fix: tighten Marmot MIP-00/01/02/05 + RFC 9420 PublicMessage framing
Follow-up to the earlier MIP-spec alignment commit, addressing the remaining audit items: - MIP-00 (KeyPackageUtils.isValid): now performs every strict tag-level check that MDK does — d tag is exactly 64 hex chars, mls_protocol_version is exactly "1.0", mls_ciphersuite is exactly "0x0001", mls_extensions contains both 0xf2ee + 0x000a, mls_proposals contains 0x000a, encoding is "base64", content non-empty, i tag present. Adds `isCryptographicallyValid` for deep checks: i tag matches the computed KeyPackageRef (RFC 9420 §5.2), Basic credential identity equals the event's pubkey, KeyPackage signature verifies. - MIP-01 (MarmotGroupData): encoder now omits the v3-only `disappearing_message_secs` field when version < 3, so v2 output matches MDK's `tls_codec` 0.4 byte-for-byte. Adds byte-level fixture tests pinned to the Rust reference (encode + decode in both directions). - MIP-02 (WelcomeGiftWrap): replaces the redundant sign-then-rumorize step with `RumorAssembler.assembleRumor`, producing a true unsigned rumor as NIP-59 requires (no wasted secp256k1 signature). - MIP-05 kind 449 (TokenRemovalEvent.build): no longer accepts a tag initializer. Per the MIP-05 spec the token-removal event MUST have empty tags; allowing arbitrary caller-supplied tags risks metadata leakage and rejection by strict validators (e.g. the MDK reference). - RFC 9420 §6 PublicMessage framing: encoder/decoder now branch on `contentType`. Application messages keep the `opaque<V>` length prefix; Proposal/Commit bodies are emitted/parsed as their typed structs (no outer length prefix), per the MLS RFC. Previously encoder used `putBytes` raw and decoder used `readOpaqueVarInt`, so neither could roundtrip and Proposal/Commit PublicMessages from other MLS clients would mis-parse. - KeyPackageUtilsTest fixtures: switch tiny "0"/"1"/"lr" slot ids to realistic 64-char hex slot ids, since `isValid` now enforces the MIP-00 d-tag format.
This commit is contained in:
Claude
+26
-14
@@ -37,8 +37,20 @@ class KeyPackageUtilsTest {
|
||||
private val testPubKey = "a".repeat(64)
|
||||
private val testRef = "b".repeat(64)
|
||||
|
||||
/**
|
||||
* Per MIP-00 the `d` tag MUST be 64 lowercase hex characters
|
||||
* (a random 32-byte slot ID). The strict [KeyPackageUtils.isValid] enforces
|
||||
* this on the parse side, so test fixtures need realistic 64-char hex
|
||||
* slot IDs even when we only care about the selection logic.
|
||||
*/
|
||||
private fun slot(label: Int): String = "0".repeat(63) + label.toString(16)
|
||||
|
||||
private val slot0 = slot(0)
|
||||
private val slot1 = slot(1)
|
||||
private val slotLastResort = "f".repeat(64)
|
||||
|
||||
private fun makeKeyPackageEvent(
|
||||
dTag: String = "0",
|
||||
dTag: String = slot0,
|
||||
createdAt: Long = 1000,
|
||||
encoding: String = "base64",
|
||||
ciphersuite: String = "0x0001",
|
||||
@@ -105,8 +117,8 @@ class KeyPackageUtilsTest {
|
||||
|
||||
@Test
|
||||
fun testSelectBest_PrefersNewest() {
|
||||
val old = makeKeyPackageEvent(dTag = "0", createdAt = 1000)
|
||||
val newer = makeKeyPackageEvent(dTag = "1", createdAt = 2000)
|
||||
val old = makeKeyPackageEvent(dTag = slot0, createdAt = 1000)
|
||||
val newer = makeKeyPackageEvent(dTag = slot1, createdAt = 2000)
|
||||
|
||||
val best = KeyPackageUtils.selectBest(listOf(old, newer))
|
||||
