Repository navigation
docs(specs): define CCDP and ceremony service contracts #13
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -127,8 +127,9 @@ Proving Circuit: The zero-knowledge circuit whose proof a Platform Verifier | |
| checks. It proves only what cannot be read from authenticated evidence. | ||
|
|
||
| Redirect Runtime: The immutable browser component served at a registered | ||
| redirect URI, which receives an authorization response, authenticates the | ||
| Application, and privately carries that response to Prover as defined by | ||
| CCDP. It does not deliver the raw response to the Application. | ||
|
|
||
| Verifier Governance Process: The authority over the verification path: the | ||
| Proof Verifier's Supported Version Set and the Verifier Version each entry | ||
|
|
@@ -239,6 +240,17 @@ identity-platform signing root, notary key, Platform Verifier, verifier governan | |
| browser supply chain, or Consumer Chain invalidates the properties that depend | ||
| on it. | ||
|
|
||
| Browser result acceptance is not ledger verification. Prover performs canonical | ||
| parsing and local request/commitment consistency checks; Application validates | ||
| the delivered result under the selected profile. Google's browser checks compare | ||
| public inputs with the delivered fields and Application's retained digest | ||
| without passing that expected digest to Prover; the | ||
| [platform profile](platform-ceremonies.md#32-browser-token-validation) owns those | ||
| checks. Neither endpoint verifies generated proofs or notary signatures | ||
| cryptographically. Well-formed forgeries can survive browser consistency checks | ||
| but still fail the applicable downstream proof, digest-binding, trusted signing-key, or | ||
| notary-signature check before an authoritative effect. | ||
|
|
||
| - SP-BIND-01: | ||
| Evidence produced by a ceremony discharges only for the Authorized | ||
| Transaction Data committed in its Authorization Digest. Depends on | ||
|
|
@@ -248,16 +260,22 @@ on it. | |
| conformance tests (supporting, not proving) plus the collision resistance of | ||
| SHA-256 and keccak256. | ||
| - SP-CLIENT-01: | ||
| The browser Prover rejects a parsed OAuth client identifier differing from | ||
| the one selected and frozen by the Application for the ceremony. This checks | ||
| local consistency, not the authenticity of an attestation's claimed identifier; ledger | ||
| verification authenticates that identifier independently. Depends on ASM-PROV-05, | ||
| ASM-PROV-07 for a profile that cites it, ASM-NOTARY-01, ASM-PROOF-01, and | ||
| ASM-BROWSER-01. | ||
| Evidence: checked invariant in the Canonical Runtime, plus conformance tests | ||
| (supporting). | ||
| - SP-DELIVERY-01: | ||
| The Identity Platform delivers an OAuth client's initial authorization | ||
| response only to that client's registered redirect origin. Subsequent browser | ||
|
Contributor
There was a problem hiding this comment. Medium: a borrowed client can receive the response under
Member
Author
There was a problem hiding this comment. Fixed both the property and security prose in bbc336a. Receipt depends on the serving Bridge's allowlist; |
||
| release follows REQ-COMMON-30: an Application outside that deployment's | ||
| allowlist cannot use a borrowed client to obtain its response through CCDP. | ||
| A shared or wildcard-admitting deployment deliberately permits other | ||
| Applications; this property does not establish client ownership or user | ||
| intent. Depends on ASM-PROV-01, ASM-BROWSER-01. | ||
| Evidence: external audit of the registered redirect URI list, plus | ||
| conformance tests (supporting). | ||
| - SP-EXCHANGE-01: | ||
|
|
@@ -706,9 +724,12 @@ attestation to verify carries no value at all. | |
| The Deployment MUST register with each Identity Platform only redirect URIs | ||
| whose origins it controls. | ||
| - REQ-COMMON-30 (upholds SP-DELIVERY-01): | ||
| The Canonical Runtime MUST release an authorization response beyond Callback | ||
| only after authenticating the exact Application origin against the deployment | ||
| allowlist. The Canonical Runtime MUST carry the response only to the configured | ||
| Prover, preserving that authenticated origin restriction as defined by CCDP | ||
| (REQ-CCDP-03, REQ-CCDP-04). The deployment allowlist follows the member and | ||
| admission rules of popup transport REQ-POPUP-ALLOW-01 and REQ-POPUP-ALLOW-02. | ||
| - REQ-COMMON-31 (upholds SP-DELIVERY-01): | ||
| The Canonical Runtime MUST ignore a forwarding target supplied in the | ||
| redirect request. | ||
|
|
@@ -832,9 +853,10 @@ An Consumer that wants a fixed-size key derives one itself, as the keccak256 of | |
| the returned bytes. Deriving is cheap and lossless; returning only a digest is | ||
| not, because the readable value cannot be recovered from it. | ||
| - REQ-COMMON-17 (upholds SP-CLIENT-01): | ||
| The Prover MUST reject locally parsed evidence whose client identifier | ||
| differs byte for byte from the client selected and frozen by the Application | ||
| for the ceremony. This browser comparison does not authenticate that evidence; | ||
| ledger verification remains authoritative. | ||
| - REQ-COMMON-17C (upholds SP-CLIENT-01): | ||
| The Proof Verifier and the Platform Verifier MUST NOT require the exposed | ||
| client identifier to belong to a registered set. The Consumer | ||
|
|
@@ -1150,8 +1172,9 @@ constant. | |
| method and path revealed in the request, byte for byte with the profile | ||
| constants it pins. | ||
| - REQ-COMMON-21B (upholds SP-EXCHANGE-01): | ||
| The Implementation MUST construct every notarized request with the media type fixed | ||
