Handshake transcript
The session is bound to the node identity.
Client and server nonces, route digest, and node identity binding become a replayable transcript. The verifier does not depend on a third-party CA claim to know which Proofnet node answered.
{
"type": "proofnet_pqtls_handshake_packet_v0",
"attesto_type": "transport_handshake",
"client_node": "proofnet-review-client",
"server_node": "proofnet-pq1-demo-node-001",
"service_route_digest": "sha3-512:14ac...9bb2",
"server_identity_binding": "sha3-512:e5e1...e4d4",
"transcript_digest": "sha3-512:1f90...ae72",
"ca_dependency": false,
"proofnet_pq_algorithm": "ML-DSA-87",
"public_safe": true
}
Verification path
Route, identity, transcript, record.
01
Resolve route
BTCore supplies the service route and advertised node identity.
02
Check identity
The node identity binding is verified before the session is trusted.
03
Digest transcript
The public handshake transcript is hashed with SHA3-512.
04
Record session
The accepted transcript can be attached to the memory-block record.