[noise] Mechanical definition of "fallback" modifier

[Rhys Weatherley]

I'm working on adding the rev32 changes to Noise-C / Noise-Java.  As part
of that I'm implementing the "fallback" and "pskN" modifiers as mechanical
translations on the base pattern at runtime.

While "pskN" is well defined mechanically in rev32, "fallback" is not.
Here's my attempt to make the definition precise:

---Start of definition---
The "fallback" modifier applies to interactive base patterns that with the
following properties:
  * The pre-message must either be empty or "-> s".
  * The first handshake message must consist of a single "e" token.
The "fallback" modifier thus applies to "NN", "NX", "XN", "XX", "KN", and
"KX".  Applying "fallback" to any other base pattern is an error.

The following modifications are applied to the base pattern:
  * The "e" token in the first message is moved to the pre-message as
either "<- e" or "<- e, s".
  * The first message is deleted from the handshake.
  * The remaining messages have their directions reversed.
  * All "es" tokens are replaced with "se", and all "se" tokens are
replaced with "es".

The "fallback" modifier does not commute well with other modifiers:
"XXfallback+psk2" is not the same handshake as "XXpsk2+fallback" for
example.  "XXfallback+psk0" is valid, but "XXpsk0+fallback" is invalid
because the first message is no longer a single "e" token.

It is recommended that if the "fallback" modifier is present, then it
should be applied before all other modifiers.
---End of definition--

The definition could be simplified further by restricting it to "XX" only.
I'm not sure whether things like "NNfallback" and "KXfallback" are useful,
but maybe someone can think of a use for them.

Comments?

Cheers,

Rhys.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://moderncrypto.org/mail-archive/noise/attachments/20170610/c8bc769f/attachment.html>