Self-Certifying Node Identity (knc-<hex>)
Deterministic cryptographic node address derived directly from the 32-byte Ed25519 public key, eliminating arbitrary node-ID assignment and preventing node-ID spoofing without possession of the corresponding private key.
knc-<64_hex_chars> using derive_node_id(public_key). When a node initiates a handshake or submits a heartbeat, the receiving node computes the hex representation from the verified public key. If the claimed node_id does not match this mathematically derived value, the connection is instantly rejected with error code -32001 (ERR_UNAUTHORIZED).
// Canonical node identity derivation (src/security.rs)
pub fn derive_node_id(pubkey: &[u8; 32]) -> String {
format!("knc-{}", hex::encode(pubkey))
}
// Verification gate:
if claim_node_id != derive_node_id(&peer_pubkey) {
return Err(RpcError::unauthorized("Claimed node_id does not match Ed25519 pubkey"));
}