ((0 == left.rel_value_us) ||
      (kx->heartbeats_unanswered >= MAX_UNANSWERED_HEARTBEATS))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                "Session with `%s' timed out (%u heartbeats unanswered)\n",
                GNUNET_i2s (&kx->peer),
                kx->heartbeats_unanswered);
    GNUNET_STATISTICS_update (GSC_stats,
                              gettext_noop ("# sessions terminated by timeout"),
                              1,
                              GNUNET_NO);
    GSC_SESSIONS_end (&kx->peer);
    kx->status = GNUNET_CORE_KX_STATE_DOWN;
    monitor_notify_all (kx);
    restart_kx (kx);
    return;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Sending HEARTBEAT to `%s'\n",
              GNUNET_i2s (&kx->peer));
  GNUNET_STATISTICS_update (GSC_stats,
                            gettext_noop ("# heartbeat messages sent"),
                            1,
                            GNUNET_NO);
  hb.header.type =  htons (GNUNET_MESSAGE_TYPE_CORE_HEARTBEAT);
  hb.header.size = htons (sizeof hb);
  // FIXME when do we request update?
  hb.flags = 0;
  kx->heartbeats_unanswered++;
  GSC_KX_encrypt_and_transmit (kx, &hb, sizeof hb);
  if (GNUNET_YES != kx->association_up)
    return;     /* #check_rekey() tore it down and restarted the exchange */
  /* Do not let @e timeout stretch the probe interval: the point of the
     counter above is that the answer, not the clock, decides. */
  retry = GNUNET_TIME_relative_max (GNUNET_TIME_relative_min (
                                      HEARTBEAT_PROBE_FREQUENCY,
                                      left),
                                    MIN_HEARTBEAT_FREQUENCY);
  kx->heartbeat_task =
    GNUNET_SCHEDULER_add_delayed (retry, &send_heartbeat, kx);
}
 
 
static void
update_timeout (struct GSC_KeyExchangeInfo *kx)
{
  struct GNUNET_TIME_Relative delta;
 
  kx->timeout =
    GNUNET_TIME_relative_to_absolute (GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT);
  delta =
    GNUNET_TIME_absolute_get_difference (kx->last_notify_timeout, kx->timeout);
  if (delta.rel_value_us > 5LL * 1000LL * 1000LL)
  {
    /* we only notify monitors about timeout changes if those
       are bigger than the threshold (5s) */
    monitor_notify_all (kx);
  }
  /* The peer answered, so nothing is outstanding any more. */
  kx->heartbeats_unanswered = 0;
  if (NULL != kx->heartbeat_task)
    GNUNET_SCHEDULER_cancel (kx->heartbeat_task);
  /* Probe again #HEARTBEAT_PROBE_FREQUENCY after the last thing we heard,
     not halfway to @e timeout: an idle association that is fine costs one
     heartbeat and one Ack per interval, while one that is not is noticed
     within #MAX_UNANSWERED_HEARTBEATS intervals instead of after the full
     #GNUNET_CONSTANTS_IDLE_CONNECTION_TIMEOUT.  A link carrying traffic
     re-arms this on every record and so still never sends one. */
  kx->heartbeat_task = GNUNET_SCHEDULER_add_delayed (HEARTBEAT_PROBE_FREQUENCY,
                                                     &send_heartbeat,
                                                     kx);
}
 
 
static void
send_initiator_hello (struct GSC_KeyExchangeInfo *kx);
 
 
static int
deliver_message (void *cls, const struct GNUNET_MessageHeader *m)
{
  struct GSC_KeyExchangeInfo *kx = cls;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Decrypted message of type %d from %s\n",
              ntohs (m->type),
              GNUNET_i2s (&kx->peer));
  GSC_CLIENTS_deliver_message (&kx->peer,
                               m,
                               ntohs (m->size),
                               GNUNET_CORE_OPTION_SEND_FULL_INBOUND);
  GSC_CLIENTS_deliver_message (&kx->peer,
                               m,
                               sizeof(struct GNUNET_MessageHeader),
                               GNUNET_CORE_OPTION_SEND_HDR_INBOUND);
  return GNUNET_OK;
}
 
 
static void
schedule_resend (struct GSC_KeyExchangeInfo *kx,
                 GNUNET_SCHEDULER_TaskCallback cb)
{
  GNUNET_assert (NULL == kx->resend_task);
  kx->resend_task = GNUNET_SCHEDULER_add_delayed (kx->resend_delay, cb, kx);
  kx->resend_delay =
    GNUNET_TIME_relative_min (RESEND_TIMEOUT_MAX,
                              GNUNET_TIME_relative_multiply (kx->resend_delay,
                                                             2));
}
 
 
static void
start_resend (struct GSC_KeyExchangeInfo *kx,
              GNUNET_SCHEDULER_TaskCallback cb)
{
  kx->resend_tries_left = RESEND_MAX_TRIES;
  kx->resend_delay = RESEND_TIMEOUT;
  schedule_resend (kx, cb);
}
 
 
static void
reset_handshake (struct GSC_KeyExchangeInfo *kx)
{
  /* Any handshake message we were still resending belongs to the exchange
     we are abandoning here.  #send_initiator_hello() /
     #send_responder_hello() overwrite @e resend_env and @e resend_task
     without clearing them first, so without this the old envelope leaks
     and -- worse -- the old task keeps running with its handle lost: a
     second resend chain that no GNUNET_SCHEDULER_cancel() can reach, still
     firing on @a kx after #handle_transport_notify_disconnect() has freed
     it. */
  if (NULL != kx->resend_task)
  {
    GNUNET_SCHEDULER_cancel (kx->resend_task);
    kx->resend_task = NULL;
  }
  if (NULL != kx->resend_env)
  {
    GNUNET_MQ_discard (kx->resend_env);
    kx->resend_env = NULL;
  }
  if (NULL != kx->transcript_hash_ctx)
  {
    GNUNET_CRYPTO_hash_context_abort (kx->transcript_hash_ctx);
    kx->transcript_hash_ctx = NULL;
  }
  /* There is no flight to recognise a retransmission of any more. */
  memset (&kx->ih_hash, 0, sizeof (kx->ih_hash));
  memset (&kx->rh_hash, 0, sizeof (kx->rh_hash));
  cleanup_handshake_secrets (kx);
}
 
 
static void
abandon_exchange (struct GSC_KeyExchangeInfo *kx)
{
  reset_handshake (kx);
  GSC_SESSIONS_end (&kx->peer);
  kx->association_up = GNUNET_NO;
  /* An armed heartbeat task belongs to the association we are dropping
     here.  Left behind it keeps encrypting heartbeats with key material
     that is no longer current, and #handle_initiator_done() would find it
     still set. */
  if (NULL != kx->heartbeat_task)
  {
    GNUNET_SCHEDULER_cancel (kx->heartbeat_task);
    kx->heartbeat_task = NULL;
  }
  kx->heartbeats_unanswered = 0;
  /* A new association starts over at epoch 0 and sequence number 0.
     Carrying @e their_max_epoch of a long-lived predecessor into it makes
     #handle_encrypted_message() reject the first records of the new one as
     "too old", and a stale anti-replay window would reject them as
     replays. */
  kx->their_max_epoch = 0;
  kx->current_epoch = 0;
  kx->current_sqn = 0;
  replay_reset_all (kx);
  kx->status = GNUNET_CORE_KX_STATE_DOWN;
}
 
 
static void
restart_kx (struct GSC_KeyExchangeInfo *kx)
{
  const struct GNUNET_HashCode *my_identity_hash;
  struct GNUNET_HashCode h1;
 
  // TODO what happens if we're in the middle of a peer id change?
  // TODO there's a small chance this gets already called when we don't have a
  // peer id yet. Add a kx, insert into the list, mark it as to be completed
  // and let the callback to pils finish the rest once we got the peer id
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Initiating key exchange with peer %s\n",
              GNUNET_i2s (&kx->peer));
  GNUNET_STATISTICS_update (GSC_stats,
                            gettext_noop ("# key exchanges initiated"),
                            1,
                            GNUNET_NO);
 
  /* Whatever we still had -- an exchange in progress, an established
     session, an armed heartbeat -- does not survive this.  Drop it before
     telling monitors where we are, so that they do not see the state of the
     exchange we are leaving reported as if it were still current: that is
     why a restart from #GNUNET_CORE_KX_STATE_INITIATOR_HELLO_SENT used to
     show up as two consecutive "Hello sent (I)" notifications. */
  abandon_exchange (kx);
  monitor_notify_all (kx);
  my_identity_hash = GNUNET_PILS_get_identity_hash (GSC_pils);
  GNUNET_assert (NULL != my_identity_hash);
  GNUNET_CRYPTO_hash (&kx->peer, sizeof(struct GNUNET_PeerIdentity), &h1);
  if (0 < GNUNET_CRYPTO_hash_cmp (&h1, my_identity_hash))
  {
    /* peer with "lower" identity starts KX, otherwise we typically end up
       with both peers starting the exchange and transmit the 'set key'
       message twice */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "I am the initiator, sending hello\n");
    kx->role = ROLE_INITIATOR;
    send_initiator_hello (kx);
  }
  else
  {
    /* peer with "higher" identity starts a delayed KX, if the "lower" peer
     * does not start a KX since it sees no reasons to do so  */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "I am the responder, yielding and await initiator hello\n");
    kx->status = GNUNET_CORE_KX_STATE_AWAIT_INITIATION;
    kx->role = ROLE_RESPONDER;
    monitor_notify_all (kx);
  }
}
 
 
static void *
handle_transport_notify_connect (void *cls,
                                 const struct GNUNET_PeerIdentity *peer_id,
                                 struct GNUNET_MQ_Handle *mq)
{
  const struct GNUNET_PeerIdentity *my_identity;
  struct GSC_KeyExchangeInfo *kx;
  (void) cls;
  my_identity = GNUNET_PILS_get_identity (GSC_pils);
  GNUNET_assert (NULL != my_identity);
  if (0 == memcmp (peer_id, my_identity, sizeof *peer_id))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Ignoring connection to self\n");
    return NULL;
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Incoming connection of peer with %s\n",
              GNUNET_i2s (peer_id));
 
  /* Set up kx struct */
  kx = GNUNET_new (struct GSC_KeyExchangeInfo);
  kx->mst = GNUNET_MST_create (&deliver_message, kx);
  kx->mq = mq;
  GNUNET_memcpy (&kx->peer, peer_id, sizeof (struct GNUNET_PeerIdentity));
  GNUNET_CONTAINER_DLL_insert (kx_head, kx_tail, kx);
 
  restart_kx (kx);
  return kx;
}
 
 
// TODO find a way to assert that a key is not yet existing before generating
// TODO find a way to assert that a key is not already existing before using
/*
 * Derive early secret and transport secret.
 * @param kx the key exchange info
 */
static void
derive_es_ets (const struct GNUNET_HashCode *transcript,
               const struct GNUNET_ShortHashCode *ss_R,
               struct GNUNET_ShortHashCode *es,
               struct GNUNET_ShortHashCode *ets)
{
  uint64_t ret;
 
  ret = GNUNET_CRYPTO_hkdf_extract (es, // prk
                                    0,                     // salt
                                    0,                     // salt_len
                                    ss_R,  // ikm - initial key material
                                    sizeof (*ss_R));
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Something went wrong extracting ES\n")
    ;
    GNUNET_assert (0);
  }
  ret = GNUNET_CRYPTO_hkdf_expand (
    ets,
    sizeof (*ets),
    es,
    GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
    GNUNET_CRYPTO_kdf_arg_string (EARLY_DATA_STR),
    GNUNET_CRYPTO_kdf_arg_auto (transcript));
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Something went wrong expanding ETS\n")
    ;
    GNUNET_assert (0);
  }
}
 
