Skip to content
This repository was archived by the owner on Aug 15, 2025. It is now read-only.

Commit d509863

Browse files
bitfl0werbitfl0wer
committed
Refactor section 6.1.1.1, define FID part names
1 parent 4f6241b commit d509863

File tree

2 files changed

+50
-40
lines changed

2 files changed

+50
-40
lines changed

‎.vscode/ltex.dictionary.en-US.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,4 @@ TypeSpec
2424
Protobuf
2525
gzipped
2626
RawR
27+
OID

‎docs/Protocol Specifications/core.md‎

Lines changed: 49 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ of the specification document: **v0.1.0-alpha.1**
2828
- [6. Cryptography and ID-Certs](#6-cryptography-and-id-certs)
2929
- [6.1 Home server signed certificates for public client identity keys (ID-Cert)](#61-home-server-signed-certificates-for-public-client-identity-keys-id-cert)
3030
- [6.1.1 Structure of an ID-Cert](#611-structure-of-an-id-cert)
31-
- [6.1.1.1 Identity Descriptors (IDDs)](#6111-identity-descriptors-idds)
31+
- [6.1.1.1 polyproto Distinguished Name (`pDN`)](#6111-polyproto-distinguished-name-pdn)
3232
- [6.1.1.2 Extensions and constraints](#6112-extensions-and-constraints)
3333
- [6.1.1.3 Session IDs](#6113-session-ids)
3434
- [6.1.2 Necessity of ID-Certs](#612-necessity-of-id-certs)
@@ -385,11 +385,19 @@ excluding the new session. The `NEW_SESSION` event's stored data can be accessed
385385
## 5. Federation IDs (FIDs)
386386

387387
Every client requires an associated actor identity. Actors are distinguished by a unique federation
388-
ID (FID). FIDs consist of their identifier, which is unique per instance, and the instance's root domain.
388+
ID (FID). FIDs consist of a local name, which is unique per instance, and the instance's root domain.
389389
This combination ensures global uniqueness.
390390

391391
FIDs used in public contexts are formatted as `[email protected]`, and are case-insensitive.
392392

393+
FIDs consist of the following parts:
394+
395+
| Part | Name | Description |
396+
| ------------------------------ | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
397+
| `actor` | "Local Name" or "Common Name" | Must be unique on each instance. |
398+
| `@` | "Separator" | Separates local name from domain name |
399+
| `optionalsubdomain.domain.tld` | "Domain Name" | Includes top-level domain, second-level domain and other subdomains. Address which the actors' home server can be reached at. |
400+
393401
The following regular expression can be used to validate actor IDs: `\b([a-z0-9._%+-]+)@([a-z0-9-]+(\.[a-z0-9-]+)*)`.
394402

395403
!!! info
@@ -429,8 +437,8 @@ client.
429437
An ID-CSR includes the following information, according to the X.509 standard:
430438

431439
- The public identity key of the client.
432-
- An identity descriptor (IDD), describing the actor the certificate is issued to. The IDD must be
433-
formatted according to [Section 6.1.1.1](#6111-identity-descriptors-idds).
440+
- A polyproto Distinguished Name (`pDN`), describing the actor the certificate is issued to. The `pDN`
441+
must be formatted according to [Section 6.1.1.1](#6111-polyproto-distinguished-name-pdn).
434442
- The signature algorithm used to sign the certificate.
435443
- The signature of the certificate, generated by using the entities' private identity key.
436444

@@ -457,47 +465,48 @@ ID-Certs encompass a subset of the structure of an X.509 certificate.
457465

