DPoP-SK normative-statement companion
type: CompanionDocument
companion of: DPoP-SK: Negotiated Symmetric Session Keys for DPoP-Bound Requests
created: 2026-07-06
was attributed to: me
description: Extracted with AI assistance (Claude Fable 5, Anthropic) from the pinned spec source; awaiting review by the human editor, like the spec itself.
extraction note: Verification steps 1-4 and 7-8 of #attestation-verification are normative only by the lead-in ('Verification, in order, all fail-closed:') and carry no BCP 14 keyword; errata candidate: give the lead-in a MUST.
extraction note: The tls-exporter key-derivation formula (#kd-exporter, 'Both ends compute...') is definitional prose with no BCP 14 keyword; conformance to it hangs on the conformance section's 'implements' list. Errata candidate.
extraction note: 'The flavour REQUIRES TLS 1.3.' (#kd-exporter) uses the non-BCP14 form REQUIRES; the requirement is captured here via DPOPSK-EST-6's MUST. Errata candidate: rephrase with a BCP 14 keyword.
extraction note: 'Neither party may log or persist it' (#establishment-response) uses lowercase 'may' with mandatory intent (RFC 8174 reserves only UPPERCASE forms); the enforced form is DPOPSK-SEC-KH-1's MUST NOT. Errata candidate.
extraction note: 'It MUST use the https scheme and SHOULD be same-origin with resource.' (#discovery) mixes two requirement levels in one sentence; split here into DPOPSK-DISC-1 and DPOPSK-DISC-2.
extraction note: The conformance section (#impl-status) enumerates what each conformance class 'implements' without BCP 14 force; the per-statement inventory here is the checkable form.

DPoP-SK: Negotiated Symmetric Session Keys for DPoP-Bound Requests
type: Specification
conformance: conformance
consideration: security-considerations
consideration: privacy-considerations
requirement: DPOPSK-REL-1
requirement: DPOPSK-REL-2
requirement: DPOPSK-REL-3
requirement: DPOPSK-DISC-1
requirement: DPOPSK-DISC-2
requirement: DPOPSK-DISC-3
requirement: DPOPSK-DISC-4
requirement: DPOPSK-DISC-5
requirement: DPOPSK-DISC-6
requirement: DPOPSK-EST-1
requirement: DPOPSK-EST-2
requirement: DPOPSK-EST-3
requirement: DPOPSK-EST-4
requirement: DPOPSK-EST-5
requirement: DPOPSK-EST-6
requirement: DPOPSK-EST-7
requirement: DPOPSK-RESP-1
requirement: DPOPSK-RESP-2
requirement: DPOPSK-RESP-3
requirement: DPOPSK-RESP-4
requirement: DPOPSK-RESP-5
requirement: DPOPSK-RESP-6
requirement: DPOPSK-RESP-7
requirement: DPOPSK-RESP-8
requirement: DPOPSK-RESP-9
requirement: DPOPSK-KD-1
requirement: DPOPSK-STATE-1
requirement: DPOPSK-ATT-1
requirement: DPOPSK-ATT-2
requirement: DPOPSK-ATT-3
requirement: DPOPSK-ATT-4
requirement: DPOPSK-ATT-5
requirement: DPOPSK-ATT-6
requirement: DPOPSK-ATT-7
requirement: DPOPSK-VER-1
requirement: DPOPSK-VER-2
requirement: DPOPSK-VER-3
requirement: DPOPSK-VER-4
requirement: DPOPSK-VER-5
requirement: DPOPSK-VER-6
requirement: DPOPSK-VER-7
requirement: DPOPSK-VER-8
requirement: DPOPSK-AR-1
requirement: DPOPSK-AR-2
requirement: DPOPSK-AR-3
requirement: DPOPSK-AR-4
requirement: DPOPSK-AR-5
requirement: DPOPSK-AR-6
requirement: DPOPSK-AR-7
requirement: DPOPSK-AR-8
requirement: DPOPSK-AR-9
requirement: DPOPSK-LT-1
requirement: DPOPSK-LT-2
requirement: DPOPSK-LT-3
requirement: DPOPSK-LT-4
requirement: DPOPSK-LT-5
requirement: DPOPSK-LT-6
requirement: DPOPSK-LT-7
requirement: DPOPSK-LT-8
requirement: DPOPSK-LT-9
requirement: DPOPSK-DG-1
requirement: DPOPSK-DG-2
requirement: DPOPSK-DG-3
requirement: DPOPSK-DG-4
requirement: DPOPSK-DG-5
requirement: DPOPSK-DG-6
requirement: DPOPSK-SEC-ED-1
requirement: DPOPSK-SEC-ED-2
requirement: DPOPSK-SEC-MITM-1
requirement: DPOPSK-SEC-KH-1
requirement: DPOPSK-SEC-KH-2
requirement: DPOPSK-SEC-KH-3
requirement: DPOPSK-SEC-KH-4

