don't create encryption for new transit tunnel immediately

libi2pd/I2NPProtocol.cpp

@@ -558,7 +558,8 @@ namespace i2p
 					return;
 				}
 				auto& noiseState = i2p::context.GetCurrentNoiseState ();
-				uint8_t replyKey[32], layerKey[32], ivKey[32];
+				uint8_t replyKey[32]; // AEAD/Chacha20/Poly1305
+				i2p::crypto::AESKey layerKey, ivKey; // AES
 				i2p::crypto::HKDF (noiseState.m_CK, nullptr, 0, "SMTunnelReplyKey", noiseState.m_CK);
 				memcpy (replyKey, noiseState.m_CK + 32, 32);
 				i2p::crypto::HKDF (noiseState.m_CK, nullptr, 0, "SMTunnelLayerKey", noiseState.m_CK);

libi2pd/TransitTunnel.cpp

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2021, The PurpleI2P Project
+* Copyright (c) 2013-2022, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -20,16 +20,21 @@ namespace i2p
 namespace tunnel
 {
 	TransitTunnel::TransitTunnel (uint32_t receiveTunnelID,
-		const uint8_t * nextIdent, uint32_t nextTunnelID,
-		const uint8_t * layerKey,const uint8_t * ivKey):
-			TunnelBase (receiveTunnelID, nextTunnelID, nextIdent)
+		const i2p::data::IdentHash& nextIdent, uint32_t nextTunnelID,
+		const i2p::crypto::AESKey& layerKey, const i2p::crypto::AESKey& ivKey):
+			TunnelBase (receiveTunnelID, nextTunnelID, nextIdent),
+			m_LayerKey (layerKey), m_IVKey (ivKey)
 	{
-		m_Encryption.SetKeys (layerKey, ivKey);
 	}
 
 	void TransitTunnel::EncryptTunnelMsg (std::shared_ptr<const I2NPMessage> in, std::shared_ptr<I2NPMessage> out)
 	{
-		m_Encryption.Encrypt (in->GetPayload () + 4, out->GetPayload () + 4);
+		if (!m_Encryption)
+		{
+			m_Encryption.reset (new i2p::crypto::TunnelEncryption);
+			m_Encryption->SetKeys (m_LayerKey, m_IVKey);
+		}	
+		m_Encryption->Encrypt (in->GetPayload () + 4, out->GetPayload () + 4);
 		i2p::transport::transports.UpdateTotalTransitTransmittedBytes (TUNNEL_DATA_MSG_SIZE);
 	}
 
@@ -94,8 +99,8 @@ namespace tunnel
 	}
 
 	std::shared_ptr<TransitTunnel> CreateTransitTunnel (uint32_t receiveTunnelID,
-		const uint8_t * nextIdent, uint32_t nextTunnelID,
-		const uint8_t * layerKey,const uint8_t * ivKey,
+		const i2p::data::IdentHash& nextIdent, uint32_t nextTunnelID,
+		const i2p::crypto::AESKey& layerKey, const i2p::crypto::AESKey& ivKey,
 		bool isGateway, bool isEndpoint)
 	{
 		if (isEndpoint)

libi2pd/TransitTunnel.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2021, The PurpleI2P Project
+* Copyright (c) 2013-2022, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -28,8 +28,8 @@ namespace tunnel
 		public:
 
 			TransitTunnel (uint32_t receiveTunnelID,
-				const uint8_t * nextIdent, uint32_t nextTunnelID,
-				const uint8_t * layerKey,const uint8_t * ivKey);
+				const i2p::data::IdentHash& nextIdent, uint32_t nextTunnelID,
+				const i2p::crypto::AESKey& layerKey, const i2p::crypto::AESKey& ivKey);
 
 			virtual size_t GetNumTransmittedBytes () const { return 0; };
 
