From 53c509edcbc8e6412d638ecc0ca13510256d1e8a Mon Sep 17 00:00:00 2001 From: Maxim Raznatovski Date: Tue, 6 Oct 2026 10:16:36 +0200 Subject: [PATCH] docs: make a reused Sentinel or pairing PSK a pairing protocol error --- README.md | 2 +- pairing.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 91c2de0..d3ba80e 100644 --- a/README.md +++ b/README.md @@ -1102,7 +1102,7 @@ with `label` `"sendspin-pair-psk-wrap-v1"` for `wrapped_psk` and `"sendspin-pair ### Protocol Errors -A condition during pairing that no conformant peer produces - a malformed or missing field, a CPace share with the wrong length or encoding a low-order point, a revealed nonce that does not match its commitment, an entered code that fails the binding check, a `wrapped_nonce_B` or `wrapped_psk` that fails to decrypt - is a **protocol error**: the detecting side closes the WebSocket without sending any application-level error message, and persists nothing. +A condition during pairing that no conformant peer produces - a malformed or missing field, a CPace share with the wrong length or encoding a low-order point, a revealed nonce that does not match its commitment, an entered code that fails the binding check, a `wrapped_nonce_B` or `wrapped_psk` that fails to decrypt, a delivered long-term PSK equal to the Sentinel PSK or to the pairing PSK the connection is keyed by - is a **protocol error**: the detecting side closes the WebSocket without sending any application-level error message, and persists nothing. ### Client → Server: `client/hello` pair-method descriptor diff --git a/pairing.md b/pairing.md index c8c8df9..cfc5d1c 100644 --- a/pairing.md +++ b/pairing.md @@ -300,7 +300,7 @@ with `label` `"sendspin-pair-psk-wrap-v1"` for `wrapped_psk` and `"sendspin-pair ### Protocol Errors -A condition during pairing that no conformant peer produces - a malformed or missing field, a CPace share with the wrong length or encoding a low-order point, a revealed nonce that does not match its commitment, an entered code that fails the binding check, a `wrapped_nonce_B` or `wrapped_psk` that fails to decrypt - is a **protocol error**: the detecting side closes the WebSocket without sending any application-level error message, and persists nothing. +A condition during pairing that no conformant peer produces - a malformed or missing field, a CPace share with the wrong length or encoding a low-order point, a revealed nonce that does not match its commitment, an entered code that fails the binding check, a `wrapped_nonce_B` or `wrapped_psk` that fails to decrypt, a delivered long-term PSK equal to the Sentinel PSK or to the pairing PSK the connection is keyed by - is a **protocol error**: the detecting side closes the WebSocket without sending any application-level error message, and persists nothing. ### Client → Server: `client/hello` pair-method descriptor