Rook architecture
A key agreement drawn top to bottom: an implant and a server exchange three
independent Diffie-Hellman public keys, all three are folded into one HKDF derivation,
the derived session key opens one encrypted pty channel to the operator TUI.
ROOK
key agreement // three independent pairs, all folded into the key
IMPLANT
macOS · arm64 · signs X_s
SERVER
linux · x86_64 · checks sig
1
X_e — implant ephemeral, fresh per session
2
S_e — server ephemeral, fresh per session
3
X_s — static public key, pinned as trust anchor
HKDF-SHA512 ( X_e ‖ S_e ‖ X_s )
all three mixed — no single pair is sufficient
SESSION KEY · AES-256-GCM
9f2c a41e 7bd0 33af
32 bytes, fresh every session
PTY CHANNEL
persistent shell · one per session
$ cd /var/log
$ ls -la — cwd held by the pty, not by the command
OPERATOR · Ratatui TUI
session list, live panes
cd survives across commands
transmitted in the clear
trust anchor, pinned
derived, never sent
encrypted session