[giskard09]

Summary

Preventive self-audit, no external trigger against this repo. The same day, unrelated to us, robertolocatelli81-dev/Noûs found (x402-foundation/tsc#4) that identity-element Ed25519 keys (R=identity, S=0) forge a signature valid for any message under naive RFC 8032 verification, and that some libraries accept non-canonically-encoded points/scalars (novifinancial/ed25519-speccheck classes 0 and 11).

hop_signature in delegation-chain-ref-v1 is this repo's only live Ed25519 check — everywhere else (peer-reconciliation-ref-v1's co_signer, anchoring-precedence-ref-v1's admission_invariant) signature validity is a declared, externally-resolved fact, not computed by our own code. This was the one place a weak crypto library would actually matter, and it had never been checked explicitly — "PyNaCl/libsodium is strict" was an assumption, not a verified fact in this repo.

Result: no vulnerability found

Reproduced, not assumed:

1. small-order-key-vectors.json (small-order-identity-key-universal-forgery-001): constructs the real attack inside a real 2-hop chain, through this spec's own hop_signing_preimage() — hop 1's delegator key is the identity element and hop_signature is the textbook universal-forgery signature (verifies for any message under the naive equation). Correctly hop_signature_invalid, confirmed through this repo's own verify_hop_signature() code path, not an isolated crypto-library unit test. verify.py's main() now runs this file too — 16/16 across the whole suite.

2. ed25519-hardening/: the full published novifinancial/ed25519-speccheck suite (Apache-2.0, 12 vectors, vendored verbatim at commit 65519336fda78a3d016e947df6d82848aca0c9da, byte-verified via git hash-object against the GitHub blob — see NOTICE.md) run against this repo's pinned PyNaCl (requirements.txt). 12/12 match the published LibSodium column exactly: small-order A/R (classes 0–2), out-of-range S (6–7), and non-canonical point encodings for both R and A (8–11 — the two classes Noûs named) are all rejected; only the one benign mixed-order edge case every major library accepts (class 3) passes.

Documentation

Added explicitly to docs/spec/delegation-chain-ref.md as a verified guarantee of the pinned dependency, not of this spec's own logic — a future PyNaCl/libsodium upgrade, or a reimplementation with a different Ed25519 library, is not guaranteed to inherit it. check_hardening.py exists to be rerun after any such change, not only once.

Reproduce

python3 examples/conformance/delegation-chain-ref/verify.py
python3 examples/conformance/delegation-chain-ref/ed25519-hardening/check_hardening.py

(needs pip install -r examples/conformance/delegation-chain-ref/requirements.txt)

Test plan

• verify.py → 16/16 (12 pre-existing + 4 from other files, now + the new small-order vector)
• check_hardening.py → 12/12, matches published LibSodium behavior exactly
• small-order-key-vectors.json's hop 0 (legitimate signer) independently confirmed valid on its own, confirming the vector's non-attack half is sound
• Vendored cases.json verified byte-identical to the source commit via git hash-object