DPoP-SK resource server
type: ConformanceClass
defined by: terminology

DPoP-SK client
type: ConformanceClass
defined by: terminology

gap-no-vectors-yet
type: TestGap
description: No conformance vectors exist yet for this profile: the spec is design-first, implementation-pending (see the spec's Conformance and implementation status section — 'There are no implementations of this profile as of this draft.'). Vectors are planned alongside the solid-server-rs Tier-2 reference implementation, homed as a dpop-sk suite in jeswr/agentic-solid-conformance; the spec's execution-verified tools/compute-examples.mjs (key derivation, confirm value, signature base, HMAC tag) is the seed fixture set.

gap-counter-exhaustion
type: TestGap
description: Not testable as specified: exhausting the 64-bit counter space (2^64 - 1 values) is unreachable in any practical test run, and the spec itself calls the bound theoretical. The statement is retained for completeness; a unit-level test could only exercise an artificially lowered bound, which the spec does not define.

DPOPSK-REL-1
type: Requirement
statement: A resource server implementing DPoP-SK MUST continue to accept ordinary per-request DPoP exactly as before.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: relationship
test gap: gap-no-vectors-yet

DPOPSK-REL-2
type: Requirement
statement: A client MUST NOT use DPoP-SK against a server that has not advertised it
requirement level: MUSTNOT
requirement subject: DPoP-SK client
testability: Enforceable
anchor: relationship
test gap: gap-no-vectors-yet

DPOPSK-REL-3
type: Requirement
statement: An access token MUST NOT ever be accepted bare (bearer-style).
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: relationship
test gap: gap-no-vectors-yet

DPOPSK-DISC-1
type: Requirement
statement: It MUST use the https scheme
comment: 'It' = the pop_session endpoint member (the session establishment endpoint URL).
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: discovery
test gap: gap-no-vectors-yet

DPOPSK-DISC-2
type: Requirement
statement: SHOULD be same-origin with resource.
comment: Subject of the fragment: the pop_session endpoint member. Split from the same sentence as DPOPSK-DISC-1 (two levels in one sentence; see the companion's extraction notes).
requirement level: SHOULD
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: discovery

DPOPSK-DISC-3
type: Requirement
statement: A server MUST NOT advertise tls-exporter on any deployment where it does not terminate TLS in the same process that evaluates requests
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
testability: AccountableExistence
comment: Deployment-topology property: where TLS terminates is not observable black-box; checkable only by deployment audit.
anchor: discovery

DPOPSK-DISC-4
type: Requirement
statement: Clients MUST ignore a pop_session member whose profile they do not recognise.
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: discovery
test gap: gap-no-vectors-yet

DPOPSK-DISC-5
type: Requirement
statement: A server MAY additionally direct clients to the metadata document from any 401 challenge using the resource_metadata parameter of WWW-Authenticate
requirement level: MAY
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: discovery

DPOPSK-DISC-6
type: Requirement
statement: A client MUST NOT attempt establishment unless the metadata offers an algorithm and a channel binding flavour it supports.
requirement level: MUSTNOT
requirement subject: DPoP-SK client
testability: Enforceable
anchor: discovery
test gap: gap-no-vectors-yet

