Skip to content

Commit 4c4e8e5

Browse files
committed
Replace visibility vocabulary with sig:obscured digest array
Instead of a controlled vocabulary of visibility types, the signer now attests to obscured nodes via a sorted array of digests from the payload envelope's Merkle tree. Empty array means fully visible; root digest means signed blind.
1 parent f31de9b commit 4c4e8e5

1 file changed

Lines changed: 63 additions & 20 deletions

File tree

papers/bcr-2026-xxx-signature-qualifiers.md

Lines changed: 63 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ Gordian Envelope already provides a mechanism for binding metadata immutably to
8383
- *what object(s)* are being signed (especially for attachments or detached objects)
8484
- role/place context (when needed)
8585
- countersignature/endorsement support
86-
- an Envelope-specific “what did the signer actually see?” claim to reduce misrepresentation after elision
86+
- an Envelope-native attestation of which parts of the envelope were obscured (not visible) at signing time
8787
5. **Practical privacy:** Support common metadata that can be partially disclosed and decorrelated when needed, especially for small enumerated fields.
8888

8989
---
@@ -118,9 +118,9 @@ We then mapped them into Envelope’s assertion model and the signature-metadata
118118

119119
For small enumerated fields where elision may be expected and decorrelation is desirable, we adopt **Salted Values** per [BCR-2026-004](bcr-2026-004-salted-value.md).
120120

121-
We also add one Envelope-specific qualifier:
121+
We also add one Envelope-native qualifier:
122122

123-
- **Visibility claim:** what portion(s) the signer asserts were visible at signing time, to reduce the chance that later disclosure/elision can be used to misrepresent what was endorsed.
123+
- **Obscured-nodes claim (`sig:obscured`):** a lexicographically-sorted array of digests identifying which nodes in the payload envelope's Merkle tree were obscured (elided, encrypted, or compressed) at signing time. This exploits Envelope's existing digest tree rather than introducing a separate controlled vocabulary.
124124

125125
---
126126

@@ -204,7 +204,7 @@ This range is intended for inclusion in the “community, specification required
204204
| 1607 | `sig:target` | predicate | Declares the intended signature target (`sig:Target`). |
205205
| 1608 | `sig:countersignatureOf` | predicate | Identifies what signature (or signature digest) is being countersigned. |
206206
| 1609 | `sig:endorsement` | predicate | Explains countersignature intent (`sig:Endorsement`). |
207-
| 1610 | `sig:visibility` | predicate | Signer visibility claim (`sig:Visibility`). |
207+
| 1610 | `sig:obscured` | predicate | Sorted array of digests of nodes obscured at signing time (see below). |
208208

209209
#### Field predicates used inside typed qualifier objects (1620–1659)
210210

@@ -231,7 +231,6 @@ This range is intended for inclusion in the “community, specification required
231231
| 1638 | `sig:displayName` | predicate | Human label for the object. |
232232
| 1639 | `sig:language` | predicate | Language tag (BCP 47 string). |
233233
| 1640 | `sig:targetType` | predicate | Controlled target/reference type (see enum below). |
234-
| 1641 | `sig:visibilityType` | predicate | Controlled visibility type (see enum below). |
235234

236235
#### Types (1650–1669)
237236

@@ -244,7 +243,6 @@ This range is intended for inclusion in the “community, specification required
244243
| 1654 | `sig:SignedObject` | type | Typed envelope describing a signed object. |
245244
| 1655 | `sig:Target` | type | Typed envelope declaring the intended signature target. |
246245
| 1656 | `sig:Endorsement` | type | Typed envelope describing countersignature endorsement semantics. |
247-
| 1657 | `sig:Visibility` | type | Typed envelope describing signer visibility claim. |
248246

249247
#### Commitment type controlled vocabulary (1670–1679)
250248

@@ -258,22 +256,14 @@ This range is intended for inclusion in the “community, specification required
258256
| 1675 | `sig:Certified` | enum | “I certify this.” |
259257
| 1676 | `sig:Attested` | enum | “I attest this is true/correct.” |
260258

261-
#### Visibility type controlled vocabulary (1680–1689)
262-
263-
| Code Point | Term | Kind | Description |
264-
|-----------:|------------------------|------|------------------------------------------------------------------------------|
265-
| 1680 | `sig:FullContentSeen` | enum | Signer claims they saw the full unelided plaintext content. |
266-
| 1681 | `sig:DigestOnly` | enum | Signer claims they only validated digests/commitments, not full plaintext. |
267-
| 1682 | `sig:DisclosedDigests` | enum | Signer claims they saw a specific disclosed subset (identified by digests). |
268-
269-
#### Target type controlled vocabulary (1690–1699)
259+
#### Target type controlled vocabulary (1680–1689)
270260

