التحقق التشفيري

{
    "statement": {
        "schema": "https://majax.app/security/schemas/attestation-v2.json",
        "schema_version": 2,
        "product": "Majax Messenger",
        "attestation_type": "automated-self-verification",
        "independent_audit": false,
        "generated_at": "2026-08-29T03:15:37Z",
        "overall_result": "PASS",
        "scope": {
            "description": "Ephemeral public verification with no production keys or user data",
            "production_secrets_accessed": false,
            "production_user_data_accessed": false,
            "persistent_test_keys": false
        },
        "architecture": {
            "kem_algorithm": "ML-KEM-1024",
            "cryptographic_domains": [
                "messages",
                "voice",
                "media",
                "rtc",
                "identity"
            ],
            "domain_count": 5,
            "domain_separation": true,
            "rotation_policy": "daily-with-bounded-overlap",
            "overlap_seconds": 3600
        },
        "implementation": {
            "verification_binary_sha256": "88B805E34122F91F98F89D30B01BA560C0A0148133753257011900F4CE7D35CA"
        },
        "tests": {
            "domains": [
                {
                    "domain": "messages",
                    "algorithm": "ML-KEM-1024",
                    "result": "PASS",
                    "checks": {
                        "algorithm_identifier": true,
                        "mlkem_1024_object_dimensions": {
                            "public_key": true,
                            "private_key": true,
                            "ciphertext": true,
                            "shared_secret": true
                        },
                        "encapsulation_decapsulation_match": true,
                        "ephemeral_key_uniqueness": true
                    },
                    "timings_ms": {
                        "key_generation": 4.928,
                        "encapsulation": 1.673,
                        "decapsulation": 1.485
                    }
                },
                {
                    "domain": "voice",
                    "algorithm": "ML-KEM-1024",
                    "result": "PASS",
                    "checks": {
                        "algorithm_identifier": true,
                        "mlkem_1024_object_dimensions": {
                            "public_key": true,
                            "private_key": true,
                            "ciphertext": true,
                            "shared_secret": true
                        },
                        "encapsulation_decapsulation_match": true,
                        "ephemeral_key_uniqueness": true
                    },
                    "timings_ms": {
                        "key_generation": 1.149,
                        "encapsulation": 1.504,
                        "decapsulation": 1.185
                    }
                },
                {
                    "domain": "media",
                    "algorithm": "ML-KEM-1024",
                    "result": "PASS",
                    "checks": {
                        "algorithm_identifier": true,
                        "mlkem_1024_object_dimensions": {
                            "public_key": true,
                            "private_key": true,
                            "ciphertext": true,
                            "shared_secret": true
                        },
                        "encapsulation_decapsulation_match": true,
                        "ephemeral_key_uniqueness": true
                    },
                    "timings_ms": {
                        "key_generation": 1.176,
                        "encapsulation": 1.078,
                        "decapsulation": 1.254
                    }
                },
                {
                    "domain": "rtc",
                    "algorithm": "ML-KEM-1024",
                    "result": "PASS",
                    "checks": {
                        "algorithm_identifier": true,
                        "mlkem_1024_object_dimensions": {
                            "public_key": true,
                            "private_key": true,
                            "ciphertext": true,
                            "shared_secret": true
                        },
                        "encapsulation_decapsulation_match": true,
                        "ephemeral_key_uniqueness": true
                    },
                    "timings_ms": {
                        "key_generation": 1.143,
                        "encapsulation": 1.212,
                        "decapsulation": 1.141
                    }
                },
                {
                    "domain": "identity",
                    "algorithm": "ML-KEM-1024",
                    "result": "PASS",
                    "checks": {
                        "algorithm_identifier": true,
                        "mlkem_1024_object_dimensions": {
                            "public_key": true,
                            "private_key": true,
                            "ciphertext": true,
                            "shared_secret": true
                        },
                        "encapsulation_decapsulation_match": true,
                        "ephemeral_key_uniqueness": true
                    },
                    "timings_ms": {
                        "key_generation": 1.021,
                        "encapsulation": 1.549,
                        "decapsulation": 1.293
                    }
