Skip to content

fix: always try retained SPKs when opening sealed mail (#50) #59

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chtnnh wants to merge 5 commits into
base: main
Choose a base branch
from
Open

fix: always try retained SPKs when opening sealed mail (#50) #59

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
567cc91
fix: always try retained SPKs when opening sealed mail (#50)
chtnnh Jul 21, 2026
2e675d9
chore: bump Expo SDK 57 patch deps for install --check
chtnnh Jul 23, 2026
4fe9851
chore: regenerate package-lock for npm ci peer resolution
chtnnh Jul 23, 2026
5e8c1be
chore: bump expo-dev-client to ~57.0.9 for install --check
chtnnh Jul 23, 2026
c71184f
chore: sync Expo deps lockfile (restore emnapi peers for npm ci)
chtnnh Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/FORWARD-SECRECY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,13 +36,13 @@ Wire layout of sealed payloads is unchanged (relays still cannot tell modes apar
|--------|----------|
| No key server | QR SPK + in-band OTK replenishment |
| Same QR scanned by two people | SPK only on QR — both deliver; OTKs are exclusive in-band |
| In-flight after SPK rotation | SPK ring retained 6h |
| Trial-decrypt cost | OTK pool ceiling (24) + `OPEN_SECRET_CAP` (28); newest-first |
| In-flight after SPK rotation | SPK ring retained 6h and always included in `secretsForOpen` |
| Trial-decrypt cost | OTK pool ceiling (24) + OTK walk cap (`OPEN_SECRET_CAP`); full SPK ring always tried |
| Forged prekeys | Signature binds SPK **and** the exact OTK list; substituted OTKs fail verify |

## Trial-decrypt cost

Every sealed envelope on the air is tried against every agreement secret we hold (opacity: no prekey-id hint). With the ceiling above, worst case is ~28 X25519 ops + AEAD fails per envelope before the long-term try — see the `trial-open cost` unit test for a host-side measurement. A flooder can still amplify this into battery drain; ingress budgets remain a separate hardening track.
Every sealed envelope on the air is tried against agreement secrets we hold (opacity: no prekey-id hint). OTK trials are capped at `OPEN_SECRET_CAP`; the full retained SPK ring is always included after that. A flooder can still amplify this into battery drain; ingress budgets remain a separate hardening track.

## Tests

Expand Down
Loading
Loading