File size: 1,103 Bytes
ef6eb55 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 | # ADR-0006: Server Challenge Protocol
**Status:** Accepted
**Date:** 2026-08-18
---
## Decision
When authorization is required, use explicit challenge/response protocol.
```
Client → Server: node_id + release_identity + nonce
Server → Client: signature(authorization_token + timestamp + nonce)
Client: Verify signature, use token for protected operation
Token: Short-lived (1 hour), signed, includes nonce
```
## Rules
- Fresh nonces for replay protection
- Short-lived tokens (1 hour max)
- Signed responses (not encrypted secrets)
- TLS for transport security
- Explicit expiration timestamps
- No client-side fallback if server unavailable
## What This Prevents
- Replayed tokens
- Token reuse across releases
- Offline authorization generation
- Casual modification of authorization state
## Consequences
- Authorization is server-validated, not client-side
- Private keys never transmitted
- Compromised clone cannot manufacture valid tokens
---
**Related ADRs:**
- ADR-0002: Authorization Boundary
- ADR-0004: Private Key Separation
|