M .gitignore → .gitignore

@@ -50,5 +50,4 @@ .tmp_versions/
 modules.order
 Module.symvers
 Mkfile.old
-dkms.conf
-
+dkms.conf

M .gitmodules → .gitmodules

@@ -1,9 +1,9 @@
-[submodule "contrib/TinyCrypT"]
-	path = contrib/TinyCrypT
-	url = https://gitea.eyes-like-fire.org/juniper/TinyCrypT.git
-[submodule "contrib/mlkem-native"]
-	path = contrib/mlkem-native
-	url = https://github.com/pq-code-package/mlkem-native.git
 [submodule "contrib/mldsa-native"]
 	path = contrib/mldsa-native
 	url = https://github.com/pq-code-package/mldsa-native.git
+[submodule "contrib/mlkem-native"]
+	path = contrib/mlkem-native
+	url = https://github.com/pq-code-package/mlkem-native.git
+[submodule "contrib/TinyCrypT"]
+	path = contrib/TinyCrypT
+	url = https://gitea.eyes-like-fire.org/juniper/TinyCrypT.git

A docs/PROTOCOL.md

@@ -0,0 +1,52 @@
+# The Circe Protocol
+
+## Cryptographic Primitives
+
+- ChaCha20-Poly1305 for fast symmetric encryption and AEAD
+- MLKEM-768 hybridized with x25519 for shared secret derivation
+- KangarooTwelve128 and SHA2-512 for key and nonce derivation
+- MLDSA-44 for cryptographic signatures
+
+## Handshake (v1)
+
+Three UDP messages, host database is pre-distributed (unknown hosts fall through to confirm-with-server state described in section 3).
+
+**Transcript:** Running SHA2-512 hash `TH` over every handshake byte, in order, plaintext form, computed identically by both sides.
+
+**Key Schedule:**
+```
+ek_p        = Polites' Curve25519 secret key
+ek_e        = Eurylochus' Curve25519 secret key
+ek_shared   = ECDH(ek_p, ek_e)
+qk_shared   = MLKEM-768 shared secret
+PRK         = HKDF-Extract(salt = "circe/v1", IKM = ek_shared | qk_shared)
+k_hs_e      = HKDF-Expand(PRK, "hs eurylochus" | TH2, 32)
+k_hs_p      = HKDF-Expand(PRK, "hs polites" | TH2, 32)
+k_d_p2e     = HKDF-Expand(PRK, "data p2e" | TH3, 32)
+k_d_e2p     = HKDF-Expand(PRK, "data e2p" | TH3, 32)
+```
+
+**Diagram:**
+```mermaid
+sequenceDiagram
+    participant Polites
+    participant Eurylochus
+    Polites->>Eurylochus: OPENTUNNEL, x25519(ek_p, 9), qk_p=MLKEM768-pubkey()
+    Eurylochus->>Polites: ACK-OPENTUNNEL, x25519(ek_e, 9), MLKEM768-encapsulated(qk_p), k_hs_e.encrypt(nonce=0, identity_e | sig_e)
+    Note right of Polites: identity_e and sig_e match for host eurylochus.aeaea.circe
+    Polites->>Eurylochus: IDENTIFY, k_hs_p.encrypt(nonce=0, identity_p | sig_p)
+    Note right of Eurylochus: identity_p and sig_p match for host polites.aeaea.circe
+    Eurylochus->>Polites: DATA, seqn0, k_d_e2p.encrypt(nonce=seqn0, packet length | packet contents), random padding bytes
+    Polites->>Eurylochus: DATA, seqn1, k_d_p2e.encrypt(nonce=seqn1, packet length | packet contents), random padding bytes
+    Eurylochus->>Polites: COMMAND, seqn2, k_d_e2p.encrypt(nonce=seqn2, CLOSE_TUNNEL | sig_e), random padding bytes
+```
+
+## References
+
+- [Curve25519](http://cr.yp.to/ecdh/curve25519-20051115.pdf)
+- [ChaCha20-Poly1305](https://datatracker.ietf.org/doc/html/rfc7539)
+- [MLKEM-768](https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.203.pdf)
+- [MLDSA-44](https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.204.pdf)
+- [KangarooTwelve128](https://eprint.iacr.org/2016/770.pdf)
+- [SHA2](https://csrc.nist.gov/groups/STM/cavp/documents/shs/sha256-384-512.pdf)
+- [Raft](https://raft.github.io/raft.pdf)

M meson.build → meson.build

@@ -15,11 +15,11 @@ core_sources = []
 
 core_incdir = include_directories('core/')
 
-core_target = static_library('libcirce-core', core_sources, c_args: build_args, include_directories: core_incdir)
+core_target = static_library('circe-core', core_sources, c_args: build_args, include_directories: core_incdir)
 
 core_dep = declare_dependency(
   include_directories: core_incdir,
-  link_with : target
+  link_with : core_target
 )
 set_variable(meson.project_name() + '_core_dep', core_dep)