@@ -39,7 +39,8 @@ namespace tunnel
 			void EncryptTunnelMsg (std::shared_ptr<const I2NPMessage> in, std::shared_ptr<I2NPMessage> out);
 		private:
 
-			i2p::crypto::TunnelEncryption m_Encryption;
+			i2p::crypto::AESKey m_LayerKey, m_IVKey;
+			std::unique_ptr<i2p::crypto::TunnelEncryption> m_Encryption;
 	};
 
 	class TransitTunnelParticipant: public TransitTunnel
@@ -47,8 +48,8 @@ namespace tunnel
 		public:
 
 			TransitTunnelParticipant (uint32_t receiveTunnelID,
-				const uint8_t * nextIdent, uint32_t nextTunnelID,
-				const uint8_t * layerKey,const uint8_t * ivKey):
+				const i2p::data::IdentHash& nextIdent, uint32_t nextTunnelID,
+				const i2p::crypto::AESKey& layerKey, const i2p::crypto::AESKey& ivKey):
 				TransitTunnel (receiveTunnelID, nextIdent, nextTunnelID,
 				layerKey, ivKey), m_NumTransmittedBytes (0) {};
 			~TransitTunnelParticipant ();
@@ -68,8 +69,8 @@ namespace tunnel
 		public:
 
 			TransitTunnelGateway (uint32_t receiveTunnelID,
-				const uint8_t * nextIdent, uint32_t nextTunnelID,
-				const uint8_t * layerKey,const uint8_t * ivKey):
+				const i2p::data::IdentHash& nextIdent, uint32_t nextTunnelID,
+				const i2p::crypto::AESKey& layerKey, const i2p::crypto::AESKey& ivKey):
 				TransitTunnel (receiveTunnelID, nextIdent, nextTunnelID,
 				layerKey, ivKey), m_Gateway(this) {};
 
@@ -88,8 +89,8 @@ namespace tunnel
 		public:
 
 			TransitTunnelEndpoint (uint32_t receiveTunnelID,
-				const uint8_t * nextIdent, uint32_t nextTunnelID,
-				const uint8_t * layerKey,const uint8_t * ivKey):
+				const i2p::data::IdentHash& nextIdent, uint32_t nextTunnelID,
+				const i2p::crypto::AESKey& layerKey, const i2p::crypto::AESKey& ivKey):
 				TransitTunnel (receiveTunnelID, nextIdent, nextTunnelID, layerKey, ivKey),
 				m_Endpoint (false) {}; // transit endpoint is always outbound
 
@@ -104,8 +105,8 @@ namespace tunnel
 	};
 
 	std::shared_ptr<TransitTunnel> CreateTransitTunnel (uint32_t receiveTunnelID,
-		const uint8_t * nextIdent, uint32_t nextTunnelID,
-		const uint8_t * layerKey,const uint8_t * ivKey,
+		const i2p::data::IdentHash& nextIdent, uint32_t nextTunnelID,
+		const i2p::crypto::AESKey& layerKey, const i2p::crypto::AESKey& ivKey,
 		bool isGateway, bool isEndpoint);
 }
 }

libi2pd/TunnelBase.h

@@ -1,5 +1,5 @@
 /*
-* Copyright (c) 2013-2020, The PurpleI2P Project
+* Copyright (c) 2013-2022, The PurpleI2P Project
 *
 * This file is part of Purple i2pd project and licensed under BSD3
 *
@@ -41,7 +41,7 @@ namespace tunnel
 	{
 		public:
 
-			TunnelBase (uint32_t tunnelID, uint32_t nextTunnelID, i2p::data::IdentHash nextIdent):
+			TunnelBase (uint32_t tunnelID, uint32_t nextTunnelID, const i2p::data::IdentHash& nextIdent):
 				m_TunnelID (tunnelID), m_NextTunnelID (nextTunnelID), m_NextIdent (nextIdent),
 				m_CreationTime (i2p::util::GetSecondsSinceEpoch ()) {};
 			virtual ~TunnelBase () {};