HARP-RECIPIENT-WRAP
Version: 0.2 Draft (Standards-Grade)
Status: Draft Specification (Extension)
Namespace: org.harp.recipientWrap
Overview
Section titled “Overview”The Enforcer encrypts artifact plaintext once under a random DEK (AES-256-GCM) and wraps the DEK to each recipient device’s durable X25519 encryption public key. The Gateway stores ciphertext and wrap blobs. It MUST NOT unwrap, re-wrap, or hold the DEK.
This is a distinct ciphertext.alg from the 1:1 pairing profile. Do not overload AES-256-GCM.
Authoritative spec: harp-spec recipient-wrap
Extension key
Section titled “Extension key”org.harp.recipientWrap sits on the gateway-visible ciphertext object (device ids + encapsulated keys). Not inside encrypted plaintext.
Registered alg: aes-256-gcm+hpke-x25519-v1
Do not wrap to Ed25519 signing keys.
Recipient-keys
Section titled “Recipient-keys”GET /v1/recipient-keys?userId={id} returns public X25519 + Ed25519 only. See HARP-GATEWAY-HTTP.
A Gateway that substitutes directory public keys can cause wrap-to-attacker. Honest public keys plus stolen ciphertext do not yield plaintext. Use TLS, authenticated Enforcer clients, and fingerprints at enroll. Blindness ≠ honest bulletin board.
Schema
Section titled “Schema”Normative JSON Schema: harp-spec/extensions/harp-recipient-wrap.schema.json