mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-09 08:04:45 +00:00
Claude
de2e71dad0
Verified against the mdk-core revision whitenoise-rs pins (marmot-protocol/mdk @e8cd584): its NostrGroupDataExtension parser consumes name/description/admins/ relays/image_hash/image_key/image_nonce/image_upload_key and rejects ANY trailing bytes at a known version, and its extension/group_image.rs fully implements avatar encryption. The previous "canonical raw-key + media_type" approach both (a) added a trailing media_type field that mdk rejects — breaking the whole group for whitenoise members — and (b) used a key scheme mdk can't decrypt. Re-implement to mdk's exact MIP-01 v2 scheme so avatars interoperate byte-for-byte: - image_key / image_upload_key are HKDF seeds (reusing Mip01ImageCrypto's mip01-image-encryption-v2 / mip01-blossom-upload-v2 labels; HKDF-SHA256 with empty salt == mdk's Hkdf::new(None, seed)). AEAD key derived from the seed. - ChaCha20-Poly1305, 12-byte nonce, EMPTY AAD, image_hash = SHA-256(ciphertext). - Decrypt tries v2 (HKDF) then falls back to v1 (raw key), exactly like mdk. - Remove media_type from the wire entirely (and from the model/cipher/uploader), so a v2 image extension ends at image_upload_key with zero trailing bytes. The plaintext MIME isn't stored; the display path lets Coil sniff the format. - Derive the Blossom upload keypair from image_upload_key instead of storing a raw key. Adds a regression test that reproduces mdk's v1/v2 field consumption and asserts a v2 image extension has no trailing bytes, plus a test pinning the HKDF-seed + empty-AAD scheme so future drift from mdk is caught. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JL3GXW1fmHa3xWfQjLLqfp