 
/*
 * Derive early secret and transport secret.
 * @param kx the key exchange info
 */
static void
derive_sn (const struct GNUNET_ShortHashCode *secret,
           unsigned char*sn,
           size_t sn_len)
{
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CRYPTO_hkdf_expand (
                   sn,
                   sn_len,
                   secret,
                   GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
                   GNUNET_CRYPTO_kdf_arg_string ("sn")));
}
 
 
static void
derive_hs (const struct GNUNET_ShortHashCode *es,
           const struct GNUNET_ShortHashCode *ss_e,
           struct GNUNET_ShortHashCode *handshake_secret)
{
  uint64_t ret;
  struct GNUNET_ShortHashCode derived_early_secret;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Deriving HS\n");
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "ES: %s\n", GNUNET_B2S (es)
              );
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "ss_e: %s\n", GNUNET_B2S (ss_e));
  ret = GNUNET_CRYPTO_hkdf_expand (
    &derived_early_secret,
    sizeof (derived_early_secret),
    es,
    GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
    GNUNET_CRYPTO_kdf_arg_string (DERIVED_STR));
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "dES: %s\n", GNUNET_B2S (&
                                                                derived_early_secret));
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Something went wrong expanding dES\n")
    ;
    GNUNET_assert (0);
  }
  // Handshake secret
  // TODO check: are dES the salt and ss_e the ikm or other way round?
  ret = GNUNET_CRYPTO_hkdf_extract (handshake_secret,     // prk
                                    &derived_early_secret,         // salt - dES
                                    sizeof (derived_early_secret), // salt_len
                                    ss_e,          // ikm - initial key material
                                    sizeof (*ss_e));
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Something went wrong extracting HS\n")
    ;
    GNUNET_assert (0);
  }
}
 
 
static void
derive_ihts (const struct GNUNET_HashCode *transcript,
             const struct GNUNET_ShortHashCode *hs,
             struct GNUNET_ShortHashCode *ihts)
{
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CRYPTO_hkdf_expand (
                   ihts,                                           // result
                   sizeof (*ihts),                          // result len
                   hs,                          // prk?
                   GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
                   GNUNET_CRYPTO_kdf_arg_string (I_HS_TRAFFIC_STR),
                   GNUNET_CRYPTO_kdf_arg_auto  (transcript)));
}
 
 
static void
derive_rhts (const struct GNUNET_HashCode *transcript,
             const struct GNUNET_ShortHashCode *hs,
             struct GNUNET_ShortHashCode *rhts)
{
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CRYPTO_hkdf_expand (
                   rhts,
                   sizeof (*rhts),
                   hs,                          // prk? TODO
                   GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
                   GNUNET_CRYPTO_kdf_arg_string (R_HS_TRAFFIC_STR),
                   GNUNET_CRYPTO_kdf_arg_auto (transcript)));
}
 
 
static void
derive_ms (const struct GNUNET_ShortHashCode *hs,
           const struct GNUNET_ShortHashCode *ss_I,
           struct GNUNET_ShortHashCode *ms)
{
  uint64_t ret;
  struct GNUNET_ShortHashCode derived_handshake_secret;
 
  ret = GNUNET_CRYPTO_hkdf_expand (
    &derived_handshake_secret,
    sizeof (derived_handshake_secret),
    hs,
    GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
    GNUNET_CRYPTO_kdf_arg_string (DERIVED_STR));
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Something went wrong expanding dHS\n")
    ;
    GNUNET_assert (0);
  }
  // TODO check: are dHS the salt and ss_I the ikm or other way round?
  ret = GNUNET_CRYPTO_hkdf_extract (ms,            // prk
                                    &derived_handshake_secret,         // salt - dHS
                                    sizeof (derived_handshake_secret), // salt_len
                                    ss_I,              // ikm - initial key material
                                    sizeof (*ss_I));
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Something went wrong extracting MS\n")
    ;
    GNUNET_assert (0);
  }
}
 
 
static void
generate_per_record_nonce (
  uint64_t seq,
  const uint8_t write_iv[AEAD_NONCE_BYTES],
  uint8_t per_record_write_iv[AEAD_NONCE_BYTES])
{
  uint64_t seq_nbo;
  uint64_t *write_iv_ptr;
  unsigned int byte_offset;
 
  seq_nbo = GNUNET_htonll (seq);
  memcpy (per_record_write_iv,
          write_iv,
          AEAD_NONCE_BYTES);
  byte_offset =
    AEAD_NONCE_BYTES - sizeof (uint64_t);
  write_iv_ptr = (uint64_t*) (per_record_write_iv + byte_offset);
  *write_iv_ptr ^= seq_nbo;
}
 
 
static void
derive_per_message_secrets (
  const struct GNUNET_ShortHashCode *ts,
  uint64_t seq,
  unsigned char key[AEAD_KEY_BYTES],
  unsigned char nonce[AEAD_NONCE_BYTES])
{
  unsigned char nonce_tmp[AEAD_NONCE_BYTES];
  /* derive actual key */
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CRYPTO_hkdf_expand (
                   key,
                   AEAD_KEY_BYTES,
                   ts,
                   GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
                   GNUNET_CRYPTO_kdf_arg_string (KEY_STR)));
 
  /* derive nonce */
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CRYPTO_hkdf_expand (
                   nonce_tmp,
                   AEAD_NONCE_BYTES,
                   ts,
                   GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
                   GNUNET_CRYPTO_kdf_arg_string (IV_STR)));
  generate_per_record_nonce (seq,
                             nonce_tmp,
                             nonce);
}
 
 
static void
derive_next_ats (const struct GNUNET_ShortHashCode *old_ats,
                 struct GNUNET_ShortHashCode *new_ats)
{
  int8_t ret;
 
  // FIXME: Not sure of PRK and output may overlap here!
  ret = GNUNET_CRYPTO_hkdf_expand (
    new_ats,
    sizeof (*new_ats),
    old_ats,
    GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
    GNUNET_CRYPTO_kdf_arg_string (TRAFFIC_UPD_STR));
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Something went wrong deriving next *ATS key\n");
    GNUNET_assert (0);
  }
}
 
 
static void
derive_initial_ats (const struct GNUNET_HashCode *transcript,
                    const struct GNUNET_ShortHashCode *ms,
                    enum GSC_KX_Role role,
                    struct GNUNET_ShortHashCode *initial_ats)
{
  const char *traffic_str;
 
  if (ROLE_INITIATOR == role)
    traffic_str = I_AP_TRAFFIC_STR;
  else
    traffic_str = R_AP_TRAFFIC_STR;
  GNUNET_assert (GNUNET_OK ==
                 GNUNET_CRYPTO_hkdf_expand (
                   initial_ats,                                           // result
                   sizeof (*initial_ats),                          // result len
                   ms,
                   GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
                   GNUNET_CRYPTO_kdf_arg_string (traffic_str),
                   GNUNET_CRYPTO_kdf_arg_auto (transcript)));
}
 
 
static void
generate_responder_finished (const struct GNUNET_HashCode *transcript,
                             const struct GNUNET_ShortHashCode *ms,
                             struct GNUNET_HashCode *result)
{
  enum GNUNET_GenericReturnValue ret;
  struct GNUNET_CRYPTO_AuthKey fk_R; // We might want to save this in kx?
 
  ret = GNUNET_CRYPTO_hkdf_expand (
    &fk_R,                                // result
    sizeof (fk_R),
    ms,
    GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
    GNUNET_CRYPTO_kdf_arg_string (R_FINISHED_STR));
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Something went wrong expanding fk_R\n");
    GNUNET_assert (0);
  }
 
  GNUNET_CRYPTO_hmac (&fk_R,
                      transcript,
                      sizeof (*transcript),
                      result);
}
 
 
static void
generate_initiator_finished (const struct GNUNET_HashCode *transcript,
                             const struct GNUNET_ShortHashCode *ms,
                             struct GNUNET_HashCode *result)
{
  enum GNUNET_GenericReturnValue ret;
  struct GNUNET_CRYPTO_AuthKey fk_I; // We might want to save this in kx?
 
  ret = GNUNET_CRYPTO_hkdf_expand (
    &fk_I,                                      // result
    sizeof (fk_I),
    ms,
    GNUNET_CRYPTO_kdf_arg_string (CAKE_LABEL),
    GNUNET_CRYPTO_kdf_arg_string (I_FINISHED_STR));
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Something went wrong expanding fk_I\n");
    GNUNET_assert (0);
  }
  GNUNET_CRYPTO_hmac (&fk_I,
                      transcript,
                      sizeof (*transcript),
                      result);
}
 
 
static void
resend_responder_hello (void *cls)
{
  struct GSC_KeyExchangeInfo *kx = cls;
 
  kx->resend_task = NULL;
  if (0 == kx->resend_tries_left)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Restarting KX\n");
    restart_kx (kx);
    return;
  }
  kx->resend_tries_left--;
  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
              "Resending responder hello. Retries left: %u\n",
              kx->resend_tries_left);
  GNUNET_MQ_send_copy (kx->mq, kx->resend_env);
  schedule_resend (kx, &resend_responder_hello);
}
 
 
void
send_responder_hello (struct GSC_KeyExchangeInfo *kx)
{
  enum GNUNET_GenericReturnValue ret;
  struct GNUNET_CRYPTO_HpkeEncapsulation c_I;
  struct ResponderHello *rhm_e; /* responder hello message - encrypted pointer */
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_CRYPTO_HpkeEncapsulation ephemeral_kem_challenge;
  struct GNUNET_ShortHashCode rhts;
  struct GNUNET_ShortHashCode ihts;
  struct GNUNET_ShortHashCode hs;
  struct GNUNET_ShortHashCode ms;
  struct GNUNET_ShortHashCode ss_e;
  struct GNUNET_ShortHashCode ss_I;
  struct GNUNET_HashContext *hc;
  unsigned char enc_key[AEAD_KEY_BYTES];
  unsigned char enc_nonce[AEAD_NONCE_BYTES];
 
  //      4. encaps -> shared_secret_e, c_e (kemChallenge)
  //         TODO potentially write this directly into rhm?
  ret = GNUNET_CRYPTO_hpke_kem_encaps (&kx->pk_e, // public ephemeral key of initiator
                                       &ephemeral_kem_challenge,    // encapsulated key
                                       &ss_e); // key - ss_e
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Something went wrong encapsulating ss_e\n");
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  hc = GNUNET_CRYPTO_hash_context_copy (kx->transcript_hash_ctx);
  //      6. encaps -> shared_secret_I, c_I
  ret = GNUNET_CRYPTO_eddsa_kem_encaps (&kx->peer.public_key, // public key of I
                                        &c_I,                              // encapsulated key
                                        &ss_I);             // where to write the key material
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Something went wrong encapsulating ss_I\n");
    GNUNET_CRYPTO_hash_context_abort (hc);
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  //      7. generate RHTS (responder_handshare_secret_key) and RATS (responder_application_traffic_secret_key) (section 5)
  {
    struct GNUNET_HashCode transcript;
    snapshot_transcript (hc, &transcript);
#if DEBUG_KX
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Transcript snapshot for derivation of HS, MS: `%s'\n",
                GNUNET_h2s (&transcript));
#endif
    derive_hs (&kx->early_secret_key,
               &ss_e,
               &hs);
    derive_ms (&hs, &ss_I, &ms);
  }
 
  // send ResponderHello
  // TODO fill fields / services_info!
  // 1. r_R <- random
  struct ResponderHelloPayload *rhp;
  size_t rhp_len = sizeof (*rhp) + strlen (my_services_info);
  unsigned char rhp_buf[rhp_len];
  size_t ct_len;
 
  rhp = (struct ResponderHelloPayload*) rhp_buf;
  ct_len = rhp_len // ResponderHelloPayload, fist PT msg
           + sizeof (struct GNUNET_HashCode) // Finished hash, second PT msg
           + AEAD_TAG_BYTES * 2; // Two tags;
  env = GNUNET_MQ_msg_extra (rhm_e,
                             ct_len,
                             GNUNET_MESSAGE_TYPE_CORE_RESPONDER_HELLO);
 
  rhm_e->r_R =
    GNUNET_CRYPTO_random_u64 (UINT64_MAX);
 
  // c_e
  GNUNET_memcpy (&rhm_e->c_e,
                 &ephemeral_kem_challenge,
                 sizeof (ephemeral_kem_challenge));
  GNUNET_CRYPTO_hash_context_read (hc,
                                   rhm_e,
                                   sizeof (struct ResponderHello));
  // 2. Encrypt ServicesInfo and c_I with RHTS
  // derive RHTS
  {
    struct GNUNET_HashCode transcript;
    snapshot_transcript (hc,
                         &transcript);
#if DEBUG_KX
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Transcript snapshot for derivation of *HTS: `%s'\n",
                GNUNET_h2s (&transcript));
#endif
    derive_rhts (&transcript,
                 &hs,
                 &rhts);
    derive_ihts (&transcript,
                 &hs,
                 &ihts);
    derive_per_message_secrets (&rhts,
                                0,
                                enc_key,
                                enc_nonce);
  }
  // c_I
  GNUNET_memcpy (&rhp->c_I, &c_I, sizeof (c_I));
  // Services info empty for now.
  GNUNET_memcpy (&rhp[1],
                 my_services_info,
                 strlen (my_services_info));
 
