Bind security-v2 signing SSIDs to the immutable message context - #16
Draft
mswilkison wants to merge 1 commit into
Draft
mswilkison wants to merge 1 commit into
mswilkison wants to merge 1 commit into
Conversation
Include the message integer and fixed byte width in security-v2 signing SSIDs. Preserve legacy transcript selection and the 32-byte SSID encoding. Snapshot the caller's message when constructing a signing party so its context remains stable. Add context separation, matching-peer, fixed-width, message ownership, and legacy tests. SSID binding adapted from the ECDSA signing changes in upstream commits 71dad22 and b73eea7.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on #9 and is stacked on
codex/dual-mode-transcript.Bind ECDSA security-v2 signing SSIDs to the message integer and
fullBytesLen, retaining the fixed 32-byte SSID encoding. Copy the caller's message at party construction so later caller mutations cannot change the signing context. Legacy transcript bytes remain unchanged.This changes the security-v2 transcript: all signers in a ceremony must deploy and activate this version together. Pre-change and post-change security-v2 parties cannot interoperate. Kept as a draft for coordinated transcript rollout.
Adapted from public upstream
71dad2229842cf296cfae00f8fd8c90d485107a0andb73eea74beb0bf112d34bc67d30736edcd34632e, with local message-ownership coverage.Validation: the full
ecdsa/signingsuite passed, including legacy/security-v2 and HD signing. Context-separation, leading-zero encoding, matching-peer, and constructor-ownership tests passed. The bidirectional historical transcript oracle passed on the final commit, with equal canonical legacy vectors and both verification directions successful. Repository-widego vet, formatting, diff checks, and independent review plus correction verification passed. Tests usedGOMAXPROCS=2and-p 1.Full test CI and formatting CI were dispatched for this branch because the automatic PR trigger only covers master.