DPOPSK-EST-1
type: Requirement
statement: The request MUST be authenticated as an ordinary DPoP request: the server MUST perform the complete RFC9449 Section 4.3 validation of the proof
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: establishment-request
test gap: gap-no-vectors-yet

DPOPSK-EST-2
type: Requirement
statement: A session MUST NOT be created if any check fails.
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: establishment-request
test gap: gap-no-vectors-yet

DPOPSK-EST-3
type: Requirement
statement: If the server cannot satisfy it exactly it MUST refuse with 400
comment: 'It' = the requested channel binding flavour (the establishment body's cb member, which is a demand, not a menu).
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: establishment-request
test gap: gap-no-vectors-yet

DPOPSK-EST-4
type: Requirement
statement: MUST NOT substitute another flavour
comment: Continuation of the DPOPSK-EST-3 sentence: on an unsatisfiable cb demand the server refuses; it never answers with a different flavour.
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: establishment-request
test gap: gap-no-vectors-yet

DPOPSK-EST-5
type: Requirement
statement: the server MUST additionally verify that the request arrived on a TLS 1.3 connection terminated by the server process itself
comment: Condition: cb=tls-exporter establishment only. Self-termination is deployment topology (audit-only); the TLS-version half is black-box testable via DPOPSK-EST-6.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: AccountableExistence
anchor: establishment-request

DPOPSK-EST-6
type: Requirement
statement: MUST reject establishment over TLS < 1.3
comment: Condition: cb=tls-exporter establishment only. Captures the #kd-exporter 'The flavour REQUIRES TLS 1.3.' requirement in BCP 14 form (see extraction notes).
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: establishment-request
test gap: gap-no-vectors-yet

DPOPSK-EST-7
type: Requirement
statement: The server SHOULD rate-limit this endpoint at least as strictly as any authenticated write
requirement level: SHOULD
requirement subject: DPoP-SK resource server
testability: AccountableExistence
comment: Rate limiting is observable under load but the threshold is deployment policy; audit-checked.
anchor: establishment-request

DPOPSK-RESP-1
type: Requirement
statement: MUST contain at least 128 bits of CSPRNG output, encoded base64url without padding
comment: Subject of the fragment: the session_id response member. Length and encoding are black-box observable, but the CSPRNG-source claim is only auditable — hence A-exist.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: AccountableExistence
anchor: establishment-response

DPOPSK-RESP-2
type: Requirement
statement: servers MUST NOT reuse one
comment: 'One' = a session_id value.
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: establishment-response
test gap: gap-no-vectors-yet

DPOPSK-RESP-3
type: Requirement
statement: It MUST equal the requested flavour
comment: 'It' = the response cb member.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: establishment-response
test gap: gap-no-vectors-yet

DPOPSK-RESP-4
type: Requirement
statement: a client MUST abort (discard the session, use plain DPoP) if it differs
comment: 'It' = the response cb member vs the requested flavour.
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: establishment-response
test gap: gap-no-vectors-yet

DPOPSK-RESP-5
type: Requirement
statement: key (REQUIRED when cb=none; MUST be absent otherwise)
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: establishment-response
test gap: gap-no-vectors-yet

DPOPSK-RESP-6
type: Requirement
statement: confirm (REQUIRED when cb=tls-exporter; MUST be absent otherwise)
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: establishment-response
test gap: gap-no-vectors-yet

DPOPSK-RESP-7
type: Requirement
statement: A client MUST verify it and MUST discard the session on mismatch.
comment: 'It' = the confirm key-confirmation value; the derivation and expected value are execution-verified by the spec's tools/compute-examples.mjs.
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: establishment-response
test gap: gap-no-vectors-yet

DPOPSK-RESP-8
type: Requirement
statement: The response MUST carry Cache-Control: no-store.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: establishment-response
test gap: gap-no-vectors-yet

DPOPSK-RESP-9
type: Requirement
statement: Browser clients SHOULD import it as a non-extractable WebCrypto HMAC key and discard the raw bytes immediately.
requirement level: SHOULD
requirement subject: DPoP-SK client
testability: AccountableExistence
anchor: establishment-response

