NodeCrypto
X25519 + HKDF with port names
The same session-key derivation with role names on the fixed ports of both nodes.
Overview & Cryptographic Context
When chaining key agreement into key derivation, renaming the ports on both nodes makes the security boundary between the non-uniform raw ECDH output and the uniform HKDF session key immediately explicit on the canvas. This workflow is functionally identical to X25519 + HKDF, but customizes port names and attaches Markdown memos on both nodes.
Specifically, the output of X25519 Key Exchange (ECDH) (port ID sharedSecret) and the input of HKDF Key Derivation (port ID ikm) are both given the display name Raw Shared Secret, while HKDF's okm output is renamed to Session Key.
Pipeline Architecture & Role Port Mapping
- X25519 Port Labels:
privateKey→Local Private Key,peerPublicKey→Peer Public Key,sharedSecret→Raw Shared Secret. - HKDF Port Labels:
ikm→Raw Shared Secret,info→Context Info,okm→Session Key.
Nodes & Configuration
| Node | Node Role & Renamed Ports | Count |
|---|---|---|
| Workflow Input | Supplies PrivateKey, PeerPublicKey, Salt, and Info | 1 |
| X25519 Key Exchange (ECDH) | Outputs Raw Shared Secret (port ID sharedSecret) | 1 |
| HKDF Key Derivation | hashAlgorithm = "SHA-256", keyLength = 32; outputs Session Key (port ID okm) | 1 |
| Workflow Output | Collects the 32-byte SessionKey | 1 |
Inputs, Outputs & Test Vector Verification
Verification Source: RFC 7748 §6.1 shared secret; HKDF-SHA-256 output cross-checked with Node.js crypto.hkdfSync
Inputs
| Name | Type | Value (Hex) |
|---|---|---|
PrivateKey | bytes (32 B) | 77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a |
PeerPublicKey | bytes (32 B) | de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f |
Salt | bytes (13 B) | 000102030405060708090a0b0c |
Info | bytes (22 B) | 6e6f646563727970746f2073657373696f6e206b6579 |
Expected Outputs
| Name | Type | Value (Hex) |
|---|---|---|
SessionKey | bytes (32 B) | 7d87f69eef5eee6ad11c518723db4f5f8708a99c84e9a3589df85d62d7b14c9b |