[akasakariko]

Fixes #502

Problem

The peer ephemeral public key received during the handshake is used in a Diffie-Hellman exchange without any check on the result

X25519 against the identity point or a small order point produces an all-zero shared secret, which was mixed into the key schedule instead of aborting the handshake, contrary to section 6 of RFC 7748

Fix

Add a check that rejects non contributory Diffie-Hellman results and return a new WireGuardError::InvalidPublicKey variant

The check is applied to every exchange that involves a peer supplied ephemeral public key

• parse_handshake_anon
• receive_handshake_initialization
• both exchanges in receive_handshake_response

Peer static public keys that come from the local configuration are left unchanged

Tests

New unit tests in the handshake module cover the identity point and the small order point encodings in both handshake directions

The tests assert that the handshake fails with InvalidPublicKey, and they fail on the parent commit because the handshake is accepted there

Verification

• cargo test -p boringtun: 13 passed
• cargo test -p boringtun --features mock-instant: 14 passed
• cargo test -p boringtun --doc: no doctests
• cargo fmt --all --check
• cargo clippy -p boringtun --all-targets, with and without mock-instant: no new warnings

The root integration tests were not run locally because they need a tun device and root privileges