271261
| Code Point | Term | Kind | Description |
272262
|-----------:|--------------------------------|------|-----------------------------------------------------------------------------|
273-
| 1690 | `sig:EnvelopeSemanticDigest` | enum | Target is the semantic digest of a Gordian Envelope. |
274-
| 1691 | `sig:EnvelopeStructuralDigest` | enum | Target is the structural digest of a Gordian Envelope. |
275-
| 1692 | `sig:DetachedBytesDigest` | enum | Target is a digest of detached bytes. |
276-
| 1693 | `sig:Reference` | enum | Target is a `Reference` (`ur:reference`, CBOR tag `#6.40025`) per [BCR-2024-011](bcr-2024-011-reference.md). |
263+
| 1680 | `sig:EnvelopeSemanticDigest` | enum | Target is the semantic digest of a Gordian Envelope. |
264+
| 1681 | `sig:EnvelopeStructuralDigest` | enum | Target is the structural digest of a Gordian Envelope. |
265+
| 1682 | `sig:DetachedBytesDigest` | enum | Target is a digest of detached bytes. |
266+
| 1683 | `sig:Reference` | enum | Target is a `Reference` (`ur:reference`, CBOR tag `#6.40025`) per [BCR-2024-011](bcr-2024-011-reference.md). |
277267

278268
---
279269

@@ -363,8 +353,61 @@ Decorrelatable form (recommended when region/locality may be elided):
363353
]
364354
```
365355

356+
### `sig:obscured`
357+
358+
The `sig:obscured` assertion records which parts of the payload envelope were **not visible** to the signer at signing time — that is, which nodes in the envelope's Merkle-like digest tree were elided, encrypted, or compressed.
359+
360+
The object is a CBOR array of `Digest` values, lexicographically sorted to support determinism. Each digest identifies a node (subject, assertion, predicate, or object) in the payload envelope that was obscured when the signer produced the signature.
361+
362+
**Interpretation:**
363+
364+
- **`'sig:obscured': []`** (empty array) — the signer claims the entire envelope was fully visible at signing time. Nothing was obscured.
365+
- **`'sig:obscured': [ Digest(<root>) ]`** where the digest is the payload envelope's top-level digest — the signer claims the envelope was "signed blind," with no knowledge of its contents.
366+
- **`'sig:obscured': [ Digest(<a>), Digest(<b>), ... ]`** — the signer claims that the listed sub-envelopes were obscured and everything else was visible.
367+
368+
A verifier who holds the full (unobscured) payload envelope can check each digest against the envelope's digest tree to confirm that the listed nodes exist and to understand exactly which content the signer did not see.
369+
370+
**Example — signer saw everything:**
371+
372+
```envelope
373+
Signature [
374+
'sig:signingTime': 2026-02-04T19:52:00Z
375+
'sig:obscured': []
376+
]
377+
```
378+
379+
**Example — signer signed blind:**
380+
381+
```envelope
382+
Signature [
383+
'sig:signingTime': 2026-02-04T19:52:00Z
384+
'sig:obscured': [
385+
Digest(71274df1)
386+
]
387+
]
388+
```
389+
390+
**Example — two assertions were elided at signing time:**
391+
392+
```envelope
393+
Signature [
394+
'sig:signingTime': 2026-02-04T19:52:00Z
395+
'sig:obscured': [
396+
Digest(3a7c8f2d)
397+
Digest(b4e1a8c0)
398+
]
399+
]
400+
```
401+
402+
**Guidance:**
403+
404+
- Producers SHOULD include `sig:obscured` whenever the payload envelope contained any obscured nodes at signing time.
405+
- Producers MAY include `'sig:obscured': []` to explicitly attest that everything was visible, though omitting the assertion entirely is also valid.
406+
- The digest array MUST be lexicographically sorted to ensure deterministic encoding.
407+
- Verifiers SHOULD treat the absence of `sig:obscured` as "unknown" — the signer made no claim about what was visible.
408+
366409
### `sig:SignedObject`
367410

368411
SignedObject describes an object that is signed or intended to be covered by the signature, especially when it is a detached object or an attachment.
369412

370-
If `sig:objectRef` is a `Reference`, the referent type is resolved from context; producers SHOULD include enough context for resolution, such as `sig:tar
413+
If `sig:objectRef` is a `Reference`, the referent type is resolved from context; producers SHOULD include enough context for resolution, such as `sig:targetType`, `sig:mediaType`, or other domain-specific qualifiers.

0 commit comments

Comments
 (0)