fenleon 77b9819de7 ClearADI cpim tail closed: X = SHA-256(encout || sig(trailing[0:16]) || const) — wire fully pinned ...

Two further live provisioning runs (gdb_prov8/9) close the last three
TODO(capture) items of the cpim:

- X (the 32-byte tail group) = SHA-256(encout || spim_map_signature(
  trailing[0:16]) || fixed 24-byte filler), written to the wire byte-exact;
  verified against both runs.
- The signature input is the spim trailing's first 16 bytes (server
  material, varies per session) — the earlier 'constant block' reading was
  a stale session's value; the signature model matches the live output
  exactly.
- The 12-byte plaintext tail is 12 fresh RNG bytes (same thread-RNG pool
  construction as the IV).
- trailing[0:16] and the sig/digest 'nowhere on the wire' mystery resolved:
  both ride transitively through X.

Kotlin: CpimShaTailSeal (the pinned production seal) wired as the provider
default; doc comments updated; one synthetic-vector test. Spec rev 29.
195 tests green.

2026-10-07 18:13:23 +02:00

..

imessage-protocol-spec.md

ClearADI cpim tail closed: X = SHA-256(encout || sig(trailing[0:16]) || const) — wire fully pinned

2026-10-07 18:13:23 +02:00