SCP - Secure Channel Protocol

SCP creates a secure, bidirectional communication channel between two parties over TCP. It provides mutual authentication using a pre-shared key (PSK) and authenticated encryption using ChaCha20-Poly1305.

SCP is *NOT* a replacement of TLS, it is an independant protocol i built to learn and demonstrate the core things of a secure channel like handshake, key exchange, key derivation, encryption, etc. This is all implemented in Go.

The protocol completes in 2 round trips before the data phase begins. Both parties must have the same PSK before initialising the connection, there is NO certification infrastructure (yet).

Every SCP message is framed as a packet with 5 byte header followed by a variable length payload.

+------------+------------------+----------------------+
| Type (1B)  | Length (4B, BE)  | Payload (N bytes)    |
+------------+------------------+----------------------+

Type - tells the message type (see Section 3)
Length - unsigned 32-bit big-endian integer, length of the payload in bytes
Payload - message specific content

The maximum payload size is 2^32 - 1 bytes. You should enforce limits appropriate to your context if you are using the package.

The SCP handshake complestes in 2 round trips

Client                    Server
  |                         |
  |--- ClientHello -------->|
  |    pub[32] nonce[16]    |
  |    psk_proof[32]        |
  |                         |
  |<-- ServerHello ---------|
  |    pub[32] nonce[16]    |
  |    psk_proof[32]        |
  |                         |
  | [both derive ECDH +     |
  |  session key via HKDF]  |
  |                         |
  |--- Done --------------->|
  |    Enc(HMAC(sk,         |
  |    "client-done"))      |
  |                         |
  |<-- Done ----------------|
  |    Enc(HMAC(sk,         |
  |    "server-done"))      |
  |                         |
  |<=== channel open ======>|

client_psk_proof = HMAC-SHA256(PSK, client_nonce || client_public key)

server_psk_proof = HMAC-SHA256(PSK, client_nonce || server_nonce || server_public_key || client_public_key)

client_done_mac  = HMAC-SHA256(sessionKey, "client-done")
client_done_nonce = nonceCounter.Next()
client_done_payload = ChaCha20-Poly1305_Encrypt(key=sessionKey, nonce=client_done_nonce, plaintext=client_done_mac)

The session key is derived from ECDH shared secret using HKDF-SHA256:

shared_secret  = X25519(my_private_key, peer_public_key)

session_key    = HKDF-SHA256(
  ikm  = shared_secret,          // raw ECDH output
  salt = PSK,                     // authenticates key derivation
  info = "SCP-session"
          || client_nonce
          || server_nonce,        // binds key to this specific session
  len  = 32 bytes
)

ikm - the raw X25519 output is the primary entropy source. HKDF conditions it into a uniform key suitable for ChaCha20-Poly1305

salt = PSK - using the PSK as HKDF salt mixes authentication into key derivation. A session key derived without the correct PSK will differ from the one derived WITH it, even if the ECDH exchange produces same raw output.

info - the context string "SCP-session" + both nonces make the the derived key unique to to this handshake. Two sessions with the same PSK and same ECDH key but different nonce will produce different session key, so thats never gonna happens.

After a sucecssful handshake, both parties may exchange MsgData packets in either direction, each packet is independently encrypted and authenticated.

to do: add ts

Nonce - a 12-byte big-endian encoded counter, it increments with every sent message and is included in the packet so the receiver can decrypt without maintaning synchronized state.

Each party maintains an independent send counter, client and server nonce sequence do not interfere with each other