DPOPSK-KD-1
type: Requirement
statement: Implementations MUST use the exporter_master_secret
comment: Condition: cb=tls-exporter derivation. The derivation pipeline (HKDF salt/info construction) is deterministic and vectorable from a fixed EKM — the spec's tools/compute-examples.mjs reproduces it; using the wrong exporter secret manifests as a key-confirmation mismatch.
requirement level: MUST
requirement subject: DPoP-SK resource server
requirement subject: DPoP-SK client
testability: Enforceable
anchor: kd-exporter
test gap: gap-no-vectors-yet

DPOPSK-STATE-1
type: Requirement
statement: The store MUST be capacity-bounded
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: AccountableExistence
comment: Capacity bounds and eviction policy are implementation state, auditable but not deterministically black-box testable.
anchor: server-state

DPOPSK-ATT-1
type: Requirement
statement: Inside an established session the client MUST NOT send a DPoP proof header field with attested requests
requirement level: MUSTNOT
requirement subject: DPoP-SK client
testability: Enforceable
anchor: attestation-request
test gap: gap-no-vectors-yet

DPOPSK-ATT-2
type: Requirement
statement: The covered components MUST include, at minimum and in this order: ("@method" "@target-uri" "authorization")
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: attestation-request
test gap: gap-no-vectors-yet

DPOPSK-ATT-3
type: Requirement
statement: Clients MAY cover additional components
requirement level: MAY
requirement subject: DPoP-SK client
testability: Enforceable
anchor: attestation-request

DPOPSK-ATT-4
type: Requirement
statement: servers MUST verify whatever set was declared.
comment: 'Set' = the declared covered-component set of the attestation signature.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: attestation-request
test gap: gap-no-vectors-yet

DPOPSK-ATT-5
type: Requirement
statement: created (REQUIRED, Integer), keyid (REQUIRED, the session identifier)
comment: The REQUIRED signature parameters; the source sentence continues with nonce (REQUIRED, the counter) — the counter discipline itself is DPOPSK-AR-1..5.
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: attestation-request
test gap: gap-no-vectors-yet

DPOPSK-ATT-6
type: Requirement
statement: tag (REQUIRED, the exact value dpop-sk)
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: attestation-request
test gap: gap-no-vectors-yet

DPOPSK-ATT-7
type: Requirement
statement: if present it MUST equal the session's algorithm
comment: Condition: the OPTIONAL alg signature parameter is present. Server-side enforcement is DPOPSK-DG-5.
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: attestation-request
test gap: gap-no-vectors-yet

DPOPSK-VER-1
type: Requirement
statement: the server MUST process it under this profile exclusively
comment: Condition: the request bears a signature whose tag is dpop-sk.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: attestation-verification
test gap: gap-no-vectors-yet

DPOPSK-VER-2
type: Requirement
statement: it MUST NOT fall back to evaluating a DPoP header also present on the same request
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: attestation-verification
test gap: gap-no-vectors-yet

DPOPSK-VER-3
type: Requirement
statement: MUST NOT treat the access token as bearer under any outcome
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: attestation-verification
test gap: gap-no-vectors-yet
restates: DPOPSK-REL-3

DPOPSK-VER-4
type: Requirement
statement: servers SHOULD apply the same window they apply to DPoP iat
comment: The freshness acceptance window for the created signature parameter.
requirement level: SHOULD
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: attestation-verification

DPOPSK-VER-5
type: Requirement
statement: This step MUST complete successfully before any session-state mutation.
comment: 'This step' = signature verification (step 6). Black-box testable via the forged-traffic window-burn probe (adversarial-review entry A7).
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: attestation-verification
test gap: gap-no-vectors-yet

DPOPSK-VER-6
type: Requirement
statement: Any failure of steps 1–7 MUST yield 401 with the server's standard WWW-Authenticate: DPoP challenge
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: challenge
test gap: gap-no-vectors-yet

DPOPSK-VER-7
type: Requirement
statement: A DPoP-SK client receiving a 401 on an attested request MUST treat the session as dead and either re-establish or fall back to per-request DPoP
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: challenge
test gap: gap-no-vectors-yet