assertNotNull(best)
|
||||
@@ -115,33 +127,33 @@ class KeyPackageUtilsTest {
|
||||
|
||||
@Test
|
||||
fun testSelectBest_PrefersNonLastResort() {
|
||||
val lastResort = makeKeyPackageEvent(dTag = "lr", createdAt = 3000)
|
||||
val regular = makeKeyPackageEvent(dTag = "0", createdAt = 1000)
|
||||
val lastResort = makeKeyPackageEvent(dTag = slotLastResort, createdAt = 3000)
|
||||
val regular = makeKeyPackageEvent(dTag = slot0, createdAt = 1000)
|
||||
|
||||
// Even though lastResort is newer, regular is preferred
|
||||
val best = KeyPackageUtils.selectBest(listOf(lastResort, regular), lastResortDTag = "lr")
|
||||
val best = KeyPackageUtils.selectBest(listOf(lastResort, regular), lastResortDTag = slotLastResort)
|
||||
assertNotNull(best)
|
||||
assertEquals("0", best.dTag())
|
||||
assertEquals(slot0, best.dTag())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun testSelectBest_FallsBackToLastResort() {
|
||||
val lastResort = makeKeyPackageEvent(dTag = "lr", createdAt = 3000)
|
||||
val lastResort = makeKeyPackageEvent(dTag = slotLastResort, createdAt = 3000)
|
||||
|
||||
// Only last-resort available
|
||||
val best = KeyPackageUtils.selectBest(listOf(lastResort), lastResortDTag = "lr")
|
||||
val best = KeyPackageUtils.selectBest(listOf(lastResort), lastResortDTag = slotLastResort)
|
||||
assertNotNull(best)
|
||||
assertEquals("lr", best.dTag())
|
||||
assertEquals(slotLastResort, best.dTag())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun testSelectBest_FiltersOutInvalid() {
|
||||
val invalid = makeKeyPackageEvent(dTag = "0", encoding = "raw")
|
||||
val valid = makeKeyPackageEvent(dTag = "1", createdAt = 500)
|
||||
val invalid = makeKeyPackageEvent(dTag = slot0, encoding = "raw")
|
||||
val valid = makeKeyPackageEvent(dTag = slot1, createdAt = 500)
|
||||
|
||||
val best = KeyPackageUtils.selectBest(listOf(invalid, valid))
|
||||
assertNotNull(best)
|
||||
assertEquals("1", best.dTag())
|
||||
assertEquals(slot1, best.dTag())
|
||||
}
|
||||
|
||||
@Test
|
||||
@@ -159,7 +171,7 @@ class KeyPackageUtilsTest {
|
||||
val template =
|
||||
KeyPackageUtils.buildRotation(
|
||||
newKeyPackageBase64 = "bmV3IGtleXBhY2thZ2U=",
|
||||
dTagSlot = "0",
|
||||
dTagSlot = slot0,
|
||||
newKeyPackageRef = testRef,
|
||||
relays = emptyList(),
|
||||
)
|
||||
|
||||
+110
@@ -155,6 +155,116 @@ class MarmotMipComplianceTest {
|
||||
assertNull(MarmotGroupData.decodeTls(blob))
|
||||
}
|
||||
|
||||
@Test
|
||||
fun marmotGroupData_rejectsDuplicateAdminPubkeys() {
|
||||
// MIP-01: admin_pubkeys MUST NOT contain duplicate keys.
|
||||
assertFailsWith<IllegalArgumentException> {
|
||||
MarmotGroupData(
|
||||
nostrGroupId = groupId32,
|
||||
adminPubkeys = listOf(adminPubkey, adminPubkey),
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
// --- MIP-01 byte-level interop fixtures (MDK reference) ----------------
|
||||
//
|
||||
// These fixtures were produced by serializing the identical struct via the
|
||||
// Rust `tls_codec` 0.4 crate used by MDK (see commit message for the
|
||||
// generator). They pin Amethyst's v2 encoder output byte-for-byte against
|
||||
// the MDK reference, so any future regression in VarInt framing surfaces
|
||||
// immediately.
|
||||
//
|
||||
// Fixtures are v2 (no `disappearing_message_secs` field) because MDK's
|
||||
// current `CURRENT_VERSION = 2` reference has no v3 support yet.
