mirror of
https://github.com/zap-proto/rns.git
synced 2026-10-30 15:04:02 +00:00
zeekay
e7ee4f0b3e
Resource Name Service over ZAP — service naming bound to KEM keypair. Schema-first release: schema/zap_rns.zap defines the wire format in ZAP schema language. Reference implementations follow in v0.2 once zap-proto/spec provides cross-language codegen. See https://github.com/zap-proto/papers/tree/main/rns-identity-binding for the formal analysis.
34 lines
1.1 KiB
Plaintext
34 lines
1.1 KiB
Plaintext
# zap-rns — Resource Name Service over ZAP.
|
|
#
|
|
# Service names are bound to KEM public keys at registration time.
|
|
# Lookup returns (name, kemPubKey, sig). Spoofing a name reduces to
|
|
# KEM key compromise + signature forgery — strictly stronger than DNS
|
|
# or service-mesh discovery. See zap-proto/papers/rns-identity-binding.
|
|
|
|
# Record is one name → key binding. ttl bounds caching; the signing
|
|
# party (the registry root) signs everything except `signature` itself.
|
|
struct Record
|
|
name Text
|
|
kemPubKey Data
|
|
sigPubKey Data
|
|
ttl UInt32
|
|
notBefore UInt64 # unix nanos
|
|
notAfter UInt64
|
|
registry Text # which RNS authority issued this
|
|
signature Data
|
|
|
|
# Query is a name lookup. Optional `auth` carries a token signed by
|
|
# the requester's long-term key, enabling encrypted-to-RNS lookups.
|
|
struct Query
|
|
name Text
|
|
auth Data
|
|
|
|
# Response carries one Record matching the query, or an error
|
|
# discriminating between "not found", "expired", and "denied".
|
|
struct Response
|
|
union
|
|
record Record
|
|
notFound Text
|
|
expired Record
|
|
denied Text
|