feat(be): verify a browser's key and its announced successor

[sea-snake]

Design: #4224. Overview: #4230. The verifier only — its caller is the sign-in ceremony in #4268, which also removes the #[allow(dead_code)] this carries.

A session records which browser created it, so the user can see where they are signed in and end one browser's access everywhere at once. That is only worth anything if the browser named in a sign-in is the browser that made it; otherwise an attacker holding an access method could attribute their session to a browser the user recognises, and the settings list would lie. Ingress messages are public, so a key presented in one sign-in can be read off the wire by anyone.

verify_browser_keys checks two signatures before a sign-in may name a browser: the current key over the session key and the announced successor, and the successor over the session key and the current key. Each is made under its own domain separator, ii-session-browser-key and ii-session-browser-successor, so neither can be replayed in the other's role.

Requiring possession of the successor is what closes the wire-reading attack: announcing a key you do not hold is impossible without its private half, so a key read off the wire cannot be claimed when its owner next presents one.

Verifying yields evidence, not a boolean. It returns a VerifiedBrowserKeys whose fields are private and whose only constructor is this function, and CreateSessionParams requires one — so create_session registering a browser from these keys cannot depend on a caller having remembered to check. That is also why the module sits at the crate root rather than under sessions: storage must not depend upward on sessions, and a P-256 verifier that knows nothing of either is something both layers may use.

One encoding per key. P-256 only, no fallback. A key that does not parse, a signature of the wrong length, and an empty signature are each refused rather than skipped — and so is a compressed SEC1 point, although it is valid DER for the same key. from_public_key_der accepts both, so one private key had two spellings and resolve_browser, which compares the bytes it is handed, would have seen two browsers. WebCrypto emits only the uncompressed form, so nothing legitimate is turned away and nothing stored needs migrating.

Tests: browser_key::tests (11), one accepting case and ten refusals — including a successor signature replayed as the current one, a signature over another session key, one paired with a substituted successor, and a compressed key that from_public_key_der accepts.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LVi99RYo2jyi2kCurgovNJ

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 6ef8323.

Security Overview

• 🔎 Scanned files: 5 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=04f1a139-1777-4591-b52b-52b7a6212330&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► src/internet_identity/src/browser_key.rs     Add browser key verification module with tests
Enhancement	► src/internet_identity/src/main.rs     Add browser_key module to imports

[Copilot]

🟡 Changes recommended

The critical domain-separator mismatch must be resolved before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds backend P-256 verification for current and successor browser keys used during session creation.

Changes:

• Verifies domain-separated signatures binding both browser keys to the session key.
• Adds acceptance and rejection tests.
• Enables PKCS#8 support and updates dependencies.

File summaries

File	Description
src/internet_identity/src/sessions/browser_key.rs	Implements key verification and tests; domain separators conflict with the documented wire format.
src/internet_identity/src/sessions.rs	Exposes the sessions module.
src/internet_identity/src/main.rs	Registers the sessions module.
src/canister_tests/Cargo.toml	Adds an unused direct P-256 dependency.
Cargo.toml	Enables P-256 PKCS#8 support.
Cargo.lock	Records dependency changes.

Review details

Suppressed comments (1)

src/canister_tests/Cargo.toml:12

• canister_tests does not use p256 in this PR; the only match in that crate is this manifest entry, and the referenced prepare_account_session caller is deferred to #4268. This adds an unused direct dependency and lockfile entry to a verifier-only change. Please add it with the integration-test helper that actually uses it and regenerate the lockfile then.

# Signs the browser-key proof `prepare_account_session` requires.
p256.workspace = true

• Files reviewed: 5/6 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.