Repository navigation
External / PQ cryptographic review of the protected-content contracts and custody crates #48
Description
From the 0.7 completion checklist in #38 (unfinished at merge time). No dependency on #44–#47; PR #204 supplies the review package (docs/PROTECTED_CONTENT_CRYPTO_REVIEW.md).
The contracts + custody crates have had internal review only. Commission an external cryptographic review (including post-quantum considerations) covering:
- The canonical codec.
- EIP-191 recovery.
- HPKE / Shamir threshold custody.
- The golden vectors.
Scope lives in elastos/crates/elastos-protected-content-* and the custody provider.
Activity
docs(audits): record the protected-content 0.7.1 follow-up plan (#42, #…
docs(protected-content): crypto review package and standing-doc align…
feat(protected-content): the 0.7.1 product surface, from Creator to a…
andersalm commentedon Sep 29, 2026
Future review input retained from the identity research: distinguish key establishment from authority signatures and recovery. Inventory authority purposes, version signed structures, preserve identity continuity and define rotation, revocation and recovery before a cryptographic migration. Check interoperability and verification cost before choosing a new identity protocol. This is review input, not an additional 0.7.1 implementation task.