zeroed keys).

This prevents an attacker from replaying connections to test whether a
transport endpoint has the same owner as an endpoint on another
transport (eg probing a Bluetooth device to see whether it has the
same owner as a given internet host).

The data to be encrypted should go in the IV, with a blank
plaintext, so that the ciphertext is equal to the keystream.

Putting the data in the plaintext would have led to different keys
derived from the same source consisting of the same keystream XORed
with different guessable plaintexts. That would have been bad.

still exist.)

Each connection's keys are derived from a secret that is erased after
deriving the keys and the secret for the next connection.

be included in this context in the near future).

This is less memory-efficient but necessary for the coming forward
secrecy changes.

contact.

consistently.

and TransportIndex (locally unique).

This is the first step towards forward secrecy. Also removed the
Writable interface and unnecessary user-defined types, moved various
constants to ProtocolConstants and renamed some classes.

Merge branch 'refs/heads/master' of ssh://akwizgran@briar.git.sourceforge.net/gitroot/briar/prototype

Merge branch 'refs/heads/master' of ssh://akwizgran@briar.git.sourceforge.net/gitroot/briar/prototype