From 15087b0e8fdb872602310119f14680aaa443fd93 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 3 Sep 2026 14:09:18 +0200 Subject: docs: Windows port audit and sender key distribution decision Add docs/WINDOWS-PORT.md with the full portability audit (what is already portable, what blocks, implementation plan W1-W7). Reverse structural decision 20: sender keys are distributed GEK-wrapped, not pairwise to identity keys. The GEK is the group secret; files and chat share the same access boundary. Per-device chains (15.0b) remain required for correctness. Co-Authored-By: Claude Opus 4.6 --- CLAUDE.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'CLAUDE.md') diff --git a/CLAUDE.md b/CLAUDE.md index 0197d1e..0292a82 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -675,9 +675,13 @@ anything that assumes one key per person. gathering, one ISP validated. **ICE/STUN (WebRTC) is the traversal path**, for native clients too (via `aiortc` in Python) - Argon2id 256 MB was applied to the **hub only**; `crypto.py` keystore is still 64 MB -- Sender keys must be distributed **pairwise to identity keys**, never GEK-derived — and - **per device, never per person** (2026-08-17). Two devices sharing one sending chain - both advance it, producing key/nonce reuse: that is C1 again, one level down. +- ~~Sender keys must be distributed pairwise to identity keys, never GEK-derived.~~ + **Reversed 2026-09-03:** sender keys are distributed **GEK-wrapped**. The GEK is the + group secret; files and chat share the same access boundary. Pairwise distribution + added complexity for a separation (files vs chat) that has no meaning in this + platform's group model. Sender keys remain **per device, never per person** + (2026-08-17). Two devices sharing one sending chain both advance it, producing + key/nonce reuse: that is C1 again, one level down. `GroupSenderKeyStore.add_sender` currently does `self._states[dist.sender_id] = ...`, so a second device under the same `sender_id` silently overwrites the first. Revoking a device must rotate, like revoking a member. See `docs/devel-phases-next.md` §15.0b -- cgit v1.2.3