commonwarexyz · patrick-ogrady · May 30, 2025 · May 29, 2025 · May 29, 2025 · May 29, 2025
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -70,6 +70,7 @@ io-uring = "0.7.4"
 rayon = "1.10.0"
 async-lock = "3.4.0"
 libc = "0.2.172"
+zeroize = "1.5.7"
 
 [profile.bench]
 # Because we enable overflow checks in "release," we should benchmark with them.

diff --git a/cryptography/Cargo.toml b/cryptography/Cargo.toml
@@ -18,9 +18,9 @@ thiserror = { workspace = true }
 rand = { workspace = true }
 sha2 = { workspace = true }
 rayon = { workspace = true }
+zeroize = { workspace = true, features = ["zeroize_derive"] }
 ed25519-consensus = "2.1.0"
 blst = { version = "0.3.13", features = ["no-threads"] }
-zeroize = { version = "1.5.7", features = ["zeroize_derive"] }
 p256 = { version = "0.13.2", features = ["ecdsa"] }
 
 # Enable "js" feature when WASM is target

diff --git a/cryptography/src/lib.rs b/cryptography/src/lib.rs
@@ -13,7 +13,7 @@ pub use bls12381::Bls12381;
 pub mod ed25519;
 pub use ed25519::{Ed25519, Ed25519Batch};
 pub mod sha256;
-pub use sha256::{hash, Sha256};
+pub use sha256::{hash, CoreSha256, Sha256};
 pub mod secp256r1;
 pub use secp256r1::Secp256r1;
 

diff --git a/cryptography/src/sha256/mod.rs b/cryptography/src/sha256/mod.rs
@@ -30,6 +30,10 @@ use std::{
     fmt::{Debug, Display},
     ops::Deref,
 };
+use zeroize::Zeroize;
+
+/// Re-export `sha2::Sha256` as `CoreSha256` for external use if needed.
+pub type CoreSha256 = ISha256;
 
 const DIGEST_LENGTH: usize = 32;
 
@@ -155,6 +159,12 @@ impl crate::Digest for Digest {
     }
 }
 
+impl Zeroize for Digest {
+    fn zeroize(&mut self) {
+        self.0.zeroize();
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

diff --git a/stream/Cargo.toml b/stream/Cargo.toml
@@ -20,8 +20,10 @@ thiserror = { workspace = true }
 bytes = { workspace = true }
 futures = { workspace = true }
 rand = { workspace = true }
-chacha20poly1305 = "0.10"
-x25519-dalek = "2"
+zeroize = { workspace = true }
+chacha20poly1305 = "0.10.1"
+hkdf = "0.12.4"
+x25519-dalek = "2.0.1"
 
 [dev-dependencies]
 criterion = { workspace = true }

diff --git a/stream/src/lib.rs b/stream/src/lib.rs
@@ -37,7 +37,9 @@ pub enum Error {
     #[error("shared secret was not contributory")]
     SharedSecretNotContributory,
     #[error("cipher creation failed")]
-    CipherCreationFailed,
+    CipherCreation,
+    #[error("HKDF expansion failed")]
+    HKDFExpansion,
     #[error("nonce overflow")]
     NonceOverflow,
     #[error("encryption failed")]

diff --git a/stream/src/public_key/benches/receiver_receive.rs b/stream/src/public_key/benches/receiver_receive.rs
@@ -14,22 +14,23 @@ fn benchmark_receiver_receive(c: &mut Criterion) {
                 || {
                     // Set up a connection between two parties.
                     // We only send messages in one direction from A to B.
-                    let cipher = ChaCha20Poly1305::new(&[0u8; 32].into());
+                    let cipher1 = ChaCha20Poly1305::new(&[1u8; 32].into());
+                    let cipher2 = ChaCha20Poly1305::new(&[2u8; 32].into());
                     let (sink, stream) = mocks::Channel::init();
                     let (sink_dummy, stream_dummy) = mocks::Channel::init();
                     let conn_a = Connection::from_preestablished(
-                        false,
                         sink,
                         stream_dummy,
-                        cipher.clone(),
                         message_size,
+                        cipher1.clone(),
+                        cipher2.clone(),
                     );
                     let conn_b = Connection::from_preestablished(
-                        true,
                         sink_dummy,
                         stream,
-                        cipher,
                         message_size,
+                        cipher2,
+                        cipher1,
                     );
 
                     let (mut sender, _) = conn_a.split();

diff --git a/stream/src/public_key/benches/sender_send.rs b/stream/src/public_key/benches/sender_send.rs
@@ -12,10 +12,16 @@ fn benchmark_sender_send(c: &mut Criterion) {
         c.bench_function(&format!("{}/len={}", module_path!(), message_size), |b| {
             b.iter_batched(
                 || {
-                    let cipher = ChaCha20Poly1305::new(&[0u8; 32].into());
+                    let cipher1 = ChaCha20Poly1305::new(&[1u8; 32].into());
+                    let cipher2 = ChaCha20Poly1305::new(&[2u8; 32].into());
                     let (sink, stream) = mocks::Channel::init();
-                    let connection =
-                        Connection::from_preestablished(true, sink, stream, cipher, message_size);
+                    let connection = Connection::from_preestablished(
+                        sink,
+                        stream,
+                        message_size,
+                        cipher1,
+                        cipher2,
+                    );
                     let (sender, _receiver) = connection.split();
                     let msg = msg.clone();
                     (sender, msg)