458466
ID-Certs have the following structure:
459467

460-
| Field Description | Special requirements, if any | X.509 equivalent |
461-
| -------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | -------------------------------------------------------- |
462-
| Correctly formatted Name attribute, according to [#6.1.1.1](#6111-identity-descriptors-idds) | [Identity descriptor](#6111-identity-descriptors-idds) | Issuer Name |
463-
| A unique identifier for the certificate, used by the CA to identify this certificate. | Must be unique across all certificates issued by a home server. | Serial Number |
464-
| The algorithm used to sign the certificate. | | Certificate Signature Algorithm & Signature Algorithm ID |
465-
| The signature of the certificate, generated by using the home servers' private identity key. | | Certificate Signature |
466-
| The expiry date of the certificate. | Time must not be after expiry date of the home server's root certificate | Validity period: Not After |
467-
| Certificate validity period starting date | Time must not be before the home server's root certificate was generated | Validity period: Not Before |
468-
| X.509 Version Number (v3) | polyproto only uses Version 3 X.509 certificates. | Version Number |
469-
| The public identity key of the client. | | Subject Public Key Info: Subject Public Key |
470-
| The public key algorithm used to generate the client's public identity key. | | Subject Public Key Info: Public Key Algorithm |
471-
| The session ID of the client. | No two valid certificates for one session ID can exist. Session IDs have to be unique per user. | Subject Unique Identifier |
472-
| Extensions | [Extensions and Constraints](#6112-extensions-and-constraints) | Extensions |
473-
474-
##### 6.1.1.1 Identity Descriptors (IDDs)
475-
476-
polyproto Identity Descriptors are a subset of the X.509 certificate's distinguished name. [Distinguished
477-
Names (`DNs`)](https://ldap.com/ldap-dns-and-rdns/), according to the LDAP Data Interchange Format (LDIF).
468+
| Field Description | Special requirements, if any | X.509 equivalent |
469+
| --------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- | -------------------------------------------------------- |
470+
| Correctly formatted Name attribute, according to [#6.1.1.1](#6111-polyproto-distinguished-name-pdn) | [polyproto Distinguished Name](#6111-polyproto-distinguished-name-pdn) | Issuer Name |
471+
| A unique identifier for the certificate, used by the CA to identify this certificate. | Must be unique across all certificates issued by a home server. | Serial Number |
472+
| The algorithm used to sign the certificate. | | Certificate Signature Algorithm & Signature Algorithm ID |
473+
| The signature of the certificate, generated by using the home servers' private identity key. | | Certificate Signature |
474+
| The expiry date of the certificate. | Time must not be after expiry date of the home server's root certificate | Validity period: Not After |
475+
| Certificate validity period starting date | Time must not be before the home server's root certificate was generated | Validity period: Not Before |
476+
| X.509 Version Number (v3) | polyproto only uses Version 3 X.509 certificates. | Version Number |
477+
| The public identity key of the client. | | Subject Public Key Info: Subject Public Key |
478+
| The public key algorithm used to generate the client's public identity key. | | Subject Public Key Info: Public Key Algorithm |
479+
| The session ID of the client. | No two valid certificates for one session ID can exist. Session IDs have to be unique per user. | Subject Unique Identifier |
480+
| Extensions | [Extensions and Constraints](#6112-extensions-and-constraints) | Extensions |
481+
482+
##### 6.1.1.1 polyproto Distinguished Name (`pDN`)
483+
484+
polyproto Distinguished Names (`pDNs`) are a subset of an X.509 certificate's [distinguished
485+
Names (`DNs`)](https://ldap.com/ldap-dns-and-rdns/), defined by the LDAP Data Interchange Format (LDIF).
478486
The `DN` is a sequence of [relative distinguished names (`RDNs`)](https://ldap.com/ldap-dns-and-rdns/).
479487

480-
The identity descriptor must be unique for each certificate issued by a home server. The `DN` of an ID-Cert
481-
must meet all of the following requirements:
482-
483-
- Identity descriptor (IDD) must have "common name" attribute. If the ID-Cert is for an actor, the
484-
common name must be the local name of the actor. In the case of an actor with an FID of
485-
`[email protected]`, the "common name" would be `xenia`. If the ID-Cert is a self-signed home server
486-
certificate, the "common name" attribute must not be present.
487-
- Must have at least one domain component, specifying the home servers' FQDN
488-
(fully qualified domain name).
489-
- If the ID-Cert or ID-CSR is for an actor, the IDD must include the `UID` (OID 0.9.2342.19200300.100.1.1)
490-
**and** `uniqueIdentifier` (OID 0.9.2342.19200300.100.1.44) fields.
491-
- `UID` is the federation ID of the actor, e.g. `actor@fqdn-of-home server.example.com`.
492-
- `uniqueIdentifier` is a Session ID.
488+
The identity descriptor must be unique for each certificate issued by a home server. A `pDN`
489+
must meet all the following requirements:
490+
491+
- If the `pDN` describes an actor, it must have a "common name" attribute. The
492+
common name must be the [local name](#5-federation-ids-fids) of the actor. In the case of an actor
493+
with an FID of `[email protected]`, the local name would be `xenia`. If the `pDN` describes a
494+
home server, the "common name" attribute must not be present.
495+
- Must have at least one domain component `dc`, specifying the domain name under which the home
496+
server can be reached. This includes the home servers' top- and second-level domain, as well as
497+
all other subdomains, if present. If the home server does not have a sub- or top-level domain, the
498+
`dc` fields for these components should be omitted.
499+
- If the `pDN` describes an actor, the `pDN` must include the `UID`
500+
([OID](https://en.wikipedia.org/wiki/Object_identifier) 0.9.2342.19200300.100.1.1) **and**
501+
`uniqueIdentifier` ([OID](https://en.wikipedia.org/wiki/Object_identifier) 0.9.2342.19200300.100.1.44)
502+
fields.
503+
- `UID` field must be equal to the federation ID of the actor, e.g. `actor@domainname-of-home server.example.com`.
504+
- `uniqueIdentifier` field must be a [Session ID](#6113-session-ids).
493505
- Can have other attributes, if the additional attributes do not conflict with the above
494506
requirements. Additional attributes might be ignored by other home servers and other clients, unless
495-
specified otherwise in a polyproto extension. Additional attributes, which are not part of a polyproto
507+
specified otherwise in a polyproto extension. Additional attributes not part of a polyproto
496508
extension must be non-critical X.509 extensions.
497509

498-
If the home server does not have a subdomain or top level domain, the `dc` fields for these
499-
components should be omitted.
500-
501510
##### 6.1.1.2 Extensions and constraints
502511

503512
The following constraints must be met by ID-Certs:
@@ -1406,7 +1415,7 @@ archive (.tar.gz) named `[email protected]`, where
14061415

14071416
- `export[numbers]` is the word `export` with 20 random digits appended to it
14081417
- `user` is the actors' name
1409-
- `subdomain.example.com` is the FQDN of the server the actor is registered on.
1418+
- `subdomain.example.com` is the domain name of the server the actor is registered on.
14101419

14111420
This file archive contains a file `messages.p2mb` which is a JSON file containing [message batches](#721-message-batches)
14121421
of all messages sent by the user. If the server where the data export was requested from has

0 commit comments

Comments
 (0)