Skip to content

Say that the pairing token is a credential #327

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arturpragacz merged 3 commits into from
Oct 23, 2026
Merged

Say that the pairing token is a credential #327

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ba2dabb
docs: say that the pairing token is a credential
maximmaxim345 Oct 21, 2026
7da7076
Strengthen wording
arturpragacz Oct 23, 2026
a24748a
Fix README
arturpragacz Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -860,7 +860,7 @@ While a client is unapproved, the server SHOULD identify and present it to the o

The Noise handshake completes using the pairing PSK, authenticating both sides. After the pairing `server/activate`, the client MUST send [`client/pair-init`](#client--server-clientpair-init) followed immediately by [`client/pair-finalize`](#client--server-clientpair-finalize), without waiting for a server response.

**Lifecycle.** The client's pairing PSK MUST be drawn from a [CSPRNG](#definitions) per device and MUST NOT be a fixed default shared across devices, whether provisioned at manufacture or generated by the client. It persists across reboots and is per-client and long-lived: a successful pairing does not consume it (pairing produces a separate [long-term PSK](#definitions)), so it can pair the client with any number of servers.
**Lifecycle.** The client's pairing PSK MUST be drawn from a [CSPRNG](#definitions) per device and MUST NOT be a fixed default shared across devices, whether provisioned at manufacture or generated by the client. It persists across reboots and is per-client and long-lived: a successful pairing does not consume it (pairing produces a separate [long-term PSK](#definitions)), so it can pair the client with any number of servers. The [pairing token](#pairing-token) is therefore a credential: anyone holding it can pair any server with the client at any time.

```mermaid
sequenceDiagram
Expand Down
2 changes: 1 addition & 1 deletion pairing.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ While a client is unapproved, the server SHOULD identify and present it to the o

The Noise handshake completes using the pairing PSK, authenticating both sides. After the pairing `server/activate`, the client MUST send [`client/pair-init`](#client--server-clientpair-init) followed immediately by [`client/pair-finalize`](#client--server-clientpair-finalize), without waiting for a server response.

**Lifecycle.** The client's pairing PSK MUST be drawn from a [CSPRNG](README.md#definitions) per device and MUST NOT be a fixed default shared across devices, whether provisioned at manufacture or generated by the client. It persists across reboots and is per-client and long-lived: a successful pairing does not consume it (pairing produces a separate [long-term PSK](README.md#definitions)), so it can pair the client with any number of servers.
**Lifecycle.** The client's pairing PSK MUST be drawn from a [CSPRNG](README.md#definitions) per device and MUST NOT be a fixed default shared across devices, whether provisioned at manufacture or generated by the client. It persists across reboots and is per-client and long-lived: a successful pairing does not consume it (pairing produces a separate [long-term PSK](README.md#definitions)), so it can pair the client with any number of servers. The [pairing token](#pairing-token) is therefore a credential: anyone holding it can pair any server with the client at any time.

```mermaid
sequenceDiagram
Expand Down
Loading