feat(descriptor): SBQ2 connection descriptor format; release v5.8.0

The SB1 invitation runs 2000-2400 characters and needs QR version 38-40, past
the point where a single code is scannable, so the app falls back to an
animated multi-frame QR. SBQ2 is a fixed binary layout carrying only what
brings up DTLS -- ICE credentials, certificate fingerprint, candidates -- with
the SDP rebuilt from a template by a strict serializer. Measured on real Chrome
and Firefox SDP across four network profiles: 98-149 bytes, QR version 6-8.

Key material is meant to move to the DataChannel, bound by a commitment in the
descriptor. That half does not exist yet, so nothing calls this module: the
format is landed for review and freeze, not wired into the connection path.
doc/DESCRIPTOR-SBQ2.md records the gate on phase 3.

The decoder is a parser of hostile input: fixed offsets, explicit lengths,
deny-by-default on reserved values and unknown TLV extension types, trailing
bytes rejected, ICE credentials alphabet-checked so a CRLF cannot reach the
serializer. No compression -- DEFLATE adds bytes on this payload, and dropping
it removes the decompression-bomb surface with it.

Candidate pruning keeps coverage before count: one candidate per (family, type,
transport) survives before any surplus, so an IPv6-only or UDP-blocked path
cannot be pruned away by a v4-first sort.

Tests cover round-trip against captured Chrome and Firefox SDP, IPv6 and NAT64
addresses, ICE-TCP candidates, the TLV area, clock skew, one-shot binding and
SAS transcript coverage.

This commit is contained in:

lockbitchat

2026-08-06 11:54:05 -04:00

parent 3212138a0d

commit 6e82cfcae2

14 changed files with 1765 additions and 37 deletions

									
										sw.js
									
		+1
		-1
	
												View File
												
				@@ -11,7 +11,7 @@ let DYNAMIC_CACHE = 'securebit-pwa-dynamic-v4.7.56';

				// Build stamp — rewritten by scripts/post-build.js on every release so this file's

				// bytes change each deploy. That is what makes the browser detect a new Service Worker,

				// reinstall it, drop stale caches and (via controllerchange) prompt the page to update.

				const SW_BUILD_VERSION = '1785988424571';

				const SW_BUILD_VERSION = '1786031423211';

				// Load version from meta.json on install

				async function getAppVersion() {