Module hybrid 

Strobe KK hybrid transport: Classic McEliece 8192128f (static keys, mutual auth)

• X25519 (ephemeral forward-secrecy key).

Protocol string: "StrobeKK_CME8192128_X25519/v1"

Handshake layout ────────────────

msg1 (initiator → responder, KK_HYBRID_MSG1_LEN bytes):

| CME ciphertext (208 B) | X25519 ephemeral pk (32 B) | MAC (16 B) |

msg2 (responder → initiator, KK_HYBRID_MSG2_LEN bytes):

| X25519 ephemeral pk (32 B) | CME ciphertext to initiator (208 B) | MAC (16 B) |

Transcript (initiator side; responder mirrors recv/send):

STROBE("StrobeKK_CME8192128_X25519/v1")
AD(responder_cme_pk)
AD(initiator_cme_pk)
AD(prologue)
send_clr(ct_cme_r)        // msg1[0..208]
KEY(ss_cme_r)
send_enc(init_eph_pk)     // msg1[208..240]
send_mac(16)              // msg1[240..256]
recv_enc(resp_eph_pk)     // msg2[0..32]
KEY(ss_x25519)
recv_enc(ct_cme_i)        // msg2[32..240]
KEY(ss_cme_i)
recv_mac(16)              // msg2[240..256]

Structs

StrobeKkHybridHandshake

In-progress KK hybrid handshake — holds the ephemeral and static keys until msg2 arrives.

StrobeKkHybridInitiator

Reusable initiator config for the Strobe KK hybrid handshake.

StrobeKkHybridResponder

Responder side of the Strobe KK hybrid handshake.

Enums

Error

Constants

KK_HYBRID_MSG1_LEN

Length of the first handshake message (initiator → responder). CME ciphertext (208) + X25519 ephemeral pk (32) + MAC (16).

KK_HYBRID_MSG2_LEN

Length of the second handshake message (responder → initiator). X25519 ephemeral pk (32) + CME ciphertext to initiator (208) + MAC (16).