Authenticate private media capabilities in Noise

2026-07-26 16:25:23 +00:00 · 2026-07-26 00:12:26 +02:00
parent 4fc1c64ea6
commit 8b1b13842f
31 changed files with 1412 additions and 133 deletions
@@ -169,6 +169,23 @@ struct BLEAnnounceHandlingPolicyTests {
        #expect(decision.isVerified)
    }

+    @Test
+    func trustPolicyRejectsSigningKeyReplacementAfterNoiseBinding() {
+        let noiseKey = Data(repeating: 0xCC, count: 32)
+        let boundSigningKey = Data(repeating: 0x11, count: 32)
+
+        let decision = BLEAnnounceTrustPolicy.evaluate(
+            hasSignature: true,
+            signatureValid: true,
+            existingNoisePublicKey: noiseKey,
+            announcedNoisePublicKey: noiseKey,
+            authenticatedSigningPublicKey: boundSigningKey,
+            announcedSigningPublicKey: Data(repeating: 0x22, count: 32)
+        )
+
+        #expect(decision == .reject(.authenticatedSigningKeyMismatch))
+    }
+
    @Test
    func responsePolicyConnectsOnlyForDirectNewOrReconnectedPeers() {
        let directNew = BLEAnnounceResponsePolicy.plan(