mirror of https://github.com/jmcorgan/fips.git synced 2026-07-22 07:48:26 +00:00

Go to file

Origami74 d3477a7c0f Add explicit counter to DataPacket for out-of-order decryption

Session-layer encryption used an implicit nonce counter with no counter
on the wire, requiring packets to arrive in exact order. Under bulk
transfer load (e.g., SCP), UDP packet loss or reordering permanently
desynchronized sender/receiver counters, causing all subsequent
decryption to fail with no recovery.

Add an 8-byte counter field to the DataPacket wire format and switch
from implicit-counter decrypt() to decrypt_with_replay_check() which
uses the explicit wire counter plus a 2048-packet sliding replay
window — the same pattern already used at the link layer.

Wire format: msg_type(1) + flags(1) + counter(8) + payload_len(2) = 12
bytes (was 4). FIPS_OVERHEAD updated 127 → 135 bytes accordingly.

2026-02-17 00:33:01 +00:00

benches

Bloom module test coverage, benchmarks, and design doc corrections

2026-02-15 16:05:59 +00:00

docs

Error recovery fixes and routing error rate limiting

2026-02-17 00:00:04 +00:00

examples/docker-network

feat: implement ICMP Packet Too Big and TCP MSS clamping for MTU handling

2026-02-16 21:33:21 +00:00

src

Add explicit counter to DataPacket for out-of-order decryption