1 files changed, 10 insertions, 4 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
index ff3da33..3d9c3c6 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/keyderive.js
@@ -246,16 +246,22 @@ async function regenerateKeys(token, username, password) {
   };
 }
 
-async function signChallenge(skEdPkcs8B64, challengeB64) {
+/**
+ * Sign an explicit byte string with the user's Ed25519 identity key.
+ *
+ * Takes bytes rather than a base64 blob from the wire: callers are expected to
+ * build the message themselves (see MeshBayCrypto.adminTranscript) so that the
+ * user's identity key is never applied to content the peer chose. Finding H5.
+ */
+async function signBytes(skEdPkcs8B64, message) {
   const skRaw = Uint8Array.from(atob(skEdPkcs8B64), c => c.charCodeAt(0));
   const sk = await crypto.subtle.importKey(
     'pkcs8', skRaw, { name: 'Ed25519' }, false, ['sign']);
-  const challenge = Uint8Array.from(atob(challengeB64), c => c.charCodeAt(0));
-  const sig = await crypto.subtle.sign('Ed25519', sk, challenge);
+  const sig = await crypto.subtle.sign('Ed25519', sk, message);
   return btoa(String.fromCharCode(...new Uint8Array(sig)));
 }
 
 window.MeshBayKeys = {
-  registerUser, loginAndRecover, regenerateKeys, generateKeypairs, signChallenge,
+  registerUser, loginAndRecover, regenerateKeys, generateKeypairs, signBytes,
   deriveAuthKey, decryptBundleWithKey,
 };