Fix two P1 flaws in the recognition tag design (Codex #1487)

Both findings are correct and both were real. This is the argument for
shipping code next to the prose: neither was obvious in the design text.

**Tags were symmetric, which leaked the social graph.** `HMAC(K_AB, epoch)`
produces the same 8 bytes for both parties, so an observer who saw one
value in two different announces would learn those two devices are mutual
favourites, and could link their two rotating IDs to each other — handing
over exactly the graph the design exists to hide, plus a cross-epoch
correlation handle. Tags are now directional: the MAC covers the ordered
sender and recipient static public keys, so A→B and B→A differ. Both
parties can still compute both directions because both hold both keys.

**Tags were replayable under any ID.** A tag depending only on
(pair, epoch) could be lifted from a recorded announce and replayed in a
fresh announce under an attacker-chosen ID; the recipient would match and
treat that ID as the favourite, and since epoch-1 is accepted it would
keep working into the next period. The MAC now covers the announced peer
ID, which reduces this to replaying the victim's own presence.

That residual is unfixable while announces are unsigned, so the spec now
states plainly that recognition is a hint only: presence may be populated,
but routing a DM or showing a verified badge must wait for a handshake
whose static key equals the favourite that produced the match. O4 is
rewritten around that, with the two alternatives named (per-epoch
ephemeral signing key, or a freshness nonce echoed by the recipient).

Tests: two regression cases named for the findings, plus a
wrong-direction-does-not-match case so the directional fix cannot silently
become cosmetic. The vector table now gives both directions, because their
difference is the security property — an implementation that produces one
value for both has reintroduced the flaw. Recomputed independently in
Python from the spec and matched byte for byte.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

localPackages/BitFoundation/Sources/BitFoundation/PeerIDRotation.swift

@@ -133,10 +133,42 @@ public enum PeerIDRotation {
         return derived.withUnsafeBytes { Data($0) }
     }
 
-    /// The tag a peer holding this pair's recognition key expects this epoch.
-    public static func recognitionTag(recognitionKey: Data, epoch: UInt32) -> Data {
+    /// The tag `sender` puts in its announce for `recipient` this epoch.
+    ///
+    /// Three inputs beyond the epoch, each load-bearing:
+    ///
+    /// - **Ordered keys make the tag directional.** An earlier draft used
+    ///   `HMAC(K_AB, epoch)`, which is symmetric — so A and B broadcast the
+    ///   *same* 8 bytes, and an observer who spots one value in two different
+    ///   announces learns those two devices are mutual favourites and can link
+    ///   their rotating IDs to each other. That hands over exactly the social
+    ///   graph this design exists to hide. Ordering the keys gives A→B and B→A
+    ///   distinct values; both parties can still compute both directions,
+    ///   because both hold both public keys.
+    /// - **`peerID` binds the tag to the announce carrying it.** Without it the
+    ///   tag depends only on (pair, epoch), so an attacker could lift a tag out
+    ///   of A's announce and replay it under an ID of their choosing; the
+    ///   recipient would match and believe that ID is A. Binding means a lifted
+    ///   tag is only valid alongside A's own ID, which reduces the attack from
+    ///   impersonation-as-any-ID to replaying A's presence.
+    ///
+    /// Replaying A's own announce within the epoch window remains possible —
+    /// unsigned announces cannot prevent it. Recognition is therefore a hint
+    /// only, and anything consequential must wait for a completed handshake.
+    /// See open question O4.
+    public static func recognitionTag(
+        recognitionKey: Data,
+        epoch: UInt32,
+        senderStaticPublicKey: Data,
+        recipientStaticPublicKey: Data,
+        peerID: Data
+    ) -> Data {
+        var message = bigEndianBytes(epoch)
+        message.append(fixedWidth(senderStaticPublicKey, 32))
+        message.append(fixedWidth(recipientStaticPublicKey, 32))
+        message.append(fixedWidth(peerID, idLength))
         let mac = HMAC<SHA256>.authenticationCode(
-            for: bigEndianBytes(epoch),
+            for: message,
             using: SymmetricKey(data: recognitionKey)
         )
         return Data(mac).prefix(idLength)
@@ -185,7 +217,13 @@ public enum PeerIDRotation {
         }
     }
 
-    /// Whether any slot in `block` matches a tag this pair expects at `date`.
+    /// Whether any slot in `block` holds the tag we expect a specific peer to
+    /// have put there, for an announce carrying `peerID`.
+    ///
+    /// `senderStaticPublicKey` is the peer we hope sent this (so we compute the
+    /// direction they would use) and `recipientStaticPublicKey` is our own.
+    /// Passing them the other way round tests the opposite direction and will
+    /// not match, which is the point of making tags directional.
     ///
     /// Comparison is constant-time per candidate, and every slot is examined
     /// even after a match, so neither the presence of a match nor its slot
@@ -193,11 +231,20 @@ public enum PeerIDRotation {
     public static func blockMatches(
         _ block: Data,
         recognitionKey: Data,
+        senderStaticPublicKey: Data,
+        recipientStaticPublicKey: Data,
+        peerID: Data,
         at date: Date
     ) -> Bool {
         guard let slots = tags(fromBlock: block) else { return false }
         let expected = candidateEpochs(around: date).map {
-            recognitionTag(recognitionKey: recognitionKey, epoch: $0)
+            recognitionTag(
+                recognitionKey: recognitionKey,
+                epoch: $0,
+                senderStaticPublicKey: senderStaticPublicKey,
+                recipientStaticPublicKey: recipientStaticPublicKey,
+                peerID: peerID
+            )
         }
         var matched = false
         for slot in slots {