feat(channel): sealed peer channel (Tier 2) - #23
Merged
Conversation
…(Tier 2) Implement ca2a_runtime.channel: an HPKE-style sealed channel (ephemeral X25519 ECDH to the peer's attested key, HKDF-SHA256, ChaCha20-Poly1305 AEAD). SealedChannel(peer_pub).seal(payload) seals to the peer's key; open_sealed(blob, private_key) opens it only with the enclave-bound private key. A wrong key, a tampered ciphertext, or a malformed blob fails closed with SEALED_CHANNEL_ERROR and never returns unauthenticated plaintext. aad binds context into the tag. Claim C4 (sealed-payload confidentiality) moves from fail-closed-only to a validated experiment at the cryptographic layer: the path sees ciphertext, only the peer's private key opens the payload, another party cannot, and tampering fails closed. Suite: 88 passed, 1 skipped (only C6 remains), 99% coverage. The enclave-binding of the private key is a hardware property from attestation, and binding the seal to a verified report on a live call is runtime wiring; docs, LIMITATIONS, and ROADMAP say so. Closes #9 Closes #13 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A real sealed peer channel, unblocking claim C4.
ca2a_runtime.channelimplements an HPKE-style scheme: ephemeral X25519 ECDH to the peer's attested key, HKDF-SHA256 to derive a key, ChaCha20-Poly1305 AEAD over the payload.SealedChannel(peer_pub).seal(payload, aad=...)seals to the peer's attested public key.open_sealed(blob, private_key, aad=...)opens it, only with the peer's private key.generate_channel_keypair()produces the peer's channel keypair (in the enclave, on hardware).A wrong key, a tampered ciphertext, or a malformed blob fails closed with
SEALED_CHANNEL_ERROR; the channel never returns unauthenticated plaintext.Claim C4 validated
experiments/claim4-sealed-payload-confidentialitymoves from fail-closed-only to a validated experiment: the transport sees ciphertext, only the peer's private key opens the payload, another party cannot, and tampering fails closed (4/4). Suite: 88 passed, 1 skipped (only C6 remains), 99% coverage.Scope / honesty
The cryptographic confidentiality of the payload to the attested key is implemented and tested. The stronger "decrypts only inside the attested measurement" rests on the private key being enclave-bound (a hardware property from attestation), and binding the seal to a verified report on a live inbound call is runtime wiring. Docs, LIMITATIONS, and ROADMAP state this.
Closes #9
Closes #13
🤖 Generated with Claude Code