SFrame Header:
+----------------+----------------+----------------+----------------+
|   KID (var)    |   CTR (var)    |   Auth Tag     |
+----------------+----------------+----------------+

原始KID:     [0x00-0x7F] 单字节 | [0x80-0xFF] 多字节变长
扩展KID:     最高位保留为算法族标识位
             0x00-0x3F: 经典算法 (AES-GCM + ECDHE)
             0x40-0x7F: 混合模式 (AES-GCM + PQC KEM)
             0x80-0xBF: 纯后量子 (AES-256-GCM + ML-KEM)
             0xC0-0xFF: 预留未来扩展

# 伪代码：SFrame密钥派生上下文构造
def derive_sframe_key(base_key, kid, algorithm_suite):
    context = concat(
        "SFrame-PQ-v1",           # 协议版本标识
        algorithm_suite,          # 算法套件标识 (如: ML-KEM-768+AES-256-GCM)
        kid,                      # 密钥标识
        "key-derivation"          # 用途分离标签
    )
    return HKDF-SHA256(base_key, salt="", info=context, length=32)

Session Key (SK) = ML-KEM.Decaps(sk_recv, ct_sender)
    │
    ├──► Media Key Chain: MK_0 = HKDF(SK, "media-chain-init")
    │                        MK_{i+1} = HKDF(MK_i, "next")
    │
    └──► Header Key Chain: HK_0 = HKDF(SK, "header-chain-init")
                             HK_{i+1} = HKDF(HK_i, "next")

Extract(salt, IKM):
    // IKM = concat(classical_shared_secret, pqc_shared_secret)
    prk_1 = HMAC-SHA256(salt, IKM)
    prk_2 = HMAC-SHA3-256(salt, IKM)      // SHA-3族抗量子边际更强
    prk_3 = KMAC256(salt, IKM, "")        // Keccak基础的KMAC，NIST标准化
    return prk_1 ⊕ prk_2 ⊕ prk_3

Info 结构化编码 (TLV格式):
+--------+--------+------------------------+------------------------+
| Type   | Length | Value                  | 说明                   |
+--------+--------+------------------------+------------------------+
| 0x01   | 1      | 算法套件ID             | 如: 0x01=ML-KEM-768    |
| 0x02   | 变长   | 会话上下文             | 会话ID、参与者标识等   |
| 0x03   | 1      | 密钥用途               | 0x01=媒体加密 0x02=信令|
| 0x04   | 4      | 时间戳/轮次            | 防重放、支持密钥更新   |
| 0xFF   | 变长   | 扩展字段               | 未来兼容               |
+--------+--------+------------------------+------------------------+

def hkdf_pq_expand(prk, info_struct, length):
    # 结构化Info序列化
    info_encoded = tlv_encode(info_struct)
    
    # 域分离标签注入
    okm = b""
    counter = 1
    while len(okm) < length:
        # 每块引入独立域分离
        block_info = concat(
            counter.to_bytes(1, 'big'),
            info_encoded,
            length.to_bytes(2, 'big')
        )
        # 双哈希并行扩展
        t_1 = HMAC-SHA256(prk, block_info)
        t_2 = HMAC-SHA3-256(prk, block_info)
        okm += t_1 ^ t_2
        counter += 1
    return okm[:length]

a=extmap-allow-mixed
a=sframe-pq:1 ML-KEM-768+AES-256-GCM
a=sframe-pq:2 ML-KEM-512+AES-256-GCM
a=sframe-classic:0 X25519+AES-GCM

[预生成] → [分发中] → [激活] → [轮换中] → [归档] → [销毁]
    │           │         │         │
    ▼           ▼         ▼         ▼
  PQC-KEM   双通道分发  双棘轮    安全擦除
  密钥对    (信令+带外) 派生      (硬件级)

(* 定义算法套件类型 *)
type suite = Classic | Hybrid | PQPure.

(* 密钥派生上下文构造：显式绑定套件标识 *)
let derive_ctx(kid: bitstring, suite: suite) = 
  concat("SFrame-PQ-v1", suite, kid, "key-derivation").

