{ "$schema": "frequency-native-transport-vectors/1", "transportVersion": 1, "generator": "server/load-generator/src/nativeVectors.ts — npm run vectors:emit -w @frequency/load-generator", "description": "Known-answer vectors for the native UDP transport record layer (packages/shared/src/nativeTransport.ts). All byte strings are lowercase hex. Sequences are decimal STRINGS because they are uint64. Every packet was produced by the reference client's own seal()/gmac(); nothing here is hand-computed. The keys are test material with no secrecy value.", "constants": { "headerLength": 35, "headerOffsets": { "versionFlags": 0, "connectionId": 1, "channelId": 5, "keyEpoch": 9, "voiceLevel": 10, "sequence": 11, "senderMac": 19 }, "aadByteLength": 19, "aead": { "algorithm": "AES-256-GCM", "keyBytes": 32, "nonceBytes": 12, "tagBytes": 16 }, "senderMac": { "algorithm": "AES-256-GMAC", "keyBytes": 32, "tagBytes": 16 }, "nonce": "connectionId(4, big-endian) || sequence(8, big-endian) — the SAME 12 bytes for the payload AEAD and the senderMac GMAC, which is sound only because the two keys differ", "flagControl": 16, "controlPayload": { "length": 9, "typeOffset": 0, "tokenOffset": 1, "tokenBytes": 8 }, "controlTypes": { "pathChallenge": 1, "pathResponse": 2 }, "nodeSequenceBase": "9223372036854775808", "payloadOffsets": { "type": 0, "streamId": 1, "timestamp": 5, "opus": 9 }, "payloadTypes": { "audio": 0, "keepalive": 1, "contentKey": 2, "videoShard": 3, "shareAudio": 4 }, "shareChannelId": 4294967295, "videoShardOffsets": { "TYPE_OFFSET": 0, "STREAM_ID_OFFSET": 1, "TIMESTAMP_OFFSET": 5, "FRAME_ID_OFFSET": 9, "FRAME_BYTES_OFFSET": 13, "BLOCK_INDEX_OFFSET": 17, "BLOCK_COUNT_OFFSET": 18, "SHARD_INDEX_OFFSET": 19, "DATA_SHARDS_OFFSET": 20, "PARITY_SHARDS_OFFSET": 21, "FLAGS_OFFSET": 22, "SHARD_OFFSET": 23 }, "videoShardFlags": { "keyframe": 1, "recoveryPoint": 2, "endOfShare": 4 } }, "keys": { "channelA": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f", "channelB": "202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f", "share": "404142434445464748494a4b4c4d4e4f505152535455565758595a5b5c5d5e5f", "senderMac": "808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f", "senderMacAlt": "a0a1a2a3a4a5a6a7a8a9aaabacadaeafb0b1b2b3b4b5b6b7b8b9babbbcbdbebf" }, "positive": [ { "name": "audio-minimal", "kind": "sealed", "note": "The smallest legal audio packet: 35-byte header + 10-byte payload + 16-byte tag = 61. One byte of Opus is the floor — a node drops anything shorter than HEADER.LENGTH + 1 + TAG_BYTES.", "input": { "connectionId": 1, "channelNativeId": 1, "keyEpoch": 0, "sequence": "0", "voiceLevel": 0, "channelKey": "channelA", "senderMacKey": "senderMac", "payload": "00000000010000000011" }, "expected": { "packet": "0100000001000000010000000000000000000007ede025be6512b9cc8eb5e7ba5869524436cdaa0d5af4a85f2dd5385cdc4434cea96704031992fd38a4", "packetLength": 61, "aad": "01000000010000000100000000000000000000", "nonce": "000000010000000000000000", "senderMac": "07ede025be6512b9cc8eb5e7ba586952", "ciphertext": "4436cdaa0d5af4a85f2d", "tag": "d5385cdc4434cea96704031992fd38a4", "controlPayload": null } }, { "name": "audio-typical", "kind": "sealed", "note": "An ordinary 20 ms frame mid-session. Every negative vector below is