https://gitlab.synchro.net/main/sbbs/-/commit/a96b6c72c0c31f1aff4080d7
Added Files:
docs/superpowers/specs/2026-08-02-qwk-certificate-authority-design.md Log Message:
docs: design QWK certificate authority
Record the design for an automated private CA whose delegation tree
follows QWKnet. A node authenticates through its existing QWK account,
carries a CSR in a REP additional file, and receives a short-lived
delegated BBS CA in the parent's QWK reply. This deliberately permits a
node that has been offline beyond its certificate lifetime to re-enrol
with a new key: the QWK account/password is the enduring authority, and stealing it is correspondingly sufficient to recover that identity.
The certificate profiles use a single CN and matching one-item DNS SAN, seven-day BBS, service, and user certificates, separate CA/service/user
keys, and a TLS 1.3 Ed25519/X25519 profile. BBS CAs may delegate
without limit in the QWK tree. Telnet client authentication pins the
direct local BBS issuer rather than accepting any leaf under the shared
root.
The offline root signs thirteen-month online intermediates. Their longer lifetime is the reason the design includes full X.509 CRLs: QWK packets distribute a CRL bundle; every validator understands it for each issuer,
and a root CRL can kill a compromised intermediate's entire subtree. The document also records the unavoidable failure mode: a compromised
intermediate controlling a node's only QWK path can withhold the CRL, so
the eventual HTTPS distribution-point support is a separate follow-on.
Finally, specify replay-safe CERTREQ/CERTREP envelopes, atomic
certificate installation, the five-minute clock margin, session expiry enforcement, and a controlled mutual-TLS IRC-link handover so regular
seven-day renewal does not require an avoidable network split.
Co-Authored-By: Codex <
noreply@openai.com>
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net