(* 查询：攻击者能否在不知基础密钥前提下，伪造合法的媒体帧认证标签？ *)
query attacker: auth_tag(kid, ctr, payload, suite).

(* 查询：会话密钥在混合模式下是否保持前向保密？ *)
query attacker: session_key(sid) ==> 
  (event(KeyCompromise(sid)) | event(QuantumComputerAvailable)).

/* SPIN/Promela 片段：算法协商状态机 */
proctype Negotiator(chan in, out) {
  state = INIT;
  do
  :: (state == INIT) ->
     if
     :: in?OFFER(peer_suites) ->
        selected = select_highest_common(peer_suites, local_suites);
        /* 关键防御：强制校验选中套件在本地策略白名单中 */
        assert(selected in policy_whitelist);
        out!ANSWER(selected);
        state = CONFIRMED(selected)
     :: timeout -> out!ABORT; break
     fi
  :: (state == CONFIRMED(suite)) ->
     in?CONFIRM_ACK(peer_suite) ->
     assert(peer_suite == suite); /* 防止中间人篡改确认消息 */
     out!KEY_EXCHANGE_INIT(suite);
     state = KEY_EXCHANGE
  od
}

// 发送端：VideoFrame -> EncodedVideoChunk -> SFrame加密 -> RTP发送
class SFrameEncoder {
  constructor(encoderConfig, keyManager) {
    this.encoder = new VideoEncoder({
      output: (chunk, metadata) => this.onEncodedChunk(chunk, metadata),
      error: (e) => console.error(e)
    });
    this.keyManager = keyManager; // 管理 KID -> Key 映射
    this.pendingFrames = new Map(); // timestamp -> {kid, ctr}
  }

  async encode(frame) {
    const kid = this.keyManager.getCurrentKID();
    const ctr = this.keyManager.getNextCounter(kid);
    // 关键：将 KID/CTR 绑定到帧时间戳，而非依赖编码器输出顺序
    this.pendingFrames.set(frame.timestamp, { kid, ctr, key: this.keyManager.getKey(kid) });
    this.encoder.encode(frame);
  }

  onEncodedChunk(chunk, metadata) {
    const ctx = this.pendingFrames.get(chunk.timestamp);
    if (!ctx) return; // 丢帧或乱序保护
    
    // 零拷贝加密：直接操作 ArrayBuffer
    const encrypted = sframeSeal(ctx.key, ctx.kid, ctx.ctr, chunk.data);
    chunk.data = encrypted; // 覆盖原始载荷
    this.controller.enqueue(chunk); // 送入 RTP 发送管线
  }
}

{
  "test_vector_set": "SFrame-PQ-HKDF-PQ-v1",
  "algorithm": "ML-KEM-768 + AES-256-GCM + HKDF-PQ(SHA256, SHA3-256, KMAC256)",
  "vectors": [
    {
      "description": "Standard Key Derivation",
      "ikm_hex": "d4ee72d4... (32 bytes classical) || 3a1f8e... (32 bytes PQC)",
      "salt_hex": "00010203... (32 bytes)",
      "info_tlv_hex": "010101 0208... (TLV encoded)",
      "expected_prk_hex": "a1b2c3d4... (32 bytes)",
      "expected_okm_64_hex": "e5f6a7b8... (64 bytes)"
    },
    {
      "description": "Key Separation: Different Suite ID",
      "info_tlv_hex": "010102 ...", // Suite ID = 0x02 (Hybrid)
      "expected_okm_64_hex": "DIFFERENT_FROM_ABOVE"
    }
  ]
}

// 伪代码：种子树节点派生
struct PQNodeSecret {
    seed: [u8; 32], // 统一使用 32 字节种子
}

impl PQNodeSecret {
    // 父节点种子 -> 子节点种子 (HKDF-PQ 扩展)
    fn derive_child(&self, label: &[u8]) -> Self {
        let okm = hkdf_pq_expand(&self.seed, "", &[label], 64);
        Self {
            seed: okm[0..32].try_into().unwrap(),
            // 另 32 字节可作应用层密钥或进一步派生
        }
    }

