C06-CJ: No
Rationale
The selected cjdns SessionManager prepends the receiving endpoint session handle after end-to-end encryption and before the switch header. Transit SwitchCore changes the route label and header fields, but retains that session handle. Authorized observers across segments can associate established packets by the retained directional session identifier; label transformation alone does not satisfy C06.
Assessment method
Primary specification and pinned code review; no runtime experiment
Source context
Tor channel-local circuit IDs and pinned cjdns session handles
Outstanding qualification
The observer participates in the outer CryptoAuth-protected links and can inspect the decrypted switch packet, without possessing final-session payload keys. A handle is not a globally unique civil or persistent node identity; collisions and reuse preclude treating it alone as universal proof across unrelated sessions. The finding is the unchanged within-session cross-hop field, not payload disclosure, and does not deny the transformed per-hop route label.
Public sources
- https://github.com/cjdelisle/cjdns/blob/f5902acab6dd2f1a68bf6e4c89e352ed71f93698/net/SessionManager.c
- https://github.com/cjdelisle/cjdns/blob/f5902acab6dd2f1a68bf6e4c89e352ed71f93698/switch/SwitchCore.c
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round501.html
- round501-sources.json