derecalliance / protobufs

The format of DeRec messages.
Apache License 2.0
3 stars 0 forks source link

Add `publicSignatureKey` to the `ContactMessage` protobuf #26

Open zanctor opened 10 months ago

zanctor commented 10 months ago

A public signature key is required for the message signature verification. However, during the pairing sequence, an initiator does not know a responder's signature key to be able to verify a pairing response right away. It needs to decrypt the message and take this key from it. This might be an inconvenience in some programming languages and/or PGP implementations, where the message handling is done using streams (e.g. Java) or another similar concept since there might be a need to decrypt the message twice (to get the signature key first, and then decrypt-and-verify again with that key).

Thus I suggest adding a responder's signature key to the ContactMessage protobuf, so any implementation will be able to decrypt and verify the pair response message at once. Also, the publicSignatureKey field can be removed from the PairResponseMessage protobuf in this case.

jorabin commented 10 months ago

Agree that the ContactMessage should contain public signature key of responder for the reason @zanctor gives.