a mutation of THIS packet, so compare against it first.", "input": { "connectionId": 16909060, "channelNativeId": 7, "keyEpoch": 3, "sequence": "1234", "voiceLevel": 96, "channelKey": "channelA", "senderMacKey": "senderMac", "payload": "000000002a000003c0557493b2d1f00f2e4d6c8baac9e80726456483a2c1e0ff1e3d5c7b9ab9d8f71635547392b1d0ef0e" }, "expected": { "packet": "010102030400000007036000000000000004d2de1226f1fb0af1c389f7f26d8ae5764ad12e1b3a7927ab91b282375f247e5ba13a1a3399f33a325facb86a4bcfd9f58f98a93737265c1bf4d543bf6020a13d1b0370472c2580e2e0da09cfd307c295e3b0", "packetLength": 100, "aad": "010102030400000007036000000000000004d2", "nonce": "0102030400000000000004d2", "senderMac": "de1226f1fb0af1c389f7f26d8ae5764a", "ciphertext": "d12e1b3a7927ab91b282375f247e5ba13a1a3399f33a325facb86a4bcfd9f58f98a93737265c1bf4d543bf6020a13d1b03", "tag": "70472c2580e2e0da09cfd307c295e3b0", "controlPayload": null } }, { "name": "audio-home-seal", "kind": "sealed", "note": "The HOME-channel copy of a talkspurt (HOME_CHANNEL_SEAL_REQUIRED). This is the copy the mediasoup bridge taps, so a sender that omits it is audible to native peers and completely silent to every browser listener, with no error anywhere.", "input": { "connectionId": 16909060, "channelNativeId": 7, "keyEpoch": 3, "sequence": "5000", "voiceLevel": 120, "channelKey": "channelA", "senderMacKey": "senderMac", "payload": "000000004d0000bb80405f7e9dbcdbfa1938577695b4d3f211304f6e8daccbea0928476685a4c3e201203f5e7d9cbbdaf91837567594b3d2f1102f4e6d8cabcae908274665" }, "expected": { "packet": "010102030400000007037800000000000013889d06775209488dbe4b1b4acf6f98e81687a6bf075699c3e9ae4deff1b302c9fdacc66623ec4d085698352c9223840f47a9150ee1055e60a6781360098bc2e56cfb9249762a7e19d1c183993a58cde1b8d161a496d3802203c2dc591ce3104d019bc2183f5b", "packetLength": 120, "aad": "01010203040000000703780000000000001388", "nonce": "010203040000000000001388", "senderMac": "9d06775209488dbe4b1b4acf6f98e816", "ciphertext": "87a6bf075699c3e9ae4deff1b302c9fdacc66623ec4d085698352c9223840f47a9150ee1055e60a6781360098bc2e56cfb9249762a7e19d1c183993a58cde1b8d161a496d3", "tag": "802203c2dc591ce3104d019bc2183f5b", "controlPayload": null } }, { "name": "audio-relay-seal", "kind": "sealed", "note": "The SAME Opus frame, same streamId and same timestamp, sealed to a relay channel under a different key with sequence 5001. SEQUENCE_PER_SEAL: the counter advances per SEAL, not per frame — which is also why a listener's view of header.sequence is sparse and loss must be derived from payload.timestamp.", "input": { "connectionId": 16909060, "channelNativeId": 9, "keyEpoch": 3, "sequence": "5001", "voiceLevel": 120, "channelKey": "channelB", "senderMacKey": "senderMac", "payload": "000000004d0000bb80405f7e9dbcdbfa1938577695b4d3f211304f6e8daccbea0928476685a4c3e201203f5e7d9cbbdaf91837567594b3d2f1102f4e6d8cabcae908274665" }, "expected": { "packet": "01010203040000000903780000000000001389a065092ceb9eaff7b473992dffcfbcac91f5aaf012fd89c343abaf4a84e4e594a061340441db9b7b1998f54fd7b73e768733702a2d25a0d28b99e69ad13d5303e5c03b8cf8637766c482e5dc0300b7bacea5af981a73f53e537226b09334392d5f053e99fa", "packetLength": 