Module subkey_chain 

Per-pairing subkey chains (auths-device-subkey-v1).

Privacy mitigation: instead of submitting the stable bootstrap DID pubkey to every controller the phone pairs with (a cross-controller correlation oracle), the phone generates a fresh session-only keypair and asks the bootstrap key to sign a binding message. The daemon observes the per-session subkey on the wire; if the daemon requests proof of continuity, the phone supplies the chain.

Binding message format (v1)

binding_message = "auths-device-subkey-v1" || session_id || subkey_pubkey_compressed_sec1

• The domain separator auths-device-subkey-v1 pins the chain to this version; a future v2 lands under subkey-chain-v2.
• session_id is the pairing session id from the URI (variable- length UTF-8 string; no length-prefix — callers must treat the session_id as opaque bytes).
• subkey_pubkey is the 33-byte compressed SEC1 encoding of the P-256 pubkey currently bound to this session (same form carried in SubmitResponseRequest.device_signing_pubkey for P-256).

On the wire

{
  "subkey_chain": {
    "bootstrap_pubkey": "<base64url-no-pad of 33-byte compressed SEC1>",
    "subkey_binding_signature": "<base64url-no-pad of 64-byte raw r||s>"
  }
}

Both fields are P-256 (ADRs 002 / 003). No alternate-encoding path — the daemon rejects malformed chains outright.

Structs

SubkeyChain

Optional chain appended to a SubmitResponseRequest proving that the submitted device_signing_pubkey was authorized by a more stable bootstrap key held by the same phone.

Enums

SubkeyChainError

Errors produced by verify_subkey_chain.

Constants

SUBKEY_CHAIN_V1_DOMAIN

Domain separator pinned to chain version 1. See crate::subkey_chain module docs for the binding-message format.

Functions

build_binding_message_v1

Build the canonical binding message for chain version 1.

verify_subkey_chain

Verify a subkey chain and return the bootstrap pubkey’s raw bytes (33-byte compressed SEC1) on success.