Module challenge 

Proving possession of a PKG-issued signing key.

A holder of a SigningKeyExt signs a challenge chosen by the party that wants the proof; that party verifies it with the [VerifyingKey] and the Policy whose identity it expects. Nothing here touches a container: it is a live proof that whoever is talking holds the signing key belonging to an identity, not a statement about data at rest.

The signing key that signs a challenge is the same one that signs container headers, so a challenge signature must never be mistakable for a header signature. CHALLENGE_DOMAIN is what keeps the two apart, and sign_challenge applies it itself: a verifier hands over a challenge and a context, never the leading bytes of the signed message. Were the domain separator an argument, a malicious verifier could pass a serialized header as the “challenge” and get back a signature valid on a container it wrote.

context names what the proof is for — an endpoint, an upload id, a session. It is signed alongside the challenge so a proof collected for one purpose does not replay into another.

use pg_core::challenge::{sign_challenge, verify_challenge};

let mut rng = rand::thread_rng();
let signing_key = &setup.signing_keys[0];

// The verifier picks the challenge; the signer never chooses it.
let challenge = b"32 random bytes from the verifier";

let sig = sign_challenge(signing_key, "cryptify/upload", challenge, &mut rng);

assert!(verify_challenge(
    &setup.ibs_pk,
    &signing_key.policy,
    "cryptify/upload",
    challenge,
    &sig,
));

Constants

CHALLENGE_DOMAIN

Domain separator for upload-possession challenges. Applied by the signer, never taken from the verifier’s input.

Functions

sign_challenge

Signs a verifier-chosen challenge, proving possession of key.

verify_challenge

Verifies a challenge signature against the identity derived from pol.