diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-08-13 03:56:30 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-08-13 03:56:30 +0200 |
| commit | f0248975908ad670fa8a820f865bf22ea8d0172d (patch) | |
| tree | f4af64d36cacaccb4f6d13436e001aeb57e861e3 /packages/meshbay-common/src | |
| parent | 35130e5528a52161630fd1c93572e1b2b7cd911b (diff) | |
| download | meshbay-f0248975908ad670fa8a820f865bf22ea8d0172d.tar.gz | |
feat: Phase 12 — P2P crypto material, password split, node Ed25519 auth
Baseline commit capturing in-progress Phase 12 work that was already present
in the working tree (uncommitted) before the Phase 11.5 security remediation
begins. Committed as-is, without review or modification, so that remediation
changes arrive as a separable diff.
Contents: BundleStore (P2P GEK + keypair bundles), password split
(auth_key / bundle_key), node Ed25519 auth (POST /v1/nodes/auth, node-scoped
JWT), GEK-HMAC handshake proof with DTLS channel binding, Ed25519 admin
challenge-response, node local admin UI rewrite, browser key persistence.
Not authored in this session — captured to establish a baseline.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Diffstat (limited to 'packages/meshbay-common/src')
| -rw-r--r-- | packages/meshbay-common/src/meshbay_common/protocol.py | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py index bf83906..55dcdde 100644 --- a/packages/meshbay-common/src/meshbay_common/protocol.py +++ b/packages/meshbay-common/src/meshbay_common/protocol.py @@ -40,6 +40,16 @@ class MNP: STREAM_DATA = "stream_data" # node sends encrypted fMP4 segment STREAM_END = "stream_end" # node signals end of stream EPHEMERAL_STREAM = "ephemeral_stream" # reserved — mobile live push + HANDSHAKE_CHALLENGE = "handshake_challenge" # node → client: GEK proof nonce + HANDSHAKE_RESPONSE = "handshake_response" # client → node: HMAC(GEK, nonce) + ADMIN_CHALLENGE = "admin_challenge" # node → client: Ed25519 sign challenge + ADMIN_RESPONSE = "admin_response" # client → node: Ed25519 signature + GEK_BUNDLE_STORE = "gek_bundle_store" # client → node: store wrapped GEK for a user + GEK_BUNDLE_FETCH = "gek_bundle_fetch" # client → node: request own wrapped GEK + GEK_BUNDLE_RESP = "gek_bundle_resp" # node → client: wrapped GEK bundle + KEYPAIR_BUNDLE_STORE = "keypair_bundle_store" # client → node: store encrypted keypair bundle + KEYPAIR_BUNDLE_FETCH = "keypair_bundle_fetch" # client → node: request own keypair bundle + KEYPAIR_BUNDLE_RESP = "keypair_bundle_resp" # node → client: encrypted keypair bundle # ── Index entry ─────────────────────────────────────────────────────────────── @@ -54,6 +64,8 @@ class IndexEntry: added_at: int # unix timestamp duration: int | None = None # seconds, for media thumb_hash: str | None = None # blake3 of thumbnail + uploader_id: str | None = None # user_id of who uploaded (None = pre-existing on disk) + uploader_pk: str | None = None # Ed25519 public key of uploader (base64 raw 32 bytes) @dataclass |