| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Phase 11.5 is complete. All six critical and all seven high findings from the
second review are now closed, bounded, or deferred by explicit decision.
Updated in place rather than appended, so the document does not carry stale
"open" markers next to shipped work:
- §9 split into "closed since this document was drafted" and "still open",
with C6, 11.5.6, 11.5.8 and M8 moved across and the closing mechanism
recorded for each
- §2 claim table: node impersonation is no longer pending
- §3.1 QUIC now shows the unified handshake enforced
- §4.2 records what the QUIC binding actually turned out to be, including the
finding that a resumed TLS session carries no certificate, so the anchor
travels with the session ticket
- §4.4 states that the client pins pk_node and refuses a change
Added a scope note: with C6 closed, pinning is defence in depth, not the primary
control. A substituted node already fails the GEK proof; pinning covers the case
where an attacker holds the group key and swaps the node underneath.
H3 remains the last unfixed finding, and the document still says so.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
|
|
Supersedes draft-v4, which described a system the code did not implement and
made several claims that were simply wrong — "ALL operations require the GEK
proof" (true on one of four transports), "Argon2id 256 MB" (hub only), "hub
stores no content metadata" (private file hashes were registered with it).
Written as a delta over v4: sections not restated are unchanged. Carries an
explicit rule — a claim must name the adversary it holds against — and a
per-adversary table replacing v4's informal assurances.
Records the decisions: transport (aiortc primary, QUIC retained, TCP and the
node HTTP API removed), unified handshake with mutual authentication, admin
operation transcripts, node authority over GEK storage and activation, upload
confinement, hub node-registration and signaling authorization, and the client
architecture — hub keeps serving the web SPA, native client offered alongside,
hub minimization deferred.
States plainly what is NOT true. The defensible claim is "the hub cannot read
your content unless it actively attacks you", not "unreadable by other parties,
even the hub": H3 (hub is the key directory and can substitute a key at invite
time) is open until Phase 12.1, and T3 (hub serves the SPA) is accepted
permanently by decision. Content is also readable by every group member and by
the node operator, so "end-to-end" here means client-to-node, never
client-to-client.
Corrects the v4 NAT traversal account: punch_nat() is a single UDP probe with
no STUN, no candidate gathering and no fallback, validated on one ISP. ICE is
the traversal path, including for native clients.
Open items listed with status, including C6 on the QUIC path.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|