Encounter
What an encounter records
Section titled “What an encounter records”Two people stand together. One shows a code, the other scans it, and each presses a button that says “I verify this person”. Each press produces a Begegnungs-Credential Unveränderliches Credential, in dem eine Partei festhält, dass sie eine andere erkannt hat. Ausgestellt von einer Partei über die andere, offline prüfbar. GlossarEncounter credential The immutable credential in which one party records that they recognized another. Issued by one party about the other, verifiable offline. Glossary that the other person keeps. That is an encounter in RLTP.
The credential proves four things and nothing more:
| It proves | Because |
|---|---|
| The issuer held their key at that moment | the credential is signed with it |
| The two codes were exchanged within one act | the credential binds the other side’s fresh Challenge Frischer, einmal verwendbarer Wert hoher Entropie, der in einer Kontaktkarte für einen Begegnungsvorgang reist. Ein Begriff; angezeigte und gesendete Karten unterscheiden sich nur im Lebenszyklus. GlossarChallenge A fresh, single-use, high-entropy value carried in a contact card for one enactment. One concept; displayed and sent cards differ only in lifecycle. Glossary |
| A human decided | nothing is issued without the press |
| The fact survives the moment | the credential is immutable and stays with its holder |
It does not prove that the two were in the same room, that their names are real, or that either trusts the other. Trust is a separate act, described on its own page: Trust.
Spec: Encounter Layer §3
The card
Section titled “The card”What travels over the code is a Kontaktkarte Signierte Selbstbeschreibung einer Person mit dem Material, um sie zu erkennen und zu erreichen, und im Begegnungsvorgang mit einer frischen Challenge; angezeigt (zum Scannen) oder gesendet (im Vorgang übertragen, nennt den Empfänger). Kein Credential. GlossarContact card A person's signed self-description carrying the material needed to recognize and reach them and, in an enactment, a fresh challenge; displayed (shown for scanning) or sent (transmitted inside an enactment, naming its recipient). Not a credential. Glossary: the Anker Kennung einer Person gegenüber einem Kontext (did:key). Jede Durchführung einer Zeremonie läuft unter einem frisch abgeleiteten Paaranker, auch eine Wiederbegegnung; ein stehender Anker erscheint nie auf dem Zeremoniedraht, und Anker laufen nie zu einer Person zusammen. GlossarAnchor A person's identifier toward one context (did:key). Every enactment of a ceremony runs under a freshly derived pair anchor, a re-encounter too; a standing anchor never appears on the ceremony wire, and anchors never converge into a person. Glossary the person uses for this encounter, an encryption key so that the other side can seal messages to them, a one-time challenge, and optionally a name and delivery hints. The card is signed with the anchor. It is a self-description, not a credential: it says how to identify and reach someone, not that anyone vouches for them.
The name on a card is self-declared. The receiver binds their own local name to the anchor, the way a phone book entry is the owner’s word, not the contact’s.
There are two kinds. The displayed card is the one shown as a code; it is addressed to nobody, anyone may scan it. The sent card is the one the scanner creates in answer. It carries two fields more: whom it is for, and which displayed challenge it answers. Both fields exist so that a card cannot be redirected to a third person or replayed into another encounter.
Spec: Encounter Layer §6
The challenge
Section titled “The challenge”A challenge is a fresh random value on the card. It turns “I know your anchor” into “I saw your code in this exchange”: the credential one side issues binds the challenge the other side showed, and nobody who did not see that value can issue a credential for this encounter.
Three rules keep it that way. Each person generates the challenge that protects them. A challenge is used once. And it expires within minutes.
Spec: Encounter Layer §5.3
One scan
Section titled “One scan”The Zeremonie Registrierte, versionierte Definition einer Begegnungsinteraktion einschließlich ihrer Zeitparameter. GlossarCeremony A registered, versioned definition of an encounter interaction, including its time parameters. Glossary of this version needs one scan.
- B shows a card with challenge cB.
- A scans it, creates a sent card with a fresh challenge cA, addressed to B and answering cB.
- A confirms the person and issues a credential that binds cB. Card and credential go to B.
- B checks that cB is still open, records the encounter, and may confirm in turn, issuing a credential that binds cA. The credential is dated to the exchange; when it arrives does not matter.
