Verify Link endorsements via HIs learned from the broadcast chain - #5
Open
erkki wants to merge 1 commit into
Open
Verify Link endorsements via HIs learned from the broadcast chain#5erkki wants to merge 1 commit into
erkki wants to merge 1 commit into
Conversation
pendingLinks was never populated, so the chain walk in recursivelyProcessingLinks was unreachable, and handleLink dropped every Link whose DNSSEC HDA key was not yet cached — with no DNS connectivity no Link ever verified. - Record each self-certified childDET -> childHI in per-aircraft knownHIs (entries pass verifyDETHashLocal before insertion). - Verify a Link with the DNSSEC-resolved parent key when cached, falling back to the broadcast-learned parent HI; park it in pendingLinks when neither is available. - Re-check pending links whenever a new child HI arrives, regardless of whether the carrying Link's own endorsement verified (arrival order of chain links is arbitrary). - Set the aircraft public key only when childDET matches the aircraft's broadcast DET (was: for any verified link, so an HDA HI could become the Wrapper/Manifest verification key). Unit tests use a Broadcast Endorsement captured over the air: Ed25519 verifies under the parent HI and not the child HI; the DET low 64 bits match cSHAKE128(upper64 | HI, S=Context ID). android.util.Log is statically mocked (mockito) in the test class. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ac.pendingLinkswas never populated, making the chain walk inrecursivelyProcessingLinksunreachable, andhandleLinkdropped every Link whoseDNSSEC HDA key was not yet cached — with no DNS connectivity no Link ever verified,
so
ac.publicKeystayed null and Wrapper/Manifest verification was unreachable.Change:
childDET -> childHIin per-aircraftknownHIs(entries pass
verifyDETHashLocalbefore insertion).broadcast-learned parent HI; park it in
pendingLinkswhen neither is available.carrying Link's own endorsement verified (chain links arrive in arbitrary order).
childDETmatches the aircraft's broadcastDET (previously any verified link's child HI became the Wrapper/Manifest key).
Trust model: the broadcast-learned path proves each endorsement is internally
consistent (parent signed child, DETs self-certify); anchoring the chain root uses
the DNSSEC path.
Tests: Broadcast Endorsement captured over the air — Ed25519 verifies under the
parent HI and not the child HI; DET low 64 bits match cSHAKE128(upper64 | HI,
S=Context ID). Device-verified: full 4-link chain (Apex→RAA→HDA→UA) verifies with
arbitrary arrival order, offline and via DNS. Adds
org.mockito:mockito-core(testImplementation) to statically mock
android.util.Logper test class ratherthan enabling the module-global
unitTests.returnDefaultValues. The mockito lineis identical in #3 and merges cleanly.