From 9fa2117de1caf4d713cc0b7a310b9549467738c3 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Fri, 14 Aug 2026 14:43:48 +0200 Subject: docs: Argon2id, the multi-browser property, and what a browser found MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit draft-v5 §7 rewritten around the keypair bundle, because that is where the last open finding actually lives. New §7.1 states the adversary (an operator holding their own node's disk), what cracking a bundle yields (identity keys, hence content on *other* nodes and the ability to sign as that user — not the content they host in the clear by design), and the measured numbers rather than adjectives: PBKDF2 241 ms vs Argon2id 88 ms natively, a GPU ceiling moving from ~8k to ~2k guesses/s, six days for a 10⁹ dictionary run, four random words outlasting the sun. The honest summary is in there too — a factor of four on one card, not a thousand; what it buys is the cost of scale. §2 gains the row the table never had: **your identity keys stay yours**, ⚠️ against a malicious node operator. An operator hosts your content by design, and that was documented; that they can also try to become *you* was not. That is the difference between reading what they host and reading what other operators host. §4 records that the challenge now carries `node_pk`, why (a first-time member signs a transcript naming the node and has no GEK to complete a handshake with), and that it is checked against the ack rather than trusted. Also that refusals carry a code, and what `not_a_member` usually means. §8.1 states the multi-browser property plainly — one identity across browsers, recovered with the passphrase, no second code — together with its cost, since it is the same mechanism as C4. invite-pairing-v1 is no longer "a proposal": it shipped. §9bis gains the four browser-found failures and their common thread — e2e.py is a second implementation of the client, written in the right order by construction, so it proves the protocol and nothing about app.js. CLAUDE.md gets the two things a future session must not rediscover the hard way: the KDF parameters live in three places held identical by a parity test, and an unbounded await on the hub socket makes a node silently unreachable (three found). second-review: C4 marked reduced, not closed. devel-phases-next: 12.2's CSP must keep `wasm-unsafe-eval`, or the strict policy locks every user out of their keys. Co-Authored-By: Claude Opus 5 --- second-review.md | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'second-review.md') diff --git a/second-review.md b/second-review.md index 071e6ef..01ee2af 100644 --- a/second-review.md +++ b/second-review.md @@ -557,6 +557,13 @@ their browser key. Fails closed, so it is a correctness problem rather than a ho sovereignty feature is effectively inert as shipped, and the mismatch will invite the wrong fix (relaxing the check) unless it is documented. +> **C4 — REDUCED 2026-08-14, not closed.** The bundle's KDF moved from PBKDF2-SHA512 +> 600k to Argon2id 128 MB/t=3 in the browser (vendored WebAssembly), so an operator +> attacking one offline no longer enjoys the GPU economics of a compute-only KDF. The +> pre-proof window is unchanged and still bounded. What remains: bundles are still stored +> on every node their owner joins, and a weak passphrase still loses — draft-v5 §7.1 gives +> the measured numbers. It closes at 13.3. + **M4 — Response-to-request matching by arrival order.** `transport.js:390-422` resolves the **oldest** pending promise with whatever message arrives, ignoring type. With the 8-deep pipelined download window, a node that reorders responses (or an `error` message arriving -- cgit v1.2.3