From 339cb427f886a0177014126bb684335837eff067 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 23 Sep 2026 17:14:26 +0200 Subject: feat: the node signs its handshake challenge (MNP 3.4) node_pk in handshake_challenge is now signed over the channel binding and both nonces, so a client can check the node key before a join rather than only at the ack. Both transports; the browser and the QUIC client refuse a wrong signature and treat an absent one as an older node. Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-hub/src/meshbay_hub/static/crypto.js | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) (limited to 'packages/meshbay-hub/src/meshbay_hub/static/crypto.js') diff --git a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js index fd24404..a3680ce 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js @@ -398,6 +398,7 @@ function adminTranscript(op, nodePkB64, groupId, subject, nonceB64, ts) { // bound in, so a client proof can never be replayed as a node proof and a missing // fingerprint cannot silently degrade the proof to nonce-only (L4). const HANDSHAKE_PREFIX = new TextEncoder().encode('meshbay:mnp:handshake:v1'); +const CHALLENGE_PREFIX = new TextEncoder().encode('meshbay:mnp:challenge:v1'); function _lenPrefixed(parts) { let total = 0; @@ -432,6 +433,18 @@ function handshakeTranscript(role, groupId, nonceClient, nonceNode, binding) { return out; } +// Mirrors meshbay_common/handshake.py challenge_transcript (MNP 3.4): what the +// node signs in handshake_challenge, so its key can be checked before a join. +function challengeTranscript(groupId, nonceClient, nonceNode, binding) { + const body = _lenPrefixed([ + new TextEncoder().encode(groupId), nonceClient, nonceNode, binding, + ]); + const out = new Uint8Array(CHALLENGE_PREFIX.length + body.length); + out.set(CHALLENGE_PREFIX, 0); + out.set(body, CHALLENGE_PREFIX.length); + return out; +} + async function handshakeProof(gekRaw, role, groupId, nonceClient, nonceNode, binding) { const transcript = handshakeTranscript(role, groupId, nonceClient, nonceNode, binding); const key = await crypto.subtle.importKey( @@ -572,7 +585,7 @@ window.MeshBayCrypto = { openGroup, sealGroup, generateGEK, wrapGEK, unwrapGEK, encryptChunk, b64encode, b64decode, adminTranscript, handshakeTranscript, handshakeProof, webrtcBinding, - joinTranscript, verifyNodeSignature, constantTimeEqual, + challengeTranscript, joinTranscript, verifyNodeSignature, constantTimeEqual, deviceRequestTranscript, deviceAddTranscript, deviceHelloTranscript, deviceCodeHash, sealChat, openChat, chatSigningTranscript, verifyChatSignature, -- cgit v1.2.3