docs(cryptoops): Update credential ID generation from Base58 SHA256 to Base32 HMAC
- Change Credential.id comment from "Base58-encoded SHA256 hash of public key" to "Base32-encoded HMAC-SHA256 of public key" - Update handshake example from `Base58Encode(SHA256(publicKey))` to `Base32Encode(HMAC_SHA256(publicKey, "RDVERB_PROTOCOL_VER_01_SHA256_ID"))` This reflects the protocol update for enhanced identity derivation and security.
lemon-mint committed
Oct 27, 2025 at 14:54 UTC
a8123d7339e7e5ff3a8ae5631177d60789db405a
2 files changed
+2
-2
relaydns/core/cryptoops/README.md
+2
-2
@@ -35,7 +35,7 @@ Each peer has a long-term Ed25519 keypair that identifies them:
35
type Credential struct {
36
privateKey ed25519.PrivateKey // 64 bytes
37
publicKey ed25519.PublicKey // 32 bytes
38
- id string // Base58-encoded SHA256 hash of public key
38
+ id string // Base32-encoded HMAC-SHA256 of public key
39
}
40
```
41
@@ -274,7 +274,7 @@ func (sc *SecureConnection) Read(p []byte) (int, error) {
274
- **Signature-based**: Ed25519 signatures over handshake payloads
275
- **Identity binding**: Public keys are cryptographically bound to identity IDs
276
```go
277
- id := Base58Encode(SHA256(publicKey))
277
+ id := Base32Encode(HMAC_SHA256(publicKey, "RDVERB_PROTOCOL_VER_01_SHA256_ID"))
278
```
279
280
### 2. Forward Secrecy