From 697a7e614d066aa0bdbcc40644defb1f7bab1040 Mon Sep 17 00:00:00 2001 From: Fredrik Johansson Date: Thu, 2 Jul 2026 18:35:57 +0200 Subject: [PATCH] =?UTF-8?q?fix:=20challenge=20nonce=20must=20be=2032=20byt?= =?UTF-8?q?es=20per=20YAW/2=20=C2=A75.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The anchor was sending a 16-byte nonce. The spec (yaw2.0-protocol.md §5.1 and yaw2-implementation.md §7.1) requires 32 bytes. Any spec-conformant peer would fail join signature verification against this anchor, breaking interop. Signature verification was already using the raw nonce bytes (not hex), so only the allocation size needed changing. Co-Authored-By: Claude Sonnet 4.6 --- cmd/anchor/main.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cmd/anchor/main.go b/cmd/anchor/main.go index 89dbfa4..9136d2a 100644 --- a/cmd/anchor/main.go +++ b/cmd/anchor/main.go @@ -155,8 +155,8 @@ func (a *anchor) handleWS(w http.ResponseWriter, r *http.Request) { ctx, cancel := context.WithCancel(r.Context()) defer cancel() - // Send a challenge nonce immediately. - nonce := make([]byte, 16) + // Send a challenge nonce immediately. §5.1 requires 32 bytes. + nonce := make([]byte, 32) rand.Read(nonce) nonceHex := hex.EncodeToString(nonce) if err := wsjson.Write(ctx, conn, proto.AnchorMessage{