Tizian 「ティツィアーン」
aea0c447fc
A key proof was a signature by the account's signing key, which every signed-in device keeps in its keyring: whoever could read one, with a code from its authenticator, set a new password without the password or the phrase (the second reading's H1). The phrase now proves itself with an Ed25519 key derived from its bits alone (halkyon_keys' recoveryProofKeysOf, KDF context hlkrprf1, a sibling of the recovery key), whose public half every setup, new phrase and account reset sends and the register keeps (account_password.recoveryProofKey); the device derives the secret half only while the phrase is typed. An account without one (none exist outside development) proves no phrase until it sets a new one; decoys check against a decoy proof key alike. Migration (module, Learn's and Todo's servers, Learn's device schema): ALTER TABLE "account_password" ADD COLUMN "recoveryProofKey" bytea; nullable, so rows made before keep working and no data is touched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
12 lines
467 B
Text
12 lines
467 B
Text
### AUTOMATICALLY GENERATED DO NOT MODIFY
|
|
###
|
|
### This file is generated by Serverpod when creating a migration, do not modify it
|
|
### manually. If a collision is detected in this file when doing a code merge, resolve
|
|
### the conflict by removing and recreating the conflicting migration.
|
|
|
|
20261019193547604
|
|
20261019201213254-profiles
|
|
20261019204122341-deletion-notices
|
|
20261020111950710-passwords
|
|
20261020125124942-sessions-ended
|
|
20261020185752014-recovery-proof-key
|