security: a transfer's memo, ticker and nonce are in no public object (pre-audit item 4)

[cryptskii]

Summary

Pre-audit item 4, recorded in CONFORMANCE_GAPS.md §6.71. Owner ruling, 2026-10-02: "one shape, BLE carries terms".

The finding. A transfer's signed operation carried its memo, token ticker, nonce, mode, the recipient's public key and the recipient's id as text, all in the clear. Those bytes hash into the tip, ride the economic admission into the register, and are read again by later counterparties walking a credit's source. So the memo, and a nonce predictable from public identifiers (§6.67), outlived the sealed spool in every public object that carries the operation.

What changes.

• One shape. Operation::Transfer is {to_device_id, amount, policy_commit, terms_commitment, signature, authority_policy}, canonical tag 37. Tag 3 is retired and never reused. recipient and to are deleted.
• Terms. TransferTerms {token_id, nonce, mode, memo, salt}. The commitment is H(DSM/transfer-terms/v1; terms), under a fresh 256-bit salt; a salt under 128 bits is refused.
• Carriage.
  • Online: OnlineTransferRequest.transfer_terms (field 15), inside the sealed spool payload.
  • BLE: BilateralPrepareRequest.transfer_terms (field 19), beside operation_data.
• Opening. Every reader opens the terms against the signed commitment first:
  • recognition (recipient_dispatch): missing, undecodable or non-opening terms mean the transfer is not recognized and nothing is staged;
  • the canonical apply: the nonce it spends and the token come from the opened terms;
  • the BLE prepare (step_terms): refused before any session exists, and checked again when a stored session is restored;
  • the inbox, history and BLE events: they show the token and memo only from opened terms.
• Assets by commit. The sender's debit, the BLE allocation spend and the BLE credit use the signed policy_commit, and each requires the opened ticker to resolve to it. The recovery egress gate names a transfer's lock from its commit, and blocks an asset it cannot name while any lock is held.
• Storage. recipient_staged_transfer.terms_bytes and bilateral_sessions.terms_bytes; client schema 28.
• Frontend binding. dsm_app_pb.ts regenerated.

Related Issues

Security pre-audit (#1096, #1099, #1100), item 4.

Testing

• cargo clippy --all-targets -- -D warnings (root workspace), cargo fmt, real-code guard and ci/conformance_evidence.py all pass.
• cargo test -p dsm passes, including the new transfer_terms tests.
• cargo test -p dsm_vertical_validation passes.
• The dsm_sdk lib suite passes: 1,078 of 1,079. The remaining one, pairing_smoke_identity_before_connection, fails the same way on main's binary when run alone; it depends on test order, and CI runs in that order.
• New tests:
  • a_transfer_without_terms_that_open_it_is_not_recognized (online)
  • a_bearer_prepare_without_terms_that_open_it_is_refused (BLE)
  • no_node_holds_a_transfers_memo_ticker_or_nonce: scans every row of every node table for the memo, nonce, salt and length-prefixed ticker
  • a_transfer_settles_only_with_terms_that_open_it
• Mutation controls, all killed:
  • the commitment check removed (three tests red);
  • online terms taken without opening;
  • BLE terms taken without opening;
  • the salt taken from public data.
• The code-map pins need a repin from this PR's own map. That is in progress.

Notes

• A clean cut: every transfer's operation bytes change shape, and nothing signed under tag 3 decodes. This ships after SPHINCS+ v2 (security: SPHINCS+ construction version 2, the FIPS 205 structure with BLAKE3 (pre-audit item 17) #1100), which already re-provisions every device.
• MR-SOFI-0283 ("a transfer nonce stays in the operation bytes") now holds by commitment, not in the clear. This is noted in §6.71 and in the §8 row.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y4wDTToHmJfkYYJvMKXt3u

---

Generated by Claude Code