Module auth 

Optional shared secret authentication.

Supplying AuthKey to Builder::key performs mutual authentication during session negotiation.

This is provided mainly for use with one-off Unix socket or Windows named pipe connections where controlling access to the endpoint or consistently discerning peer identity may be difficult, e.g. when crossing container boundaries with unknown or misconfigured identity mappings.

This does not provide message integrity or privacy; the protocol remains unencrypted and unsigned, so it must be used over a private channel such as a Unix socket, or tunneled over a protocol that provides privacy and integrity, like SSH or TLS.

Authentication is a simple derived key exchange with no nonce, so it is not replay-resistant. It is intended for single-use keys minted per session and exchanged beforehand over a secure side channel. It must carry sufficient entropy on its own.

Each side advertises a digest derived from the key with a role-specific BLAKE3 key-derivation context, and checks the digest derived from the other role. Because the digests are one-way, an impostor that connects first and harvests the server’s advertisement cannot derive the client’s, and an impostor that binds the socket first cannot produce the server’s. Both digests ride the existing symmetric negotiation exchange, so authentication costs no additional round trips.

Structs

AuthKey

A pre-shared key, reduced to the pair of digests negotiation exchanges.

Constants

MIN_KEY_LEN

Minimum accepted length, in bytes, of a pre-shared authentication key.