wt
e69372c6db
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: Stanza 12.22.1 browser HMAC sha-512 fails RFC 4231 Test Case 1: wrong 64-byte block selection. SCRAM-SHA-512 derives that hyphenated algorithm; private algorithm mutation/vendor patches are unsupported. Parent cannot attest browser strongest-mechanism compatibility from Node-only success. Task: S00-003 Agent: auto-protocol-dcdf92cd067e Role: protocol Action: claim Status: blocked Task title: Проверить XMPP WSS/auth библиотеку
33 lines
2.9 KiB
JSON
33 lines
2.9 KiB
JSON
{
|
|
"title": "Validate browser-compatible SCRAM-SHA-512 through a public mechanism API",
|
|
"reason": "Stanza 12.22.1 browser HMAC sha-512 fails RFC 4231 Test Case 1: wrong 64-byte block selection. SCRAM-SHA-512 derives that hyphenated algorithm; private algorithm mutation/vendor patches are unsupported. Parent cannot attest browser strongest-mechanism compatibility from Node-only success.",
|
|
"reproduction": "Run the inline diagnostic in state/evidence/S00-003-auto-protocol-dcdf92cd067e.md using accepted Node runtime; sha-512 mismatches fixed RFC/Node digest while sha512 alias and SHA-256/SHA-1 controls match. Source Hmac.js uses alg === sha512 for 128-byte blocks.",
|
|
"role": "crypto",
|
|
"reviewer_role": "security",
|
|
"scope": [
|
|
"experiments/0002-xmpp-library/sha512-validation/**",
|
|
"docs/decisions/0002-xmpp-sha512-validation.md"
|
|
],
|
|
"outcome": "One isolated runnable independently reviewed browser-compatible SCRAM-SHA-512 integration uses vetted existing crypto through a supported public mechanism API and validates proof/server-final without vendor/private-field patching or custom primitives.",
|
|
"steps": [
|
|
"Read original blocker, accepted stack/SASL ADR and pinned browser implementation/public APIs.",
|
|
"Reproduce the HMAC alias defect and evaluate an existing vetted mechanism/backend or candidate with primary docs, exact pins, license and browser/API checks.",
|
|
"Implement only isolated SCRAM-SHA-512 integration via supported public APIs using existing cryptographic code; retain fail-closed mutual authentication and real absence of channel binding.",
|
|
"Run fixed known vectors and full exchange positive/negative checks against the browser-resolved backend; preserve evidence, limitations and handoff for independent security review."
|
|
],
|
|
"acceptance": [
|
|
"RFC SHA-512 known vectors match using actual browser-compatible crypto backend, including algorithm spelling and varied key lengths.",
|
|
"Full SCRAM-SHA-512 client proof and verified server-final agree with an independent existing implementation/fixed externally derived vector; missing/forged/premature final fails without authentication/restart.",
|
|
"Integration uses public mechanism APIs, correct SCRAM-SHA-512 wire name, no private-field/vendor patch, invented binding, custom primitives or plaintext downgrade.",
|
|
"Runnable pinned fixture experiment and browser bundle/backend evidence permit independent review; no parent WSS/library selection/shared contract work."
|
|
],
|
|
"checks": [
|
|
"Reproduce original browser sha-512 HMAC mismatch.",
|
|
"Fixed SHA-512/HMAC known vectors including long keys using selected browser backend.",
|
|
"Full SCRAM-SHA-512 verified exchange and forged/missing/out-of-order server-final rejection.",
|
|
"Exact dependency/license/API/browser checks and repeatable clean install/bundle plus focused suite."
|
|
],
|
|
"depends_on": [],
|
|
"requires_user_input": false
|
|
}
|