From d8131c58ddf38dca9f3111d1b27d5785938636d1 Mon Sep 17 00:00:00 2001 From: Arthur Lazzaretti Date: Tue, 21 Jul 2026 17:02:00 -0700 Subject: [PATCH] Remove reply-quote validation detail from the cryptography primer The paragraph predates the primer rewrite and was merged into it mechanically. The primer is a conceptual page and does not otherwise discuss replies; reply_preview_validation remains fully documented in the Chat XDK reference and in Troubleshooting, where the field-level detail belongs. --- xchat/cryptography-primer.mdx | 2 -- 1 file changed, 2 deletions(-) diff --git a/xchat/cryptography-primer.mdx b/xchat/cryptography-primer.mdx index def7dcccb..dbc02b0f0 100644 --- a/xchat/cryptography-primer.mdx +++ b/xchat/cryptography-primer.mdx @@ -184,8 +184,6 @@ If anything in the signed content changes, verification fails. Of course, this g **In your app.** The XDK signs when you encrypt and verifies when you decrypt. Rejection happens at both ends: X Chat itself rejects events it cannot verify, and the XDK does the same on receipt, **mandatory by default** (disabling this is not recommended). Details: [Chat XDK](/xchat/xchat-xdk). -Signatures also cover quoted content. A reply embeds the raw **signed** original message it quotes; when the Chat XDK decrypts the reply, it verifies that embedded original and compares the quote against it, reporting the outcome as `reply_preview_validation` (`Valid` / `Invalid`). An `Invalid` outcome means the quote does not match the signed original—treat the quoted material as untrusted, even though the reply itself is verified separately—so no participant can attribute fabricated words to another. - ### Signed state changes (action signatures) Messages are not the only thing signed. Every change to a conversation (creating a group, adding members, rotating a key) must also carry **action signatures**: the sender signs a payload describing exactly what the change does, and the API rejects requests where these are missing or malformed. The XDK produces them for you.