feat: the node signs its handshake challenge (MNP 3.4)

node_pk in handshake_challenge is now signed over the channel binding
and both nonces, so a client can check the node key before a join
rather than only at the ack. Both transports; the browser and the QUIC
client refuse a wrong signature and treat an absent one as an older node.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

3 files changed, 49 insertions, 4 deletions

diff --git a/packages/meshbay-node/src/meshbay_node/transport/quic_client.py b/packages/meshbay-node/src/meshbay_node/transport/quic_client.py
index 273f225..8f3fb74 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/quic_client.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/quic_client.py
@@ -26,6 +26,7 @@ from meshbay_common.handshake import (
     NONCE_LEN,
     ROLE_CLIENT,
     ROLE_NODE,
+    challenge_transcript,
     check_version,
     handshake_transcript,
     make_proof,
@@ -211,6 +212,17 @@ class QuicChunkClient:
                 "session — refusing to handshake without channel binding")
         binding = quic_binding(self._peer_cert_der)
 
+        # MNP 3.4: a signed challenge proves the node key before we send anything
+        # else. A wrong signature is refused; an absent one is an older node.
+        if reply.get("sig"):
+            try:
+                Ed25519PublicKey.from_public_bytes(
+                    base64.b64decode(reply.get("node_pk", ""))
+                ).verify(base64.b64decode(reply["sig"]), challenge_transcript(
+                    self._group_id, nonce_c, nonce_s, binding))
+            except Exception as exc:
+                raise ConnectionError(f"Node challenge signature invalid: {exc}") from exc
+
         self._proto._send(self._ctrl_stream, {
             "type":  MNP.HANDSHAKE_RESPONSE,
             "v":     MNP_VERSION,
diff --git a/packages/meshbay-node/src/meshbay_node/transport/quic_server.py b/packages/meshbay-node/src/meshbay_node/transport/quic_server.py
index 036574b..96cd752 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/quic_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/quic_server.py
@@ -41,6 +41,7 @@ from meshbay_common.handshake import (
     ROLE_NODE,
     HandshakeError,
     authorize_token,
+    challenge_transcript,
     check_version,
     handshake_transcript,
     make_proof,
@@ -313,11 +314,23 @@ class _MNPServerProtocol(QuicConnectionProtocol):
         # Decoded but NOT authenticated: authentication is the GEK proof below.
         self._pending = peer
         self._gek_challenge = os.urandom(NONCE_LEN)
+        # The same announcement and signature as WebRTC's challenge (MNP 3.4),
+        # so the two transports stay one handshake. The binding is the node's
+        # certificate, which is known here as it is at the proof.
+        sig = {}
+        cert = self._ctx.get("server_cert_der")
+        if cert:
+            transcript = challenge_transcript(
+                peer.group_id, self._nonce_client, self._gek_challenge,
+                quic_binding(cert))
+            sig = {"sig": base64.b64encode(self._ctx["sk_node"].sign(transcript)).decode()}
         self._send(stream_id, {
-            "type":  MNP.HANDSHAKE_CHALLENGE,
-            "v":     MNP_VERSION,
-            "v_min": MNP_MIN_SUPPORTED,
-            "nonce": base64.b64encode(self._gek_challenge).decode(),
+            "type":    MNP.HANDSHAKE_CHALLENGE,
+            "v":       MNP_VERSION,
+            "v_min":   MNP_MIN_SUPPORTED,
+            "nonce":   base64.b64encode(self._gek_challenge).decode(),
+            "node_pk": pk_to_b64(self._ctx["sk_node"].public_key()),
+            **sig,
         })
 
     def _do_handshake_response_sync(self, stream_id: int, msg: dict) -> None:
diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
index a5e15df..809c5c5 100644
--- a/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
+++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc_server.py
@@ -99,6 +99,7 @@ from meshbay_common.handshake import (
     ROLE_NODE,
     HandshakeError,
     authorize_token,
+    challenge_transcript,
     check_version,
     handshake_transcript,
     make_proof,
@@ -962,8 +963,27 @@ class WebRTCPeerSession:
             # the two match, and a wrong value only makes our own verification
             # fail. It is never a substitute for the ack's proof and signature.
             "node_pk": self._node_pk_b64(),
+            # ...except that since 3.4 it is signed, so a client that already
+            # knows which key to expect can check it before it sends a code.
+            **self._challenge_sig(peer.group_id, self._channel_binding()),
         })
 
+    def _challenge_sig(self, group_id: str, binding: bytes) -> dict:
+        """
+        `{"sig": ...}` over the challenge transcript, or nothing (MNP 3.4).
+
+        What makes `node_pk` above more than an announcement: a client about to
+        send an invitation code can check this node holds the key it was told
+        to expect, before the code leaves. No binding means no signature rather
+        than an unbound one — a signature that is not tied to the channel is one
+        somebody can relay, and the handshake proof refuses that case anyway.
+        """
+        if not binding:
+            return {}
+        transcript = challenge_transcript(
+            group_id, self._nonce_client, self._gek_challenge, binding)
+        return {"sig": base64.b64encode(self._ctx["sk_node"].sign(transcript)).decode()}
+
     def _do_handshake_response(self, msg: dict) -> None:
         if not self._gek_challenge or not hasattr(self, "_pending_sub"):
             self._send({"type": "error", "detail": "No pending handshake challenge"})