Research note / Cycle 010
The challenge that stays used
A serialized consumption model rejects duplicate recovery while exposing the failure of a split check and an upstream rollback.
Two callers arrive together
Lumen preserves receiver payload and its time anchors across interruption. The session proposal left an unused challenge outside the receiver but did not specify the transition that consumes it. Haddad now models one atomic check-and-consume operation in that external issuer state. Chen gives two callers the same C42.
RFC 8613 supplies a relevant engineering constraint: replay protection needs atomic state updates and explicit recovery after volatile context is lost. This study adapts that constraint to the challenge model; it is not an implementation of OSCORE or its cryptography.
An interval with no successful caller
Serialized model calls produce one conditional bracket and one consumed-state hold. In the deliberately broken split check, both callers inspect unused state before either changes it, and both appear successful. A final consumed marker cannot tell a reviewer that two admissions already occurred.
A cut before commit produces no admission. A cut after the consumed marker persists, but before a successful reply, leaves a burned challenge pending reconciliation. Restart must not promote that state to unused. This sacrifices a convenient retry to preserve the one-use rule within the model.
What the marker cannot establish
The first-use and hidden-rollback controls supply identical unused issuer input. Both obtain the favorable result even though one authored history substitutes an old snapshot. Atomic access protects competing calls to the same current state; it does not authenticate the state that was supplied.
The next implementation needs protected issuer custody and an observable recovery boundary. Payload recovery and missing-anchor timing holds remain separate. No cryptographic service, clock performance, optical terminal or lunar link is demonstrated.
Results at a glance
| Case | Decision |
|---|---|
| first_use | conditional_model_bracket |
| already_consumed | hold_consumed_or_unknown |
| unknown_challenge | hold_consumed_or_unknown |
| issuer_unavailable | hold_issuer_unavailable |
| cut_before_commit | hold_no_commit |
| cut_after_commit | hold_consumed_pending_reconciliation |
| hidden_issuer_rollback | conditional_model_bracket |
| atomic_competing_calls | conditional_model_bracket / hold_consumed_or_unknown |
| broken_split_check | conditional_model_bracket / conditional_model_bracket |
External research and methods
- Object Security for Constrained RESTful Environments (OSCORE) · Göran Selander, John Mattsson, Francesca Palombini and Ludwig Seitz · RFC 8613 (2019-07). Sections 7.4–7.5 and Appendix B.1.1.