GroupKey
Purpose
The shared key of one epoch — what the members of one GroupRevision seal and unseal that epoch's
messages with. Holding it is what being entitled to read the epoch means. The material never appears
off a member's device in the clear: it travels only inside a WrappedKey sealed to one recipient,
and rests only inside a sealed KeyRing. How the sealing is performed — the cipher — is a carried
concern of the boundary; what the domain owns is that the key that sealed a writing is the only key
that unseals it, and that a sealed payload betrays nothing of the writing.
Attributes
- key id: is
Textthat identifies the key, such as "k-0142" - material: is
Textthat carries the key material, opaque
Invariants
- Neither the key id nor the material is empty.
Operations
seal
Renders a given Message into its sealed payload — an opaque text carrying no readable trace of
the message: not its writing, not its author, not its identity. Recoverable only through the key
that sealed it.
Result: the sealed payload as Text
seal revision
Renders a given GroupRevision into its sealed payload — an opaque text carrying no readable trace
of the membership: not who is in the epoch, not who minted it. Recoverable only through the key that
sealed it, and recoverable whole: the seal carries every field the revision holds — for the
creator and for each member, both their name and their shown name — so what unsealing yields is the
revision that was sealed, not a likeness of it.
Result: the sealed payload as Text
Scenarios
A sealed payload betrays nothing of the message
Given: a GroupKey with key id "k-0163" and a Message "m-8001" by anne.bruun carrying a Writing of "The hearing moved to Thursday."
When: seal is performed
Then: the sealed payload is not the text "The hearing moved to Thursday.", and carries neither "m-8001" nor "anne.bruun" readably
Two keys seal the same message differently
Given: a GroupKey with key id "k-0163", a GroupKey with key id "k-0264" and different material, and a Message carrying a Writing of "The hearing moved to Thursday."
When: each key seals the message
Then: the two sealed payloads differ — what a payload yields depends on the key that made it
A key without material is rejected
Given: key id "k-0142" and empty material When: a GroupKey is created Then: the creation is rejected because the material is empty