Backlog — real, latent, deliberately not scheduled. Audit-confirmed defects in the current container: the preamble and version field are authenticated by nothing (AEAD AAD is empty everywhere; the IBS header signature covers only the header bytes), the format number does not equal the wire value (VERSION_V3 = 2), and there is no extension mechanism.
Format 3: bind preamble+header into both the AEAD AAD and the IBS signature input; make the format number the wire value; add a ciphersuite ID and critical-extension support. Prerequisites: the bidirectional wire-compat gate as a required check, and a readers-first rollout (read support ships a major before the write default flips). Reference material: PROTOCOL-rfc-draft.md in postguard-e2e.
Part of #247 (workstream G).
Backlog — real, latent, deliberately not scheduled. Audit-confirmed defects in the current container: the preamble and version field are authenticated by nothing (AEAD AAD is empty everywhere; the IBS header signature covers only the header bytes), the format number does not equal the wire value (VERSION_V3 = 2), and there is no extension mechanism.
Format 3: bind preamble+header into both the AEAD AAD and the IBS signature input; make the format number the wire value; add a ciphersuite ID and critical-extension support. Prerequisites: the bidirectional wire-compat gate as a required check, and a readers-first rollout (read support ships a major before the write default flips). Reference material: PROTOCOL-rfc-draft.md in postguard-e2e.
Part of #247 (workstream G).