Participant Relationship Protocol

Back to matrix

E03-MQ: Pending

Rationale

A private editorial policy harness now pins the client SubjectPublicKeyInfo SHA-256 while retaining the OpenSSL certificate/signature verifier. Two live mutually authenticated multipath connections, in separate server contexts, each received 10,142 bytes of an unfinished 2 MB upload. After policy revocation and explicit connection enumeration/close, both endpoints disconnected and neither server application received additional bytes. Fresh attempts with the revoked key and with a valid certificate whose key was outside the allowlist both failed with TLS access_denied (QUIC crypto error 305). A fresh relink with a retained linker map now identifies 84 extracted archive objects: 58 picoquic test/log/core objects, 22 Picotls Minicrypto objects, three Picotls core objects and one OpenSSL adapter. Minicrypto includes Cifra and micro-ecc; it cannot be omitted from this binary inventory simply because the test uses OpenSSL verification. Fusion and picohttp archives were offered but contributed no extracted members. ELF dependencies are libcrypto.so.3 and libc.so.6.

Assessment method

Rebuilt unchanged harness with linker map; documentary dependency inventory, not a new traffic test

Source context

Pinned source notices, CMake provenance, actual ELF/linker map and installed package copyright records

Outstanding qualification

E03 remains Pending: the private policy harness is not an already public complete selected implementation. Dependency provenance is now concrete: picoquic repository MIT with individual ISC-style permission notices, Picotls MIT, Cifra CC0/public-domain notices, micro-ecc BSD-2-Clause, OpenSSL Apache-2.0 and glibc package notices (mostly LGPL-2.1-or-later). Public-domain dedication is not mislabeled as an OSI-approved license. This is not an exhaustive redistribution audit: transitive headers, generated/toolchain objects and full notice obligations remain outside the inventory. Static inclusion does not prove which provider negotiated the session. The round296 limits remain: simulated links, fixture certificates, UID 0, two server contexts, no selective multi-identity/concurrent revocation or application-owned queue cancellation. Preserve positive multipath limits and the draft-21 zero-limit deviation; no hybrid suite is silently selected.

Public sources

Editorial evidence references

The following identifiers refer to research records not included in this public package; they are not public links.