ksecuremessage-core-protocol/dev.kreienbuehl.ksecuremessage.protocol/RecoveryKeyRevocation

RecoveryKeyRevocation

Recovery key revocation, format version 1 (docs/recovery-key-lifecycle.md). Revocation statement:

u32 length | userId (UTF-8)
u32 length | authorizer userId (UTF-8) | u32 length | authorizer deviceId (UTF-8)
current recovery public key (32)
expected recovery key epoch: i64 (>= 1)
timestamp: i64, epoch milliseconds
nonce (16)

Each construction prefixes u32 length | domain (UTF-8):

authorization, Ed25519 by the current recovery key: KSecureMessage-RecoveryKeyRevocation-v1;
RecoveryKeyRevocationId, SHA-256: KSecureMessage-RecoveryKeyRevocationId-v1.

Properties

PUBLIC_KEY_SIZE

const val PUBLIC_KEY_SIZE: Int

Size of a recovery public key (Ed25519).

SIGNATURE_SIZE

const val SIGNATURE_SIZE: Int

Size of a signature (Ed25519).

Functions

authorizationInput

fun authorizationInput(statement: RecoveryKeyRevocationStatement): ByteArray

The bytes the current recovery key signs.

authorize

fun authorize(currentKey: LastDeviceRecoveryKey, authorizer: DeviceAddress, expectedEpoch: Long, timestamp: Instant, nonce: RequestNonce = RequestNonce.random()): RecoveryKeyRevocationAuthorization

The revocation of currentKey (registered at expectedEpoch) for authorizer's user, signed by it.

revocationId

fun revocationId(statement: RecoveryKeyRevocationStatement): RecoveryKeyRevocationId

The ID of statement.

verifySignature

fun verifySignature(currentPublicKey: ByteArray, authorization: RecoveryKeyRevocationAuthorization): Boolean

true if authorization's signature verifies with currentPublicKey. The server passes the registered recovery key (or, for an exact retry, the statement's).