120, "aad": "01010203040000000903780000000000001389", "nonce": "010203040000000000001389", "senderMac": "a065092ceb9eaff7b473992dffcfbcac", "ciphertext": "91f5aaf012fd89c343abaf4a84e4e594a061340441db9b7b1998f54fd7b73e768733702a2d25a0d28b99e69ad13d5303e5c03b8cf8637766c482e5dc0300b7bacea5af981a", "tag": "73f53e537226b09334392d5f053e99fa", "controlPayload": null } }, { "name": "audio-uint8-edges", "kind": "sealed", "note": "keyEpoch 255 and voiceLevel 255 — both uint8, both AAD-covered. keyEpoch wraps mod 256 on rekey, so 255 is an ordinary value and not an error.", "input": { "connectionId": 43981, "channelNativeId": 2, "keyEpoch": 255, "sequence": "9", "voiceLevel": 255, "channelKey": "channelA", "senderMacKey": "senderMac", "payload": "0000000003000007807796b5d4f31231506f8eadcceb0a29486786a5c4" }, "expected": { "packet": "010000abcd00000002ffff000000000000000972211dbffe0ca70ac9b43979b12e93a4e24f7dea0693d8659aca7b7a21820a1a2bcc5a7ccd12fd41933ff5cebffe572089044ddb705aa916fe44e6b66e", "packetLength": 80, "aad": "010000abcd00000002ffff0000000000000009", "nonce": "0000abcd0000000000000009", "senderMac": "72211dbffe0ca70ac9b43979b12e93a4", "ciphertext": "e24f7dea0693d8659aca7b7a21820a1a2bcc5a7ccd12fd41933ff5cebf", "tag": "fe572089044ddb705aa916fe44e6b66e", "controlPayload": null } }, { "name": "audio-sequence-top-of-client-half", "kind": "sealed", "note": "sequence = 2^63 - 1, the highest a CLIENT may use: the node owns sequences >= NODE_SEQUENCE_BASE (2^63) for its own control packets under the same key. A signed 64-bit counter that overflows into the top bit produces a packet the node drops on the direction check — see neg-sequence-in-node-half.", "input": { "connectionId": 287454020, "channelNativeId": 5, "keyEpoch": 1, "sequence": "9223372036854775807", "voiceLevel": 8, "channelKey": "channelA", "senderMacKey": "senderMac", "payload": "00000f4240ffffffff99b8d7f615345372" }, "expected": { "packet": "01112233440000000501087fffffffffffffff77769b941217df1f4281c70570a380702e458891e2c7aea89ac22dbc07a8bc464174944338ad0fe6d62952e0bb7c1ab966", "packetLength": 68, "aad": "01112233440000000501087fffffffffffffff", "nonce": "112233447fffffffffffffff", "senderMac": "77769b941217df1f4281c70570a38070", "ciphertext": "2e458891e2c7aea89ac22dbc07a8bc4641", "tag": "74944338ad0fe6d62952e0bb7c1ab966", "controlPayload": null } }, { "name": "audio-uint32-max", "kind": "sealed", "note": "connectionId and channelNativeId both 0xFFFFFFFF, streamId and timestamp both at uint32 max. All four are big-endian; connectionId is also the first four nonce bytes, so a little-endian read here changes the nonce and the packet decrypts to nothing.", "input": { "connectionId": 4294967295, "channelNativeId": 4294967295, "keyEpoch": 7, "sequence": "3735928559", "voiceLevel": 1, "channelKey": "channelB", "senderMacKey": "senderMac", "payload": "00ffffffffffffffffc3e201203f5e7d9cbbdaf918" }, "expected": { "packet": "01ffffffffffffffff070100000000deadbeeff59b16d6b666bc1a4a73e98d24cc7ed49c700566dd846ed44135970516e9262cd929a1ef9d26fa72ad61f16a0c269152e4337c6d05", "packetLength": 72, "aad": "01ffffffffffffffff070100000000deadbeef", "nonce": "ffffffff00000000deadbeef", "senderMac": "f59b16d6b666bc1a4a73e98d24cc7ed4", "ciphertext": "9c700566dd846ed44135970516e9262cd929a1ef9d", "tag": "26fa72ad61f16a0c269152e4337c6d05", "controlPayload": null } }, { "name": "keepalive", "kind": "sealed", "note": "LISTENER_KEEPALIVE_REQUIRED. A listen-only client MUST send this, sealed like any other packet, and repeat it: the node binds a peer's UDP address only on its first MAC-valid INBOUND packet and skips forwarding to any listener with no bound address. Payload is exactly 9 bytes — type 1, streamId 0, timestamp 0, no Opus.", "input": { "connectionId": 168496141, "channelNativeId": 4, "keyEpoch": 2, "sequence": "1", "voiceLevel": 0, "channelKey": "channelA", "senderMacKey": "senderMac", "payload": "010000000000000000" }, "expected": { "packet": "010a0b0c0d00000004020000000000000000019728cf779164f436405d4cdf3a431c332402edce573c9620da76a90ade15a5ae6154b056905693c281", "packetLength": 60, "aad": "010a0b0c0d0000000402000000000000000001", "nonce": "0a0b0c0d0000000000000001", "senderMac": "9728cf779164f436405d4cdf3a431c33", "ciphertext": "2402edce573c9620da", "tag": "76a90ade15a5ae6154b056905693c281", "controlPayload": null } }, { "name": "share-video-shard", "kind": "sealed", "note": "SCREEN SHARE (capability screen-share, 0.81.0). A type-3 video shard sealed ONCE under the frequency's SHARE key, so header channelId is the share key's wire id (SHARE_CHANNEL_ID, 0xFFFFFFFF: reserved, above any channel's int4 id). No carrying set and no home copy. The first nine plaintext bytes are audio's (type, streamId, timestamp), so the owner check is unchanged; the timestamp here is the 90 kHz capture clock. Frame 3 is a 2-shard keyframe (flags 0x01) in one block with 2 parity shards; this is shard 0. The shard is 1100 bytes, the sender's size: 35 header + 23 shard header + 1100 + 16 tag = 1174, under the 1200-byte datagram budget.", "input": { "connectionId": 16909060, "channelNativeId": 4294967295, "keyEpoch": 3, "sequence": "6000", "voiceLevel": 0, "channelKey": "share", "senderMacKey": "senderMac", "payload": "030000005800015f9000000003000008660001000202015a7998b7d6f51433527190afceed0c2b4a6988a7c6e504234261809fbeddfc1b3a597897b6d5f4133251708faecdec0b2a496887a6c5e4032241607f9ebddcfb1a39587796b5d4f31231506f8eadcceb0a29486786a5c4e30221405f7e9dbcdbfa1938577695b4d3f211304f6e8daccbea0928476685a4c3e201203f5e7d9cbbdaf91837567594b3d2f1102f4e6d8cabcae90827466584a3c2e1001f3e5d7c9bbad9f81736557493b2d1f00f2e4d6c8baac9e80726456483a2c1e0ff1e3d5c7b9ab9d8f71635547392b1d0ef0e2d4c6b8aa9c8e70625446382a1c0dffe1d3c5b7a99b8d7f61534537291b0cfee0d2c4b6a89a8c7e60524436281a0bfdefd1c3b5a7998b7d6f51433527190afceed0c2b4a6988a7c6e504234261809fbeddfc1b3a597897b6d5f4133251708faecdec0b2a496887a6c5e4032241607f9ebddcfb1a39587796b5d4f31231506f8eadcceb0a29486786a5c4e30221405f7e9dbcdbfa1938577695b4d3f211304f6e8daccbea0928476685a4c3e201203f5e7d9cbbdaf91837567594b3d2f1102f4e6d8cabcae90827466584a3c2e1001f3e5d7c9bbad9f81736557493b2d1f00f2e4d6c8baac9e80726456483a2c1e0ff1e3d5c7b9ab9d8f71635547392b1d0ef0e2d4c6b8aa9c8e70625446382a1c0dffe1d3c5b7a99b8d7f61534537291b0cfee0d2c4b6a89a8c7e60524436281a0bfdefd1c3b5a7998b7d6f51433527190afceed0c2b4a6988a7c6e504234261809fbeddfc1b3a597897b6d5f4133251708faecdec0b2a496887a6c5e4032241607f9ebddcfb1a39587796b5d4f31231506f8eadcceb0a29486786a5c4e30221405f7e9dbcdbfa1938577695b4d3f211304f6e8daccbea0928476685a4c3e201203f5e7d9cbbdaf91837567594b3d2f1102f4e6d8cabcae90827466584a3c2e1001f3e5d7c9bbad9f81736557493b2d1f00f2e4d6c