From f0248975908ad670fa8a820f865bf22ea8d0172d Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 13 Aug 2026 03:56:30 +0200 Subject: feat: Phase 12 — P2P crypto material, password split, node Ed25519 auth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Baseline commit capturing in-progress Phase 12 work that was already present in the working tree (uncommitted) before the Phase 11.5 security remediation begins. Committed as-is, without review or modification, so that remediation changes arrive as a separable diff. Contents: BundleStore (P2P GEK + keypair bundles), password split (auth_key / bundle_key), node Ed25519 auth (POST /v1/nodes/auth, node-scoped JWT), GEK-HMAC handshake proof with DTLS channel binding, Ed25519 admin challenge-response, node local admin UI rewrite, browser key persistence. Not authored in this session — captured to establish a baseline. Co-Authored-By: Claude Opus 5 --- packages/meshbay-hub/src/meshbay_hub/static/crypto.js | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'packages/meshbay-hub/src/meshbay_hub/static/crypto.js') diff --git a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js index eb96eef..5ebf624 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js @@ -230,8 +230,24 @@ function b64encode(bytes) { return btoa(String.fromCharCode(...bytes)); } +// ── GEK proof (HMAC-SHA256 for handshake challenge) ───────────────────────── + +async function hmacGEK(gekRaw, nonceB64, offerFp, answerFp) { + const nonce = b64decode(nonceB64); + const data = concatBuffers([ + nonce, + offerFp || new Uint8Array(0), + answerFp || new Uint8Array(0), + ]); + const key = await crypto.subtle.importKey( + 'raw', gekRaw, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']); + const sig = await crypto.subtle.sign('HMAC', key, data); + return b64encode(new Uint8Array(sig)); +} + // Export for use in app.js window.MeshBayCrypto = { importGEK, deriveChunkKey, decryptChunk, decryptChunkBin, decryptFile, generateGEK, wrapGEK, unwrapGEK, encryptChunk, b64encode, b64decode, + hmacGEK, }; -- cgit v1.2.3