kai/web-terminal
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(relay): close F6 replay K_content nonce reuse via per-generation epoch-in-key

Browse Source 
The recoverable replay key was stable per (hostContentSecret, sessionId) while the
agent-side sealer resets its deterministic-nonce seq to 0 on every restart/re-attach
→ two sealer generations sealed distinct plaintext under the SAME (key, nonce).

Add a required 'epoch' to ReplayKeyParams, fold it into the K_content HKDF salt
(sessionId U+001F epoch), mint a fresh epoch per createReplaySealer generation and
expose it, and thread it through ReplaySource so the browser re-derives the matching
key. Fresh epoch per generation ⇒ fresh key ⇒ seq=0 can never collide; recoverability
within a generation is preserved.

Touches relay-contracts/relay-e2e/agent/relay-web. Green: contracts 81, e2e 78,
agent 133, web 99; tsc clean. Regression proves same seq-0 nonce, different key.
This commit is contained in:
Yaojia Wang
2026-07-02 16:41:19 +02:00
parent a09c131539
commit 3020184054
13 changed files with 243 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
relay-e2e/test/keystore.test.ts
View File

@@ -37,8 +37,8 @@ describe('T11 multi-device adapters (authenticated channel, NOT a QR)', () => {
expect(result.aead).toBe('xchacha20-poly1305')
expect(label).toBeTruthy()
}
const kA = deriveContentKey({ hostContentSecret: secret, sessionId: 's', alg: 'aes-256-gcm' })
const kB = deriveContentKey({ hostContentSecret: secret, sessionId: 's', alg: 'aes-256-gcm' })
const kA = deriveContentKey({ hostContentSecret: secret, sessionId: 's', alg: 'aes-256-gcm', epoch: 'gen-0' })
const kB = deriveContentKey({ hostContentSecret: secret, sessionId: 's', alg: 'aes-256-gcm', epoch: 'gen-0' })
expect(bytesToHex(unwrapAeadKey(kA).raw)).toBe(bytesToHex(unwrapAeadKey(kB).raw))
})

31
relay-e2e/test/replay-key.test.ts
View File

@@ -6,10 +6,16 @@ import { AeadOpenError } from '../src/errors.js'
import { deriveContentKey, openReplayCiphertext, sealReplayFrame } from '../src/replay-key.js'
import { bytesToHex, fromUtf8, utf8 } from './helpers.js'
const params = (secret: Uint8Array, sessionId: string, alg: AeadAlg = 'aes-256-gcm'): ReplayKeyParams => ({
const params = (
secret: Uint8Array,
sessionId: string,
alg: AeadAlg = 'aes-256-gcm',
epoch = 'gen-0',
): ReplayKeyParams => ({
hostContentSecret: secret,
sessionId,
alg,
epoch,
})
describe('T10 recoverable replay content-key', () => {
@@ -48,6 +54,29 @@ describe('T10 recoverable replay content-key', () => {
expect(() => openReplayCiphertext(deriveContentKey(params(secretA, 's2')), wire)).toThrow(AeadOpenError)
})
it('F6: SAME (secret, sessionId) but DIFFERENT epoch ⇒ different raw key bytes (no seq=0 (key,nonce) reuse across generations)', () => {
const secret = new Uint8Array(32).fill(0x66)
// Two sealer generations (e.g. before/after an agent restart) that both reset seq to 0.
const kA = deriveContentKey(params(secret, 'sess-F6', 'aes-256-gcm', 'epoch-A'))
const kB = deriveContentKey(params(secret, 'sess-F6', 'aes-256-gcm', 'epoch-B'))
// Raw key bytes MUST differ, so sealFrame(kA, 0n) and sealFrame(kB, 0n) never share (key, nonce).
expect(bytesToHex(unwrapAeadKey(kA).raw)).not.toBe(bytesToHex(unwrapAeadKey(kB).raw))
// And a frame sealed under one epoch cannot be opened with the other epoch's key.
const wireA = encodeEnvelope(sealReplayFrame(kA, 0n, utf8('generation A, seq 0')))
expect(() => openReplayCiphertext(kB, wireA)).toThrow(AeadOpenError)
})
it('F6: SAME (secret, sessionId, epoch) ⇒ identical key — recoverability WITHIN a generation preserved', () => {
const secret = new Uint8Array(32).fill(0x67)
const kSeal = deriveContentKey(params(secret, 'sess-F6', 'aes-256-gcm', 'epoch-E'))
const wire = encodeEnvelope(sealReplayFrame(kSeal, 0n, utf8('same-epoch replay')))
// Browser re-derives the key for the SAME epoch E carried with the ring buffer.
const kReDerived = deriveContentKey(params(secret, 'sess-F6', 'aes-256-gcm', 'epoch-E'))
expect(bytesToHex(unwrapAeadKey(kSeal).raw)).toBe(bytesToHex(unwrapAeadKey(kReDerived).raw))
expect(fromUtf8(openReplayCiphertext(kReDerived, wire))).toBe('same-epoch replay')
})
it('revocation (INV12): a revoked wrap yields no secret → no key derivable for that host going forward', () => {
// The unwrap mechanism is P5/P2; P4 asserts derivation is GATED on having the unwrapped secret.
const revokedUnwrap = (): Uint8Array => {