permissionlesstech/bitchat
1
0
Fork 0
mirror of https://github.com/permissionlesstech/bitchat.git synced 2026-07-26 21:05:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Pin announce signing keys to stop mesh identity spoofing (#1349)

Browse Source 
TOFU-pins the Ed25519 signing key per noise key so a self-consistent announce that reuses a victim's peerID+noise key with the attacker's signing key/nickname is rejected instead of overwriting the registry and persisted identity. Complements #1432: that PR's signed-LEAVE verification reads the stored signing key this PR protects from announce-path poisoning.

Rebased onto main as a single commit; swift build --build-tests green, 40/40 targeted tests incl. the spoofing e2e cases, and #1432's suites 50/50 unaffected.
This commit is contained in:
jack
2026-07-26 11:38:24 +02:00
committed by GitHub
parent d326cecb63
commit b96a41054e
11 changed files with 885 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+1
View File
@@ -80,3 +80,4 @@ build.log
# Local configs
Local.xcconfig
*.profraw