  {
    unsigned long long out_ct_len;
    struct GNUNET_HashCode finished;
    struct GNUNET_HashCode transcript;
    unsigned char *finished_buf;
    GNUNET_assert (0 == crypto_aead_xchacha20poly1305_ietf_encrypt (
                     (unsigned char*) &rhm_e[1], /* c - ciphertext */
                     &out_ct_len, /* clen_p */
                     rhp_buf, /* rhm_p - plaintext message */
                     rhp_len, // mlen
                     NULL, 0, // ad, adlen // FIXME should this not be the other, unencrypted
                              // fields?
                     NULL, // nsec - unused
                     enc_nonce, // npub - nonce // FIXME nonce can be reused
                     enc_key)); // k - key RHTS
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Encrypted and wrote %llu bytes\n",
                out_ct_len);
    // 3. Create ResponderFinished (Section 6)
    // Derive fk_I <- HKDF-Expand (MS, "r finished", NULL)
    /* Forward the transcript */
    /* {svcinfo, c_I}RHTS */
    GNUNET_CRYPTO_hash_context_read (
      hc,
      &rhm_e[1],
      out_ct_len);
 
    finished_buf = ((unsigned char*) &rhm_e[1]) + out_ct_len;
    snapshot_transcript (hc,
                         &transcript);
#if DEBUG_KX
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Transcript snapshot for derivation of Rfinished: `%s'\n",
                GNUNET_h2s (&transcript));
#endif
    generate_responder_finished (&transcript,
                                 &ms,
                                 &finished);
    // 4. Encrypt ResponderFinished
    derive_per_message_secrets (&rhts,
                                1,
                                enc_key,
                                enc_nonce);
    GNUNET_assert (0 == crypto_aead_xchacha20poly1305_ietf_encrypt (
                     finished_buf,                               /* c - ciphertext */
                     &out_ct_len, /* clen_p */
                     (unsigned char*) &finished, /* rhm_p - plaintext message */
                     sizeof (finished), // mlen
                     NULL, 0, // ad, adlen // FIXME should this not be the other, unencrypted
                              // fields?
                     NULL, // nsec - unused
                     enc_nonce, // npub
                     enc_key)); // k - key RHTS
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Encrypted and wrote %llu bytes\n",
                out_ct_len);
    /* Forward the transcript
     * after responder finished,
     * before deriving *ATS and generating finished_I
     * (finished_I will be generated when receiving the InitiatorFinished message
     * in order to check it) */
    GNUNET_CRYPTO_hash_context_read (
      hc,
      finished_buf,
      out_ct_len);
    // 5. optionally send application data - encrypted with RATS
    // We do not really have any application data, instead, we send the ACK
    snapshot_transcript (hc,
                         &transcript);
#if DEBUG_KX
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Transcript snapshot for derivation of *ATS: `%s'\n",
                GNUNET_h2s (&transcript));
#endif
    derive_initial_ats (&transcript,
                        &ms,
                        ROLE_RESPONDER,
                        &kx->current_ats);
  }
  /* Lock into struct */
  GNUNET_CRYPTO_hash_context_abort (kx->transcript_hash_ctx);
  kx->transcript_hash_ctx = hc;
  kx->master_secret = ms;
  kx->handshake_secret = hs;
  kx->ss_e = ss_e;
  kx->ihts = ihts;
  kx->rhts = rhts;
  kx->ss_I = ss_I;
  kx->current_epoch = 0;
  kx->current_sqn = 0;
  derive_per_message_secrets (&kx->current_ats,
                              kx->current_sqn,
                              enc_key,
                              enc_nonce);
 
  GNUNET_MQ_send_copy (kx->mq, env);
  kx->resend_env = env;
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Sent ResponderHello: %d %d\n", kx->role,
              kx->status);
  start_resend (kx, &resend_responder_hello);
  kx->status = GNUNET_CORE_KX_STATE_RESPONDER_HELLO_SENT;
  monitor_notify_all (kx);
  GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
}
 
 
static void
handle_initiator_hello_cont (struct GSC_KeyExchangeInfo *kx,
                             const struct InitiatorHello *ihm_e,
                             const struct GNUNET_ShortHashCode *ss_R)
{
  const struct GNUNET_HashCode *my_identity_hash;
  uint32_t ihm_len = ntohs (ihm_e->header.size);
  unsigned char enc_key[AEAD_KEY_BYTES];
  unsigned char enc_nonce[AEAD_NONCE_BYTES];
  struct GNUNET_PeerIdentity peer_before = kx->peer;
  struct GNUNET_HashCode h1;
  struct GNUNET_HashCode transcript;
  struct GNUNET_ShortHashCode es;
  struct GNUNET_ShortHashCode ets;
  enum GNUNET_GenericReturnValue ret;
 
  GNUNET_memcpy (&kx->pk_e.ecdhe_key,
                 &ihm_e->pk_e,
                 sizeof (ihm_e->pk_e));
  //      5. generate ETS (early_traffic_secret_key, decrypt pk_i
  //         expand ETS <- expand ES <- extract ss_R
  //         use ETS to decrypt
 
  /* Forward the transcript hash context over the unencrypted fields to get it
   * to the same status that the initiator had when it needed to derive es and
   * ets for the encryption */
  GNUNET_CRYPTO_hash_context_read (
    kx->transcript_hash_ctx,
    ihm_e,
    sizeof (struct InitiatorHello));
  snapshot_transcript (kx->transcript_hash_ctx,
                       &transcript);
#if DEBUG_KX
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Transcript snapshot for derivation of ES, ETS: `%s'\n",
              GNUNET_h2s (&transcript));
#endif
  derive_es_ets (&transcript, ss_R, &es, &ets);
  derive_per_message_secrets (&ets,
                              0,
                              enc_key,
                              enc_nonce);
  {
    struct InitiatorHelloPayload *ihmp;
    size_t ct_len = ihm_len - sizeof (struct InitiatorHello);
    unsigned char ihmp_buf[ct_len - AEAD_TAG_BYTES];
    ihmp = (struct InitiatorHelloPayload*) ihmp_buf;
    ret = crypto_aead_xchacha20poly1305_ietf_decrypt (
      ihmp_buf,   // unsigned char *m
      NULL,                                      // mlen_p message length
      NULL,                                      // unsigned char *nsec       - unused: NULL
      (unsigned char*) &ihm_e[1],   // const unsigned char *c    - ciphertext
      ct_len,                                     // unsigned long long clen   - length of ciphertext
      // mac,                                   // const unsigned char *mac  - authentication tag
      NULL,                                      // const unsigned char *ad   - additional data (optional) TODO those should be used, right?
      0,                                         // unsigned long long adlen
      enc_nonce,      // const unsigned char *npub - nonce
      enc_key   // const unsigned char *k    - key
      );
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "pid_sender: %s\n",
                GNUNET_i2s (&ihmp->pk_I));
    if (0 != ret)
    {
      GNUNET_log (DECRYPTION_FAILURES_LOG_LEVEL,
                  "Something went wrong decrypting: %d\n", ret);
      GNUNET_break_op (0);
      GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
      restart_kx (kx);
      return;
    }
    /* now forward it considering the encrypted messages that the initiator was
     * able to send after deriving the es and ets */
    GNUNET_CRYPTO_hash_context_read (kx->transcript_hash_ctx,
                                     &ihm_e[1],
                                     ct_len);
    GNUNET_memcpy (&kx->peer,
                   &ihmp->pk_I,
                   sizeof (struct GNUNET_PeerIdentity));
  }
 
  /* @e pk_I is the initiator's *claim* about who it is, and nothing has
     checked it.  It must be the peer transport handed us this @a kx for:
     @e role was derived from that identity, GSC_SESSIONS_create() below
     keys the session on it, and transport routes everything we send by it.
     Letting the claim through means one peer can make us run a session
     under another peer's identity, and -- via the role comparison right
     below, which is computed over exactly this value -- can pick a @e pk_I
     that sends us down the reject path at will. */
  if (0 != GNUNET_memcmp (&kx->peer, &peer_before))
  {
    GNUNET_break_op (0);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "InitiatorHello from `%s' claims to be `%s'\n",
                GNUNET_i2s (&peer_before),
                GNUNET_i2s2 (&kx->peer));
    kx->peer = peer_before;
    GNUNET_CRYPTO_hash_context_abort (kx->transcript_hash_ctx);
    kx->transcript_hash_ctx = NULL;
    kx->status = GNUNET_CORE_KX_STATE_AWAIT_INITIATION;
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
 
  my_identity_hash = GNUNET_PILS_get_identity_hash (GSC_pils);
  GNUNET_assert (NULL != my_identity_hash);
 
  // We could follow with the rest of the Key Schedule (dES, HS, ...) for now
  /* Check that we are actually in the receiving role */
  GNUNET_CRYPTO_hash (&kx->peer, sizeof(struct GNUNET_PeerIdentity), &h1);
  if (0 < GNUNET_CRYPTO_hash_cmp (&h1, my_identity_hash))
  {
    /* peer with "lower" identity starts KX, otherwise we typically end up
       with both peers starting the exchange and transmit the 'set key'
       message twice */
    /* Something went wrong - we have the lower value and should have sent the
     * InitiatorHello, but instead received it. TODO handle this case
     * We might end up in this case if the initiator didn't initiate the
     * handshake long enough and the 'responder' initiates the handshake */
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Something went wrong - we have the lower value and should have sent the InitiatorHello, but instead received it.\n");
    GNUNET_CRYPTO_hash_context_abort (kx->transcript_hash_ctx);
    kx->transcript_hash_ctx = NULL;
    /* Same reason the three other reject paths in #handle_initiator_hello()
       do this: that function set @e status to INITIATOR_HELLO_RECEIVED
       before calling us, and leaving it there makes every *later* hello hit
       the "Already received InitiatorHello" guard and be dropped, forever.
       Rejecting this hello must not cost us the next one. */
    kx->status = GNUNET_CORE_KX_STATE_AWAIT_INITIATION;
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Peer ID of other peer: %s\n", GNUNET_i2s
                (&kx->peer));
  /* We update the monitoring peers here because now we know
   * that we can decrypt the message AND know the PID
   */
  monitor_notify_all (kx);
  kx->ss_R = *ss_R;
  kx->early_secret_key = es;
  kx->early_traffic_secret = ets;
  send_responder_hello (kx);
}
 
 
static int
check_initiator_hello (void *cls, const struct InitiatorHello *m)
{
  uint16_t size = ntohs (m->header.size);
 
  if (size < sizeof (*m)
      + sizeof (struct InitiatorHelloPayload)
      + AEAD_TAG_BYTES)
  {
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_initiator_hello (void *cls, const struct InitiatorHello *ihm_e)
{
  const struct GNUNET_HashCode *my_identity_hash;
  const struct GNUNET_CRYPTO_EddsaPrivateKey *my_private_key;
  struct GSC_KeyExchangeInfo *kx = cls;
  struct GNUNET_HashCode ih_hash;
  struct GNUNET_ShortHashCode ss_R;
  size_t ihm_len;
 
  ihm_len = ntohs (ihm_e->header.size);
  GNUNET_CRYPTO_hash (ihm_e,
                      ihm_len,
                      &ih_hash);
  if (ROLE_INITIATOR == kx->role)
  {
    GNUNET_break_op (0);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "I am an initiator! Tearing down...\n");
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  if (kx->status == GNUNET_CORE_KX_STATE_INITIATOR_HELLO_RECEIVED)
  {
    /* Now that the decapsulation is synchronous nothing can observe this
       state from the outside -- #handle_initiator_hello_cont() runs before
       we return.  Keep the guard anyway: reaching it means the state
       machine leaked a state, not that a peer did anything. */
    GNUNET_break (0);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Already received InitiatorHello: %d %d\n", kx->role, kx->status
                );
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  else if (kx->status > GNUNET_CORE_KX_STATE_INITIATOR_HELLO_RECEIVED)
  {
    if (0 == GNUNET_memcmp (&ih_hash,
                            &kx->ih_hash))
    {
      /* Not a new exchange at all: the initiator resent the very hello we
         are already answering, because our ResponderHello did not make it
         back in time (#resend_initiator_hello() sends a copy of the same
         envelope, so a retransmission is byte-identical).
 
         Starting over here is what breaks the pair.  A fresh
         #send_responder_hello() picks a new @e ss_e and feeds a new
         ResponderHello into the transcript, and the transcript is what both
         @e finished_R and @e finished_I are computed over.  The initiator
         answers whichever ResponderHello reaches it first and binds its
         InitiatorDone to *that* transcript, while we have moved on to the
         transcript of our latest one -- so #handle_initiator_done() cannot
         verify @e finished_I and drops it, every retransmission included.
         Neither side can make progress and neither side sees an error: the
         initiator sits in #GNUNET_CORE_KX_STATE_INITIATOR_DONE_SENT
         reporting "Unexpected ResponderHello", we sit in
         #GNUNET_CORE_KX_STATE_RESPONDER_HELLO_SENT, and both merely run out
         of retries after RESEND_MAX_TRIES and start over -- with no reason
         for the next attempt to be any luckier.  One InitiatorHello
         retransmission, which any hiccup on the path produces, is enough to
         lose the peer indefinitely.
 
