F16-BP: Yes
Rationale
A bounded native configuration closes the unmatched-source gap without an application filter. Enable ION BSL and install two APPOUT wildcard-source/wildcard-destination verifier rules: require BIB-HMAC-SHA2 over primary and payload, using the locally configured active pairwise key, with delete_bundle on failure. All accepted source EIDs match the policy, so inventing an unlisted source cannot bypass it. The rule creates a required security operation before any matching BIB is found; absent BIBs leave security-block number zero, whose canonical-block lookup fails. Invalid or absent results cause non-success finalization and mark the bundle insecure; ION abandons it before delivery. Query errors also return before delivery. The remote key holder is the only authorized remote sender in this witness; keys are not given to transit. Revocation is a completed cold cutover: stop receiver and consumers, retire all old delivery/fragment/storage state from the active instance, replace the key with an independently fresh secret shared only with the newly authorized sender, then resume. Old in-flight bundles fail the new key; old admitted queues and callbacks cannot survive the fresh instance. Authorized new traffic can pass the same native verifier. F16 explicitly allows administrative teardown/restart. This is a capability proof for one authorized sender at a time, not a default ION behavior, live multi-peer revocation, claimed-EID identity proof, or preservation of queued data. F21 is unchanged.
Assessment method
Pinned native-policy/control-flow proof and explicit administrative cutover; no ION execution
Source context
ION BSL APPOUT gate and BSL wildcard policy, missing-block failure, fixed local key and delete action
Outstanding qualification
Run the supplied policy in the pinned BSL-enabled ION build with operationally generated secret keys (not test-vector mode). Verify legitimate nonempty payload delivery, absent/invalid BIBs on each target, false source EIDs without the key, malformed blocks, fragmentation, and old bundles in flight/queued during a completed cold cutover. Observe no post-cutover old callback and successful newly authorized delivery. Check fail-closed startup and ensure no retired queues, fragments or old key registry are restored. No such execution occurred in this round.
Public sources
- https://github.com/nasa-jpl/ION-DTN/blob/154a4cc7354b26661169f8d8b75a4002cd509a9f/bpv7/library/libbpP.c
- https://github.com/nasa-jpl/ION-DTN/blob/154a4cc7354b26661169f8d8b75a4002cd509a9f/bpv7/bsl/bsl.c
- https://github.com/NASA-AMMOS/BSL/blob/468db9ba29ad4b3ca90bf77ef0879c1ecc85121d/src/policy_provider/SamplePolicyProvider.c
- https://github.com/NASA-AMMOS/BSL/blob/468db9ba29ad4b3ca90bf77ef0879c1ecc85121d/src/backend/PublicInterfaceImpl.c
- https://github.com/NASA-AMMOS/BSL/blob/468db9ba29ad4b3ca90bf77ef0879c1ecc85121d/src/backend/SecurityContext.c
- https://github.com/NASA-AMMOS/BSL/blob/468db9ba29ad4b3ca90bf77ef0879c1ecc85121d/src/security_context/BIB_HMAC_SHA2.c
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round137-policy.json
- round137-sources.json
- round137.html