kai/web-terminal
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(relay): close F6 replay K_content nonce reuse via per-generation epoch-in-key

Browse Source 
The recoverable replay key was stable per (hostContentSecret, sessionId) while the
agent-side sealer resets its deterministic-nonce seq to 0 on every restart/re-attach
→ two sealer generations sealed distinct plaintext under the SAME (key, nonce).

Add a required 'epoch' to ReplayKeyParams, fold it into the K_content HKDF salt
(sessionId U+001F epoch), mint a fresh epoch per createReplaySealer generation and
expose it, and thread it through ReplaySource so the browser re-derives the matching
key. Fresh epoch per generation ⇒ fresh key ⇒ seq=0 can never collide; recoverability
within a generation is preserved.

Touches relay-contracts/relay-e2e/agent/relay-web. Green: contracts 81, e2e 78,
agent 133, web 99; tsc clean. Regression proves same seq-0 nonce, different key.
This commit is contained in:
Yaojia Wang
2026-07-02 16:41:19 +02:00
parent a09c131539
commit 3020184054
13 changed files with 243 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
relay-e2e/src/replay-key.ts
View File

@@ -21,12 +21,36 @@ import { openFrame, sealFrame } from './session.js'
const encoder = new TextEncoder()
/** HKDF(hostContentSecret, salt=sessionId, info=REPLAY_KDF_INFO) → per-session, per-host content key. */
/**
* ASCII unit separator (0x1f). Domain-separates sessionId ‖ epoch inside the HKDF salt so
* distinct (sessionId, epoch) pairs can never alias via concatenation. Neither field contains
* it: sessionId is an opaque id and epoch is a generated non-secret diversifier.
*/
const SALT_FIELD_SEPARATOR = 0x1f
/** salt = utf8(sessionId) ‖ 0x1f ‖ utf8(epoch) — unambiguous per-session, per-generation binding. */
function replaySalt(sessionId: string, epoch: string): Uint8Array {
const sessionBytes = encoder.encode(sessionId)
const epochBytes = encoder.encode(epoch)
const salt = new Uint8Array(sessionBytes.length + 1 + epochBytes.length)
salt.set(sessionBytes, 0)
salt[sessionBytes.length] = SALT_FIELD_SEPARATOR
salt.set(epochBytes, sessionBytes.length + 1)
return salt
}
/**
* HKDF(hostContentSecret, salt=sessionId ‖ 0x1f ‖ epoch, info=REPLAY_KDF_INFO) → per-session,
* per-host, per-generation content key (F6). A fresh `epoch` per sealer generation yields a fresh
* key even for the same (hostContentSecret, sessionId), so a seq=0 reset after restart/re-attach
* can never collide with a prior generation's (key, nonce). Recoverability WITHIN one generation is
* preserved: same (secret, sessionId, alg, epoch) ⇒ byte-identical key.
*/
export function deriveContentKey(p: ReplayKeyParams): AeadKey {
const raw = hkdf(
sha256,
p.hostContentSecret,
encoder.encode(p.sessionId),
replaySalt(p.sessionId, p.epoch),
encoder.encode(REPLAY_KDF_INFO),
AEAD_KEY_BYTES,
)