         Retransmit our flight instead and leave the handshake state alone,
         per RFC 9147, Section 5.8: "implementations MUST retransmit their
         last flight in response to a retransmitted flight from the peer".
         Our own @e resend_task keeps its schedule; this only adds the
         answer the initiator is waiting for. */
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "InitiatorHello repeated by `%s' in state %d\n",
                  GNUNET_i2s (&kx->peer),
                  kx->status);
      GNUNET_STATISTICS_update (GSC_stats,
                                gettext_noop (
                                  "# InitiatorHello retransmissions received"),
                                1,
                                GNUNET_NO);
      if ((GNUNET_CORE_KX_STATE_RESPONDER_HELLO_SENT == kx->status) &&
          (NULL != kx->resend_env))
        GNUNET_MQ_send_copy (kx->mq,
                             kx->resend_env);
      /* Past that state the initiator already had our ResponderHello (we
         only leave it once @e finished_I verifies), so this is a duplicate
         that crossed with its InitiatorDone.  Nothing to answer, and
         nothing that may cost us the association we just built. */
      GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
      return;
    }
    /* The initiator has given up on whatever we still hold and started
       over.  Only the initiator drives this handshake, so follow it rather
       than dropping the hello.
       This used to return, which deadlocks the pair whenever we are in
       #GNUNET_CORE_KX_STATE_RESPONDER_CONNECTED: an InitiatorHello is not
       an EncryptedMessage and so does not refresh @e timeout, and nothing
       else ever leaves that state, so we would reject every retransmit
       until our own idle timeout fires -- five minutes during which the
       initiator restarts its exchange every 50s and we report the peer as
       connected.  In #GNUNET_CORE_KX_STATE_RESPONDER_HELLO_SENT it is a
       plain retransmit: the initiator resends precisely because it did not
       get our ResponderHello, and answering the hello it actually sent
       converges instead of leaving both sides to turn over on unrelated
       50s timers that need not ever re-phase.
 
       This is RFC 9147, Section 5.11: "In cases where a server believes it
       has an existing association [...] and it receives an epoch=0
       ClientHello, it SHOULD proceed with a new handshake but MUST NOT
       destroy the existing association until the client has demonstrated
       reachability [...] by completing a complete handshake including
       delivering a verifiable Finished message."
 
       So only the handshake state goes.  An InitiatorHello is not
       authenticated -- @e finished_I in the InitiatorDone is our Finished
       -- and must not be able to cost us an association on its own.  What
       we have keeps its traffic keys (@e association_up stays set, and the
       record layer keys off that rather than off @e status), its
       @e heartbeat_task and its @e timeout, and clients keep being told the
       peer is connected.  #handle_initiator_done() does the swap once, and
       only once, @e finished_I verifies.  If it never does, the old
       association dies of its own idle timeout exactly as it would have. */
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                "Peer `%s' restarted the key exchange in state %d, following\n",
                GNUNET_i2s (&kx->peer),
                kx->status);
    reset_handshake (kx);
  }
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received InitiatorHello: %d %d\n", kx->
              role, kx->status);
  GNUNET_assert (NULL == kx->transcript_hash_ctx);
  kx->transcript_hash_ctx = GNUNET_CRYPTO_hash_context_start ();
  GNUNET_assert (NULL != kx->transcript_hash_ctx);
 
  GNUNET_STATISTICS_update (GSC_stats,
                            gettext_noop ("# key exchanges initiated"),
                            1,
                            GNUNET_NO);
 
  kx->status = GNUNET_CORE_KX_STATE_INITIATOR_HELLO_RECEIVED;
 
  my_identity_hash = GNUNET_PILS_get_identity_hash (GSC_pils);
  GNUNET_assert (NULL != my_identity_hash);
 
  //      1. verify type _INITIATOR_HELLO
  //         - This is implicytly done by arriving within this handler
  //         - or is this about verifying the 'additional data' part of aead?
  //           should it check the encryption + mac? (is this implicitly done
  //           while decrypting?)
  //      2. verify H(pk_R) matches pk_R
  if (0 != memcmp (&ihm_e->h_pk_R,
                   my_identity_hash,
                   sizeof (struct GNUNET_HashCode)))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "This message is not meant for us (H(PID) mismatch)\n");
    GNUNET_CRYPTO_hash_context_abort (kx->transcript_hash_ctx);
    kx->transcript_hash_ctx = NULL;
    /* Leaving @e status at #GNUNET_CORE_KX_STATE_INITIATOR_HELLO_RECEIVED
       here wedges the kx: every later hello then hits the "already
       received" guard above and is dropped, forever. */
    kx->status = GNUNET_CORE_KX_STATE_AWAIT_INITIATION;
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  // FIXME this sometimes triggers in the tests - why?
  //      3. decaps -> shared_secret_R, c_R (kemChallenge)
  /* From here on this is the hello we answer, so a byte-identical one is a
     retransmission of it and must not restart the exchange. */
  kx->ih_hash = ih_hash;
  my_private_key = GNUNET_PILS_get_private_key (GSC_pils);
  if (NULL == my_private_key)
  {
    /* #GSC_KX_start() enables local key access before we ever talk to
       TRANSPORT, so this means the key on disk does not match the identity
       PILS announced.  We cannot answer any hello in that state. */
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "No private key for our peer identity, cannot answer hello"
                " from `%s'\n",
                GNUNET_i2s (&kx->peer));
    GNUNET_CRYPTO_hash_context_abort (kx->transcript_hash_ctx);
    kx->transcript_hash_ctx = NULL;
    kx->status = GNUNET_CORE_KX_STATE_AWAIT_INITIATION;
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  if (GNUNET_OK !=
      GNUNET_CRYPTO_eddsa_kem_decaps (my_private_key,
                                      &ihm_e->c_R,
                                      &ss_R))
  {
    GNUNET_break_op (0);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Failed to decapsulate c_R of hello from `%s'\n",
                GNUNET_i2s (&kx->peer));
    GNUNET_CRYPTO_hash_context_abort (kx->transcript_hash_ctx);
    kx->transcript_hash_ctx = NULL;
    kx->status = GNUNET_CORE_KX_STATE_AWAIT_INITIATION;
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  handle_initiator_hello_cont (kx,
                               ihm_e,
                               &ss_R);
}
 
 
struct ResponderHelloCls
{
  /* Current KX session */
  struct GSC_KeyExchangeInfo *kx;
 
  /* responder hello message - encrypted */
  struct ResponderHello rhm_e;
 
  /* responder hello message - plain/decrypted */
  struct ResponderHelloPayload *rhp;
 
  /* Decrypted finish hash */
  struct GNUNET_HashCode decrypted_finish;
 
  /* Encrypted finished CT (for transcript later) */
  char finished_enc[sizeof (struct GNUNET_HashCode)
                    + AEAD_TAG_BYTES];
 
  /* Temporary transcript context */
  struct GNUNET_HashContext *hc;
 
  /* Temporary handshake secret */
  struct GNUNET_ShortHashCode hs;
 
  /* Temporary handshake secret */
  struct GNUNET_ShortHashCode ss_e;
 
  /* Temporary handshake secret */
  struct GNUNET_ShortHashCode ihts;
 
  /* Temporary handshake secret */
  struct GNUNET_ShortHashCode rhts;
};
 
static void
resend_initiator_done (void *cls)
{
  struct GSC_KeyExchangeInfo *kx = cls;
 
  kx->resend_task = NULL;
  if (0 == kx->resend_tries_left)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Restarting KX\n");
    restart_kx (kx);
    return;
  }
  kx->resend_tries_left--;
  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
              "Resending initiator done. Retries left: %u\n",
              kx->resend_tries_left);
  GNUNET_MQ_send_copy (kx->mq, kx->resend_env);
  schedule_resend (kx, &resend_initiator_done);
}
 
 
static void
handle_responder_hello_cont (struct ResponderHelloCls *rh_ctx,
                             const struct GNUNET_ShortHashCode *ss_I)
{
  struct GSC_KeyExchangeInfo *kx = rh_ctx->kx;
  struct InitiatorDone *idm_e; /* encrypted */
  struct InitiatorDone idm_local;
  struct InitiatorDone *idm_p; /* plaintext */
  struct GNUNET_MQ_Envelope *env;
  unsigned char enc_key[AEAD_KEY_BYTES];
  unsigned char enc_nonce[AEAD_NONCE_BYTES];
  struct ConfirmationAck ack_i;
  struct GNUNET_HashCode transcript;
  struct GNUNET_ShortHashCode ms;
 
  // XXX valgrind reports uninitialized memory
  //     the following is a way to check whether this memory was meant
  // memset (&rhm_local, 0, sizeof (rhm_local)); - adapt to cls if still needed
  memset (&idm_local, 0, sizeof (idm_local));
 
  kx->ss_I = *ss_I;
 
  /* derive *ATS */
  derive_ms (&rh_ctx->hs, ss_I, &ms);;
  // 5. Create ResponderFinished as per Section 6 and check against decrypted payload.
  struct GNUNET_HashCode responder_finished;
  // Transcript updates, snapshot again
  snapshot_transcript (rh_ctx->hc,
                       &transcript);
#if DEBUG_KX
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Transcript snapshot for derivation of Rfinished: `%s'\n",
              GNUNET_h2s (&transcript));
#endif
  generate_responder_finished (&transcript,
                               &ms,
                               &responder_finished);
  if (0 != memcmp (&rh_ctx->decrypted_finish,
                   &responder_finished,
                   sizeof (struct GNUNET_HashCode)))
  {
    /* A peer that answers our InitiatorHello with a ResponderHello whose
       finished field does not verify must not be able to abort us; this
       used to be a GNUNET_assert (0). */
    GNUNET_break_op (0);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Could not verify \"responder finished\" from `%s'\n",
                GNUNET_i2s (&kx->peer));
    GNUNET_free (rh_ctx->rhp);
    GNUNET_CRYPTO_hash_context_abort (rh_ctx->hc);
    GNUNET_free (rh_ctx);
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    restart_kx (kx);
    return;
  }
 
 
  /* Forward the transcript
   * after generating finished_R,
   * before deriving *ATS */
  GNUNET_CRYPTO_hash_context_read (
    rh_ctx->hc,
    rh_ctx->finished_enc,
    sizeof (rh_ctx->finished_enc));
 
  // At this point we cannot fail anymore and may lock into kx
  GNUNET_CRYPTO_hash_context_abort (kx->transcript_hash_ctx);
  kx->transcript_hash_ctx = rh_ctx->hc;
  kx->ss_I = *ss_I;
  kx->handshake_secret = rh_ctx->hs;
  kx->ss_e = rh_ctx->ss_e;
  kx->ihts = rh_ctx->ihts;
  kx->rhts = rh_ctx->rhts;
  kx->master_secret = ms;
  GNUNET_free (rh_ctx->rhp);
  GNUNET_free (rh_ctx);
  rh_ctx = NULL;
 
  snapshot_transcript (kx->transcript_hash_ctx,
                       &transcript);
#if DEBUG_KX
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Transcript snapshot for derivation of *ATS: `%s'\n",
              GNUNET_h2s (&transcript));
#endif
  derive_initial_ats (&transcript,
                      &kx->master_secret,
                      ROLE_RESPONDER,
                      &kx->their_ats[0]);
  for (int i = 0; i < MAX_EPOCHS - 1; i++)
  {
    derive_next_ats (&kx->their_ats[i],
                     &kx->their_ats[i + 1]);
  }
  kx->their_max_epoch = MAX_EPOCHS - 1;
 
  derive_per_message_secrets (&kx->ihts,
                              0,
                              enc_key,
                              enc_nonce);
  /* Create InitiatorDone message */
  idm_p = &idm_local; /* plaintext */
  env = GNUNET_MQ_msg_extra (idm_e,
                             sizeof (ack_i)
                             + AEAD_TAG_BYTES,
                             GNUNET_MESSAGE_TYPE_CORE_INITIATOR_DONE);
  // 6. Create IteratorFinished as per Section 6.
  generate_initiator_finished (&transcript,
                               &kx->master_secret,
                               &idm_p->finished);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "InteratorFinished: `%s'\n",
              GNUNET_h2s (&idm_p->finished));
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Transcript `%s'\n",
              GNUNET_h2s (&transcript));
  // 7. Send InteratorFinished message encrypted with the key derived from IHTS to R
 
