enbility / ship-go / 24991636226

93%

Build Type

push

github

Committed by web-flow

Commit Message

SHIP Pairing Implementation and API redesign (#66)

Implements SHIP Pairing Service specification including automatic device
pairing, HMAC-based authentication, and Device Replacement Timing Logic
for AddCu devices.

BREAKING CHANGE: ServiceIdentity is now used instead of ServiceDetails,
or manual SKI, fingerprint, shipID arguments

Key components:
- Complete pairing service with listener and announcer functionality
- HMAC-SHA256 authentication with nonce-based replay protection
- Ring buffer digest validation preventing replay attacks
- QR code generation and parsing for device discovery
- 15-minute AddCu device replacement timer with automatic trust
management
- ServiceDetails-centric Hub API replacing SKI-string methods
- Thread-safe AddCuReplacementTracker for production environments
- Comprehensive test coverage with specification compliance validation

Architecture improvements:
- Enhanced ServiceDetails with fingerprint, PairingType, and Copy()
methods
- Hub interface modernized to use ServiceDetails objects consistently
- Multi-identifier service lookup (SKI, fingerprint, SHIP ID)
- Clean separation between pairing service and Hub functionality
- Interface-based design enabling flexible pairing strategies

Security features:
- Constant-time HMAC validation preventing timing attacks
- Secure nonce generation with cryptographic randomness
- Certificate fingerprint validation for device identity verification
- Memory clearing of sensitive pairing data
- Protection against concurrent access races with Copy() pattern

Specification compliance:
- Device Replacement Timing Logic per section 4.3
- Automatic trust establishment after successful HMAC verification
- Timer-based pairing listener reactivation
- Backward compatibility with existing SHIP 1.0.1 connections

Coverage Stats

2464 of 2733 new or added lines in 27 files covered. (90.16%)

13 existing lines in 6 files now uncovered.

5698 of 6124 relevant lines covered (93.04%)

12665.89 hits per line