diff options
| -rw-r--r-- | packages/meshbay-common/src/meshbay_common/chatbox.py | 21 |
1 files changed, 17 insertions, 4 deletions
diff --git a/packages/meshbay-common/src/meshbay_common/chatbox.py b/packages/meshbay-common/src/meshbay_common/chatbox.py index e04bd9b..f3cfc76 100644 --- a/packages/meshbay-common/src/meshbay_common/chatbox.py +++ b/packages/meshbay-common/src/meshbay_common/chatbox.py @@ -16,10 +16,23 @@ The property is given up on the record rather than inherited by accident. delivers it to members wrapped under the current group key. Each device derives its *own* subkey from it, by name, so: -* two devices never share an AES key, and nonce reuse across devices is - impossible without any coordination — the property per-device ratchet chains - were wanted for, obtained by derivation instead of by mutable state (which is - C1 one level down, and is exactly what `GroupSenderKeyStore` got wrong); +* two *keys* never share a subkey, and — the part that actually matters — + **there is no mutable sending state at all**, so nothing can be advanced + twice. §15.0b wanted per-device chains because two devices advancing one + chain produce key and nonce reuse (C1, one level down, and exactly what + `GroupSenderKeyStore` got wrong). Derivation plus a *random* nonce removes + the hazard rather than partitioning it; + + Be precise about what that does **not** say, because the obvious stronger + claim is false in the deployment that exists: two clients of one account on + one node normally hold the **same** identity key — a second browser recovers + it from the keypair bundle rather than minting a new one — so they share a + device key and therefore this subkey. That is safe here only because the + nonce is 96 random bits and not a counter: two independent senders under one + key collide with probability governed by the birthday bound, which at chat + volume is unreachable, whereas two independent senders advancing one counter + collide immediately. The design degrades correctly into that reality; a + chain-based one would not have; * a receiver derives any sender's subkey from the epoch key it already has, so nothing is distributed per device and there is no per-device state to persist, migrate or lose; |