  GNUNET_assert (0 == crypto_aead_xchacha20poly1305_ietf_encrypt (
                   (unsigned char*) &idm_e->finished, /* c - ciphertext */
                   NULL, /* clen_p */
                   (unsigned char*) &idm_p->finished, /* idm_p - plaintext message */
                   sizeof (idm_p->finished), // mlen
                   NULL, 0, // ad, adlen // FIXME should this not be the other, unencrypted
                            // fields?
                   NULL, // nsec - unused
                   enc_nonce, // npub - nonce
                   enc_key)); // k - key IHTS
  /* Forward the transcript hash context
   * after generating finished_I and RATS_0
   * before deriving IATS_0 */
  GNUNET_CRYPTO_hash_context_read (kx->transcript_hash_ctx,
                                   &idm_e->finished,
                                   sizeof (idm_e->finished)
                                   + AEAD_TAG_BYTES);
  snapshot_transcript (kx->transcript_hash_ctx,
                       &transcript);
#if DEBUG_KX
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Transcript snapshot for derivation of *ATS: `%s'\n",
              GNUNET_h2s (&transcript));
#endif
  derive_initial_ats (&transcript,
                      &kx->master_secret,
                      ROLE_INITIATOR,
                      &kx->current_ats);
  kx->current_epoch = 0;
  kx->current_sqn = 0;
  /* We start sending under this epoch here, so it has to be dated here too.
     #check_if_ack_or_heartbeat() only sets @e current_epoch_expiration once
     the responder's Ack arrives; until then it holds whatever the previous
     association left (zero for a first exchange), and #check_rekey() treats
     a past expiration as "rekey now".  Anything we send while waiting for
     the Ack -- the Ack we answer an early heartbeat with, say -- would then
     burn an epoch the responder has no reason to expect. */
  kx->current_epoch_expiration =
    GNUNET_TIME_relative_to_absolute (EPOCH_EXPIRATION);
  /* Application traffic keys are installed, so from the record layer's
     point of view the association exists from here: we have to be able to
     deprotect the responder's Ack, which arrives before the handshake is
     confirmed.  The client-visible session is created only once it does. */
  replay_reset_all (kx);
  kx->association_up = GNUNET_YES;
  // 8. optionally encrypt payload TODO
  derive_per_message_secrets (&kx->current_ats,
                              kx->current_sqn,
                              enc_key,
                              enc_nonce);
  kx->current_sqn++;
  ack_i.header.type = htons (GNUNET_MESSAGE_TYPE_CORE_ACK);
  ack_i.header.size = htons (sizeof ack_i);
  GNUNET_assert (0 == crypto_aead_xchacha20poly1305_ietf_encrypt (
                   (unsigned char*) &idm_e[1], /* c - ciphertext */
                   NULL, /* clen_p */
                   (unsigned char*) &ack_i, /* rhm_p - plaintext message */
                   sizeof ack_i, // mlen
                   NULL, 0, // ad, adlen // FIXME should this not be the other, unencrypted
                            // fields?
                   NULL, // nsec - unused
                   enc_nonce, // npub - nonce // FIXME nonce can be reused
                   enc_key)); // k - key RHTS
 
  GNUNET_MQ_send_copy (kx->mq, env);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Sent InitiatorDone: %d %d\n", kx->role,
              kx->status);
 
 
  kx->resend_env = env;
  start_resend (kx, &resend_initiator_done);
  kx->status = GNUNET_CORE_KX_STATE_INITIATOR_DONE_SENT;
  monitor_notify_all (kx);
  GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
}
 
 
static int
check_responder_hello (void *cls, const struct ResponderHello *m)
{
  uint16_t size = ntohs (m->header.size);
 
  if (size < sizeof (*m)
      + sizeof (struct ResponderHelloPayload)
      + sizeof (struct GNUNET_HashCode)
      + AEAD_TAG_BYTES * 2)
  {
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_responder_hello (void *cls, const struct ResponderHello *rhm_e)
{
  struct GSC_KeyExchangeInfo *kx = cls;
  const struct GNUNET_CRYPTO_EddsaPrivateKey *my_private_key;
  struct ResponderHelloCls *rh_ctx;
  struct GNUNET_HashCode transcript;
  struct GNUNET_HashCode rh_hash;
  struct GNUNET_HashContext *hc;
  struct GNUNET_ShortHashCode ss_I;
  unsigned char enc_key[AEAD_KEY_BYTES];
  unsigned char enc_nonce[AEAD_NONCE_BYTES];
  enum GNUNET_GenericReturnValue ret;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received ResponderHello: %d %d\n", kx->
              role, kx->status);
 
  GNUNET_CRYPTO_hash (rhm_e,
                      ntohs (rhm_e->header.size),
                      &rh_hash);
  if (ROLE_RESPONDER == kx->role)
  {
    GNUNET_break_op (0);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "I am the responder! Ignoring.\n");
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  if (GNUNET_CORE_KX_STATE_INITIATOR_HELLO_SENT != kx->status)
  {
    if ((GNUNET_CORE_KX_STATE_INITIATOR_DONE_SENT == kx->status) &&
        (0 == GNUNET_memcmp (&rh_hash,
                             &kx->rh_hash)))
    {
      /* The responder resent the ResponderHello we already answered, which
         means our InitiatorDone did not reach it.  That is an ordinary
         retransmission, not a protocol violation -- the GNUNET_break_op()
         below used to report it as one, which is what "Unexpected
         ResponderHello in state 6" in the logs is.  Answer it the way
         RFC 9147, Section 5.8 requires: "implementations MUST retransmit
         their last flight in response to a retransmitted flight from the
         peer".  Our @e resend_task would get there on its own eventually;
         doing it here converges at the pace of the peer's timer instead of
         ours, and both are bounded by RESEND_MAX_TRIES. */
      GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                  "ResponderHello repeated by `%s', resending InitiatorDone\n",
                  GNUNET_i2s (&kx->peer));
      GNUNET_STATISTICS_update (GSC_stats,
                                gettext_noop (
                                  "# ResponderHello retransmissions received"),
                                1,
                                GNUNET_NO);
      if (NULL != kx->resend_env)
        GNUNET_MQ_send_copy (kx->mq,
                             kx->resend_env);
      GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
      return;
    }
    /* Outside of that state there is no handshake this message could
       belong to.  In particular @e transcript_hash_ctx is then NULL, and
       #GNUNET_CRYPTO_hash_context_copy() dereferences its argument -- so
       a peer could crash us by sending a ResponderHello at any other
       time.  Note that @e resend_task and @e resend_env below belong to
       the exchange we *are* in the middle of and must not be cleared
       before this point either. */
    GNUNET_break_op (0);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Unexpected ResponderHello in state %d, ignoring\n",
                kx->status);
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  /* From here on this is the hello we answer; recognising a retransmission
     of it is what lets us resend our InitiatorDone above instead of
     dropping the peer's flight on the floor. */
  kx->rh_hash = rh_hash;
  GNUNET_assert (NULL != kx->transcript_hash_ctx);
  hc = GNUNET_CRYPTO_hash_context_copy (kx->transcript_hash_ctx);
  if (NULL != kx->resend_task)
  {
    GNUNET_SCHEDULER_cancel (kx->resend_task);
    kx->resend_task = NULL;
  }
  if (NULL != kx->resend_env)
  {
    GNUNET_MQ_discard (kx->resend_env);
    kx->resend_env = NULL;
  }
 
  /* Forward the transcript hash context */
  GNUNET_CRYPTO_hash_context_read (hc,
                                   rhm_e,
                                   sizeof (struct ResponderHello));
  // 1. Verify that the message type is CORE_RESPONDER_HELLO
  //    - implicitly done by handling this message?
  //    - or is this about verifying the 'additional data' part of aead?
  //      should it check the encryption + mac? (is this implicitly done
  //      while decrypting?)
  // 2. sse <- Decaps(ske,ce)
  rh_ctx = GNUNET_new (struct ResponderHelloCls);
  ret = GNUNET_CRYPTO_hpke_kem_decaps (&kx->sk_e, // secret/private ephemeral key of initiator (us)
                                       &rhm_e->c_e,    // encapsulated key
                                       &rh_ctx->ss_e); // key - ss_e
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Something went wrong decapsulating ss_e\n");
    GNUNET_CRYPTO_hash_context_abort (hc);
    GNUNET_free (rh_ctx);
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  // 3. Generate IHTS and RHTS from Section 5 and decrypt ServicesInfo, cI and ResponderFinished.
  snapshot_transcript (hc, &transcript);
#if DEBUG_KX
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Transcript snapshot for derivation of HS, *HTS: `%s'\n",
              GNUNET_h2s (&transcript));
#endif
  derive_hs (&kx->early_secret_key,
             &rh_ctx->ss_e,
             &rh_ctx->hs);
  derive_rhts (&transcript,
               &rh_ctx->hs,
               &rh_ctx->rhts);
  derive_ihts (&transcript,
               &rh_ctx->hs,
               &rh_ctx->ihts);
  derive_per_message_secrets (&rh_ctx->rhts,
                              0,
                              enc_key,
                              enc_nonce);
  rh_ctx->kx = kx;
  GNUNET_memcpy (&rh_ctx->rhm_e, rhm_e, sizeof (*rhm_e));
  {
    unsigned long long int c_len;
    unsigned char *finished_buf;
    // use RHTS to decrypt
    c_len = ntohs (rhm_e->header.size) - sizeof (*rhm_e)
            - sizeof (struct GNUNET_HashCode)
            - AEAD_TAG_BYTES;                                   // finished ct
    rh_ctx->rhp = GNUNET_malloc (c_len
                                 -
                                 AEAD_TAG_BYTES);
    rh_ctx->hc = hc;
    finished_buf = ((unsigned char*) &rhm_e[1]) + c_len;
    /* Forward the transcript_hash_ctx
     * after rhts has been generated,
     * before generating finished_R*/
    GNUNET_CRYPTO_hash_context_read (
      hc,
      &rhm_e[1],
      c_len);
 
    ret = crypto_aead_xchacha20poly1305_ietf_decrypt (
      (unsigned char*) rh_ctx->rhp,   // unsigned char *m
      NULL,                                     // mlen_p message length
      NULL,                                     // unsigned char *nsec       - unused: NULL
      (unsigned char*) &rhm_e[1],   // const unsigned char *c    - ciphertext
      c_len,                                    // unsigned long long clen   - length of ciphertext
      NULL,                                     // const unsigned char *ad   - additional data (optional) TODO those should be used, right?
      0,                                        // unsigned long long adlen
      enc_nonce,     // const unsigned char *npub - nonce
      enc_key   // const unsigned char *k    - key
      );
    if (0 != ret)
    {
      GNUNET_log (DECRYPTION_FAILURES_LOG_LEVEL,
                  "Something went wrong decrypting: %d\n", ret);
      GNUNET_free (rh_ctx->rhp);
      GNUNET_free (rh_ctx);
      GNUNET_CRYPTO_hash_context_abort (hc);
      GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
      return;
    }
    // FIXME nonce reuse (see encryption)
    derive_per_message_secrets (&rh_ctx->rhts,
                                1,
                                enc_key,
                                enc_nonce);
    c_len = sizeof (struct GNUNET_HashCode)
            + AEAD_TAG_BYTES;
    ret = crypto_aead_xchacha20poly1305_ietf_decrypt (
      (unsigned char*) &rh_ctx->decrypted_finish,   // unsigned char *m
      NULL,                                // mlen_p message length
      NULL,                                // unsigned char *nsec       - unused: NULL
      finished_buf,   // const unsigned char *c    - ciphertext
      c_len,                               // unsigned long long clen   - length of ciphertext
      NULL,                                // const unsigned char *ad   - additional data (optional) TODO those should be used, right?
      0,                                   // unsigned long long adlen
      enc_nonce,   // const unsigned char *npub - nonce
      enc_key   // const unsigned char *k    - key
      );
    if (0 != ret)
    {
      GNUNET_log (DECRYPTION_FAILURES_LOG_LEVEL,
                  "Something went wrong decrypting finished field: %d\n", ret);
      GNUNET_free (rh_ctx->rhp);
      GNUNET_free (rh_ctx);
      GNUNET_CRYPTO_hash_context_abort (hc);
      GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
      return;
    }
    GNUNET_memcpy (rh_ctx->finished_enc,
                   finished_buf,
                   c_len);
  }
  // 4. ssI <- Decaps(skI,cI).
  my_private_key = GNUNET_PILS_get_private_key (GSC_pils);
  if ( (NULL == my_private_key) ||
       (GNUNET_OK !=
        GNUNET_CRYPTO_eddsa_kem_decaps (my_private_key,
                                        &rh_ctx->rhp->c_I,
                                        &ss_I)) )
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Failed to decapsulate c_I of ResponderHello from `%s'\n",
                GNUNET_i2s (&kx->peer));
    GNUNET_free (rh_ctx->rhp);
    GNUNET_free (rh_ctx);
    GNUNET_CRYPTO_hash_context_abort (hc);
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    restart_kx (kx);
    return;
  }
  handle_responder_hello_cont (rh_ctx,
                               &ss_I);
}
 
 
static int
check_initiator_done (void *cls, const struct InitiatorDone *m)
{
  uint16_t size = ntohs (m->header.size);
 
