ddn.net.ssh.packet_gcm

AES-GCM packet protection for the SSH transport (RFC 5647).

Wire construction per RFC 5647 section 7: the packet length travels in the clear as additional authenticated data, the plaintext (padding length, payload, padding, a multiple of 16 bytes) is encrypted with AES-GCM, and the 16-byte tag is appended. The nonce is a 4-byte fixed field from the key exchange plus a big-endian 64-bit invocation counter that increments after every packet.

Tag verification happens before any plaintext exists: the reader collects the whole packet before calling the AEAD.

enum SshGcmLimits
class GcmPacketReader GcmPacketWriter SshGcmException
fn feedAll toHex

Types 4

classSshGcmException : Exception

Raised for protected-packet violations: bad lengths, counter exhaustion, or authentication failures.

Constructors
this(string msg, string file = __FILE__, size_t line = __LINE__)Constructs a protected-packet exception.
enumSshGcmLimits

GCM framing parameters: AES block size and tag length.

blockSize = 16AES-GCM block size; plaintext must be a multiple
tagSize = 16Authentication tag length
ivSize = 12IV length: 4 fixed bytes plus the 8-byte counter
classGcmPacketWriter

Protected packet writer.

Produces wire packets from payloads: random GCM padding, plaintext length as AAD, per-packet nonce from the invocation counter.

Fields
private GCM!AES aead_
private CryptoRandom rng_
private ubyte[12] iv_
private uint sequenceNumber_
private bool wiped_
Methods
uint sequenceNumber() @property const pure nothrow @nogcReturns: the sequence number of the next packet to be written.
void wipe() nothrow @nogc @trustedVolatile-wipes the GCM key schedule and invocation counter.
ubyte[] protect(const(ubyte)[] payload)Frames and protects one payload.
void setSequence(uint value) pure nothrow @nogc @safeSets the sequence counter explicitly (continuity across rekey).
private void incrementCounter() pure nothrow @nogc @safe
Constructors
this(const(ubyte)[] key, in ubyte[12] iv, CryptoRandom rng)Constructs a writer from derived key material.
classGcmPacketReader

Incremental protected packet reader.

Collects the plaintext length, then ciphertext and tag, then authenticates and decrypts in one AEAD call.

Fields
private GCM!AES aead_
private ubyte[12] iv_
private ubyte[] buffer_
private uint sequenceNumber_
private bool wiped_
Methods
uint sequenceNumber() @property const pure nothrow @nogcReturns: the sequence number of the next packet to be read.
void wipe() nothrow @nogc @trustedVolatile-wipes the GCM key schedule, IV, and buffered wire data.
size_t bytesNeeded() @property const pure nothrow @nogc @safeReturns: how many more wire bytes the current packet still needs, or 0 when a full packet is buffered.
bool packetReady() @property const pure nothrow @nogc @safeReturns: whether a complete authenticated packet is buffered.
void feed(const(ubyte)[] data) @safeFeeds received wire bytes.
ubyte[] take()Takes the next authenticated packet's payload.
void setSequence(uint value) pure nothrow @nogc @safeSets the sequence counter explicitly (continuity across rekey).
private uint peekLength() const pure nothrow @nogc @safe
private void incrementCounter() pure nothrow @nogc @safe
Constructors
this(const(ubyte)[] key, in ubyte[12] iv)Constructs a reader from derived key material.

Functions 2

private fnvoid feedAll(GcmPacketReader reader, const(ubyte)[] data) @safe
private fnstring toHex(scope const(ubyte)[] data) @safe pure