Module pairing 

Pairing a new device with a short code, using a PAKE (SPAKE2).

The DM’s device shows a code like 7-tavern-dragon. The number picks the pairing on the auth service and is public; the two words are a password that never leaves the two devices. Both run SPAKE2 with the words, with the auth service relaying the messages, and end up with the same strong key only if they used the same words. An eavesdropper (the relay included) learns nothing it could guess the words against offline; an active attacker gets one online guess, after which the pairing is gone.

Over the resulting encrypted channel the new device sends its public key and name, and the DM’s device answers with a certificate for it, the campaign, and the auth service’s key, which the new device then trusts because it came from the DM, not from whatever server it happens to be talking to.

Everything here is IO-free; edda-client moves the bytes.

Structs

Channel

Authenticated encryption both ways, with a key per direction. Nonces are message counters, so no key ever sees a nonce twice.

Exchange

One side’s SPAKE2 run, between sending its message and receiving the other’s.

JoinRequest

The joiner’s first encrypted message.

PairingCode

<slot>-<word>-<word>.

Enums

JoinAnswer

The DM’s answer.

PairingError

What can go wrong reading a pairing code or a sealed message.

Side

The two sides of a pairing. SPAKE2 is asymmetric, and each side’s identity is bound into the key.

Constants

WORDS

Words in a code. With 1,296 words, two give a 1 in 1,679,616 chance to an attacker, who only gets one try per code.