Participant Relationship Protocol

Back to matrix

F16-GN: Yes

Rationale

A constructive native configuration resolves F16 without treating an application message validator as an admission gate. The dedicated receiver opens no CADET listening port and creates bidirectional channels only toward locally authorized peer public keys. channel_create passes the exact destination to the service; the channel belongs to that destination tunnel, whose key derivation includes its public identity. Validated plaintext is looked up in the channel map of that tunnel, not a global channel-number namespace. Unsolicited incoming channels at unopened ports remain unbound; the native plaintext-data handler drops data when neither local owner nor destination client exists. Thus an authorized remote peer can send payload on the locally initiated channel, while another peer cannot acquire the same local delivery path merely by choosing the same port or channel number. For revocation, stop the consuming clients and local CADET service, wait for termination, discard the old volatile delivery/channel state, and restart with no listening ports and channels only to the revised authorized set. This completed cutover removes active and queued delivery authority; authorized communication resumes on new channels. F16 permits administrative restart and does not require remote initiation or uninterrupted availability. This does not establish a general incoming-server allowlist, live channel-revocation safety or a tested GNUnet deployment. The earlier connect-callback lifetime and optional MQ-validator limitations remain valid but are not used by this witness.

Assessment method

Constructive native configuration and pinned source-path review; no daemon/security execution

Source context

GNUnet 0.20.0 release: cadet_api.c, service channel/tunnel/client implementation and channel header

Outstanding qualification

Run an isolated pinned GNUnet deployment with two authorized and one unauthorized remote peer through a relay. Verify reverse-direction delivery over locally initiated channels, unopened-port denial, tunnel-local channel-number isolation, pre-cutover queued traffic, complete consumer/service restart, denial of the removed peer and restored service from the remaining peer. No daemon, cryptographic attack, IPC race, restart or end-to-end delivery experiment was executed in this round.

Public sources

Editorial evidence references

The following identifiers refer to research records not included in this public package; they are not public links.