K01-I2: Yes
Rationale
Pinned i2pd 2.58.0 implements type-6 end-to-end ratchet establishment. NewSessionReplyMessage first mixes the X25519 ephemeral agreement, encapsulates to the received ML-KEM key, authenticates the ciphertext in the transcript and calls MixKey on the KEM secret. It then mixes the additional X25519 agreement before deriving directional ratchet keys and the reply payload key. HandleNewOutgoingSessionReply performs matching decapsulation and key derivation. Crypto.cpp implements MixKey using HKDF with the current chaining key and the 32-byte secret. This supports a documentary Yes for the selected hybrid key establishment against passive recorded-traffic decryption, subject to the component cryptographic assumptions. It is an endpoint ratchet construction, not an inference from adjacent-router NTCP2 protection.
Assessment method
Documentary source mapping with explicit hybrid profile and first-flight boundary
Source context
Pinned official i2pd 2.58.0 source and I2P hybrid specification, reviewed 2026-10-22
Outstanding qualification
The initial New Session flight carries an ML-KEM public key but has not incorporated a KEM shared secret: its payload is outside this post-quantum confidentiality claim. WrapSingleMessage can include a payload in that flight; no automatic application-data deferral was established. Reply and subsequent hybrid-derived traffic are the positive witness. Destination.cpp accepts an explicit encryption-type list and uses its first nonzero type as a preference; PQ-enabled defaults also include classical types. LeaseSet.cpp chooses a supported preferred type, or a higher supported available type when that preference is absent. Preference is therefore not a universal minimum-security requirement. Builds below OpenSSL 3.5 skip PQ types; those builds and sessions selecting type 4 are excluded. Both endpoints and the actual selected type must match the witness. No PQ authentication, full-traffic PQ anonymity, independent audit, local handshake execution or interoperability result is claimed. Other cells keep their own configurations.
Public sources
- https://github.com/PurpleI2P/i2pd/blob/e8d59c83754a0809b753ea7f59021160f755abad/libi2pd/ECIESX25519AEADRatchetSession.cpp
- https://github.com/PurpleI2P/i2pd/blob/e8d59c83754a0809b753ea7f59021160f755abad/libi2pd/Crypto.cpp
- https://github.com/PurpleI2P/i2pd/blob/e8d59c83754a0809b753ea7f59021160f755abad/libi2pd/Crypto.h
- https://github.com/PurpleI2P/i2pd/blob/e8d59c83754a0809b753ea7f59021160f755abad/libi2pd/Destination.cpp
- https://github.com/PurpleI2P/i2pd/blob/e8d59c83754a0809b753ea7f59021160f755abad/libi2pd/LeaseSet.cpp
- https://www.i2p.net/en/docs/specs/ecies-hybrid/
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round422.html
- round422-sources.json