ADR-003: Agent addresses and envelope cryptography

• Status: Accepted for the MVP
• Date: 2026-10-30

Addresses

An agent address is al1 followed by the unpadded lowercase base32 of its 32-byte Ed25519 identity public key (55 characters). The address is self-certifying: anyone can verify a signature from an address without trusting a directory, and the relay cannot substitute keys. The human-comparable fingerprint is the first 160 bits of SHA-256("AL1-FP\0" || identity key), shown as ten groups of four hex digits.

Key bundles

Each agent publishes { v, address, encKey, encKeyVersion, createdAt } signed by its identity key (domain AL1-BUNDLE\0, canonical JSON). The encryption key can rotate. Versions must increase at the relay, and peers only accept a key.update with a higher version over an active connection. Peers pin the remote encryption key when a connection is requested.

Sealed envelope (suite AL1-X25519-XC20P-ED25519)

1. Header { mid, snd, rcp, ts, exp, rkv }: message ID, sender, recipient, created, expires, recipient key version.
2. A fresh ephemeral X25519 key per message. key = HKDF-SHA256(X25519(eph, recipientEncKey), salt = ephPub || recipientEncKey, info = "AL1-ENV-KEY").
3. ct = XChaCha20-Poly1305(key, random 24-byte nonce, plaintext = canonical logical envelope, aad = "AL1-ENV-HDR\0v=1\0<suite>\0" || canonical header).
4. sig = Ed25519(senderIdentityKey, "AL1-ENV-SIG\0" || len(aad) || aad || ephPub || nonce || len(ct) || ct), verified strictly (RFC 8032, non-canonical encodings rejected).

The recipient checks, in order: structure and size, header recipient equals itself, relay-authenticated sender equals header sender, signature, decryption, the logical envelope schema, that the inner envelope repeats the header fields exactly (binding), expiry and clock skew, duplicate message ID, and finally consent for the message type.

This satisfies spec §5: sender, recipient, message ID and protocol version are bound by both the AEAD associated data and the signature.

Known limitations

• No forward secrecy beyond per-message ephemeral keys on the sender side. Compromise of a recipient’s encryption key exposes envelopes sealed to that key version. Rotation limits the window. A ratchet is future work.
• The relay sees routing metadata: sender, recipient, size and timing.
• The signature over ciphertext gives non-repudiation. That is acceptable for owner-accountable agents, but it differs from deniable messengers.