Index for crypto::exp_ihat, the IHAT profile. Current state, not history — the individual issues carry that.
What the profile is
IHAT over NIST P-256, aligned byte-for-byte with ihat-rs, the reference implementation published in this org by Samuel Schlesinger, one of the draft authors. It follows that code rather than the crypto draft's prose, because the code is executable and interoperating with it is the only validation available — neither publishes test vectors.
interop/ cross-verifies in both directions: presentations produced here verify under ihat-rs and re-encode byte-identically, ihat-rs's verify here, keys round-trip, and neither accepts a substituted accepted set. tests/appendix_a_flow.rs runs Appendix A on it, and interop/tests/appendix_a_end_to_end.rs runs the same exchange with no mocks at all, paired with real RFC 9578 Privacy Pass credentials.
Not deployable. ihat-rs states it has not been audited. Interoperability is agreement, not correctness.
Open — all upstream reports
Five findings, plus editorial. None is work on this crate; each is something the drafts should say.
Also worth reporting: upstream PR #39 contradicts ihat-rs on point encoding, the Pedersen generator, and the OR-proof construction.
Open — local
Closed
#2 (DSTs — fixed by ihat-rs, adopted verbatim), #3 (hash — the RFC 9380 P-256 suite fixes it), #4 (transcripts — resolved by adoption), #6 (OR proof — matches the reference implementation), #7 (m does not exist), #10 (test vectors — superseded by interop/).
Not in scope, and not a backlog
MoLE specifies several endorsement and credential protocols to demonstrate agility; a deployment picks one of each. This crate implements IHAT and Privacy Pass Reverse Flow. For Longfellow, ACT and Budget Privacy Pass the wire structures, registries and dispatch are implemented and tested — only their cryptography is external, and Longfellow's and ACT's underlying drafts are not in a state to build against. Key rotation and the configuration format are TODO. upstream, so there is nothing to implement.
One note that is a property rather than a task: ACT is the only credential protocol with bound updates, which Reverse Flow cannot provide (§5.2.3, an open problem upstream).
Index for
crypto::exp_ihat, the IHAT profile. Current state, not history — the individual issues carry that.What the profile is
IHAT over NIST P-256, aligned byte-for-byte with
ihat-rs, the reference implementation published in this org by Samuel Schlesinger, one of the draft authors. It follows that code rather than the crypto draft's prose, because the code is executable and interoperating with it is the only validation available — neither publishes test vectors.interop/cross-verifies in both directions: presentations produced here verify underihat-rsand re-encode byte-identically,ihat-rs's verify here, keys round-trip, and neither accepts a substituted accepted set.tests/appendix_a_flow.rsruns Appendix A on it, andinterop/tests/appendix_a_end_to_end.rsruns the same exchange with no mocks at all, paired with real RFC 9578 Privacy Pass credentials.Not deployable.
ihat-rsstates it has not been audited. Interoperability is agreement, not correctness.Open — all upstream reports
Five findings, plus editorial. None is work on this crate; each is something the drafts should say.
challenge_digestis implemented by nobody. §4.1.3's two MUSTs cannot be satisfied while interoperating, becauseihat-rshas no such field anywhere.ChallengeBindingexposes both sides of the contradiction. The sharpest one.challenge_digestis computed by RFC 9578 over an RFC 9577TokenChallenge, which is never empty. Cheapest to fix: a cross-reference and one sentence.C'is used before it is defined. Editorial.Also worth reporting: upstream PR #39 contradicts
ihat-rson point encoding, the Pedersen generator, and the OR-proof construction.Open — local
zeroizepinned inCargo.lockto hold MSRV 1.75. A build note.Closed
#2 (DSTs — fixed by
ihat-rs, adopted verbatim), #3 (hash — the RFC 9380 P-256 suite fixes it), #4 (transcripts — resolved by adoption), #6 (OR proof — matches the reference implementation), #7 (mdoes not exist), #10 (test vectors — superseded byinterop/).Not in scope, and not a backlog
MoLE specifies several endorsement and credential protocols to demonstrate agility; a deployment picks one of each. This crate implements IHAT and Privacy Pass Reverse Flow. For Longfellow, ACT and Budget Privacy Pass the wire structures, registries and dispatch are implemented and tested — only their cryptography is external, and Longfellow's and ACT's underlying drafts are not in a state to build against. Key rotation and the configuration format are
TODO.upstream, so there is nothing to implement.One note that is a property rather than a task: ACT is the only credential protocol with bound updates, which Reverse Flow cannot provide (§5.2.3, an open problem upstream).