harden(cog-ha-matter crypto): domain-separate witness signing + verify_strict (signing chain otherwise sound — P2 crypto core verified) (#1080)
* fix(cog-ha-matter): domain-separate witness signing chain + verify_strict (ADR-116 §2.2)
Crypto review of the SHA-256 + Ed25519 witness chain that ADR-262 P2
reuses. The sibling wifi-densepose-engine bug class (unframed
concatenation of operator-influenceable strings into a signed digest)
is ABSENT here — canonical_bytes already length-prefixes kind/payload.
Two real hardening gaps fixed:
- CHM-WIT-01: add a versioned domain-separation tag
(WITNESS_DOMAIN_TAG = b"cog-ha-matter/witness-event/v1\0") to
canonical_bytes so the witness SHA-256 preimage / Ed25519 message
cannot be replayed as a message for another signing context that
shares key infrastructure (notably the manifest binary_signature).
Completes the engine review's "domain-tag + length-prefix" rule.
Witness bytes change by design (prior on-disk hashes/sigs invalidated);
no in-repo crate consumes these bytes programmatically.
- CHM-WIT-02: verify_signature uses VerifyingKey::verify_strict (rejects
non-canonical encodings + small-order keys) for the audit-uniqueness
property. Key stays caller-pinned (not read from the event).
Pinned by fails-on-old tests: canonical_bytes_is_domain_separated,
canonical_bytes_starts_with_domain_tag_then_prev_hash,
witness_preimage_cannot_collide_with_a_bare_manifest_digest,
signature_commits_to_domain_tag_not_bare_fields; key-pinning guarded by
verify_uses_strict_path_and_pins_caller_key. cog-ha-matter 64 -> 68
tests, 0 failed.
Co-Authored-By: claude-flow <ruv@ruv.net>
* docs(cog-ha-matter): record ADR-116 crypto review findings (CHM-WIT-01/02)
CHANGELOG [Unreleased] Security entry + ADR-116 §4.1 review notes:
engine-class signed-digest collision confirmed ABSENT (length-prefixing
already correct), domain-separation tag added, verify_strict hardening,
and the clean dimensions (verify-before-trust, key-handling,
determinism, fail-closed parsing) with byte-layout evidence.
Co-Authored-By: claude-flow <ruv@ruv.net>
9f80b66ae3