Skip to content

Use 64-bit integer for session sending key counter on 32-bit platforms#460

Open
JeroenRobben wants to merge 2 commits intocloudflare:masterfrom
JeroenRobben:master
Open

Use 64-bit integer for session sending key counter on 32-bit platforms#460
JeroenRobben wants to merge 2 commits intocloudflare:masterfrom
JeroenRobben:master

Conversation

@JeroenRobben
Copy link
Copy Markdown

@JeroenRobben JeroenRobben commented Mar 18, 2026

The sending key/nonce counter must be 64 bits wide, but the current implementation uses AtomicUsize, which is only 32 bits wide on 32-bit platforms. This will wrap-around after 2^32 packets are sent in a single secure session, hence leading to nonce reuse. This is less likely in practice, since secure sessions are expected to rotate every 120 seconds.

This change switches the counter to AtomicU64. However, AtomicU64 is not available on arm-linux-androideabi (but is on the other arm targets), so maintaining support for that target may require using AtomicU64 from the portable_atomic crate or a Mutex<u64>

@celeste-sinead
Copy link
Copy Markdown
Collaborator

Hey, thanks for this. I'd support taking a portable_atomic dependency for this :)

@JeroenRobben
Copy link
Copy Markdown
Author

Done, I've switched to portable_atomic::AtomicU64. This should also make it easier to resolve #450.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants