fix(dkms): bind re-seal AAD into the recover possession-proof (close pre-mainnet invariant)

The dKMS node re-seals a recovered CEK under the caller-supplied `aad_b64`,
which was NOT bound into the recover possession-proof. A MITM that tampered
`aad_b64` in transit could make the node seal under an AAD of its choosing;
it was safe only because the decrypt boundary independently rebuilt the AAD
and failed closed (a compensating control, not a fix).

Now the canonical possession-proof preimage binds `sha256(reseal_aad)`
(`ddrm_envelope::recover_proof_message`, domain bumped v1 -> v2). The client
signs over the exact AAD it sends (key-provider), and the node verifies the
proof over the byte-identical `args.aad_b64` in `verify_session` BEFORE any
CEK is recovered or re-sealed. The AAD (DecryptTranscriptV1) already carries
`node_set_id` + `segment_digests`, so all three are bound transitively; the
32-byte digest keeps the preimage bounded for long presentations.

A MITM cannot re-sign the proof (it lacks the token-bound caller key), so a
tampered `aad_b64` now fails closed at the node (`session_invalid`). The
decrypt boundary's rebuild remains as defense-in-depth.

- ddrm-envelope: recover_proof_message/sign/verify take `reseal_aad`; bind
  sha256; bump DKMS_RECOVER_DOMAIN to /v2; unit test asserts tampered-AAD ->
  verify=false.
- dkms-authority: verify_session verifies over decode(args.aad_b64) before
  recover; SECURITY INVARIANT comment rewritten to CLOSED; landing test
  recover_fails_closed_on_a_tampered_aad (35 legacy / 25 default tests green).
- key-provider: recover_proof_b64 + both delegate paths sign over the
  request's aad_b64.
- dev harnesses (ddrm-runtime-open, dkms-live-recover): each direct node
  recover signs over its request AAD.
- docs: THREAT_MODEL §7 + DEPLOY_CHECKLIST + AUDITOR_PACKET §1 flipped
  open -> closed, with the landing test referenced.

Gates: ddrm-envelope + dkms-authority tests, key-provider/dev-script builds,
verify-capsules, alignment-check all green.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: SashaMIT

capsules/ddrm-envelope/src/lib.rs

@@ -1057,7 +1057,10 @@ pub const DKMS_SESSION_DOMAIN: &[u8] = b"elastos.dkms.authority/session/v1";
 /// runtime-core analogue of PC2's session being OWNER-BOUND (the bearer token alone is insufficient;
 /// the owner is re-checked, in the TEE via `ecrecover(delegationSig)`, `secureViewSession.ts:87`–`:100`).
 /// Domain-separated from the session token + hello attestation + CEK seals.
-pub const DKMS_RECOVER_DOMAIN: &[u8] = b"elastos.dkms.authority/recover-proof/v1";
+/// v2 (re-seal-AAD binding): the preimage now also binds `sha256(re-seal AAD)`, closing the
+/// pre-mainnet invariant where the node sealed under a caller-supplied AAD it did not authenticate.
+/// Bumped from v1 so a v1 proof can never be misread under v2 semantics.
+pub const DKMS_RECOVER_DOMAIN: &[u8] = b"elastos.dkms.authority/recover-proof/v2";
 
 /// Length-prefixed concatenation of variable-length fields into one unambiguous signed preimage:
 /// each field is preceded by its u32(LE) length, so `("a","bc")` and `("ab","c")` never collide.
@@ -1107,55 +1110,86 @@ pub fn verify_session_token(
 
 /// Canonical signed preimage of a recover possession proof: the session `challenge`, the
 /// content/recipient binding of THIS recover (`content_id`, `kid_hex`, the decrypt session pubkey),
-/// AND a per-recover FRESHNESS counter (`recover_seq`, Day 95–96). Binding the recover identity means
-/// the proof authorizes recovering THIS content for THIS session; binding a strictly-increasing
-/// `recover_seq` means a captured recover frame replayed verbatim carries a STALE counter the node
-/// has already consumed, so it is refused (anti-replay). The runtime-core analogue of PC2's
-/// per-delegation revocable `nonce` (`secureViewSession.ts:108`–`:112`). Defined ONCE here so the
-/// node + client cannot drift.
+/// a per-recover FRESHNESS counter (`recover_seq`, Day 95–96), AND `sha256(re-seal AAD)` (v2). Binding
+/// the recover identity means the proof authorizes recovering THIS content for THIS session; binding a
+/// strictly-increasing `recover_seq` means a captured recover frame replayed verbatim carries a STALE
+/// counter the node has already consumed, so it is refused (anti-replay); binding the re-seal AAD
+/// digest means the node will only seal under the EXACT AAD the caller proved possession over — a
+/// MITM-tampered `aad_b64` invalidates the proof and is refused at the node (the AAD itself carries
+/// `node_set_id` + `segment_digests`, so all of them are bound transitively). We bind the 32-byte
+/// digest, not the raw AAD, so a long presentation's segment digests don't bloat the preimage. The
+/// runtime-core analogue of PC2's per-delegation revocable `nonce` (`secureViewSession.ts:108`–`:112`).
+/// Defined ONCE here so the node + client cannot drift.
 pub fn recover_proof_message(
     challenge: &[u8],
     content_id: &[u8],
     kid_hex: &[u8],
     decrypt_session_pub: &[u8],
     recover_seq: u64,
+    reseal_aad: &[u8],
 ) -> Vec<u8> {
+    let aad_digest = Sha256::digest(reseal_aad);
     lp_concat(
         DKMS_RECOVER_DOMAIN,
-        &[challenge, content_id, kid_hex, decrypt_session_pub, &recover_seq.to_le_bytes()],
+        &[
+            challenge,
+            content_id,
+            kid_hex,
+            decrypt_session_pub,
+            &recover_seq.to_le_bytes(),
+            &aad_digest[..],
+        ],
     )
 }
 
 /// The CLIENT side: prove possession of the token-bound ephemeral private key by signing the recover
-/// binding + this recover's freshness counter. The node verifies this against the pubkey the session
-/// token committed to AND that `recover_seq` strictly advances (a replayed frame is refused).
+/// binding + this recover's freshness counter + the re-seal AAD digest. The node verifies this against
+/// the pubkey the session token committed to AND that `recover_seq` strictly advances AND that the AAD
+/// it is about to seal under matches the one signed here (a replayed or AAD-tampered frame is refused).
 pub fn sign_recover_proof(
     signer: &impl seal::CekSealSigner,
     challenge: &[u8],
     content_id: &[u8],
     kid_hex: &[u8],
     decrypt_session_pub: &[u8],
     recover_seq: u64,
+    reseal_aad: &[u8],
 ) -> Vec<u8> {
-    signer.sign(&recover_proof_message(challenge, content_id, kid_hex, decrypt_session_pub, recover_seq))
+    signer.sign(&recover_proof_message(
+        challenge,
+        content_id,
+        kid_hex,
+        decrypt_session_pub,
+        recover_seq,
+        reseal_aad,
+    ))
 }
 
 /// The NODE side: verify the caller's possession proof against the token-bound pubkey. `true` only
 /// when `sig` is valid under `verifier` (built from the token's `caller_pub`) over the SAME binding
-/// (including `recover_seq`) — a missing/forged proof, a proof from a different key, a tampered
-/// binding, or a swapped freshness counter all return `false`. Freshness (the strictly-increasing
-/// check) is enforced by the node against its per-session counter, not here.
+/// (including `recover_seq` and `sha256(reseal_aad)`) — a missing/forged proof, a proof from a
+/// different key, a tampered binding, a swapped freshness counter, or a tampered re-seal AAD all
+/// return `false`. Freshness (the strictly-increasing check) is enforced by the node against its
+/// per-session counter, not here.
 pub fn verify_recover_proof(
     verifier: &impl CekSealVerifier,
     challenge: &[u8],
     content_id: &[u8],
     kid_hex: &[u8],
     decrypt_session_pub: &[u8],
     recover_seq: u64,
+    reseal_aad: &[u8],
     sig: &[u8],
 ) -> bool {
     verifier.verify(
-        &recover_proof_message(challenge, content_id, kid_hex, decrypt_session_pub, recover_seq),
+        &recover_proof_message(
+            challenge,
+            content_id,
+            kid_hex,
+            decrypt_session_pub,
+            recover_seq,
+            reseal_aad,
+        ),
         sig,
     )
 }
@@ -2417,27 +2451,31 @@ mod tests {
         let challenge = [0x12u8; 32];
         let (content, kid, sess_pub) = (b"bafContent".as_slice(), b"c5c5".as_slice(), b"sessionpub".as_slice());
         let seq = 1u64;
-        let proof = crate::sign_recover_proof(&caller, &challenge, content, kid, sess_pub, seq);
-        assert!(crate::verify_recover_proof(&caller_verifier, &challenge, content, kid, sess_pub, seq, &proof));
+        let aad = b"re-seal-transcript-aad".as_slice();
+        let proof = crate::sign_recover_proof(&caller, &challenge, content, kid, sess_pub, seq, aad);
+        assert!(crate::verify_recover_proof(&caller_verifier, &challenge, content, kid, sess_pub, seq, aad, &proof));
 
         // A proof from a DIFFERENT key (a captured-token replayer without the private key) fails.
         let (other, _ovk) = crate::seal::mldsa_seal_keypair([0x62u8; 32]);
-        let wrong = crate::sign_recover_proof(&other, &challenge, content, kid, sess_pub, seq);
-        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, content, kid, sess_pub, seq, &wrong));
+        let wrong = crate::sign_recover_proof(&other, &challenge, content, kid, sess_pub, seq, aad);
+        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, content, kid, sess_pub, seq, aad, &wrong));
 
         // A tampered binding (different content / kid / session pub / challenge / freshness seq) fails.
-        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, b"bafOTHER", kid, sess_pub, seq, &proof));
-        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, content, b"ffff", sess_pub, seq, &proof));
-        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, content, kid, b"otherpub", seq, &proof));
-        assert!(!crate::verify_recover_proof(&caller_verifier, b"otherchal", content, kid, sess_pub, seq, &proof));
+        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, b"bafOTHER", kid, sess_pub, seq, aad, &proof));
+        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, content, b"ffff", sess_pub, seq, aad, &proof));
+        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, content, kid, b"otherpub", seq, aad, &proof));
+        assert!(!crate::verify_recover_proof(&caller_verifier, b"otherchal", content, kid, sess_pub, seq, aad, &proof));
         // A SWAPPED freshness counter invalidates the proof (the seq is authenticated, not free to alter).
-        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, content, kid, sess_pub, seq + 1, &proof));
+        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, content, kid, sess_pub, seq + 1, aad, &proof));
+        // A TAMPERED re-seal AAD (v2 binding) invalidates the proof — the node will not seal under an
+        // AAD the caller did not prove possession over. This is the re-seal-AAD invariant, enforced.
+        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, content, kid, sess_pub, seq, b"tampered-aad", &proof));
 
         // The possession proof is domain-separated from the session token (different domain prefix).
         assert!(!crate::verify_session_token(&caller_verifier, &challenge, content, 0, &proof));
 
         // A malformed signature fails closed.
-        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, content, kid, sess_pub, seq, b"nope"));
+        assert!(!crate::verify_recover_proof(&caller_verifier, &challenge, content, kid, sess_pub, seq, aad, b"nope"));
     }
 
     /// The socket framing round-trips messages, recovers exact boundaries from a concatenated

capsules/dkms-authority/src/main.rs

@@ -1025,16 +1025,14 @@ impl DkmsAuthorityNode {
             }
         };
 
