pub fn signed_material(at_ms: i64, body: &[u8]) -> Vec<u8> ⓘExpand description
The bytes a signature actually covers: the signing time, then the message.
The timestamp is inside the signed material, unlike SIG_KID, and
the asymmetry is easy to get backwards. A rewritten kid can only select a
key under which verification fails, so it is safe outside. A rewritten
timestamp would let anyone replay a captured message by making it look
fresh again — which is the entire freshness bound, defeated by editing one
header. So it is signed.
The prefix is fixed-width rather than delimited so there is no
concatenation ambiguity to reason about: no timestamp encoding can be
chosen such that one (at, body) pair produces the same bytes as another.
Keeping it a prefix rather than a field also leaves the Command wire type
untouched — agent-authored in-process commands would otherwise carry a
field that means nothing for them.