Skip to content

Allow at most one pairing-code method per client - #189

Merged
maximmaxim345 merged 5 commits into
Sendspin:mainfrom
balloobbot:one-pairing-code-method
Sep 2, 2026
Merged

Allow at most one pairing-code method per client#189
maximmaxim345 merged 5 commits into
Sendspin:mainfrom
balloobbot:one-pairing-code-method

Conversation

@balloobbot

@balloobbot balloobbot commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Fixes #184. Fixes #186.

Two changes to pairing.md's Methods section:

  • Clients may implement at most one pairing-code method: static or dynamic, not both (Pairing PSK stays mandatory). No wire change - supported_pair_methods already carries whatever the client offers; this constrains what may appear there.
  • The steering paragraph (SHOULD implement dynamic_pairing_code given an out-channel, SHOULD offer qr_code given a display) is changed to a regular non binding "should". Method choice is the client's decision; the method list already describes the trade-offs (out-channel requirement, static-code MITM caveat).

Note: overlaps textually with #183, which edits the same paragraph - whichever lands second needs a trivial rebase.

Comment thread pairing.md Outdated
Comment thread pairing.md Outdated
Comment thread pairing.md Outdated
@balloobbot
balloobbot force-pushed the one-pairing-code-method branch from bb595ca to 4e38135 Compare August 28, 2026 20:57
Comment thread pairing.md Outdated
balloob and others added 4 commits September 2, 2026 15:13
Which pairing method a client implements is its own decision, so the steering paragraph goes; the method descriptions already carry the trade-offs. A client offers static or dynamic, not both.

Co-Authored-By: Claude Fable 5 <[email protected]>
Name the methods in the Methods intro so the rule is searchable. State
the constraint on supported_pair_methods in both directions: the client
MUST NOT list both code methods, and a server that receives both
disregards static_pairing_code, so a non-conformant advertisement
degrades to the safer method instead of undefined behavior.

Co-Authored-By: Claude Fable 5 <[email protected]>
Co-authored-by: Maxim Raznatovski <[email protected]>
Co-Authored-By: Claude Fable 5 <[email protected]>
@balloobbot
balloobbot force-pushed the one-pairing-code-method branch from e9c6afa to 1edf355 Compare September 2, 2026 13:13
The advice stays in the spec until an implementation guide exists to hold
it. Lowercase keywords keep it out of conformance, and the clause telling
clients to also ship `static_pairing_code` disabled is gone because a
client may now offer only one pairing-code method.
@maximmaxim345
maximmaxim345 merged commit 8c9577e into Sendspin:main Sep 2, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Decide: allow at most one pairing-code method per client Decide: keep or trim the pairing-method steering

5 participants