DPOPSK-VER-8
type: Requirement
statement: servers MUST NOT emit, and clients MUST NOT require, any DPoP-SK-specific error code
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
requirement subject: DPoP-SK client
testability: Enforceable
anchor: challenge
test gap: gap-no-vectors-yet

DPOPSK-AR-1
type: Requirement
statement: the client MUST start at 1 and assign strictly increasing values — never reusing one
comment: The nonce parameter's per-session counter discipline.
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: anti-replay
test gap: gap-no-vectors-yet

DPOPSK-AR-2
type: Requirement
statement: SHOULD increment by exactly 1
comment: Continuation of DPOPSK-AR-1's sentence (gaps are tolerated but waste window space).
requirement level: SHOULD
requirement subject: DPoP-SK client
testability: Enforceable
anchor: anti-replay

DPOPSK-AR-3
type: Requirement
statement: Values MUST fit in an unsigned 64-bit integer
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: anti-replay
test gap: gap-no-vectors-yet

DPOPSK-AR-4
type: Requirement
statement: a client that could exhaust the space MUST re-establish first
requirement level: MUST
requirement subject: DPoP-SK client
testability: Premature
anchor: anti-replay
test gap: gap-counter-exhaustion

DPOPSK-AR-5
type: Requirement
statement: Servers MUST reject non-numeric, zero, or >64-bit values at parse time.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: anti-replay
test gap: gap-no-vectors-yet

DPOPSK-AR-6
type: Requirement
statement: W MUST be at least 128
comment: W = the receive-window width.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: anti-replay
test gap: gap-no-vectors-yet

DPOPSK-AR-7
type: Requirement
statement: SHOULD be 1024.
comment: Continuation of DPOPSK-AR-6's sentence: the recommended window width.
requirement level: SHOULD
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: anti-replay

DPOPSK-AR-8
type: Requirement
statement: the window MUST NOT be consulted-and-mutated, advanced, or shifted for any request whose HMAC has not verified
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: anti-replay
test gap: gap-no-vectors-yet

DPOPSK-AR-9
type: Requirement
statement: The signature-verify + window check-and-mark pair for one session MUST be atomic with respect to concurrent requests
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: AccountableExistence
comment: Concurrency atomicity is exercisable only by nondeterministic race probing; deterministic vectors cannot pin it. A formal model (sc:formalModel seam) is the stronger future check.
anchor: anti-replay

DPOPSK-LT-1
type: Requirement
statement: expires_in MUST NOT exceed the remaining lifetime of the bound access token
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: lifetime
test gap: gap-no-vectors-yet

DPOPSK-LT-2
type: Requirement
statement: SHOULD NOT exceed 300 seconds
comment: Continuation of DPOPSK-LT-1's sentence: the recommended ceiling on expires_in.
requirement level: SHOULDNOT
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: lifetime

DPOPSK-LT-3
type: Requirement
statement: Servers MUST enforce both the session expiry and the token expiry on every request.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: lifetime
test gap: gap-no-vectors-yet

DPOPSK-LT-4
type: Requirement
statement: Clients MAY re-establish before expiry and overlap the old and new sessions.
requirement level: MAY
requirement subject: DPoP-SK client
testability: Enforceable
anchor: lifetime

DPOPSK-LT-5
type: Requirement
statement: The server MAY invalidate any session at any time
requirement level: MAY
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: lifetime

DPOPSK-LT-6
type: Requirement
statement: Clients MUST tolerate this at any moment (it is indistinguishable from expiry).
comment: 'This' = a server-forced session invalidation.
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: lifetime
test gap: gap-no-vectors-yet

DPOPSK-LT-7
type: Requirement
statement: A client SHOULD terminate a session it will not use again
requirement level: SHOULD
requirement subject: DPoP-SK client
testability: Enforceable
anchor: lifetime

DPOPSK-LT-8
type: Requirement
statement: The server MUST verify the attestation like any other request before deleting, and respond 204
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: lifetime
test gap: gap-no-vectors-yet

