Device sigchain operations.

DefaultRotationInterval is weshnet's rendezvous rotation period, in seconds (rendezvous.DefaultRotationInterval = 24h). The rendezvous point an account announces on changes once per interval, so an observer who learns one point does not learn every future one.

DigestLen is the length of a statement digest (SHA-256).

WebLinkPrefix is the prefix of a shareable Berty web link. The fragment marker is part of it on purpose: everything after '#' stays in the browser and is never sent to berty.tech, so the web host never learns the identity being shared.

BindStatement returns the canonical text an account signs, with its Wesh account private key, to claim a directory entry.

The signature is what makes a directory entry meaningful. Without it anyone could publish anyone else's account key next to a seed of their choosing and harvest the contact requests that followed. With it, a directory entry is a statement by the account itself, verifiable by anyone, replayable nowhere:

• the kind prefix stops a signature made for one purpose being reused for another;
• chainID stops a binding signed for a testnet being replayed on mainnet;
• gnoAddr binds the Wesh identity to exactly one gno account, so a leaked signature cannot be used to claim the identity from a different address;
• revision is monotonic, so an old, superseded binding cannot be replayed to roll a rotation back.

payload is the seed for a publicly published identity, or the seed commitment from SeedCommitment for one that keeps its rendezvous point off chain. The two are indistinguishable on the wire, which is deliberate: an observer cannot tell a committed identity from a published one without the realm's own mode flag.

Fields are newline-framed and hex-encoded, never concatenated raw: with plain concatenation a different split of the same bytes would produce the same statement.

DecodeAccountPK parses a hex-encoded account public key.

DecodeCommitment parses a hex-encoded seed commitment.

DecodeDevicePK parses a hex-encoded device public key.

DecodeSeed parses a hex-encoded public rendezvous seed.

DeviceStatement returns the canonical text an account signs to append one entry to its device sigchain.

This is the piece the Wesh protocol has no answer for. Its own documentation says a device, once linked, can never be revoked: the account metadata log is append-only and no authority can mark an entry void. A chain cannot undo that (the ratchets are already out there and forward secrecy is a local property), but it can host the record that was missing, so a revocation becomes publicly visible, ordered, and attributable to the account key.

prev is the digest of the preceding statement, or GenesisDigest for seq 0. Chaining each entry to its predecessor means the log cannot be reordered or have an entry quietly dropped: any gap changes every digest after it.

GenesisDigest is the all-zero digest that the first sigchain entry chains to.

HMACSHA256 computes HMAC-SHA256 as specified in RFC 2104.

gno's standard library exposes sha256.Sum256 but no streaming hash.Hash and no crypto/hmac, so the construction is spelled out here:

1HMAC(K, m) = H((K' ⊕ opad) ‖ H((K' ⊕ ipad) ‖ m))

with K' the key hashed down when longer than the block size, then zero-padded up to it. This is the primitive weshnet's rendezvous point derivation is built on, so it has to agree byte-for-byte; see RendezvousPoint.

NextPeriod returns the start of the period after the one containing unixSec. Mirrors weshnet's rendezvous.NextTimePeriod.

OpenCommitment reports whether commitment is H(seed ‖ salt).

The comparison is constant-time over the digest: a short-circuiting compare leaks, through gas, how many leading bytes of a guess were right.

RendezvousPoint derives the rotating DHT topic an account announces on during the period starting at periodStart.

It reproduces weshnet's rendezvous.GenerateRendezvousPointForPeriod exactly:

1HMAC-SHA256(key = topic ‖ seed, msg = big-endian uint64(periodStart))

For contact requests, weshnet passes the account public key as the topic and the public rendezvous seed as the seed (see swiper.WatchTopic in contact_request_manager.go), which is what Contact.RendezvousPointAt does.

Deriving this on chain is what makes a published identity checkable: anyone can confirm that the seed in the directory really is the one the account is announcing under, without trusting the directory.

RoundPeriod returns the start of the rotation period containing unixSec. Mirrors weshnet's rendezvous.RoundTimePeriod.

SeedCommitment returns H(seed ‖ salt), the value published instead of the seed itself when an account wants the chain to attest the binding without broadcasting its rendezvous point.

The salt is not optional: a seed is 32 bytes of entropy, but a commitment with no salt is a deterministic function of the seed, so two accounts that (impossibly, but still) shared a seed would be linkable, and a seed later disclosed out of band retroactively confirms every past commitment. The salt keeps disclosure a deliberate act.

StatementDigest returns SHA-256 of a canonical statement. It is the value the next sigchain entry chains to.

ValidOp reports whether op is a known sigchain operation.

VerifyBind checks a binding signature against the account key.

VerifyDevice checks a sigchain entry's shape and its signature, and returns the digest the next entry must chain to.

ParseWebLink decodes a Berty contact web link back into a Contact.

It accepts links with or without a trailing query segment, and ignores query keys other than "name", matching berty's own UnmarshalLink leniency.

Contact is the publishable identity of a Wesh account: weshnet's ShareableContact. It is everything a stranger needs to send a contact request, and it contains no secret.

AccountPK is the raw ed25519 account public key. Seed is the public rendezvous seed; together they derive the rotating rendezvous point the account announces on, see RendezvousPoint. DisplayName is free-form app metadata and is not authenticated by anything.