protocol proto_circe
mtu 1472

version 1 {
    header {
        u8[64] tunnel_id;
    }

    message open_tunnel {
        clear {
            u8[32] ecdh_fragment
            u8[1184] mlkem_pubkey
        }
        digest sha512
    }

    message ack_open (u8[32] k_hs_e) {
        clear {
            u8[32] ecdh_fragment
            u8[1088] mlkem_encaps
        }
        cc20_p1305 (nonce:0, key:@k_hs_e, aad:$preceding) {
            u8[64] identity
            u8[2420] signature
        }
        digest sha512
    }

    message identify (u8[32] k_hs_p) {
        cc20_p1305 (nonce:0, key:@k_hs_p, aad:$preceding) {
            u8[64] identity
            u8[2420] signature
        }
        digest sha512
    }

    message data (u8[32] k_d) {
        clear {
            u64 sequence_number
        }
        cc20_p1305 (nonce:@sequence_number, key:@k_d, aad:$preceding) {
            u8 n_random_bytes
            u8[] payload
            u8[@n_random_bytes] padding
        }
    }

    message close_tunnel (u8[32] k_d) {
        clear {
            u64 sequence_number
        }
        cc20_p1305 (nonce:@sequence_number, key:@k_d, aad:$preceding) {
            u8[64] identity
            u8[2420] signature
        }
    }

    message path_challenge (u8[32] k_d) {
        clear {
            u64 sequence_number
        }
        cc20_p1305 (nonce:@sequence_number, key:@k_d, aad:$preceding) {
            u8[64] identity
            u8[2420] signature
        }
    }
}