Nen Logo
Nen

Cryptography Specifications

Nen is built upon the following cryptographic primitives, carefully selected for their security, performance, and resistance to quantum attacks.

Key Encapsulation: ML-KEM (Kyber)

  • Standard: FIPS 203
  • Parameter Set: Kyber768 (Level 3 security, roughly equivalent to AES-192)
  • Usage: Used to securely transmit a 32-byte shared secret across the network during the initial handshake.

Digital Signatures: ML-DSA (Dilithium)

  • Standard: FIPS 204
  • Parameter Set: Dilithium3 (Level 3 security)
  • Usage: Used optionally by clients to sign their ML-KEM public key, proving identity to the server and preventing active Man-in-the-Middle (MitM) attacks.

Session keys (HKDF key schedule)

As of NEN-PROTOCOL-V3, Nen runs an HKDF-SHA256 key schedule over the shared secret. The handshake establishes a shared secret ss — hybrid by default, combining X25519 and ML-KEM-768 — and each side independently derives two distinct keys locally:

  • k_enc = HKDF(ss, "nen/v3 enc") — the 32-byte ChaCha20-Poly1305 key
  • k_mac = HKDF(ss, "nen/v3 mac") — the 32-byte HMAC-SHA256 key

Because both keys are derived with HKDF on the client and the server, no key material ever crosses the wire — the handshake response carries only the KEM ciphertext and the server's X25519 public key. (V1/V2 used the raw shared secret as the encryption key and transmitted a server-generated HMAC key in the handshake response; V3 removes that.) A per-request rekey ratchet (HKDF(k, "nen/v3 ratchet")) can advance the keys forward for forward secrecy. See Protocol Spec and the repo's KEY_SCHEDULE.md.

Symmetric Encryption: ChaCha20Poly1305

  • Standard: RFC 8439
  • Usage: An Authenticated Encryption with Associated Data (AEAD) cipher used to encrypt all JSON payloads. Chosen for its extreme performance in software (including WebAssembly) without relying on hardware AES acceleration. Each payload uses a fresh 12-byte nonce and carries a 16-byte Poly1305 tag — any tampering of the ciphertext fails decryption (ISO-4001).

Request Authentication: HMAC-SHA256

  • Standard: FIPS 198-1 / FIPS 180-4
  • Usage: Computes a message authentication code over the canonical string METHOD \n PATH \n TIMESTAMP \n NONCE (not over the ciphertext). This hot-path authentication is mandatory and extremely fast, protecting against forgery and replay before any decryption is attempted. PQC signatures are used only at the handshake, never per request.