jcp-wire: a caller-signed challenge, and endpoint evidence bound to the answer #394

Merged

dcharlot merged 1 commit from feat/jcp-wire-evidence into main 2026-10-21 12:41:10 -04:00

Conversation 0 Commits 1 Files changed 5 +383 -9

dcharlot commented 2026-10-21 10:26:45 -04:00

Owner

Copy link

Sweep 2026-10-19 item #5, wire side; the sandbox side merged in #392. A WireRequest had no challenge slot and a WireResponse carried no endpoint evidence. Freshness came only from the caller's now stamp, so a caller had no way to ask the platform an endpoint runs on to vouch for an answer.

What changes (SPEC §11)

• WireRequest.challenge. 32 caller-chosen bytes, covered by the caller's signature (challenged_signable_bytes, sign_challenged). It is omitted when absent, so a request without one keeps its bytes and its signature.
• WireResponse.evidence { kind, report }, omitted when absent. An endpoint configured with_attester answers an authenticated, challenged request with a report over:

  report_data = BLAKE3-XOF-64(derive_key = "jcp/1 wire evidence v1", challenge ‖ BLAKE3(receipt))
  

  The challenge makes it the caller's; the receipt makes it this answer's.
• Forged requests get no evidence. A request denied bad-signature gets none, so a forgery can't make the platform produce reports on demand.
• Repeats and restarts. A repeat gets its first evidence, and a restart rebuilds it.
• WireResponse::verify_evidence checks against the challenge the caller sent, never one read back, through a caller-supplied EvidenceVerifier. jcp-wire stays free of any TEE crate, and a transport's own evidence (an exported authenticator on TLS) is a profile of the same slot.
• Conformance class C28, with a check.

Verification (build host)

• jcp-rs: 579 tests (--locked), and every conformance class passes, including C28.
• Clippy and rustdoc -D warnings are clean on the touched crates.
• Mutation testing: 9 mutants, all killed:
  • the challenge unsigned, or ignored at verification;
  • evidence given for forgeries, never, or unasked;
  • the challenge or the receipt left out of the binding;
  • missing evidence passing;
  • the verifier ignoring the caller's challenge.
• Repo checks pass, including lockfiles.

🤖 Generated with Claude Code

Sweep 2026-10-19 item #5, wire side; the sandbox side merged in #392. A `WireRequest` had no challenge slot and a `WireResponse` carried no endpoint evidence. Freshness came only from the caller's `now` stamp, so a caller had no way to ask the platform an endpoint runs on to vouch for an answer. ## What changes (SPEC §11) - **`WireRequest.challenge`.** 32 caller-chosen bytes, covered by the caller's signature (`challenged_signable_bytes`, `sign_challenged`). It is omitted when absent, so a request without one keeps its bytes and its signature. - **`WireResponse.evidence { kind, report }`**, omitted when absent. An endpoint configured `with_attester` answers an authenticated, challenged request with a report over: ```text report_data = BLAKE3-XOF-64(derive_key = "jcp/1 wire evidence v1", challenge ‖ BLAKE3(receipt)) ``` The challenge makes it the caller's; the receipt makes it this answer's. - **Forged requests get no evidence.** A request denied `bad-signature` gets none, so a forgery can't make the platform produce reports on demand. - **Repeats and restarts.** A repeat gets its first evidence, and a restart rebuilds it. - **`WireResponse::verify_evidence`** checks against the challenge the caller **sent**, never one read back, through a caller-supplied `EvidenceVerifier`. jcp-wire stays free of any TEE crate, and a transport's own evidence (an exported authenticator on TLS) is a profile of the same slot. - **Conformance class C28**, with a check. ## Verification (build host) - **jcp-rs:** 579 tests (`--locked`), and every conformance class passes, including C28. - **Clippy and rustdoc** `-D warnings` are clean on the touched crates. - **Mutation testing:** 9 mutants, all killed: - the challenge unsigned, or ignored at verification; - evidence given for forgeries, never, or unasked; - the challenge or the receipt left out of the binding; - missing evidence passing; - the verifier ignoring the caller's challenge. - **Repo checks** pass, including lockfiles. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dcharlot added 1 commit 2026-10-21 10:26:46 -04:00

jcp-wire: a caller-signed challenge, and endpoint evidence bound to the answer ... ca3de8e3b3

Sweep 2026-10-19 item #5, wire side. A WireRequest had no challenge slot
and a WireResponse carried no endpoint evidence. Freshness came only from
the caller's `now` stamp, so a caller had no way to ask the platform an
endpoint runs on to vouch for an answer.

jcp-wire (SPEC §11):
- WireRequest.challenge: 32 caller-chosen bytes, covered by the caller's
  signature (challenged_signable_bytes, sign_challenged). It is omitted when
  absent, so a request without one keeps its bytes and its signature.
- WireResponse.evidence { kind, report }, omitted when absent. An endpoint
  configured with_attester answers an authenticated challenged request with
  a report over evidence_report_data = BLAKE3-XOF-64(derive_key "jcp/1 wire
  evidence v1", challenge ‖ BLAKE3(receipt)). The challenge makes it the
  caller's; the receipt makes it this answer's.
- No evidence for a request denied bad-signature, so a forgery cannot make
  the platform produce reports on demand. A repeat gets its first evidence,
  and a restart rebuilds it through respond(), so the attester is
  configured before with_journal.
- WireResponse::verify_evidence checks against the challenge the caller
  SENT, never one read back, through a caller-supplied EvidenceVerifier.
  jcp-wire stays free of any TEE crate, and a transport's own evidence (an
  exported authenticator on TLS) is a profile of the same slot.

SPEC §11: message shapes, the evidence binding and rules, and conformance
class C28 with a C28 check.

Tests: 4 new, plus C28. A challenged request gets evidence bound to its
answer; evidence comes only where asked and able, with an unchallenged
request byte-identical and signed over the old bytes; the challenge is
signed, so swapping or stripping it is refused with no evidence; a repeat
gets its first evidence and a restart rebuilds it. Mutation testing: 9
mutants, all killed.

Verified on the build host: jcp-rs 579 tests (--locked) and every
conformance class; clippy -D warnings (jcp-wire, -conformance, -threshold)
and rustdoc -D warnings (jcp-wire) clean. Repo checks pass, including
lockfiles.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dcharlot merged commit 1151888c4d into main 2026-10-21 12:41:10 -04:00

dcharlot referenced this pull request from a commit 2026-10-21 12:41:11 -04:00

Merge pull request 'jcp-wire: a caller-signed challenge, and endpoint evidence bound to the answer' (#394) from feat/jcp-wire-evidence into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Transaction-Science/open-standards!394

No description provided.