{"file":"docs/seed/Five_Device_Instantiation.txt","start":22,"end":78,"lines":[{"number":22,"text":"Step 2: CRE8 creates five enrollment slots"},{"number":23,"text":"Slot A: Authentication component"},{"number":24,"text":"Slot B: Delegation component"},{"number":25,"text":"Slot C: Authorship component"},{"number":26,"text":"Slot D: Confidentiality component"},{"number":27,"text":"Slot E: Public bundle verification"},{"number":28,"text":""},{"number":29,"text":"Each slot receives:"},{"number":30,"text":""},{"number":31,"text":"A random claim token."},{"number":32,"text":"An expiration."},{"number":33,"text":"A single-use state."},{"number":34,"text":"A separate short confirmation code."},{"number":35,"text":""},{"number":36,"text":"Store only a hash of each claim token."},{"number":37,"text":""},{"number":38,"text":"Step 3: Send claim links"},{"number":39,"text":""},{"number":40,"text":"A destination receives a one-time URL. The Owner dashboard separately displays the confirmation code."},{"number":41,"text":""},{"number":42,"text":"Therefore, compromising only the email destination is not enough to complete the claim."},{"number":43,"text":""},{"number":44,"text":"Step 4: Generate locally"},{"number":45,"text":""},{"number":46,"text":"The receiving device:"},{"number":47,"text":""},{"number":48,"text":"Opens the claim page."},{"number":49,"text":"Enters the confirmation code."},{"number":50,"text":"Generates the assigned keypair locally."},{"number":51,"text":"Sends the public key to CRE8."},{"number":52,"text":"Signs a server challenge for Ed25519 components."},{"number":53,"text":"Displays the private component once."},{"number":54,"text":"Offers:"},{"number":55,"text":"Copy."},{"number":56,"text":"QR representation."},{"number":57,"text":"Checksummed text."},{"number":58,"text":"Encrypted .cre8component file."},{"number":59,"text":""},{"number":60,"text":"The page should not retain the private key after navigation or refresh."},{"number":61,"text":""},{"number":62,"text":"Step 5: Public verification device"},{"number":63,"text":""},{"number":64,"text":"After four public components have been registered, the fifth device receives:"},{"number":65,"text":""},{"number":66,"text":"Credential ID."},{"number":67,"text":"All four public keys."},{"number":68,"text":"Short fingerprints."},{"number":69,"text":"Key type."},{"number":70,"text":"Parent Credential ID."},{"number":71,"text":"Policy hash."},{"number":72,"text":"Creation time."},{"number":73,"text":""},{"number":74,"text":"The Owner compares the fingerprints shown by the four component devices with the fifth public bundle."},{"number":75,"text":""},{"number":76,"text":"Step 6: Owner activates"},{"number":77,"text":""},{"number":78,"text":"Only after confirmation does the logical Key become active."}]}