                }
            ],
            "negative": {
                "tampered_ciphertext_implicit_rejection": {
                    "result": "PASS",
                    "semantics": "decapsulation returns a divergent pseudorandom secret",
                    "domains": [
                        {
                            "domain": "messages",
                            "result": "PASS",
                            "decapsulation_ms": 1.345
                        },
                        {
                            "domain": "voice",
                            "result": "PASS",
                            "decapsulation_ms": 1.304
                        },
                        {
                            "domain": "media",
                            "result": "PASS",
                            "decapsulation_ms": 1.338
                        },
                        {
                            "domain": "rtc",
                            "result": "PASS",
                            "decapsulation_ms": 1.275
                        },
                        {
                            "domain": "identity",
                            "result": "PASS",
                            "decapsulation_ms": 1.188
                        }
                    ]
                },
                "cross_domain_private_key_implicit_rejection": {
                    "result": "PASS",
                    "semantics": "a private key from another domain cannot recover the original secret",
                    "domain_pairs": [
                        {
                            "ciphertext_domain": "messages",
                            "private_key_domain": "voice",
                            "result": "PASS",
                            "decapsulation_ms": 1.264
                        },
                        {
                            "ciphertext_domain": "voice",
                            "private_key_domain": "media",
                            "result": "PASS",
                            "decapsulation_ms": 1.248
                        },
                        {
                            "ciphertext_domain": "media",
                            "private_key_domain": "rtc",
                            "result": "PASS",
                            "decapsulation_ms": 1.17
                        },
                        {
                            "ciphertext_domain": "rtc",
                            "private_key_domain": "identity",
                            "result": "PASS",
                            "decapsulation_ms": 1.432
                        },
                        {
                            "ciphertext_domain": "identity",
                            "private_key_domain": "messages",
                            "result": "PASS",
                            "decapsulation_ms": 1.438
                        }
                    ]
                }
            },
            "maurice_hmac_v2": {
                "result": "PASS",
                "protocol": "Maurice-HMAC-v2",
                "evidence_mode": "independent-reference-model-plus-production-source-binding",
                "canonical_form": "METHOD|PATH|TS|NONCE|DEVICE_ID|SHA256(BODY)",
                "production_middleware_sha256": "AC5DC96E21230A84E91BE616848EAF92905D388D046EB5886D465C7C373C697E",
                "checks": {
                    "production_source_invariants": {
                        "canonical_form_present": true,
                        "strict_hmac_v2_present": true,
                        "replay_cache_check_present": true,
                        "replay_rejection_present": true,
                        "timing_safe_comparison_present": true
                    },
                    "valid_canonical_request_accepted": true,
                    "exact_replay_rejected": true,
                    "body_mutation_rejected": true,
                    "path_mutation_rejected": true,
                    "fresh_nonces_are_distinct": true
                }
            },
            "not_evaluated": {
                "signal_mlkem_composition": {
                    "result": "NOT_EVALUATED",
                    "reason": "Production composes a KEM envelope inside Signal; the public suite does not execute the Android Signal engine."
                },
                "signal_forward_secrecy": {
                    "result": "NOT_EVALUATED",
                    "reason": "Requires a stateful two-party Signal ratchet harness using the production Android stores."
                },
                "signal_post_compromise_recovery": {
                    "result": "NOT_EVALUATED",
                    "reason": "Requires compromise-and-recovery tests across successive production-compatible Signal ratchets."
                },
                "application_nonce_management": {
                    "result": "NOT_EVALUATED",
                    "reason": "Maurice request nonces are tested here; media, RTC and Android storage nonces require separate application harnesses."
                }
            }
        },
        "limitations": [
            "This is a signed self-attestation and not an independent certification.",
            "The suite uses ephemeral keys and deliberately excludes production secrets and user data."
        ]
    },
    "signature": {
        "algorithm": "Ed25519",
        "encoding": "base64",
        "value": "ZexJDtzVDFQQk4iscmE4WPcqnPFMsLzV3xnY1gFn4WGzWDk1DtC48/qjnldEZtp2Vhn20CXkNNC3JLN7+BDBDA==",
        "public_key": "/security/public-attestation-ed25519.pem"
    }
}