  if (size < sizeof (*m) + sizeof (struct ConfirmationAck))
  {
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_initiator_done (void *cls, const struct InitiatorDone *idm_e)
{
  struct GSC_KeyExchangeInfo *kx = cls;
  struct InitiatorDone idm_local;
  struct InitiatorDone *idm_p = &idm_local; /* plaintext */
  struct GNUNET_HashCode initiator_finished;
  struct GNUNET_HashCode transcript;
  struct GNUNET_ShortHashCode their_ats;
  struct GNUNET_HashContext *hc;
  unsigned char enc_key[AEAD_KEY_BYTES];
  unsigned char enc_nonce[AEAD_NONCE_BYTES];
  struct ConfirmationAck ack_i;
  struct ConfirmationAck ack_r;
  int8_t ret;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Received InitiatorDone: %d %d\n", kx->
              role, kx->status);
  if (ROLE_INITIATOR == kx->role)
  {
    GNUNET_break_op (0);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "I am the initiator! Tearing down...\n");
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  if (GNUNET_CORE_KX_STATE_RESPONDER_CONNECTED == kx->status)
  {
    /* The initiator did not see our ConfirmationAck and is resending (it
       tries #RESEND_MAX_TRIES times).  Our handshake secrets are gone --
       #cleanup_handshake_secrets() zeroed @e ihts -- so verifying this
       message again is not possible and would only look like a decryption
       failure.  Send what the initiator is actually missing instead. */
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "InitiatorDone repeated by `%s', resending our Ack\n",
                GNUNET_i2s (&kx->peer));
    ack_r.header.type = htons (GNUNET_MESSAGE_TYPE_CORE_ACK);
    ack_r.header.size = htons (sizeof ack_r);
    GSC_KX_encrypt_and_transmit (kx,
                                 &ack_r,
                                 sizeof ack_r);
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  if (GNUNET_CORE_KX_STATE_RESPONDER_HELLO_SENT != kx->status)
  {
    /* We have no handshake state this message could be checked against.
       Note that @e resend_task and @e resend_env below belong to whatever
       exchange we *are* in the middle of, so they must not be cleared
       before this point. */
    GNUNET_break_op (0);
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Unexpected InitiatorDone in state %d, ignoring\n",
                kx->status);
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  if (NULL != kx->resend_task)
  {
    GNUNET_SCHEDULER_cancel (kx->resend_task);
    kx->resend_task = NULL;
  }
  if (NULL != kx->resend_env)
  {
    GNUNET_MQ_discard (kx->resend_env);
    kx->resend_env = NULL;
  }
  derive_per_message_secrets (&kx->ihts,
                              0,
                              enc_key,
                              enc_nonce);
  ret = crypto_aead_xchacha20poly1305_ietf_decrypt (
    (unsigned char*) &idm_p->finished,     // unsigned char *m
    NULL,                                  // mlen_p message length
    NULL,                                  // unsigned char *nsec       - unused: NULL
    (unsigned char*) &idm_e->finished,     // const unsigned char *c    - ciphertext
    sizeof (idm_p->finished)               // unsigned long long clen   - length of ciphertext
    + AEAD_TAG_BYTES,
    NULL,                                  // const unsigned char *ad   - additional data (optional) TODO those should be used, right?
    0,                                     // unsigned long long adlen
    enc_nonce,     // const unsigned char *npub - nonce
    enc_key     // const unsigned char *k    - key
    );
  if (0 != ret)
  {
    GNUNET_log (DECRYPTION_FAILURES_LOG_LEVEL,
                "Something went wrong decrypting: %d\n", ret);
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
 
  //      - verify finished_I
  /* Generate finished_I
   * after Forwarding until {finished_R}RHTS
   *   (did so while we prepared responder hello)
   * before forwarding to [{payload}RATS and] {finished_I}IHTS */
  // (look at the end of handle_initiator_hello())
  snapshot_transcript (kx->transcript_hash_ctx, &transcript);
  generate_initiator_finished (&transcript,
                               &kx->master_secret,
                               &initiator_finished);
  if (0 != memcmp (&idm_p->finished,
                   &initiator_finished,
                   sizeof (struct GNUNET_HashCode)))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Could not verify \"initiator finished\" hash.\n");
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Want: `%s'\n",
                GNUNET_h2s (&initiator_finished));
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Have: `%s'\n",
                GNUNET_h2s (&idm_p->finished));
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Transcript `%s'\n",
                GNUNET_h2s (&transcript));
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
 
  /* Forward the transcript hash_context_read */
  hc = GNUNET_CRYPTO_hash_context_copy (kx->transcript_hash_ctx);
  GNUNET_CRYPTO_hash_context_read (hc,
                                   &idm_e->finished,
                                   sizeof (idm_e->finished)
                                   + AEAD_TAG_BYTES);
  snapshot_transcript (hc, &transcript);
  derive_initial_ats (&transcript,
                      &kx->master_secret,
                      ROLE_INITIATOR,
                      &their_ats);
  derive_per_message_secrets (&their_ats, // FIXME other HS epoch?
                              0,
                              enc_key,
                              enc_nonce);
  ret = crypto_aead_xchacha20poly1305_ietf_decrypt (
    (unsigned char*) &ack_i,     // unsigned char *m
    NULL,                                  // mlen_p message length
    NULL,                                  // unsigned char *nsec       - unused: NULL
    (unsigned char*) &idm_e[1],     // const unsigned char *c    - ciphertext
    sizeof (ack_i) + AEAD_TAG_BYTES,                                 // unsigned long long clen   - length of ciphertext
    NULL,                                  // const unsigned char *ad   - additional data (optional) TODO those should be used, right?
    0,                                     // unsigned long long adlen
    enc_nonce,     // const unsigned char *npub - nonce
    enc_key     // const unsigned char *k    - key
    );
  if (0 != ret)
  {
    GNUNET_log (DECRYPTION_FAILURES_LOG_LEVEL,
                "Something went wrong decrypting the Ack: %d\n", ret);
    GNUNET_CRYPTO_hash_context_abort (hc);
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  if ((sizeof ack_i != ntohs (ack_i.header.size)) ||
      (GNUNET_MESSAGE_TYPE_CORE_ACK != ntohs (ack_i.header.type)))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Ack invalid!\n");
    GNUNET_CRYPTO_hash_context_abort (hc);
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  GNUNET_memcpy (&kx->their_ats[0],
                 &their_ats,
                 sizeof their_ats);
  for (int i = 0; i < MAX_EPOCHS - 1; i++)
  {
    derive_next_ats (&kx->their_ats[i],
                     &kx->their_ats[i + 1]);
  }
  GNUNET_CRYPTO_hash_context_abort (kx->transcript_hash_ctx);
  kx->transcript_hash_ctx = hc;
  kx->status = GNUNET_CORE_KX_STATE_RESPONDER_CONNECTED;
  kx->current_epoch_expiration =
    GNUNET_TIME_relative_to_absolute (EPOCH_EXPIRATION);
  cleanup_handshake_secrets (kx);
  monitor_notify_all (kx);
  /* @e finished_I has verified.  RFC 9147, Section 5.11: the peer has now
     "demonstrated reachability [...] by completing a complete handshake
     including delivering a verifiable Finished message", so this is the
     point -- and the only point -- at which the old association may be
     destroyed.  #handle_initiator_hello() deliberately left it running.
     GSC_SESSIONS_create() puts into @e sessions with
     #GNUNET_CONTAINER_MULTIHASHMAPOPTION_UNIQUE_ONLY under a
     GNUNET_assert(), so a leftover session is not merely untidy. */
  GSC_SESSIONS_end (&kx->peer);
  if (NULL != kx->heartbeat_task)
  {
    GNUNET_SCHEDULER_cancel (kx->heartbeat_task);
    kx->heartbeat_task = NULL;
  }
  /* #send_initiator_done() starts the initiator at epoch 0 and we have to
     agree: on a kx that had an association before, these still hold the
     predecessor's values, and none of them was ever reset here. */
  kx->current_epoch = 0;
  kx->their_max_epoch = 0;
  kx->current_sqn = 1;
  replay_reset_all (kx);
  kx->association_up = GNUNET_YES;
  GSC_SESSIONS_create (&kx->peer, kx, kx->class);
  update_timeout (kx);
  ack_r.header.type = htons (GNUNET_MESSAGE_TYPE_CORE_ACK);
  ack_r.header.size = htons (sizeof ack_r);
  GSC_KX_encrypt_and_transmit (kx,
                               &ack_r,
                               sizeof ack_r);
 
  GNUNET_TRANSPORT_core_receive_continue (transport,
                                          &kx->peer);
}
 
 
static int
check_encrypted_message (void *cls, const struct EncryptedMessage *m)
{
  uint16_t size = ntohs (m->header.size) - sizeof(*m);
 
  // TODO check (see check_encrypted ())
  //       - check epoch
  //       - check sequence number
  if (size < sizeof(struct GNUNET_MessageHeader))
  {
    GNUNET_break_op (0);
    return GNUNET_SYSERR;
  }
  return GNUNET_OK;
}
 
 
static void
handle_heartbeat (struct GSC_KeyExchangeInfo *kx,
                  const struct Heartbeat *m)
{
  struct GNUNET_ShortHashCode new_ats;
  struct ConfirmationAck ack;
 
  if (m->flags & GSC_HEARTBEAT_KEY_UPDATE_REQUESTED)
  {
    if (kx->current_epoch == UINT64_MAX)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  "Max epoch reached (you probably will never see this)\n");
    }
    else
    {
      kx->current_epoch++;
      kx->current_epoch_expiration =
        GNUNET_TIME_relative_to_absolute (EPOCH_EXPIRATION);
      kx->current_sqn = 0;
      derive_next_ats (&kx->current_ats,
                       &new_ats);
      memcpy (&kx->current_ats,
              &new_ats,
              sizeof new_ats);
    }
  }
  update_timeout (kx);
  ack.header.type = htons (GNUNET_MESSAGE_TYPE_CORE_ACK);
  ack.header.size = htons (sizeof ack);
  GSC_KX_encrypt_and_transmit (kx,
                               &ack,
                               sizeof ack);
  /* NOTE: no GNUNET_TRANSPORT_core_receive_continue() here.  We are called
     from #handle_encrypted_message(), which owns the message and issues
     exactly one call for it. */
}
 
 
static enum GNUNET_GenericReturnValue
check_if_ack_or_heartbeat (struct GSC_KeyExchangeInfo *kx,
                           const char *buf,
                           size_t buf_len)
{
  struct GNUNET_MessageHeader *msg;
  struct ConfirmationAck *ack;
  struct Heartbeat *hb;
 
  if (sizeof *msg > buf_len)
    return GNUNET_NO;
  msg = (struct GNUNET_MessageHeader*) buf;
  if (GNUNET_MESSAGE_TYPE_CORE_ACK == ntohs (msg->type))
  {
    ack = (struct ConfirmationAck *) buf;
    if (sizeof *ack != ntohs (ack->header.size))
      return GNUNET_NO;
  }
  else if  (GNUNET_MESSAGE_TYPE_CORE_HEARTBEAT == ntohs (msg->type))
  {
    hb = (struct Heartbeat*) buf;
    if (sizeof *hb != ntohs (hb->header.size))
      return GNUNET_NO;
    handle_heartbeat (kx, hb);
  }
  else
  {
    return GNUNET_NO;
  }
 
  if (kx->status == GNUNET_CORE_KX_STATE_INITIATOR_DONE_SENT)
  {
    GSC_SESSIONS_create (&kx->peer, kx, kx->class);
    kx->status = GNUNET_CORE_KX_STATE_INITIATOR_CONNECTED;
    kx->current_epoch_expiration =
      GNUNET_TIME_relative_to_absolute (EPOCH_EXPIRATION);
    cleanup_handshake_secrets (kx);
    if (NULL != kx->resend_task)
      GNUNET_SCHEDULER_cancel (kx->resend_task);
    kx->resend_task = NULL;
    if (NULL != kx->resend_env)
      GNUNET_MQ_discard (kx->resend_env);
    kx->resend_env = NULL;
    monitor_notify_all (kx);
  }
  update_timeout (kx);
 
  return GNUNET_YES;
}
 
 
static void
handle_encrypted_message (void *cls, const struct EncryptedMessage *m)
{
  struct GSC_KeyExchangeInfo *kx = cls;
  uint16_t size = ntohs (m->header.size);
  char buf[size - sizeof (*m)] GNUNET_ALIGN;
  unsigned char seq_enc_k[crypto_stream_chacha20_ietf_KEYBYTES];
  const unsigned char *seq_enc_nonce;
  unsigned char enc_key[AEAD_KEY_BYTES];
  unsigned char enc_nonce[AEAD_NONCE_BYTES];
  struct GNUNET_ShortHashCode new_ats[MAX_EPOCHS];
  uint32_t seq_enc_ctr;
  uint64_t epoch;
  uint64_t m_seq;
  uint64_t m_seq_nbo;
  uint64_t c_len;
  int8_t ret;
 
