Keep the tolerance reasoning out of the package - #115
Merged
Conversation
The javadoc above BOUNDARY_TOLERANCE explained what the allowance is for and what a key belonging to its own period protects against. The figure itself cannot be hidden in a public repository, so the explanation is what turned a duration into a described security parameter. The constant and its value stay, without a comment, because the name says what it is. The candidatesFor javadoc kept the sentence naming which entries are tried and lost the one spelling out that accepting any earlier entry would let one leaked period of key material sign something dated later. It now says the rule is not one to relax here because the cloud applies the same one, which stops a maintainer widening it without describing the attack to a reader. The verifySignatureDetailed javadoc is unchanged, because it names the behaviour rather than the purpose. No behaviour, no value and no test changed. Module suite 99 with 2 skipped, Java 8 signature check passing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The javadoc above
BOUNDARY_TOLERANCEexplained what the allowance isfor and what a key belonging to its own period protects against. The
figure itself cannot be hidden in a public repository, so the
explanation is what turned a duration into a described security
parameter. The constant and its value stay, without a comment, because
the name says what it is.
The
candidatesForjavadoc keeps the sentence naming which entries aretried and loses the one spelling out that accepting any earlier entry
would let one leaked period of key material sign something dated later.
It now says the rule is not one to relax here because the cloud applies
the same one, which stops a maintainer widening it without describing
the attack to a reader.
The
verifySignatureDetailedjavadoc is unchanged, because it names thebehaviour rather than the purpose.
The other five 51Did packages had the same change made before their
pull requests merged. This one arrives separately because pull request
113 merged at the previous commit while the change was being made.
No behaviour, no value and no test changed. Module suite 99 with 2
skipped, and the Java 8 signature check passes.
Produced with AI assistance under James Rosewell's direction and needs
human review before merge.