-        // SECURITY INVARIANT (pre-mainnet, scoped with the external auditor): `aad` here is the
-        // CALLER-SUPPLIED `args.aad_b64` (decoded above), and it is NOT bound into the recover
-        // possession-proof — the node verifies the escrow (recover_escrowed_cek) and the producer,
-        // but does NOT independently verify that this re-seal AAD matches the segment-bound
-        // transcript / node-set the open claims. Therefore the node's re-seal AAD is NOT
-        // independently trustworthy. This is safe TODAY only because the single consumer — the
-        // decrypt boundary — rebuilds the segment-bound AAD itself and fails closed on a mismatch;
-        // it does not trust this value. DO NOT add a consumer that trusts this re-seal AAD without
-        // first binding aad_b64 / segment_digests / node_set_id into the recover possession-proof
-        // (so a tampered aad_b64 fails the proof closed here). See docs/THREAT_MODEL.md.
+        // SECURITY INVARIANT (re-seal AAD — CLOSED): `aad` here is the caller-supplied `args.aad_b64`,
+        // but it is now BOUND into the recover possession-proof: `verify_session` (above, before any CEK
+        // is recovered) verifies `verify_recover_proof(.., reseal_aad = decode(args.aad_b64), ..)`, which
+        // is the byte-identical AAD passed here. So a MITM-tampered `aad_b64` — including its embedded
+        // `node_set_id` / `segment_digests` — invalidates the proof and is refused at the node, fail-closed
+        // (test: `recover_fails_closed_on_a_tampered_aad`). The decrypt boundary STILL independently
+        // rebuilds the segment-bound AAD and fails closed on any mismatch — defense-in-depth, not the sole
+        // control. See docs/THREAT_MODEL.md §7 and docs/AUDITOR_PACKET.md §1.
         let envelope = ddrm_envelope::seal::seal_bound(&public, cek.as_slice(), &aad, &authority.signer);
         let mut material = json!({
             "suite": ddrm_envelope::SUITE_PQ_HYBRID,
@@ -1796,17 +1794,25 @@ fn verify_session(authority: &NodeAuthority, args: &RecoverArgs) -> Result<(), S
     let session_pub = b64()
         .decode(&args.decrypt_session_pub_b64)
         .map_err(|_| "decrypt_session_pub_b64 is not valid base64".to_string())?;
+    // RE-SEAL-AAD BINDING (v2): verify the proof over the EXACT AAD this recover will seal under. This
+    // is the SAME `args.aad_b64` `recover_inner` decodes and passes to `seal_bound` — so a MITM that
+    // tampers `aad_b64` in transit (incl. its embedded node_set_id / segment_digests) makes this proof
+    // fail closed HERE, before any CEK is recovered or re-sealed. Closes the pre-mainnet invariant.
+    let reseal_aad = b64()
+        .decode(&args.aad_b64)
+        .map_err(|_| "aad_b64 is not valid base64".to_string())?;
     if !ddrm_envelope::verify_recover_proof(
         &caller_verifier,
         &challenge,
         args.content_id.as_bytes(),
         args.kid_hex.as_bytes(),
         &session_pub,
         args.recover_seq,
+        &reseal_aad,
         &caller_sig,
     ) {
         return Err(
-            "caller possession proof is missing, forged, signed by the wrong key, or carries a swapped freshness counter (captured token replay refused)"
+            "caller possession proof is missing, forged, signed by the wrong key, carries a swapped freshness counter, or does not match the re-seal AAD (captured token replay / tampered AAD refused)"
                 .to_string(),
         );
     }
@@ -2444,6 +2450,7 @@ mod tests {
         kid_hex: &str,
         session_pub_b64: &str,
         recover_seq: u64,
+        aad: &[u8],
     ) -> String {
         let challenge = b64().decode(&token.challenge_b64).unwrap();
         let session_pub = b64().decode(session_pub_b64).unwrap();
@@ -2454,6 +2461,7 @@ mod tests {
             kid_hex.as_bytes(),
             &session_pub,
             recover_seq,
+            aad,
         ))
     }
 
@@ -2526,7 +2534,8 @@ mod tests {
         let (caller, caller_vk) = caller_keypair();
         node.allowed_callers = Some(vec![caller_vk.clone()]);
         let token = live_token(&node, &b64().encode(&caller_vk));
-        let caller_sig_b64 = proof_for(&caller, &token, CONTENT, &kid_hex, &session_pub_b64, 1);
+        let caller_sig_b64 =
+            proof_for(&caller, &token, CONTENT, &kid_hex, &session_pub_b64, 1, &transcript_aad);
         let resp = node.recover(RecoverArgs {
             wrapped_cek_b64: b64().encode(wrapped.to_bytes()),
             scheme: scheme.to_string(),
@@ -2603,7 +2612,8 @@ mod tests {
         let (caller, caller_vk) = caller_keypair();
         node.allowed_callers = Some(vec![caller_vk.clone()]);
         let token = live_token(&node, &b64().encode(&caller_vk));
-        let caller_sig_b64 = proof_for(&caller, &token, CONTENT, &kid_hex, &session_pub_b64, 1);
+        let caller_sig_b64 =
+            proof_for(&caller, &token, CONTENT, &kid_hex, &session_pub_b64, 1, b"attest-transcript");
         let data = ok_data(node.recover(RecoverArgs {
             wrapped_cek_b64: b64().encode(wrapped.to_bytes()),
             scheme: scheme.to_string(),
@@ -2693,7 +2703,7 @@ mod tests {
         let (caller, caller_vk) = caller_keypair();
         node.allowed_callers = Some(vec![caller_vk.clone()]);
         let token = live_token(&node, &b64().encode(&caller_vk));
-        let caller_sig_b64 = proof_for(&caller, &token, CONTENT, &kid_hex, &session_pub_b64, 1);
+        let caller_sig_b64 = proof_for(&caller, &token, CONTENT, &kid_hex, &session_pub_b64, 1, b"t");
         let forged = node.recover(RecoverArgs {
             wrapped_cek_b64: b64().encode(wrapped.to_bytes()),
             scheme: scheme.to_string(),
@@ -2779,8 +2789,8 @@ mod tests {
         node.allowed_callers = Some(vec![caller_vk.clone()]);
         let token = live_token(&node, &b64().encode(&caller_vk));
         // Base case uses freshness seq 1; tests that drive multiple recovers re-sign with the
-        // returned caller signer at a higher seq.
-        let caller_sig_b64 = proof_for(&caller, &token, CONTENT, &kid_hex, &session_pub_b64, 1);
+        // returned caller signer at a higher seq. The proof binds the re-seal AAD (b"transcript").
+        let caller_sig_b64 = proof_for(&caller, &token, CONTENT, &kid_hex, &session_pub_b64, 1, b"transcript");
         let args = RecoverArgs {
             wrapped_cek_b64: b64().encode(wrapped.to_bytes()),
             scheme: scheme.to_string(),
@@ -2808,6 +2818,28 @@ mod tests {
         (node, args, caller)
     }
 
