diff options
Diffstat (limited to 'packages/meshbay-common/src')
| -rw-r--r-- | packages/meshbay-common/src/meshbay_common/__init__.py | 18 | ||||
| -rw-r--r-- | packages/meshbay-common/src/meshbay_common/handshake.py | 25 |
2 files changed, 41 insertions, 2 deletions
diff --git a/packages/meshbay-common/src/meshbay_common/__init__.py b/packages/meshbay-common/src/meshbay_common/__init__.py index f10302f..1271c4e 100644 --- a/packages/meshbay-common/src/meshbay_common/__init__.py +++ b/packages/meshbay-common/src/meshbay_common/__init__.py @@ -220,5 +220,21 @@ __version__ = "0.15.0" # the node's own `stream_init` and from no version number, so the request is # never sent to a peer that could not answer it. `MNP_MIN_SUPPORTED` does not # move. -MNP_VERSION = "3.3" +# +# **3.4 (2026-09-23): the node signs its challenge.** +# +# `handshake_challenge` carries `sig`, Ed25519 by the node key over +# `meshbay:mnp:challenge:v1` ‖ group_id ‖ nonce_c ‖ nonce_s ‖ binding +# (`handshake.challenge_transcript`). Until now `node_pk` in the challenge was a +# claim: the ack proves it, but a join is sent *before* the ack, so an +# invitation code went to whichever peer answered signaling. With the +# signature, a client that knows which node it means to reach — an invitation +# link names it — can refuse to send the code anywhere else. +# +# **Additive, and MINOR because nothing is required of an older peer.** A client +# that ignores `sig` behaves exactly as before; a client that reads it refuses a +# *wrong* one outright and treats an absent one as "this node cannot prove +# itself early", which it discovers from the node's answer and never from the +# version number. `MNP_MIN_SUPPORTED` does not move. +MNP_VERSION = "3.4" MHP_VERSION = "0.1" diff --git a/packages/meshbay-common/src/meshbay_common/handshake.py b/packages/meshbay-common/src/meshbay_common/handshake.py index 4d2cac2..73e0b2e 100644 --- a/packages/meshbay-common/src/meshbay_common/handshake.py +++ b/packages/meshbay-common/src/meshbay_common/handshake.py @@ -12,7 +12,7 @@ The sequence: client → node handshake {token, group_id, nonce_c, v, v_min} node check_version() supported range, both ways node authorize_token() JWT, scope, denylist, membership, hosting - node → client handshake_challenge {nonce_s, v, v_min} + node → client handshake_challenge {nonce_s, v, v_min, node_pk, sig} client → node handshake_response {proof} node verify client proof HMAC(GEK, client transcript) node → client handshake_ack {proof, sig, node_pk, nonce, ct} @@ -65,6 +65,7 @@ import jwt from meshbay_common import MNP_VERSION HANDSHAKE_PREFIX = b"meshbay:mnp:handshake:v1" +CHALLENGE_PREFIX = b"meshbay:mnp:challenge:v1" # The oldest peer this build will talk to. # @@ -157,6 +158,28 @@ def handshake_transcript( return bytes(out) +def challenge_transcript( + group_id: str, + nonce_client: bytes, + nonce_node: bytes, + binding: bytes, +) -> bytes: + """ + Bytes the node signs in `handshake_challenge` (MNP 3.4). + + The ack proves the node key, but a join is sent before the ack — so without + this, `node_pk` in the challenge was an announcement anyone answering + signaling could make. `nonce_client` makes the signature fresh and `binding` + pins it to this connection, so one cannot be recorded and relayed. No role + field: it has its own prefix, and nothing else is signed under it. + """ + out = bytearray(CHALLENGE_PREFIX) + for field in (group_id.encode(), nonce_client, nonce_node, binding): + out += len(field).to_bytes(4, "big") + out += field + return bytes(out) + + def make_proof( gek: bytes, role: str, |