From 14ab04d2bbf4beda32ea365329b2d94ba49d3c16 Mon Sep 17 00:00:00 2001 From: jack Date: Thu, 2 Jul 2026 10:52:52 +0200 Subject: [PATCH] Correct doc comment on signing-key pin recovery MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment on upsertCryptographicIdentity claimed a legitimately re-keyed peer could recover via "explicit user re-verification", but no such path exists: setVerified does not reset the signing-key pin. State the actual recovery options — a new noise identity (new peerID) or clearAllIdentityData. Co-Authored-By: Claude Fable 5 --- bitchat/Identity/SecureIdentityStateManager.swift | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/bitchat/Identity/SecureIdentityStateManager.swift b/bitchat/Identity/SecureIdentityStateManager.swift index 7324ad60..c24b1bf1 100644 --- a/bitchat/Identity/SecureIdentityStateManager.swift +++ b/bitchat/Identity/SecureIdentityStateManager.swift @@ -347,8 +347,11 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol { /// mirrors `BLEPeerRegistry.upsertVerifiedAnnounce` — without it, an /// attacker replaying a victim's noiseKey/peerID with their own signing /// key could overwrite the victim's persisted identity while the victim is - /// offline or after an app restart. Recovering from a legitimate signing - /// re-key requires a new noise identity or explicit user re-verification. + /// offline or after an app restart. The refusal is permanent: there is + /// currently no targeted in-app way to reset the pin (`setVerified` does + /// not touch it). Recovering from a legitimate signing re-key requires the + /// peer to establish a new noise identity (new peerID) or the local user + /// to wipe all identity data (`clearAllIdentityData`, e.g. panic wipe). /// - Parameters: /// - fingerprint: SHA-256 hex of the Noise static public key /// - noisePublicKey: Noise static public key data