+    /// LANDING TEST for the re-seal-AAD invariant (docs/AUDITOR_PACKET.md §1, THREAT_MODEL §7): a
+    /// recover whose `aad_b64` is tampered IN TRANSIT — after the caller signed its possession proof
+    /// over the real AAD — is refused at the node because the proof no longer matches, BEFORE any CEK
+    /// is recovered or re-sealed. A MITM cannot re-sign the proof (it lacks the token-bound caller
+    /// key), so it cannot make the node seal under an AAD of its choosing. This is what makes the
+    /// node's re-seal AAD trustworthy on its own; the decrypt boundary's independent rebuild remains
+    /// defense-in-depth, not the sole control.
+    #[test]
+    fn recover_fails_closed_on_a_tampered_aad() {
+        let store = unique_store("tampered-aad");
+        let (mut node, mut args, _caller) = setup_recover(&store);
+        // The possession proof was signed over b"transcript"; flip the AAD the node would seal under.
+        args.aad_b64 = b64().encode(b"transcript-TAMPERED");
+        let resp = node.recover(args);
+        assert_eq!(
+            error_code(&resp),
+            "session_invalid",
+            "a tampered re-seal aad_b64 must fail the possession proof closed at the node"
+        );
+        let _ = std::fs::remove_file(&store);
+    }
+
     /// W3/D4 — an ANONYMOUS caller (the node has no allow-list) presenting a valid live session +
     /// a perfectly-formed `allowed:true` receipt but NO wallet-signed grant is REFUSED. This is the
     /// safety property that lets the allow-list be dropped as the security boundary: an unenrolled
@@ -3005,6 +3037,7 @@ mod tests {
             &base.kid_hex,
             &base.decrypt_session_pub_b64,
             base.recover_seq,
+            &b64().decode(&base.aad_b64).unwrap(),
         );
         assert_eq!(error_code(&node.recover(wrong_key)), "session_invalid");
 
@@ -3068,7 +3101,7 @@ mod tests {
         let proof = {
             let chal = b64().decode(challenge_str(token)).unwrap();
             let dp = b64().decode(&decrypt_pub_b64).unwrap();
-            b64().encode(ddrm_envelope::sign_recover_proof(&caller, &chal, CONTENT.as_bytes(), kid_hex.as_bytes(), &dp, 1))
+            b64().encode(ddrm_envelope::sign_recover_proof(&caller, &chal, CONTENT.as_bytes(), kid_hex.as_bytes(), &dp, 1, b"transcript"))
         };
         let recover = call(
             &mut client,
@@ -3816,6 +3849,7 @@ mod tests {
             &base.kid_hex,
             &base.decrypt_session_pub_b64,
             2,
+            &b64().decode(&base.aad_b64).unwrap(),
         );
         assert_eq!(error_code(&node.recover(live)), "caller_revoked");
 
@@ -3882,6 +3916,7 @@ mod tests {
                 &base.kid_hex,
                 &base.decrypt_session_pub_b64,
                 seq,
+                &b64().decode(&base.aad_b64).unwrap(),
             );
             assert!(matches!(node.recover(args), Response::Ok { .. }), "recover seq {seq} should succeed");
         }
@@ -3909,7 +3944,7 @@ mod tests {
         let mut next = base.clone();
         next.recover_seq = 2;
         next.caller_sig_b64 =
-            proof_for(&caller, &base.session_token, CONTENT, &base.kid_hex, &base.decrypt_session_pub_b64, 2);
+            proof_for(&caller, &base.session_token, CONTENT, &base.kid_hex, &base.decrypt_session_pub_b64, 2, &b64().decode(&base.aad_b64).unwrap());
         assert!(matches!(node.recover(next), Response::Ok { .. }));
 
         // After consuming seq 2, a recover that regresses to seq 1 (or repeats 2) is refused.