KeychainMDIP / kc / 34987319218

96%

push

github

Bind verified credentials to the challenge responder (#1281)

* fix(keymaster): bind credentials to responders

Reject presentations for another subject even when their signed plaintext
is available to the responder. Bind the outer response controller to its
encryption sender and decrypt the same resolved document version to block
transfer-based responder substitution.

Preserve delegated and transferred credential controllers. Outer response
controllers that differ from the encryption sender no longer verify.

* docs: remove verification contract additions

Restore the documentation changed in 67881cd4. The verification fix
enforces the intended subject-responder relationship rather than defining
a new protocol feature. Keep implementation and regression tests intact.

6993 of 7396 branches covered (94.55%)

Branch coverage included in aggregate %.

21 of 21 new or added lines in 1 file covered. (100.0%)

8678 of 8978 relevant lines covered (96.66%)

1665.69 hits per line