| by the selected Platform Profile and, where used, the `redirect_uri` frozen | ||
| by the Application for the ceremony. Neither value is a | ||
| Consumer input. Necessity: media type selects the platform's request parser, | ||
| while redirect URI is application delivery configuration rather than | ||
| Consumer Chain identity authority. | ||
|
|
@@ -1323,8 +1346,8 @@ the constructions that role implements. | |
| completes contains the raw `authorizationNonce` of a PKCE profile. | ||
| Verification: inspection of the emitted artifacts. | ||
| - TEST-COMMON-09 (exercises REQ-COMMON-16, REQ-COMMON-16A, REQ-COMMON-16B, REQ-COMMON-17, REQ-COMMON-17C, REQ-COMMON-22A): | ||
| The Prover rejects locally parsed evidence carrying a client identifier | ||
| other than the Application's frozen client, while a proof carrying a client | ||
| identifier registered nowhere remains acceptable to the Platform Verifier. | ||
| Every platform returns the identifier as exact bytes, never a digest, and a | ||
| Submission whose supplied bytes its evidence does not authenticate is | ||
|
|
@@ -1367,7 +1390,8 @@ the constructions that role implements. | |
| - TEST-COMMON-11 (exercises REQ-COMMON-21, REQ-COMMON-21A, REQ-COMMON-21B, REQ-COMMON-21C): | ||
| The Platform Verifier rejects an authenticated foreign authority, method, | ||
| or path. The request constructor refuses a media type or `redirect_uri` | ||
| differing from the selected profile's media type or the Application's frozen | ||
| redirect URI, respectively. One verifying key serves | ||
| two deployments configured with different clients and redirect URIs. | ||
| - TEST-COMMON-12 (exercises REQ-COMMON-23, REQ-COMMON-24, REQ-COMMON-25): | ||
| A fractional, negative, overflowing, or textual timestamp is rejected, and | ||
|
|
@@ -1380,9 +1404,13 @@ the constructions that role implements. | |
| operation with a further authoritative effect succeeds, and a Consumer whose | ||
| only effect is the metadata write rejects the Submission. | ||
| - TEST-COMMON-14 (exercises REQ-COMMON-30, REQ-COMMON-31): | ||
| Each of two explicitly admitted application origins can complete its own | ||
| authenticated live channel; an unadmitted origin is rejected. A pattern or | ||
| `*` admits the origins specified by the popup transport rules without granting | ||
| client ownership. A redirect request carrying | ||
| a forwarding target cannot change either result. Callback privately carries | ||
| the return only to the configured Prover; that Prover authenticates the same | ||
| Application origin before credential use. | ||
| - TEST-COMMON-15 (exercises REQ-COMMON-29): | ||
| Every redirect URI registered against each production client resolves to an | ||
| origin the deployment controls. Verification: audit of the platform client | ||
|
|
@@ -1408,7 +1436,8 @@ the constructions that role implements. | |
| moves no value; and a call whose native value differs from the quoted value | ||
| is rejected at every hop. | ||
| - TEST-COMMON-17 (exercises REQ-COMMON-33, REQ-COMMON-34B, REQ-COMMON-33A, REQ-COMMON-34, REQ-COMMON-34A, REQ-COMMON-34C, REQ-COMMON-34D, REQ-COMMON-34E): | ||
| At ledger verification, the trusted Notary Service rejects an attestation | ||
| carrying a foreign notary signature; a | ||
| verification whose fee was not delivered is rejected; the charged fee is | ||
| identical across differing attested content, authors, payers, and | ||
| submitters; the current fee is readable before the Submission is submitted; and a | ||
|
|
@@ -1489,17 +1518,20 @@ Transaction Author and the proof-bound Authorized Transaction Data. A copied | |
| proof creates no authority for a submitter that cannot satisfy that predicate. | ||
|
|
||
| Client binding rejects evidence issued to a client other than the one whose | ||
| ceremony the Canonical Runtime opened. The check is local: the Application | ||
| freezes its selected Bridge's client configuration, which may be shared with | ||
| other admitted Applications. The Consumer | ||
| authenticates the proof-bound transaction and Transaction Author instead; it | ||
| does not maintain an OAuth-client allowlist or admit applications on the | ||
| Consumer Chain. | ||
|
|
||
| Consent-screen phishing remains outside protocol enforcement. The Identity | ||
| Platform delivers a borrowed client's response only to that client's registered | ||
| redirect URI (ASM-PROV-01); Callback then applies the deployment's allowlist. | ||
| An unadmitted Application cannot receive the response through that flow, but | ||
| a shared deployment or `*` may deliberately admit an unrelated Application. | ||
| Such an Application, or one using its own client and redirect, can obtain | ||
| evidence from a ceremony the user approves; the proof-bound operation, | ||
| Transaction Author authentication, and any composition-owned transaction authorization | ||
| contain that case. The ceremony layer defines no extra confirmation page. The | ||
| registered redirect URI list and the origins on it are therefore trust-bearing | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Low: the client source is stale. SP-CLIENT-01 says "fixed by its immutable ceremony profile", and so does REQ-COMMON-17 (:848-851, outside the diff), but a Platform Profile carries no client. REQ-PLAT-47 and REQ-PLAT-62 use the client frozen by the Application. Say "the client frozen for the ceremony" in both.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Updated SP-CLIENT-01 and REQ-COMMON-17 to use the client frozen for the ceremony. Platform profiles continue to own protocol constants, not deployment-specific OAuth client IDs.