KDF Chain Implementation

Detailed implementation of the symmetric chain.

The constants 0x01 and 0x02 are domain separators — ensures mk != ck.

Per message, derive AEAD key + nonce + auth_key from mk:

Encrypt:

Sender state per direction:

sending_chain = (DH, dh_priv, dh_pub_peer, ck_send, n_send)
receiving_chain = (ck_recv, n_recv)

n_send, n_recv are message counters. Used in headers to:

• Detect out-of-order delivery.
• Skip ahead if a message is missed (deriving and storing intermediate mks).

Out-of-order:

Cache eviction: drop after a max-skip count or time bound. Else memory grows on attacker stuffing huge n.