  // TODO look at handle_encrypted
  //       - statistics
 
  /* The record layer answers to @e association_up, not to @e status: a
     handshake may be in flight over an association that is still live
     (RFC 9147, Section 5.11), and records of the old epoch have to keep
     being deprotected while it is.  Conversely a record we have no keys
     for is simply an invalid record -- RFC 9147, Section 4.5.2: "In
     general, invalid records SHOULD be silently discarded, thus preserving
     the association" -- so it must not end a session or restart anything.
     If we are idle it does tell us the peer believes in an association we
     do not have, which is worth one exchange. */
  if (GNUNET_YES != kx->association_up)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Discarding record from `%s': no keys for epoch %" PRIu64 "\n",
                GNUNET_i2s (&kx->peer),
                GNUNET_ntohll (m->epoch));
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    if (GNUNET_CORE_KX_STATE_DOWN == kx->status)
      restart_kx (kx);
    return;
  }
  epoch = GNUNET_ntohll (m->epoch);
  memcpy (new_ats,
          kx->their_ats,
          MAX_EPOCHS * sizeof (struct GNUNET_ShortHashCode));
  // FIXME here we could introduce logic that sends heartbeats
  // with key update request if we have not seen a new
  // epoch after a while (e.g. EPOCH_EXPIRATION)
  if (kx->their_max_epoch < epoch)
  {
    if ((epoch - kx->their_max_epoch) > 2 * MAX_EPOCHS)
    {
      /* @e epoch is plaintext and not covered by the AEAD tag, so this is
         reached by a single flipped bit as readily as by a peer that really
         did skip ahead.  Drop the message like the "too old" case below
         does; tearing the session down here means one unauthenticated
         header field costs a full re-handshake. */
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  "Epoch %" PRIu64 " is too new, will not decrypt...\n",
                  epoch);
      GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
      return;
    }
    for (uint64_t i = kx->their_max_epoch; i < epoch; i++)
    {
      derive_next_ats (&new_ats[i % MAX_EPOCHS],
                       &new_ats[(i + 1) % MAX_EPOCHS]);
      /* This slot of the ring now holds a different key, so the window
         that went with the old one no longer means anything. */
      replay_reset (kx, i + 1);
    }
  }
  else if ((kx->their_max_epoch - epoch) > MAX_EPOCHS)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "Epoch %" PRIu64 " is too old, cannot decrypt...\n",
                epoch);
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  derive_sn (
    &new_ats[epoch % MAX_EPOCHS],
    seq_enc_k,
    sizeof seq_enc_k);
  /* compute the sequence number */
  seq_enc_ctr = *((uint32_t*) m->tag);
  seq_enc_nonce = &m->tag[sizeof (uint32_t)];
#if DEBUG_KX
  GNUNET_print_bytes (&new_ats[epoch % MAX_EPOCHS],
                      sizeof (struct GNUNET_ShortHashCode),
                      8,
                      GNUNET_NO);
  GNUNET_print_bytes (seq_enc_k,
                      sizeof seq_enc_k,
                      8,
                      GNUNET_NO);
  GNUNET_print_bytes ((char*) &seq_enc_ctr,
                      sizeof seq_enc_ctr,
                      8,
                      GNUNET_NO);
#endif
  crypto_stream_chacha20_ietf_xor_ic (
    (unsigned char*) &m_seq_nbo,
    (unsigned char*) &m->sequence_number,
    sizeof (uint64_t),
    seq_enc_nonce,
    ntohl (seq_enc_ctr),
    seq_enc_k);
  m_seq = GNUNET_ntohll (m_seq_nbo);
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Received encrypted message in epoch %" PRIu64
              " with E(SQN=%" PRIu64 ")=%" PRIu64
              "\n",
              epoch,
              m_seq,
              m->sequence_number);
  /* RFC 9147, Section 4.5.1.  Cheap enough to do before deprotection, and
     doing it first means a flood of replayed records costs no AEAD work.
     The window itself is only moved once the record verifies, below. */
  if (GNUNET_OK != replay_check (kx, epoch, m_seq))
  {
    GNUNET_STATISTICS_update (GSC_stats,
                              gettext_noop ("# replayed records discarded"),
                              1,
                              GNUNET_NO);
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Discarding replayed record %" PRIu64 "/%" PRIu64
                " from `%s'\n",
                epoch,
                m_seq,
                GNUNET_i2s (&kx->peer));
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  /* We are the initiator and as we are going to receive,
   * we are using the responder key material */
  derive_per_message_secrets (&new_ats[epoch % MAX_EPOCHS],
                              m_seq,
                              enc_key,
                              enc_nonce);
  // TODO checking sequence numbers - handle the case of out-of-sync messages!
  // for now only decrypt the payload
  // TODO encrypt other fields, too!
  // TODO
  // c_len = size - offsetof ();
  c_len = size - sizeof (struct EncryptedMessage);
  ret = crypto_aead_xchacha20poly1305_ietf_decrypt_detached (
    (unsigned char*) buf,   // m - plain message
    NULL,                                   // nsec - unused
    (unsigned char*) &m[1],                 // c - ciphertext
    c_len,                                  // clen
    (const unsigned char*) &m->tag,         // mac
    NULL,                                   // ad - additional data TODO
    0,                                      // adlen
    enc_nonce,           // npub
    enc_key          // k
    );
  if (0 != ret)
  {
    /* RFC 9147, Section 4.5.2: "invalid records SHOULD be silently
       discarded, thus preserving the association; however, an error MAY be
       logged for diagnostic purposes."  Not a protocol violation on the
       peer's part either -- anything at all can arrive here -- so no
       GNUNET_break_op(). */
    GNUNET_STATISTICS_update (GSC_stats,
                              gettext_noop ("# invalid records discarded"),
                              1,
                              GNUNET_NO);
    GNUNET_log (GNUNET_ERROR_TYPE_INFO,
                "Discarding record %" PRIu64 "/%" PRIu64 " from `%s':"
                " does not deprotect\n",
                epoch,
                m_seq,
                GNUNET_i2s (&kx->peer));
    GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
    return;
  }
  /* Deprotected, so the record is authentic and everything derived from it
     may now be committed: the epoch ring, the anti-replay window (RFC 9147,
     Section 4.5.1: "The window MUST NOT be updated due to a received record
     until that record has been deprotected successfully") and @e timeout.
     @e timeout is the only liveness signal CORE has and is what
     `gnunet-core -m' reports, so refreshing it any earlier would let
     anything merely shaped like a record keep a session nominally alive. */
  /* Only ever forward: @e their_max_epoch is the *highest* epoch we have
     seen, and the ratchet above keys off it.  A record that was merely
     reordered across an epoch boundary -- entirely normal, the peer starts
     the new epoch at sequence number 0 while the old one is still in flight
     -- used to pull it back, so the next record of the newer epoch looked
     like a fresh advance and ran the loop again, wiping that epoch's
     anti-replay window (RFC 9147, Section 4.5.1) every single time. */
  if (kx->their_max_epoch < epoch)
    kx->their_max_epoch = epoch;
  memcpy (&kx->their_ats,
          new_ats,
          MAX_EPOCHS * sizeof (struct GNUNET_ShortHashCode));
  replay_commit (kx, epoch, m_seq);
  update_timeout (kx);
 
  if (GNUNET_NO == check_if_ack_or_heartbeat (kx,
                                              buf,
                                              sizeof buf))
  {
    if (kx->status == GNUNET_CORE_KX_STATE_INITIATOR_DONE_SENT)
    {
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  "Dropping message as we are still waiting for handshake ACK\n");
      GNUNET_break_op (0);
      GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
      return;
    }
    if (GNUNET_OK !=
        GNUNET_MST_from_buffer (kx->mst,
                                buf,
                                sizeof buf,
                                GNUNET_YES,
                                GNUNET_NO))
      GNUNET_break_op (0);
  }
  GNUNET_TRANSPORT_core_receive_continue (transport, &kx->peer);
}
 
 
static void
handle_transport_notify_disconnect (void *cls,
                                    const struct GNUNET_PeerIdentity *peer,
                                    void *handler_cls)
{
  struct GSC_KeyExchangeInfo *kx = handler_cls;
  (void) cls;
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Peer `%s' disconnected from us.\n",
              GNUNET_i2s (&kx->peer));
  GSC_SESSIONS_end (&kx->peer);
  GNUNET_STATISTICS_update (GSC_stats,
                            gettext_noop ("# key exchanges stopped"),
                            1,
                            GNUNET_NO);
  if (NULL != kx->resend_task)
  {
    GNUNET_SCHEDULER_cancel (kx->resend_task);
    kx->resend_task = NULL;
  }
  if (NULL != kx->resend_env)
  {
    GNUNET_MQ_discard (kx->resend_env);
    kx->resend_env = NULL;
  }
  if (NULL != kx->heartbeat_task)
  {
    GNUNET_SCHEDULER_cancel (kx->heartbeat_task);
    kx->heartbeat_task = NULL;
  }
  kx->status = GNUNET_CORE_KX_PEER_DISCONNECT;
  monitor_notify_all (kx);
  if (kx->transcript_hash_ctx)
  {
    GNUNET_CRYPTO_hash_context_abort (kx->transcript_hash_ctx);
    kx->transcript_hash_ctx = NULL;
  }
  GNUNET_CONTAINER_DLL_remove (kx_head, kx_tail, kx);
  GNUNET_MST_destroy (kx->mst);
  GNUNET_free (kx);
}
 
 
static void
resend_initiator_hello (void *cls)
{
  struct GSC_KeyExchangeInfo *kx = cls;
 
  kx->resend_task = NULL;
  if (0 == kx->resend_tries_left)
  {
    /* The InitiatorHello we keep repeating carries the ephemeral public key
       generated by #send_initiator_hello(), and only #restart_kx() ever
       generates a new one.  Retrying the same message forever therefore
       never recovers from a responder that has dropped the exchange -- it
       just keeps a retransmit timer running against a peer that is not
       answering.  Give up like #resend_responder_hello() and
       #resend_initiator_done() do and start a fresh exchange. */
    GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                "InitiatorHello not answered by `%s', restarting KX\n",
                GNUNET_i2s (&kx->peer));
    restart_kx (kx);
    return;
  }
  kx->resend_tries_left--;
  GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
              "Resending InitiatorHello. Retries left: %u\n",
              kx->resend_tries_left);
  GNUNET_MQ_send_copy (kx->mq, kx->resend_env);
  schedule_resend (kx, &resend_initiator_hello);
}
 
 
static void
send_initiator_hello (struct GSC_KeyExchangeInfo *kx)
{
  const struct GNUNET_PeerIdentity *my_identity;
  struct GNUNET_MQ_Envelope *env;
  struct GNUNET_ShortHashCode es;
  struct GNUNET_ShortHashCode ets;
  struct GNUNET_ShortHashCode ss_R;
  struct InitiatorHelloPayload *ihmp; /* initiator hello message - buffer on stack */
  struct InitiatorHello *ihm_e; /* initiator hello message - encrypted */
  long long unsigned int c_len;
  unsigned char enc_key[AEAD_KEY_BYTES];
  unsigned char enc_nonce[AEAD_NONCE_BYTES];
  enum GNUNET_GenericReturnValue ret;
  size_t pt_len;
 
  my_identity = GNUNET_PILS_get_identity (GSC_pils);
  GNUNET_assert (NULL != my_identity);
 
  pt_len = sizeof (*ihmp) + strlen (my_services_info);
  c_len = pt_len + AEAD_TAG_BYTES;
  env = GNUNET_MQ_msg_extra (ihm_e,
                             c_len,
                             GNUNET_MESSAGE_TYPE_CORE_INITIATOR_HELLO);
  ihmp = (struct InitiatorHelloPayload*) &ihm_e[1];
  ihmp->peer_class = htons (GNUNET_CORE_CLASS_UNKNOWN); // TODO set this to a meaningful
  GNUNET_memcpy (&ihmp->pk_I,
                 my_identity,
                 sizeof (struct GNUNET_PeerIdentity));
  GNUNET_CRYPTO_hash (&kx->peer, /* what to hash */ // TODO do we do this twice?
                      sizeof (struct GNUNET_PeerIdentity),
                      &ihm_e->h_pk_R); /* result */
  // TODO init hashcontext/transcript_hash
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG, "Send InitiatorHello: %d %d\n", kx->role,
              kx->status);
  GNUNET_assert (NULL == kx->transcript_hash_ctx);
  kx->transcript_hash_ctx = GNUNET_CRYPTO_hash_context_start ();
  GNUNET_assert (NULL != kx->transcript_hash_ctx);
  // TODO fill services_info
 
