From f0248975908ad670fa8a820f865bf22ea8d0172d Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 13 Aug 2026 03:56:30 +0200 Subject: feat: Phase 12 — P2P crypto material, password split, node Ed25519 auth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Baseline commit capturing in-progress Phase 12 work that was already present in the working tree (uncommitted) before the Phase 11.5 security remediation begins. Committed as-is, without review or modification, so that remediation changes arrive as a separable diff. Contents: BundleStore (P2P GEK + keypair bundles), password split (auth_key / bundle_key), node Ed25519 auth (POST /v1/nodes/auth, node-scoped JWT), GEK-HMAC handshake proof with DTLS channel binding, Ed25519 admin challenge-response, node local admin UI rewrite, browser key persistence. Not authored in this session — captured to establish a baseline. Co-Authored-By: Claude Opus 5 --- packages/meshbay-common/src/meshbay_common/protocol.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'packages/meshbay-common/src/meshbay_common') diff --git a/packages/meshbay-common/src/meshbay_common/protocol.py b/packages/meshbay-common/src/meshbay_common/protocol.py index bf83906..55dcdde 100644 --- a/packages/meshbay-common/src/meshbay_common/protocol.py +++ b/packages/meshbay-common/src/meshbay_common/protocol.py @@ -40,6 +40,16 @@ class MNP: STREAM_DATA = "stream_data" # node sends encrypted fMP4 segment STREAM_END = "stream_end" # node signals end of stream EPHEMERAL_STREAM = "ephemeral_stream" # reserved — mobile live push + HANDSHAKE_CHALLENGE = "handshake_challenge" # node → client: GEK proof nonce + HANDSHAKE_RESPONSE = "handshake_response" # client → node: HMAC(GEK, nonce) + ADMIN_CHALLENGE = "admin_challenge" # node → client: Ed25519 sign challenge + ADMIN_RESPONSE = "admin_response" # client → node: Ed25519 signature + GEK_BUNDLE_STORE = "gek_bundle_store" # client → node: store wrapped GEK for a user + GEK_BUNDLE_FETCH = "gek_bundle_fetch" # client → node: request own wrapped GEK + GEK_BUNDLE_RESP = "gek_bundle_resp" # node → client: wrapped GEK bundle + KEYPAIR_BUNDLE_STORE = "keypair_bundle_store" # client → node: store encrypted keypair bundle + KEYPAIR_BUNDLE_FETCH = "keypair_bundle_fetch" # client → node: request own keypair bundle + KEYPAIR_BUNDLE_RESP = "keypair_bundle_resp" # node → client: encrypted keypair bundle # ── Index entry ─────────────────────────────────────────────────────────────── @@ -54,6 +64,8 @@ class IndexEntry: added_at: int # unix timestamp duration: int | None = None # seconds, for media thumb_hash: str | None = None # blake3 of thumbnail + uploader_id: str | None = None # user_id of who uploaded (None = pre-existing on disk) + uploader_pk: str | None = None # Ed25519 public key of uploader (base64 raw 32 bytes) @dataclass -- cgit v1.2.3