Replace stubbed signed_prekey_signature = [0] ** 64 with real Ed25519
cryptographic signatures. This fixes the security-critical signature
validation that was previously bypassed in tests.
Changes:
- Add signEd25519() helper for deterministic Ed25519 signing
- Add verifyEd25519() helper for signature verification
- Generate real identity keypair for Bob (Ed25519)
- Sign Bob's X25519 signed_prekey with his Ed25519 identity key
- Verify signature before using prekey in handshake
- Add dedicated test for Ed25519 signature roundtrip
Security: Prekey bundles now carry cryptographic proof of authenticity.
The signature binds the medium-term signed prekey to the long-term
identity key, preventing MITM attacks during key exchange.
Fixes P0 security audit issue: Stubbed Signature Validation
(closes issue at test_pqxdh.zig:113)
Previously encryptPayload() used empty AAD, allowing ciphertext to be
replayed across different contexts. Now includes header fields as AAD:
- ephemeral_pubkey: Binds to sender identity
- timestamp: Replay protection (5 min window)
- service_type: Context binding (WORLD/FEED/MESSAGE/DIRECT)
API changes:
- encryptPayload() now requires service_type parameter
- decryptPayload() now requires expected_service_type parameter
- EncryptedPayload extended with timestamp and service_type fields
- New error types: ServiceTypeMismatch, TimestampTooOld, TimestampInFuture
Security: Ciphertext is now cryptographically bound to sender,
timestamp, and service context. Replay and context confusion attacks
are prevented via AAD verification during decryption.
Fixes P0 security audit issue: Missing AAD in AEAD Encryption
Add build option -Denable-liboqs to conditionally enable post-quantum crypto.
When disabled, uses liboqs_stub.zig which provides stub implementations
that return ML_KEM_NotAvailable error.
Changes:
- build.zig: Add enable_liboqs option and liboqs module selection
- pqxdh.zig: Use liboqs.isAvailable() runtime check for PQ operations
- soulkey.zig: Use pqxdh.enable_pq to conditionally generate ML-KEM keys
- liboqs_stub.zig: Stub implementations when liboqs not linked
- liboqs_real.zig: Real C FFI bindings when liboqs is linked
Fixes P0 security audit issue: liboqs Build Breakage
Fix circular and missing module imports across L0-L2 layers:
- Add l0_transport import to QVL and PoP modules in build.zig
- Fix gateway test to use DhtService parameter
- Convert l0_transport imports to direct time imports in L1
- Fix soulkey to use module import (@import("pqxdh"))
- Fix policy.zig to use module import (@import("lwf"))
- Refactor mod.zig exports to avoid circular dependencies
- Update service.zig and utcp/socket.zig to use module imports
- Fix all QVL test files to import time directly
Results: 254+ tests passing (was 124), 1 module conflict remaining
in service tests (opq/store.zig in both lwf and opq modules).
Refs: Night Sprint 2026-02-05
Markus Maiwald