8baac9e80726456483a2c1e0ff1e3d5c7b9ab9d8f71635547392b1d0ef0e2d4c6b8aa9c8e70625446382a1c0dffe1d3c5b7a99b8d7f61534537291b0cfee0d2c4b6a89a8c7e60524436281a0bfdefd1c3b5a7998b7d6f51433527190afceed0c2b4a6988a7c6e504234261809fbeddfc1b3a597897b6d5f4133251708faecdec0b2a496887a6c5e4032241607f9ebddcfb1a39587796b5d4f31231506f8eadcceb0a29486786a5c4e30221405f7e9dbcdbfa1938577695b4d3f211304f6e8daccbea0928476685a4c3e201203f5e7d9cbbdaf91837567594b3d2f1102f4e6d8cabcae90827466584a3c2e1001f3e5d7c9bbad9f81736557493b2d1f00f2e4d6c8baac9e80726456483a2c1e0ff1e3d5c7b9ab9d8f71635547392b1d0ef0e2d4c6b8aa9c8e70625446382a1c0dffe1d3c5b7a99b8d7f61534537291b0cfee0d2c4b6a89a8c7e60524436281a0bfdefd1c3b5a7998b7d6f51433527190afceed0c2b4a6988a7c6e504234261809fbeddfc1b3a597897b6d5f4133251708faecdec0b2a496887a6c5e4032241607f9ebddcfb1a39587796b5d4f31231506f" }, "expected": { "packet": "0101020304ffffffff030000000000000017708ab784abd2bb5da1ba347c885ae9b663730df34a1239bed70e683f5ec970f9a03691dcb877adcf8f8cbd008a9850c279dcfe1985b159d37a74f689730f7ec41bfd7f61491c904729276a10576f7b6a68d8d14bc1a94b024b73d61128bdbd0d6930d88296b68cb4a3101d22ef4dd1224cf2af4aefb9a1a748bbf2a93183d4ad09ce1f61f2c06b5e7451cd7fded47f1d240b324e063eeb179a45b73b02e6f66858e5161fdb7253879616004070be9e326dde55ebbe172b86701e44ed8bdecd0e5551de290f1cd48599b73fd91e78913fa7d82ee6d9fa35f68dce8b64ecd51b17d6c99044aa9370f5d76c99bdeccd1ab3f5fb12953dd2deb364f78688228216c150fc0568d184f819eb736de7bdfb0a886751d1014e5aa88565f2dba44bfd6a244abcc7881b3e1da6757c5c0f6e37beab65dca2d0bc7f6524584c4a678c4f6dde5e90eaaf0e3509e09a1793609f026ad582117fe379900d04569c4627502910171127d5d92f44adcfa7f7be9d6b2f2b9e792db02376a0d8bd2c0bf2a0b581edcdfd3ee965f7190423578934fad8ab985cf1de7380348e7a68c7fc49c95042f3c8cfabca6338ea0b753569af80bff7b030b56ea6a1760a0423141d042fed145ac59f6d2c35fe024e5aab6dff59acde7be656e32e4b2882d0a5919138bd715c0bf6ba2ddaa26cdb0128103fb1cc5cf0178a687fb68b864ba91bd8062e6bc1446a5e2463dc3909f2eb100ef95347630505914de27d54b54508e2fbd2e169bd5406ac3ecb8b273418b2989dc8826be8e8573f595a37eec795fb7f0836cd8630b5ea402e6bd2b49313afebf7ba056018d0b8110f14155d67a5c68618acb126358257cd104ab755d61479d9c65b10b299b21880554eb230178fb3a6ac14b5934ee14843eef7d8d075d2b19efe1d07db77be90fca7bca2f11a5faadbdfdb2b459df1816e83b2c12905b3b9f534dbb30bbfd3d6cdc81f79e79d1da92c93eb22bb4cd0fec3f4b285f56a95f93a0a661004eec83c30e6d813247fe2c74c2348b479057fb19de4e8272be70280165cc7dcb6196983732f941ad4d9c440be64b0951e48363b3d9c9abaf6be278a39a3e05da6d156ef55a8043eac5b5559a9cfe729f79e704443ac052ddea9c9294a61e51bca0b1c2bd175828ef1c3de155f1c73a026cf59d51194922d2e39aba728b4589b14b447e563860acf73450cabc10a04935cc40e4b2c80dae5522a159be7cb9a8c032e43d5ceeb740c0dd6f155e5dc30dbdeec2323a4b05be2df82ed378dee2cf8294e77d965c402d0980d2b840fd2cbe91eb0d1bb66dda73902aaef0f963194d07995f08c6009cb5c4d4d695cec14399482590208108fed2e50adba002c33fe4343c801876907f84162ed3db5a7de20baeb480619abbdab382f45f65f96581cf6416f7e7d0bcb9782b6b98b5cc506be90c499fd9e0995efe2ab9965ef1fd9f1caec922da2ad630d755d03baa440d5c48a0c9b3b92eb38d8c7f62b9f62783177d7236674023355949cb5703464edf47f6b8c1a1038b4f42142045c40a3883eeae5511464609658322587a884b02e17e47da2a0bdc2e1e147de1bac4c78d91e77befbfa03a2bdda1c1dfa8cf39fed00f768cee222a5ce238bd905", "packetLength": 1174, "aad": "0101020304ffffffff03000000000000001770", "nonce": "010203040000000000001770", "senderMac": "8ab784abd2bb5da1ba347c885ae9b663", "ciphertext": "730df34a1239bed70e683f5ec970f9a03691dcb877adcf8f8cbd008a9850c279dcfe1985b159d37a74f689730f7ec41bfd7f61491c904729276a10576f7b6a68d8d14bc1a94b024b73d61128bdbd0d6930d88296b68cb4a3101d22ef4dd1224cf2af4aefb9a1a748bbf2a93183d4ad09ce1f61f2c06b5e7451cd7fded47f1d240b324e063eeb179a45b73b02e6f66858e5161fdb7253879616004070be9e326dde55ebbe172b86701e44ed8bdecd0e5551de290f1cd48599b73fd91e78913fa7d82ee6d9fa35f68dce8b64ecd51b17d6c99044aa9370f5d76c99bdeccd1ab3f5fb12953dd2deb364f78688228216c150fc0568d184f819eb736de7bdfb0a886751d1014e5aa88565f2dba44bfd6a244abcc7881b3e1da6757c5c0f6e37beab65dca2d0bc7f6524584c4a678c4f6dde5e90eaaf0e3509e09a1793609f026ad582117fe379900d04569c4627502910171127d5d92f44adcfa7f7be9d6b2f2b9e792db02376a0d8bd2c0bf2a0b581edcdfd3ee965f7190423578934fad8ab985cf1de7380348e7a68c7fc49c95042f3c8cfabca6338ea0b753569af80bff7b030b56ea6a1760a0423141d042fed145ac59f6d2c35fe024e5aab6dff59acde7be656e32e4b2882d0a5919138bd715c0bf6ba2ddaa26cdb0128103fb1cc5cf0178a687fb68b864ba91bd8062e6bc1446a5e2463dc3909f2eb100ef95347630505914de27d54b54508e2fbd2e169bd5406ac3ecb8b273418b2989dc8826be8e8573f595a37eec795fb7f0836cd8630b5ea402e6bd2b49313afebf7ba056018d0b8110f14155d67a5c68618acb126358257cd104ab755d61479d9c65b10b299b21880554eb230178fb3a6ac14b5934ee14843eef7d8d075d2b19efe1d07db77be90fca7bca2f11a5faadbdfdb2b459df1816e83b2c12905b3b9f534dbb30bbfd3d6cdc81f79e79d1da92c93eb22bb4cd0fec3f4b285f56a95f93a0a661004eec83c30e6d813247fe2c74c2348b479057fb19de4e8272be70280165cc7dcb6196983732f941ad4d9c440be64b0951e48363b3d9c9abaf6be278a39a3e05da6d156ef55a8043eac5b5559a9cfe729f79e704443ac052ddea9c9294a61e51bca0b1c2bd175828ef1c3de155f1c73a026cf59d51194922d2e39aba728b4589b14b447e563860acf73450cabc10a04935cc40e4b2c80dae5522a159be7cb9a8c032e43d5ceeb740c0dd6f155e5dc30dbdeec2323a4b05be2df82ed378dee2cf8294e77d965c402d0980d2b840fd2cbe91eb0d1bb66dda73902aaef0f963194d07995f08c6009cb5c4d4d695cec14399482590208108fed2e50adba002c33fe4343c801876907f84162ed3db5a7de20baeb480619abbdab382f45f65f96581cf6416f7e7d0bcb9782b6b98b5cc506be90c499fd9e0995efe2ab9965ef1fd9f1caec922da2ad630d755d03baa440d5c48a0c9b3b92eb38d8c7f62b9f62783177d7236674023355949cb5703464edf47f6b8c1a1038b4f42142045c40a3883eeae5511464609658322587a884b02e17e47da2a0bdc2e1e147de1bac4c78d91e77befbfa03a2bdda1c1dfa", "tag": "8cf39fed00f768cee222a5ce238bd905", "controlPayload": null } }, { "name": "control-path-challenge", "kind": "control", "note": "NODE -> CLIENT. Sent when a MAC-valid packet arrives from a new address; the flow does NOT migrate until the client answers. 44 bytes exactly: header + 9-byte cleartext control payload, MAC'd but never channel-sealed (the node holds no channel key on an all-native channel). Note the sequence is in the NODE half — NODE_SEQUENCE_BASE + 1.", "input": { "connectionId": 16909060, "channelNativeId": 0, "keyEpoch": 0, "sequence": "9223372036854775809", "voiceLevel": 0, "channelKey": null, "senderMacKey": "senderMac", "payload": null }, "expected": { "packet": "110102030400000000000080000000000000012e6c4a369466bc31802153eb1debc117010102030405060708", "packetLength": 