  // 1. Encaps
  ret = GNUNET_CRYPTO_eddsa_kem_encaps (&kx->peer.public_key, // public ephemeral key of initiator
                                        &ihm_e->c_R,    // encapsulated key
                                        &ss_R); // key - ss_R
  if (GNUNET_OK != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Something went wrong encapsulating ss_R\n");
    // TODO handle
  }
  // 2. generate rR (uint64_t) - is this the nonce? Naming seems not quite
  //    consistent
  ihm_e->r_I =
    GNUNET_CRYPTO_random_u64 (UINT64_MAX);
  // 3. generate sk_e/pk_e - ephemeral key
  GNUNET_CRYPTO_ecdhe_key_create (&kx->sk_e.ecdhe_key);
  GNUNET_CRYPTO_ecdhe_key_get_public (
    &kx->sk_e.ecdhe_key,
    &kx->pk_e.ecdhe_key);
  GNUNET_memcpy (&ihm_e->pk_e,
                 &kx->pk_e.ecdhe_key,
                 sizeof (kx->pk_e.ecdhe_key));
  // 4. generate ETS to encrypt
  //         generate ETS (early_traffic_secret_key, decrypt pk_i
  //         expand ETS <- expand ES <- extract ss_R
  //         use ETS to decrypt
  GNUNET_CRYPTO_hash_context_read (kx->transcript_hash_ctx,
                                   ihm_e,
                                   sizeof (struct InitiatorHello));
  {
    struct GNUNET_HashCode transcript;
    snapshot_transcript (kx->transcript_hash_ctx,
                         &transcript);
    derive_es_ets (&transcript,
                   &ss_R,
                   &es,
                   &ets);
    derive_per_message_secrets (&ets,
                                0,
                                enc_key,
                                enc_nonce);
  }
  // 5. encrypt
 
  ret = crypto_aead_xchacha20poly1305_ietf_encrypt (
    (unsigned char*) &ihm_e[1],   /* c - ciphertext */
    // mac,
    // NULL, // maclen_p
    &c_len,   /* clen_p */
    (unsigned char*) ihmp,   /* m - plaintext message */
    pt_len,   // mlen
    NULL, 0,   // ad, adlen // FIXME maybe over the unencrypted header?
               // fields?
    NULL,   // nsec - unused
    enc_nonce,   // npub - nonce
    enc_key);   // k - key
  if (0 != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR, "Something went wrong encrypting\n");
    GNUNET_CRYPTO_hash_context_abort (kx->transcript_hash_ctx);
    kx->transcript_hash_ctx = NULL;
    GNUNET_MQ_discard (env);
    return;
  }
  /* Forward the transcript */
  GNUNET_CRYPTO_hash_context_read (
    kx->transcript_hash_ctx,
    &ihm_e[1],
    c_len);
 
  kx->status = GNUNET_CORE_KX_STATE_INITIATOR_HELLO_SENT;
  kx->early_secret_key = es;
  kx->early_traffic_secret = ets;
  kx->ss_R = ss_R;
  monitor_notify_all (kx);
  GNUNET_MQ_send_copy (kx->mq, env);
  kx->resend_env = env;
  start_resend (kx, &resend_initiator_hello);
}
 
 
static enum GNUNET_GenericReturnValue
check_rekey (struct GSC_KeyExchangeInfo *kx)
{
  struct GNUNET_ShortHashCode new_ats;
 
  if ((UINT64_MAX == kx->current_sqn) ||
      (GNUNET_TIME_absolute_is_past (kx->current_epoch_expiration)))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Epoch expiration %" PRIu64 " SQN %" PRIu64
                ", incrementing epoch...\n",
                kx->current_epoch_expiration.abs_value_us,
                kx->current_sqn);
    if (UINT64_MAX == kx->current_epoch)
    {
      /* RFC 9147, Section 6.1: "Implementations MUST NOT allow the epoch to
         wrap, but instead MUST establish a new association, terminating the
         old association".  This used to be a GNUNET_assert(). */
      GNUNET_log (GNUNET_ERROR_TYPE_WARNING,
                  "Epoch exhausted for `%s', starting a new association\n",
                  GNUNET_i2s (&kx->peer));
      restart_kx (kx);
      return GNUNET_SYSERR;
    }
    kx->current_epoch++;
    kx->current_epoch_expiration =
      GNUNET_TIME_relative_to_absolute (EPOCH_EXPIRATION);
    kx->current_sqn = 0;
    derive_next_ats (&kx->current_ats,
                     &new_ats);
    memcpy (&kx->current_ats,
            &new_ats,
            sizeof new_ats);
  }
  return GNUNET_OK;
}
 
 
void
GSC_KX_encrypt_and_transmit (struct GSC_KeyExchangeInfo *kx,
                             const void *payload,
                             size_t payload_size)
{
  struct GNUNET_MQ_Envelope *env;
  struct EncryptedMessage *encrypted_msg;
  unsigned char enc_key[AEAD_KEY_BYTES];
  unsigned char enc_nonce[AEAD_NONCE_BYTES];
  unsigned char seq_enc_k[crypto_stream_chacha20_ietf_KEYBYTES];
  uint64_t sqn;
  uint64_t epoch;
  int8_t ret;
 
  encrypted_msg = NULL;
 
  if (GNUNET_YES != kx->association_up)
  {
    /* No application traffic keys installed -- there is nothing to protect
       this with.  Callers reach this through a session, which only exists
       while the association does, so this is a should-not-happen. */
    GNUNET_break (0);
    return;
  }
  if (GNUNET_OK != check_rekey (kx))
    return;     /* association was torn down, @e current_ats is gone */
  sqn = kx->current_sqn;
  epoch = kx->current_epoch;
  /* We are the sender and as we are going to send,
   * we are using the initiator key material */
  derive_per_message_secrets (&kx->current_ats,
                              sqn,
                              enc_key,
                              enc_nonce);
  kx->current_sqn++;
  derive_sn (&kx->current_ats,
             seq_enc_k,
             sizeof seq_enc_k);
  env = GNUNET_MQ_msg_extra (encrypted_msg,
                             payload_size,
                             GNUNET_MESSAGE_TYPE_CORE_ENCRYPTED_MESSAGE_CAKE);
  // only encrypt the payload for now
  // TODO encrypt other fields as well
  ret = crypto_aead_xchacha20poly1305_ietf_encrypt_detached (
    (unsigned char*) &encrypted_msg[1],     // c - resulting ciphertext
    (unsigned char*) &encrypted_msg->tag,     // mac - resulting mac/tag
    NULL,     // maclen
    (unsigned char*) payload,     // m - plain message
    payload_size,     // mlen
    NULL,     // ad - additional data TODO also cover the unencrypted part (epoch)
    0,     // adlen
    NULL,     // nsec - unused
    enc_nonce,     // npub nonce
    enc_key     // k - key
    );
  if (0 != ret)
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                "Something went wrong encrypting message\n");
    GNUNET_assert (0);
  }
  {
    /* compute the sequence number */
    unsigned char *seq_enc_nonce;
    uint64_t seq_nbo;
    uint32_t seq_enc_ctr;
 
    seq_nbo = GNUNET_htonll (sqn);
    seq_enc_ctr = *((uint32_t*) encrypted_msg->tag);
    seq_enc_nonce = &encrypted_msg->tag[sizeof (uint32_t)];
    crypto_stream_chacha20_ietf_xor_ic (
      (unsigned char*) &encrypted_msg->sequence_number,
      (unsigned char*) &seq_nbo,
      sizeof seq_nbo,
      seq_enc_nonce,
      ntohl (seq_enc_ctr),
      seq_enc_k);
#if DEBUG_KX
    GNUNET_print_bytes (seq_enc_k,
                        sizeof seq_enc_k,
                        8,
                        GNUNET_NO);
    GNUNET_print_bytes ((char*) &seq_enc_ctr,
                        sizeof seq_enc_ctr,
                        8,
                        GNUNET_NO);
#endif
    GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
                "Sending encrypted message with E(SQN=%" PRIu64 ")=%" PRIu64
                "\n",
                sqn,
                encrypted_msg->sequence_number);
  }
  encrypted_msg->epoch = GNUNET_htonll (epoch);
 
  // TODO actually copy payload
  GNUNET_MQ_send (kx->mq, env);
}
 
 
void
GSC_KX_start (void)
{
  const struct GNUNET_PeerIdentity *my_identity;
  struct GNUNET_MQ_MessageHandler handlers[] = {
    GNUNET_MQ_hd_var_size (initiator_hello,
                           GNUNET_MESSAGE_TYPE_CORE_INITIATOR_HELLO,
                           struct InitiatorHello,
                           NULL),
    GNUNET_MQ_hd_var_size (initiator_done,
                           GNUNET_MESSAGE_TYPE_CORE_INITIATOR_DONE,
                           struct InitiatorDone,
                           NULL),
    GNUNET_MQ_hd_var_size (responder_hello,
                           GNUNET_MESSAGE_TYPE_CORE_RESPONDER_HELLO,
                           struct ResponderHello,
                           NULL),
    GNUNET_MQ_hd_var_size   (encrypted_message, // TODO rename?
                             GNUNET_MESSAGE_TYPE_CORE_ENCRYPTED_MESSAGE_CAKE,  // TODO rename!
                             struct EncryptedMessage,
                             NULL),
    GNUNET_MQ_handler_end ()
  };
 
  my_identity = GNUNET_PILS_get_identity (GSC_pils);
  GNUNET_assert (NULL != my_identity);
 
  /* Decapsulate with our peer identity's private key directly instead of
     round-tripping through the PILS service.  The shared secret is needed
     in the middle of processing a handshake message, and an asynchronous
     answer meant that every InitiatorHello and ResponderHello had to be
     parked with its kx across a callback: the kx could be torn down or
     freed underneath it, two hellos could be in flight at once, and if
     the answer never came (PILS restarting) the handshake stalled *and*
     the message was never acknowledged to TRANSPORT. */
  if (GNUNET_OK !=
      GNUNET_PILS_enable_private_key (GSC_pils))
  {
    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,
                _ ("Failed to load our private key, "
                   "cannot run key exchange\n"));
    GSC_KX_done ();
    return;
  }
 
  nc = GNUNET_notification_context_create (1);
  transport =
    GNUNET_TRANSPORT_core_connect (GSC_cfg,
                                   my_identity,
                                   handlers,
                                   NULL, // cls - this connection-independant
                                         // cls seems not to be needed.
                                         // the connection-specific cls
                                         // will be set as a return value
                                         // of
                                         // handle_transport_notify_connect
                                   &handle_transport_notify_connect,
                                   &handle_transport_notify_disconnect);
  if (NULL == transport)
  {
    GSC_KX_done ();
    return;
  }
 
  GNUNET_log (GNUNET_ERROR_TYPE_DEBUG,
              "Connected to TRANSPORT\n");
 
  GSC_complete_initialization_cb ();
}
 
 
void
pid_change_cb (void *cls,
               const struct GNUNET_HELLO_Parser *parser,
               const struct GNUNET_HashCode *hash)
{
  if (NULL != transport)
    return;
 
  GSC_KX_start ();
}
 
 
int
GSC_KX_init (void)
{
  GSC_pils = GNUNET_PILS_connect (GSC_cfg,
                                  &pid_change_cb,
                                  NULL);
  if (NULL == GSC_pils)
  {
    GSC_KX_done ();
    return GNUNET_SYSERR;
  }
 
  return GNUNET_OK;
}
 
 
void
GSC_KX_done ()
{
  if (NULL != GSC_pils)
  {
    GNUNET_PILS_disconnect (GSC_pils);
    GSC_pils = NULL;
  }
  if (NULL != transport)
  {
    GNUNET_TRANSPORT_core_disconnect (transport);
    transport = NULL;
  }
  if (NULL != rekey_task)
  {
    GNUNET_SCHEDULER_cancel (rekey_task);
    rekey_task = NULL;
  }
  if (NULL != nc)
  {
    GNUNET_notification_context_destroy (nc);
    nc = NULL;
  }
}
 
 
unsigned int
GSC_NEIGHBOURS_get_queue_length (const struct GSC_KeyExchangeInfo *kxinfo)
{
  return GNUNET_MQ_get_length (kxinfo->mq);
}
 
 
int
GSC_NEIGHBOURS_check_excess_bandwidth (const struct GSC_KeyExchangeInfo *kxinfo)
{
  return kxinfo->has_excess_bandwidth;
}
 
 
void
GSC_KX_handle_client_monitor_peers (struct GNUNET_MQ_Handle *mq)
{
  struct GNUNET_MQ_Envelope *env;
  struct MonitorNotifyMessage *done_msg;
  struct GSC_KeyExchangeInfo *kx;
 
  GNUNET_notification_context_add (nc, mq);
  for (kx = kx_head; NULL != kx; kx = kx->next)
  {
    struct GNUNET_MQ_Envelope *env_notify;
    struct MonitorNotifyMessage *msg;
 
    env_notify = GNUNET_MQ_msg (msg, GNUNET_MESSAGE_TYPE_CORE_MONITOR_NOTIFY);
    msg->state = htonl ((uint32_t) kx->status);
    msg->peer = kx->peer;
    msg->timeout = GNUNET_TIME_absolute_hton (kx->timeout);
    GNUNET_MQ_send (mq, env_notify);
  }
  env = GNUNET_MQ_msg (done_msg, GNUNET_MESSAGE_TYPE_CORE_MONITOR_NOTIFY);
  done_msg->state = htonl ((uint32_t) GNUNET_CORE_KX_ITERATION_FINISHED);
  done_msg->timeout = GNUNET_TIME_absolute_hton (GNUNET_TIME_UNIT_FOREVER_ABS);
  GNUNET_MQ_send (mq, env);
}
 
 
/* end of gnunet-service-core_kx.c */