    // 仅在叶子节点或需要跨设备同步时，执行昂贵的 ML-KEM 封装
    fn encapsulate_to(&self, peer_ek: &MlKem768PublicKey) -> (Ciphertext, SharedSecret) {
        // 使用 self.seed 作为 ML-KEM 封装的隐式随机源 (通过自定义 RNG 实现)
        // 实现确定性封装，便于审计与重放调试
        deterministic_encaps(peer_ek, &self.seed)
    }
}

// Welcome 消息紧凑编码格式 (CBOR-like)
struct WelcomeMessage {
    uint16 group_id;
    uint32 epoch;
    // 紧凑路径节点列表
    vector<NodeUpdate> path; 
    // 仅包含新成员所需的加密密钥包
    vector<EncryptedGroupSecrets> secrets; 
}

struct EncryptedGroupSecrets {
    uint32 leaf_index;        // 新成员叶子索引
    uint16 kem_suite;         // 0x0020 = ML-KEM-512
    bytes  ciphertext;        // 768 bytes
    // 无 IV/Tag，复用 ML-KEM IND-CCA2 安全性
}

// Rust 侧零化最佳实践：利用 Drop trait + 编译器屏障
use zeroize::{Zeroize, ZeroizeOnDrop};

#[derive(Zeroize, ZeroizeOnDrop)]
struct MediaKeyMaterial {
    #[zeroize(skip)] // 由 TEE 管理，不在此零化
    tee_handle: TEEHandle, 
    // 进程内存中仅保留派生出的对称密钥
    aes_key: [u8; 32], 
    hmac_key: [u8; 32],
    // 明文计数器状态（非敏感，但防篡改需签名）
    ctr_state: CounterState, 
}

// 关键：编译器优化屏障，防止零化被优化掉
impl Drop for MediaKeyMaterial {
    fn drop(&mut self) {
        self.aes_key.zeroize();
        self.hmac_key.zeroize();
        // 编译器屏障
        std::sync::atomic::compiler_fence(std::sync::atomic::Ordering::SeqCst);
    }
}

graph LR
    A[用户请求入会] --> B{分流策略引擎}
    B -->|95% 流量| C[经典轨道: X25519 + AES-GCM]
    B -->|5% 流量| D[PQ 轨道: ML-KEM-768 + HKDF-PQ]
    B -->|影子流量 1%| E[双轨并行: 同时跑两套, 仅用经典结果]
    
    C --> F[指标采集]
    D --> F
    E --> F
    
    F --> G[自动化决策引擎]
    G -->|指标达标| H[扩大 PQ 比例]
    G -->|异常| I[自动熔断回滚]

def evaluate_canary(metrics: MetricsSnapshot) -> Decision:
    # 硬性安全门禁
    if metrics.downgrade_attempts > 0:
        return Decision.ROLLBACK_IMMEDIATE
    
    # 体验门禁
    if metrics.p99_handshake_latency > BASELINE * 1.5:
        return Decision.HOLD
    
    if metrics.p99_encrypt_overhead > BASELINE * 2.0:
        return Decision.HOLD
    
    # 成功门禁
    if metrics.success_rate > 0.999 and metrics.sample_size > 10000:
        return Decision.EXPAND(ratio=min(current_ratio * 2, 0.5))
    
    return Decision.MAINTAIN

// 动态下发配置
message CryptoPolicy {
  // 算法套件优先级列表，前缀匹配
  repeated AlgorithmSuite preferred_suites = 1;
  
  // 紧急禁用列表 (立即生效, 无需重启)
  repeated string disabled_algorithms = 2; // e.g. "ML-KEM-768", "SHA3-256"
  
  // 熔断触发条件
  CircuitBreakerConfig circuit_breaker = 3;
}

message CircuitBreakerConfig {
  // 监控指标名
  string metric_name = 1; // e.g. "pq_kem_failure_rate"
  // 阈值
  double threshold = 2;   // e.g. 0.05
  // 统计窗口
  Duration window = 3;    // e.g. 5m
  // 动作: DISABLE_SUITE / FALLBACK_CLASSIC / ALERT_ONLY
  CircuitAction action = 4; 
}