diff options
Diffstat (limited to 'docs/MESHBAY_DESIGN.md')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 6dd1b2e..49baa6a 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -283,7 +283,11 @@ new_pk_x25519)`. The approving device asks the node for this account's pending requests **with their stored hashes** and recomputes the hash for each until one matches. **An approval answers a pending request**: it names the request's hash, and the node admits the keys only if that request was filed by those same keys. A -countersignature alone — however it was obtained — admits nothing. Retiring a +countersignature alone — however it was obtained — admits nothing. **A code that +matches more than one pending request approves none**: filing needs only the +account's token, so somebody holding the passphrase who saw the code could file +their own keys under it, and the first match would then be whoever filed first. +The new device shows a new code instead. Retiring a device is signed under a prefix of its own, never the admission transcript: a signature given to retire a key would otherwise admit it. |