spt-srp

SmartPoints RendezVous Protocol -- Noise-inspired handshake with capability negotiation

Overview

spt-srp implements the SmartPoints RendezVous Protocol, a custom Noise XX-inspired handshake protocol with built-in capability negotiation for secure agent-to-agent communication. It provides X25519 key agreement for forward secrecy, ChaCha20-Poly1305 authenticated encryption, and a capability-based security model with attenuation and revocation. An optional pq feature adds ML-KEM-768 key encapsulation and SLH-DSA-SHAKE-128f post-quantum signatures.

Key Features

• 4-phase handshake -- Noise XX-based with embedded capability payloads
• X25519 key agreement -- ephemeral Diffie-Hellman for forward secrecy
• ChaCha20-Poly1305 AEAD -- authenticated encryption for all transport messages
• Capability-based security -- fine-grained actions, constraints, attenuation, and revocation
• Session management -- cryptographic session IDs with key zeroization on revocation
• Post-quantum mode -- ML-KEM-768 KEM + SLH-DSA-SHAKE-128f signatures (feature pq)
• Mode negotiation -- classical, post-quantum, or hybrid handshake selection

Dependencies

No internal SPT crate dependencies. Uses x25519-dalek for key agreement, chacha20poly1305 for AEAD, hkdf/sha2 for key derivation, zeroize for memory safety. Optional ml-kem and fips205 for post-quantum support.

Usage

use spt_srp::{Initiator, Responder, KeyPair, generate_keypair, Capability, Action};

let initiator_keys = generate_keypair();
let responder_keys = generate_keypair();

let mut initiator = Initiator::new(initiator_keys);
let mut responder = Responder::new(responder_keys);
// Execute 4-phase handshake...

API Reference

Core Types

Type	Description
Initiator	Handshake initiator (client side)
Responder	Handshake responder (server side)
Session	Established encrypted session with capabilities
SessionId	Cryptographic session identifier
Capability	A granted capability with resource, actions, constraints
CapabilitySet	Collection of capabilities for a session
CapabilityGrant	Signed capability grant
Attenuation	Capability restriction (reduce scope)
RevocationManager	Manages session and capability revocation
HandshakeMode	Classical / PostQuantum / Hybrid mode enum
SrpError	Crate error type

Feature Flags

Feature	Default	Description
pq	no	ML-KEM-768 + SLH-DSA-SHAKE-128f post-quantum handshake