|
||||
|
||||
private fun mdkFixtureA(): ByteArray =
|
||||
(
|
||||
// version=2 + 32 bytes of group_id (all zero)
|
||||
"0002" +
|
||||
"00".repeat(32) +
|
||||
// name=empty, description=empty (VarInt(0) = single 0x00)
|
||||
"0000" +
|
||||
// admin_pubkeys: VarInt(32) = 0x20, then one 32-byte key of 0xAA
|
||||
"20" + "aa".repeat(32) +
|
||||
// relays: outer VarInt(21) = 0x15; inner VarInt(20) = 0x14 +
|
||||
// "wss://relay.example/" (20 bytes)
|
||||
"15" + "14" + "7773733a2f2f72656c61792e6578616d706c652f" +
|
||||
// image_hash, image_key, image_nonce, image_upload_key — all empty
|
||||
"00000000"
|
||||
).hexToByteArray()
|
||||
|
||||
private fun mdkFixtureB(): ByteArray =
|
||||
(
|
||||
"0002" +
|
||||
"11".repeat(32) +
|
||||
// name: VarInt(8)=0x08 + "Amethyst"
|
||||
"08" + "416d657468797374" +
|
||||
// description: VarInt(10)=0x0a + "Test group"
|
||||
"0a" + "546573742067726f7570" +
|
||||
// admin_pubkeys: outer VarInt(64) — 64 = 0x40, two-byte VarInt
|
||||
// prefix "40 40" (high bits 01, value 0x0040) + 2×32 bytes
|
||||
"4040" + "bb".repeat(32) + "cc".repeat(32) +
|
||||
// relays outer VarInt(44) = 0x2c, then two inner relays each
|
||||
// VarInt(21) + 21-byte URL
|
||||
"2c" +
|
||||
"15" + "7773733a2f2f72656c6179312e6578616d706c652f" +
|
||||
"15" + "7773733a2f2f72656c6179322e6578616d706c652f" +
|
||||
// image_* all empty
|
||||
"00000000"
|
||||
).hexToByteArray()
|
||||
|
||||
@Test
|
||||
fun marmotGroupData_encodesFixtureAByteForByteVsMdk() {
|
||||
// Encode an Amethyst MarmotGroupData with the same inputs and assert the
|
||||
// bytes match MDK's tls_codec 0.4 output exactly.
|
||||
val data =
|
||||
MarmotGroupData(
|
||||
version = 2,
|
||||
nostrGroupId = "00".repeat(32),
|
||||
name = "",
|
||||
description = "",
|
||||
adminPubkeys = listOf("aa".repeat(32)),
|
||||
relays = listOf("wss://relay.example/"),
|
||||
)
|
||||
assertContentEquals(mdkFixtureA(), data.encodeTls())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun marmotGroupData_encodesFixtureBByteForByteVsMdk() {
|
||||
val data =
|
||||
MarmotGroupData(
|
||||
version = 2,
|
||||
nostrGroupId = "11".repeat(32),
|
||||
name = "Amethyst",
|
||||
description = "Test group",
|
||||
adminPubkeys = listOf("bb".repeat(32), "cc".repeat(32)),
|
||||
relays = listOf("wss://relay1.example/", "wss://relay2.example/"),
|
||||
)
|
||||
assertContentEquals(mdkFixtureB(), data.encodeTls())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun marmotGroupData_decodesMdkFixtureA() {
|
||||
val decoded = assertNotNull(MarmotGroupData.decodeTls(mdkFixtureA()))
|
||||
assertEquals(2, decoded.version)
|
||||
assertEquals("00".repeat(32), decoded.nostrGroupId)
|
||||
assertEquals("", decoded.name)
|
||||
assertEquals("", decoded.description)
|
||||
assertEquals(listOf("aa".repeat(32)), decoded.adminPubkeys)
|
||||
assertEquals(listOf("wss://relay.example/"), decoded.relays)
|
||||
assertNull(decoded.disappearingMessageSecs)
|
||||
}
|
||||
|
||||
@Test
|
||||
fun marmotGroupData_decodesMdkFixtureB() {
|
||||
val decoded = assertNotNull(MarmotGroupData.decodeTls(mdkFixtureB()))
|
||||
assertEquals(2, decoded.version)
|
||||
assertEquals("Amethyst", decoded.name)
|
||||
assertEquals("Test group", decoded.description)
|
||||
assertEquals(listOf("bb".repeat(32), "cc".repeat(32)), decoded.adminPubkeys)
|
||||
assertEquals(listOf("wss://relay1.example/", "wss://relay2.example/"), decoded.relays)
|
||||
}
|
||||
|
||||
@Test
|
||||
fun mip01ImageCrypto_deriveImageKeyIs32BytesAndDeterministic() {
|
||||
val seed = "11".repeat(32).hexToByteArray()
|
||||
|
||||
Reference in New Issue
Block a user