feat: the node signs its handshake challenge (MNP 3.4)

node_pk in handshake_challenge is now signed over the channel binding
and both nonces, so a client can check the node key before a join
rather than only at the ack. Both transports; the browser and the QUIC
client refuse a wrong signature and treat an absent one as an older node.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 14 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
index fd24404..a3680ce 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
@@ -398,6 +398,7 @@ function adminTranscript(op, nodePkB64, groupId, subject, nonceB64, ts) {
 // bound in, so a client proof can never be replayed as a node proof and a missing
 // fingerprint cannot silently degrade the proof to nonce-only (L4).
 const HANDSHAKE_PREFIX = new TextEncoder().encode('meshbay:mnp:handshake:v1');
+const CHALLENGE_PREFIX = new TextEncoder().encode('meshbay:mnp:challenge:v1');
 
 function _lenPrefixed(parts) {
   let total = 0;
@@ -432,6 +433,18 @@ function handshakeTranscript(role, groupId, nonceClient, nonceNode, binding) {
   return out;
 }
 
+// Mirrors meshbay_common/handshake.py challenge_transcript (MNP 3.4): what the
+// node signs in handshake_challenge, so its key can be checked before a join.
+function challengeTranscript(groupId, nonceClient, nonceNode, binding) {
+  const body = _lenPrefixed([
+    new TextEncoder().encode(groupId), nonceClient, nonceNode, binding,
+  ]);
+  const out = new Uint8Array(CHALLENGE_PREFIX.length + body.length);
+  out.set(CHALLENGE_PREFIX, 0);
+  out.set(body, CHALLENGE_PREFIX.length);
+  return out;
+}
+
 async function handshakeProof(gekRaw, role, groupId, nonceClient, nonceNode, binding) {
   const transcript = handshakeTranscript(role, groupId, nonceClient, nonceNode, binding);
   const key = await crypto.subtle.importKey(
@@ -572,7 +585,7 @@ window.MeshBayCrypto = {
   openGroup, sealGroup,
   generateGEK, wrapGEK, unwrapGEK, encryptChunk, b64encode, b64decode,
   adminTranscript, handshakeTranscript, handshakeProof, webrtcBinding,
-  joinTranscript, verifyNodeSignature, constantTimeEqual,
+  challengeTranscript, joinTranscript, verifyNodeSignature, constantTimeEqual,
   deviceRequestTranscript, deviceAddTranscript, deviceHelloTranscript,
   deviceCodeHash,
   sealChat, openChat, chatSigningTranscript, verifyChatSignature,