Skip to content

MSC4388: Secure out-of-band channel for sign in with QR #4388

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hughns wants to merge 47 commits into
base: main
Choose a base branch
from
+1,169 −0
Open

MSC4388: Secure out-of-band channel for sign in with QR #4388

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
47 commits
Select commit Hold shift + click to select a range
0b6bc0a
Secure out-of-band channel for sign in with QR
hughns Dec 10, 2025
e298500
MSC4388
hughns Dec 10, 2025
86baa15
Overview diagram
hughns Dec 12, 2025
620aa5e
Move example API usage back to after the API definitions
hughns Dec 12, 2025
ac711d4
Switch from ECIES to HPKE
poljar Dec 17, 2025
870d2ad
Standardise on || for concatenation
hughns Jan 7, 2026
a279629
Fix encoding of LoginOkMessage
hughns Jan 7, 2026
98f94a0
Refer to nonce logic described in HPKE
hughns Jan 7, 2026
815583d
Clean up HPKE section
hughns Jan 14, 2026
94ad88c
Update proposals/4388-secure-qr-channel.md
hughns Jan 14, 2026
ac1d9b5
Remove | from concatenated strings
hughns Jan 14, 2026
d081b78
Change expires_ts to expires_in_ms
hughns Jan 21, 2026
d8424cc
Use binary packing for LoginInitiateMEssage and LoginOkMessage
hughns Jan 23, 2026
fbc626b
Fix unstable rendezvious endpoint path
hughns Jan 23, 2026
270c17d
Use HPKE functions directly where possible and don't repeat what is i…
hughns Jan 23, 2026
69a9997
Apply suggestions from code review
hughns Feb 9, 2026
a44815f
Bind secure channel to rendezvous session via additional authenticati…
hughns Feb 25, 2026
db88079
Ensure no leading zero in check code and notes on acceptable limitations
hughns Feb 25, 2026
1963cf1
Add alternative about making `Sec-Fetch` logic explicit
hughns Feb 25, 2026
7d1d413
With note about MUST and SHOULD
hughns Feb 25, 2026
f07df05
Add discovery endpoint and remove unstable_features
hughns Mar 16, 2026
4af6457
Add note about Context_DeviceG_Send exporter secret
hughns Mar 16, 2026
309b0f7
Attempt to clarify maximum size of data
hughns Mar 17, 2026
d638bdd
Clarify the PUT semantics
hughns Mar 17, 2026
69869ec
Add create_available to discovery response body
hughns Mar 18, 2026
62672cf
Correction on discovery response codes
hughns Mar 18, 2026
f95061f
Apply suggestions from review
hughns Apr 8, 2026
d2ba84f
Incorporate helpful note from @uhoreg
hughns Apr 8, 2026
5b6dc1e
Specify maximum length of rendezvous ID and sequence token + delimit …
hughns Apr 10, 2026
470ed05
Update proposals/4388-secure-qr-channel.md
hughns May 21, 2026
c992731
Update proposals/4388-secure-qr-channel.md
hughns May 27, 2026
d125239
Incorporate review feedback
hughns May 27, 2026
9aabff8
Add note about client handling of M_CONCURRENT_WRITE
hughns May 27, 2026
98d3b04
Make PUT requests idempotent
hughns May 27, 2026
abcba86
Apply suggestions from code review
hughns Jun 3, 2026
7b4020c
Apply suggestion from @richvdh
hughns Jun 3, 2026
2efb43a
Ordering of LoginInitiateMessage contents
hughns Jun 3, 2026
c56d9fa
Readability improvements
hughns Jun 3, 2026
914ae87
Constrain rendezvous ID and sequence_token to the opaque identifier g…
hughns Jun 3, 2026
9b9a346
Fix table inconsistency
hughns Jun 3, 2026
e43db14
Replace EncodeStringAsBytes() with EncodeStringAsBytes8() and EncodeS…
hughns Jun 4, 2026
64ff8a1
sequence tokens do not need to be unique to a rendezvous session
hughns Jun 8, 2026
3c267fd
<ol> to heading
hughns Jul 2, 2026
6222c62
MSC4108 doesn't say where the check code is in the flow
hughns Jul 2, 2026
95e6b6d
Refactor "secure operations" section
hughns Jul 2, 2026
96239e7
Defer to HPKE for replay protection nonces
hughns Jul 3, 2026
726e115
Clarifications to sequence_token and recommended implementation
hughns Jul 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Loading