Package zeroecho.pki.server.confirmation

package zeroecho.pki.server.confirmation
Internal credential key-possession proof profiles.

The signature profile follows the established signature-based proof-of- possession principle used by CRMF, while defining a ZeroEcho-internal transcript. It does not claim to be a CRMF, CMP, CMC, or other standardized endpoint or wire representation.

Transcript version 1 starts with ASCII ZEPP, an unsigned two-byte field count, and nine ordered fields. Every field is encoded as a one-byte tag, a four-byte unsigned big-endian length, and its value. The fields bind:

  1. four-byte big-endian version 1;
  2. ASCII purpose credential-key-possession-confirmation;
  3. the canonical realm identifier;
  4. the UTF-8 server audience;
  5. the exact x509: SHA-256 credential identifier of canonical DER;
  6. the versioned proof-suite identifier;
  7. the 32-byte SHA-256 suite-configuration commitment;
  8. the 32-byte random challenge;
  9. expiry as an eight-byte epoch second and four-byte nanosecond value.

Verification decodes and canonically re-encodes the complete bounded transcript for each request and retains no verifier capability or request state after return. The package is an internal foundation only. It provides no endpoint, persistence, registry discovery, challenge retention, or lifecycle transition.