44, "aad": "11010203040000000000008000000000000001", "nonce": "010203048000000000000001", "senderMac": "2e6c4a369466bc31802153eb1debc117", "ciphertext": null, "tag": null, "controlPayload": "010102030405060708" } }, { "name": "control-path-response", "kind": "control", "note": "CLIENT -> NODE, echoing the challenge token verbatim, with a sequence from the CLIENT half and its own fresh GMAC. It must be sent from the address under validation — a response relayed from elsewhere proves nothing about that path and is dropped. A client that never answers keeps being served at its old address and then goes silent when that address dies.", "input": { "connectionId": 16909060, "channelNativeId": 0, "keyEpoch": 0, "sequence": "1235", "voiceLevel": 0, "channelKey": null, "senderMacKey": "senderMac", "payload": null }, "expected": { "packet": "110102030400000000000000000000000004d34d10f4c474e20be04ba27d709c256b6b020102030405060708", "packetLength": 44, "aad": "110102030400000000000000000000000004d3", "nonce": "0102030400000000000004d3", "senderMac": "4d10f4c474e20be04ba27d709c256b6b", "ciphertext": null, "tag": null, "controlPayload": "020102030405060708" } } ], "negative": [ { "name": "neg-undefined-flag-bit", "note": "Byte 0 carries version in the low nibble and flags in the high nibble; on a VERSION 1 packet every bit but FLAG_CONTROL (0x10) is MUST-be-zero. Here 0x20 is set: that is FLAG_CONTENT_KEY, which is defined only for wire version 2 (native-transport-v2.json), so on v1 it is still an undefined bit. Dropped on shape, before any crypto runs — so a client that puts something clever in the spare bits is invisible rather than rejected.", "packet": "210102030400000007036000000000000004d2de1226f1fb0af1c389f7f26d8ae5764ad12e1b3a7927ab91b282375f247e5ba13a1a3399f33a325facb86a4bcfd9f58f98a93737265c1bf4d543bf6020a13d1b0370472c2580e2e0da09cfd307c295e3b0", "channelKey": "channelA", "senderMacKey": "senderMac", "expected": { "nodeAccepts": false, "opensWithChannelKey": false, "rejectedBy": "shape" } }, { "name": "neg-aad-flipped-voice-level", "note": "One bit flipped in voiceLevel (byte 10) AFTER sealing. voiceLevel is cosmetic and attacker-controlled, but it is inside the 19 AAD bytes — so tampering with it breaks the senderMac AND would break the payload AEAD. A client whose AAD is only 13 bytes (the stale pre-per-channel-key header length) produces a packet that passes nothing.", "packet": "010102030400000007036100000000000004d2de1226f1fb0af1c389f7f26d8ae5764ad12e1b3a7927ab91b282375f247e5ba13a1a3399f33a325facb86a4bcfd9f58f98a93737265c1bf4d543bf6020a13d1b0370472c2580e2e0da09cfd307c295e3b0", "channelKey": "channelA", "senderMacKey": "senderMac", "expected": { "nodeAccepts": false, "opensWithChannelKey": false, "rejectedBy": "senderMac" } }, { "name": "neg-wrong-epoch", "note": "keyEpoch changed 3 -> 4 with the MAC left alone. The epoch byte is AAD, so it cannot be rewritten in flight to point a receiver at a different key. Distinct from a client that HAS the wrong epoch and MACs it correctly: that packet is well-formed and is refused later, by the receiver having no key for it.", "packet": "010102030400000007046000000000000004d2de1226f1fb0af1c389f7f26d8ae5764ad12e1b3a7927ab91b282375f247e5ba13a1a3399f33a325facb86a4bcfd9f58f98a93737265c1bf4d543bf6020a13d1b0370472c2580e2e0da09cfd307c295e3b0", "channelKey": "channelA", "senderMacKey": "senderMac", "expected": { "nodeAccepts": false, "opensWithChannelKey": false, "rejectedBy": "senderMac" } }, { "name": "neg-sender-mac-under-wrong-key", "note": "Byte-identical