DPOPSK-LT-9
type: Requirement
statement: Implementations MUST NOT persist K to durable storage.
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
requirement subject: DPoP-SK client
testability: AccountableExistence
comment: Negative internal property; audit/code-review only.
anchor: lifetime

DPOPSK-DG-1
type: Requirement
statement: a request carrying a valid DPoP proof and no dpop-sk-tagged signature MUST be processed as plain DPoP, always, on every server
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: downgrade
test gap: gap-no-vectors-yet

DPOPSK-DG-2
type: Requirement
statement: the server MUST NOT create a session under a different flavour than requested (400 instead)
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: downgrade
test gap: gap-no-vectors-yet
restates: DPOPSK-EST-3
restates: DPOPSK-EST-4

DPOPSK-DG-3
type: Requirement
statement: the client MUST discard a session whose response cb differs from its request
requirement level: MUST
requirement subject: DPoP-SK client
testability: Enforceable
anchor: downgrade
test gap: gap-no-vectors-yet
restates: DPOPSK-RESP-4

DPOPSK-DG-4
type: Requirement
statement: The server MUST verify with the session's algorithm only, regardless of any alg parameter on the request
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: downgrade
test gap: gap-no-vectors-yet

DPOPSK-DG-5
type: Requirement
statement: MUST reject a mismatching alg parameter
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
anchor: downgrade
test gap: gap-no-vectors-yet

DPOPSK-DG-6
type: Requirement
statement: Servers MUST NOT advertise, and clients MUST NOT use, tls-exporter across any TLS-terminating intermediary
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
requirement subject: DPoP-SK client
testability: AccountableExistence
anchor: downgrade
restates: DPOPSK-DISC-3

DPOPSK-SEC-ED-1
type: Requirement
statement: establishment requests and attested requests MUST be rejected (with the standard challenge) if received as early data
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: Enforceable
comment: Deterministically testable with a TLS 1.3 test client offering 0-RTT early data.
anchor: sec-early-data
test gap: gap-no-vectors-yet

DPOPSK-SEC-ED-2
type: Requirement
statement: the early exporter MUST NOT be used in key derivation
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
requirement subject: DPoP-SK client
testability: AccountableExistence
comment: Internal KDF-input choice; a wrong choice surfaces indirectly as key-confirmation mismatch but the prohibition itself is audit-checked.
anchor: sec-early-data

DPOPSK-SEC-MITM-1
type: Requirement
statement: Deployments where the target URI must be reconstructed (e.g. behind a trusted reverse proxy, cb=none only) MUST derive it from configuration or authenticated forwarding information, never from unauthenticated client-controlled headers.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: AccountableExistence
comment: Deployment configuration property; spot-checkable by probing with spoofed forwarding headers but conformance is a topology/config audit.
anchor: sec-mitm

DPOPSK-SEC-KH-1
type: Requirement
statement: they MUST NOT be logged, MUST NOT appear in URLs, MUST NOT be persisted durably
comment: 'They' = K and the key response member (credentials).
requirement level: MUSTNOT
requirement subject: DPoP-SK resource server
requirement subject: DPoP-SK client
testability: AccountableExistence
anchor: sec-key-handling

DPOPSK-SEC-KH-2
type: Requirement
statement: SHOULD be held non-extractable where the platform allows (WebCrypto)
requirement level: SHOULD
requirement subject: DPoP-SK resource server
requirement subject: DPoP-SK client
testability: AccountableExistence
anchor: sec-key-handling

DPOPSK-SEC-KH-3
type: Requirement
statement: HMAC comparison MUST be constant-time.
requirement level: MUST
requirement subject: DPoP-SK resource server
testability: AccountableExistence
comment: Timing discipline; checkable by code audit or statistical timing analysis, not a deterministic vector.
anchor: sec-key-handling

DPOPSK-SEC-KH-4
type: Requirement
statement: session_id MAY appear in logs (it is an identifier, not a secret)
requirement level: MAY
requirement subject: DPoP-SK resource server
testability: AccountableExistence
anchor: sec-key-handling