.El
.Pp
After creating initialising
-.Fa ctx ,
+.Fa ctx ,
the client calls
.Fn crypto_kex_x_1
to generate
which is application logic and not part of the key exchange protocol.
.Pp
After initialising
-.Fa ctx ,
+.Fa ctx ,
the server waits for the client to send
.Fa msg1
and reads it from the network.
and
.Fn crypto_kex_x_1
return nothing.
-.PP
+.Pp
.Fn crypto_kex_x_2
returns 0 on success or -1 if the messages were corrupt or mismatched the
server's identity.
.Bd -literal -offset indent
crypto_kex_ctx client_ctx; /* key exchange context */
uint8_t sk[32]; /* 32 random bytes long-term secret key */
-uint8_t their_pk[32]; /* the server's public key
+uint8_t their_pk[32]; /* the server's public key
* (known ahead of time) */
uint8_t seed[32]; /* 32 random bytes */
uint8_t buf[80]; /* buffer for the key exchange messages */
.El
.Pp
After initialising
-.Fa ctx ,
+.Fa ctx ,
the client calls
.Fn crypto_kex_xk1_1
to generate
are generated ahead of time and known to the clients.
.Pp
After initialising
-.Fa ctx ,
+.Fa ctx ,
the server waits for the client to send
.Fa msg1
and reads it from the network.
.Bd -literal -offset indent
crypto_kex_ctx client_ctx; /* key exchange context */
uint8_t sk[32]; /* 32 random bytes long-term secret key */
-uint8_t their_pk[32]; /* the server's public key
+uint8_t their_pk[32]; /* the server's public key
* (known ahead of time) */
uint8_t seed[32]; /* 32 random bytes */
uint8_t buf[48]; /* buffer for the key exchange messages */
.Ft int
.Fo crypto_memcmp
.Fa "const uint8_t *p1"
-.Fa"const uint8_t *p2"
+.Fa "const uint8_t *p2"
.Fa "size_t n"
.Fc
.Ft int
checks that a given signature is genuine.
Meaning, only someone who had the private key could have signed the
message.
-.Sy \It does not run in constant time .
+.Sy \&It does not run in constant time .
It does not have to in most threat models, because nothing is secret:
everyone knows the public key, and the signature and message are
rarely secret.