to audio-typical except the senderMac, which is computed under senderMacAlt. THE PAYLOAD STILL OPENS PERFECTLY under channelA — the two keys are independent and only the MAC is wrong. This is the vector that catches MAC'ing under the channel key, or under a previous connection's key after a re-tune: the audio is fine and the node never forwards it.", "packet": "010102030400000007036000000000000004d20cb98e3d1ff0f8dcd8e368f2437e8e61d12e1b3a7927ab91b282375f247e5ba13a1a3399f33a325facb86a4bcfd9f58f98a93737265c1bf4d543bf6020a13d1b0370472c2580e2e0da09cfd307c295e3b0", "channelKey": "channelA", "senderMacKey": "senderMac", "expected": { "nodeAccepts": false, "opensWithChannelKey": true, "rejectedBy": "senderMac" } }, { "name": "neg-sequence-in-node-half", "note": "The top bit of the sequence set, and the MAC recomputed so the packet is otherwise entirely valid. Clients own sequences < 2^63; the node spends the top half under the same pairwise key. This is what a signed-int64 counter that has gone negative looks like on the wire, and the node drops it on direction — after the MAC passes, so no MAC counter moves and nothing looks wrong from the client's side.", "packet": "010102030400000007036080000000000004d293bdd9ae064947bb8254b6c5b79d835dd12e1b3a7927ab91b282375f247e5ba13a1a3399f33a325facb86a4bcfd9f58f98a93737265c1bf4d543bf6020a13d1b0370472c2580e2e0da09cfd307c295e3b0", "channelKey": "channelA", "senderMacKey": "senderMac", "expected": { "nodeAccepts": false, "opensWithChannelKey": false, "rejectedBy": "direction" } }, { "name": "neg-tampered-ciphertext", "note": "One bit flipped inside the ciphertext, header untouched. THE NODE ACCEPTS AND FORWARDS THIS — it holds no channel key and could not detect it even in principle; the listener's GCM tag check is the only place the tampering is visible. That split is the design, not a gap: a receiver that treats 'the node forwarded it' as authentication has no integrity at all.", "packet": "010102030400000007036000000000000004d2de1226f1fb0af1c389f7f26d8ae5764ad12e9b3a7927ab91b282375f247e5ba13a1a3399f33a325facb86a4bcfd9f58f98a93737265c1bf4d543bf6020a13d1b0370472c2580e2e0da09cfd307c295e3b0", "channelKey": "channelA", "senderMacKey": "senderMac", "expected": { "nodeAccepts": true, "opensWithChannelKey": false, "rejectedBy": "payloadAead" } }, { "name": "neg-truncated-tag", "note": "The last byte of the 16-byte GCM tag removed. Still long enough to pass the node's length floor, and the header is untouched, so the senderMac passes and the node forwards it — it fails only at the listener's AEAD open. A client that writes a 12-byte tag (several stacks default to 12 for GCM) produces exactly this shape; the contract requires the full 16.", "packet": "010102030400000007036000000000000004d2de1226f1fb0af1c389f7f26d8ae5764ad12e1b3a7927ab91b282375f247e5ba13a1a3399f33a325facb86a4bcfd9f58f98a93737265c1bf4d543bf6020a13d1b0370472c2580e2e0da09cfd307c295e3", "channelKey": "channelA", "senderMacKey": "senderMac", "expected": { "nodeAccepts": true, "opensWithChannelKey": false, "rejectedBy": "payloadAead" } } ] }