origin89hq/km43#128 (origin89hq/km43#130) replaces KM43's label-derived keys with Noise key agreement and sealed sessions. The app's pairing, Hello and kept enrolment change with it.
Label (P-049, P-236). Scan the v2 QR payload km43:2:<device_id>:<printed_secret>:<controller_fp> (137 characters) and refuse a v1 payload. During pairing, abandon without sending message 3 when the controller key message 2 proves is not the one controller_fp names; that check is what stops a label holder with a network position from sitting in the middle for the life of the enrolment.
Pairing (P-064, P-241, P-242). Pair 0x0B/0x8B then Enrol 0x13/0x93, Noise XXpsk0 under the label's pre-shared key. Generate the client key, and keep it and the controller key durably before sending Enrol 0x13. If Enrol 0x93 never arrives, do not assume a refusal: Discover and Hello, whose report names the slot. Believe a refusal only when its tag verifies under the label's refusal key; treat anything else as "the code may be wrong", never as "the controller refused".
Sessions (P-222, P-226, P-227, P-238). Hello runs Noise IK against the kept controller key, never one from Discover, and carries the admission tag. Build the prologue from the latest Discover, the challenge being presented (Discover key 7, or Enrol 0x93 key 4 after an enrolment on the same connection) and the handle. A differing epoch in Discover is not a reason to discard the enrolment; offer re-pairing only after a Hello is refused with error 12.
Transport (P-230 to P-234). Every message after a handshake is sealed with ChaCha20-Poly1305. A request's nonce is its req_id, issued from 1 by the sealer; the controller's nonces arrive in key 2 and are checked against a 64-nonce window. Never persist transport keys or nonces.
Kept enrolment. Format 2 holds the device id, the pinned controller key, the client's private key, the suite, and the epoch, slot and generation when known. Format 1 (a label-derived key) must be refused and the phone re-paired.
The Rust reference implementation is km43 (PairPending, HelloPending, ClientChannel, StoredEnrolment); the published vectors are in docs/protocol/vectors/v1.json under handshakes, sealed, macs and bodies.
origin89hq/km43#128 (origin89hq/km43#130) replaces KM43's label-derived keys with Noise key agreement and sealed sessions. The app's pairing,
Helloand kept enrolment change with it.Label (P-049, P-236). Scan the v2 QR payload
km43:2:<device_id>:<printed_secret>:<controller_fp>(137 characters) and refuse a v1 payload. During pairing, abandon without sending message 3 when the controller key message 2 proves is not the onecontroller_fpnames; that check is what stops a label holder with a network position from sitting in the middle for the life of the enrolment.Pairing (P-064, P-241, P-242).
Pair 0x0B/0x8BthenEnrol 0x13/0x93, NoiseXXpsk0under the label's pre-shared key. Generate the client key, and keep it and the controller key durably before sendingEnrol 0x13. IfEnrol 0x93never arrives, do not assume a refusal:DiscoverandHello, whose report names the slot. Believe a refusal only when its tag verifies under the label's refusal key; treat anything else as "the code may be wrong", never as "the controller refused".Sessions (P-222, P-226, P-227, P-238).
Helloruns NoiseIKagainst the kept controller key, never one fromDiscover, and carries the admission tag. Build the prologue from the latestDiscover, the challenge being presented (Discoverkey 7, orEnrol 0x93key 4 after an enrolment on the same connection) and the handle. A differing epoch inDiscoveris not a reason to discard the enrolment; offer re-pairing only after aHellois refused with error 12.Transport (P-230 to P-234). Every message after a handshake is sealed with ChaCha20-Poly1305. A request's nonce is its
req_id, issued from 1 by the sealer; the controller's nonces arrive in key 2 and are checked against a 64-nonce window. Never persist transport keys or nonces.Kept enrolment. Format 2 holds the device id, the pinned controller key, the client's private key, the suite, and the epoch, slot and generation when known. Format 1 (a label-derived key) must be refused and the phone re-paired.
The Rust reference implementation is
km43(PairPending,HelloPending,ClientChannel,StoredEnrolment); the published vectors are indocs/protocol/vectors/v1.jsonunderhandshakes,sealed,macsandbodies.