diff options
Diffstat (limited to 'docs/meshbay-draft-v5.md')
| -rw-r--r-- | docs/meshbay-draft-v5.md | 27 |
1 files changed, 23 insertions, 4 deletions
diff --git a/docs/meshbay-draft-v5.md b/docs/meshbay-draft-v5.md index b4a9e45..6fdbbc6 100644 --- a/docs/meshbay-draft-v5.md +++ b/docs/meshbay-draft-v5.md @@ -348,10 +348,29 @@ separation, on-the-fly encryption. | Hub password verifier | Argon2id 256 MB over a PBKDF2-derived `auth_key` | | Browser bundle key | PBKDF2-SHA512, 600 000 iterations | -**Known weakness (C4).** Keypair bundles are protected only by PBKDF2 and are pushed to -every node whose group the user joins, while GEK and keypair bundle fetches are served in -the pre-proof window because the client needs its bundle to compute the proof. The window -is bounded (4 fetches) and audited. It closes properly when the native client stops +**Known weakness (C4), reduced 2026-08-14.** Keypair bundles are pushed to every node +whose group the user joins, and GEK and keypair bundle fetches are served in the pre-proof +window because the client needs its bundle to compute the proof. The window is bounded +(4 fetches) and audited. + +The bundle's own protection moved from PBKDF2-SHA512 to **Argon2id, 64 MB, t=3, p=1** +(`static/vendor/argon2.min.js`, WebAssembly, no external host). PBKDF2 is compute-only, +so 600k iterations cost an attacker with a GPU far less than the wall clock suggested: +measured on the dev machine, both take ~0.3 s honestly, but only one of them makes a +graphics card allocate 64 MB per guess. The two implementations — the browser's WASM and +`argon2-cffi` in QE — are held byte-identical by a parity test, because a disagreement +would present as an account nobody can open. + +What that changes, and what it does not. The bundle is what a node operator can take and +attack offline; cracking it yields the user's *identity keys*, and with them content on +**other** nodes and the ability to sign as that user — not the content on the operator's +own node, which they host in the clear by design. Argon2id raises the price of that +attack; it does not remove it, and a weak passphrase still loses. The client refuses +passphrases below 12 characters and ~60 bits, which can only be enforced there: with the +password split (T1) the hub never sees a passphrase. + +Bundles written before the change are still readable, and are re-encrypted the first time +their owner's browser backs them up. It closes properly when the native client stops storing keypair bundles remotely (Phase 13.3) — the material belongs on the user's own device, not on the hub *or* on other people's nodes. |