Step 3 reaches B in one of two ways, and the device may switch between them at any moment. With a network, card and credential travel as a sealed Bündel Die Ein-Scan-Übertragung (gesendete Karte plus Schritt-Credential), spezifiziert als Delivery-Contract-Task encounter-bundle. GlossarBundle The one-scan transmission (sent card plus step credential), specified as the Delivery Contract task encounter-bundle. Glossary through the delivery service. Without one, A shows the sent card as a code and B scans it; the credential follows whenever a network next carries it. Neither way needs a third party, and nothing about the encounter is decided by when a message arrives.
A credential issued before the press, or without the other side’s challenge, does not exist. The Vorgangsaufzeichnung Die dauerhafte lokale Aufzeichnung einer Partei über einen Begegnungsvorgang, vor der Ausstellung angelegt; die Aufzeichnungen sind zugleich die Geschichte verbrauchter Challenges. GlossarEnactment record A party's durable local record of an enactment, created before issuing; the records are also the consumed-challenge history. Glossary on each device precedes the credential, so a crash between the two leaves nothing half-written.
Spec: Encounter Layer §5
One-sided is a result
Section titled “One-sided is a result”The credentials of one encounter form an Kante Die Relation zwischen zwei Ankern, gebildet aus den Begegnungs-Credentials zwischen ihnen; eingehend, ausgehend oder beidseitig. Eine Kante je Ankerpaar. GlossarEdge The relation between two anchors constituted by the encounter credentials between them; incoming, outgoing, or mutual. One edge per anchor pair. Glossary between the two anchors. If only A confirmed, the edge is one-sided: A says they verified B, B has said nothing. That is a legitimate outcome, not a failure, and the app shows it as such. The edge becomes mutual when each side holds the other’s credential. Mutuality is held, never inferred: a card addressed to you suggests verification, only the credential proves it.
Spec: Encounter Layer §4
Fresh anchors, and what outsiders see
Section titled “Fresh anchors, and what outsiders see”Every encounter is performed under a fresh Paaranker Ein für einen Begegnungsvorgang abgeleiteter Anker (DTG-Scope pairwise). Der Anker, unter dem eine Zeremonie durchgeführt wird, ist bei jedem Vorgang ein frischer Paaranker. GlossarPair anchor An anchor derived for one enactment (DTG scope pairwise). The enacting anchor of a ceremony is a fresh pair anchor at every enactment. Glossary, an identifier created for this one act. The credential names that anchor, not the person. Anyone can verify that a credential is properly signed, and anyone holding both credentials of an encounter can verify that they fit together. What that shows is that two anchors mutually assert an encounter, consistently. It does not show that a meeting took place, and it does not show who the two are unless one of the holders discloses the link.
Meeting the same person again creates a new pair anchor. After the ceremony, a Kontinuitäts-Probe Die geblendete Liste (continuity-probe@1), die eine Seite, möglichst beide, nach einem Begegnungsvorgang sendet: die eigenen Paaranker der zuvor aktiven Beziehungen, aufgefüllt auf ein Vielfaches von 256 und an das frische Paar geschlüsselt. Ein Treffer erkennt eine gemeinsame frühere Beziehung, an die das frische Paar gekettet wird; kein Treffer bedeutet einen neuen Kontakt. Der Regelweg der Kontinuität, bei jedem Vorgang, unabhängig von jeder Offenlegung. GlossarContinuity probe The blinded list (continuity-probe@1) that either party, preferably both, sends after an enactment: its own pair anchors of the relationships active before, padded to a multiple of 256 and keyed to the fresh pair. A match identifies a shared prior relationship, to which the fresh pair is chained; no match means a new contact. The default path of continuity, run on every enactment, independent of any disclosure. Glossary over the fresh channel lets the two devices find out that they already share a relationship; only a counterpart that holds the earlier one can answer it. On a match the new pair is chained to that relationship, and the chain is visible to its two holders alone.
Spec: Encounter Layer §8 · Network Visibility
What the credential is
Section titled “What the credential is”A DTG Relationship Credential: a verifiable credential in the form of the ToIP Decentralized Trust Graph work, issued to the person it is about, who holds it and shows it to whom they choose. The issuer keeps a copy, may show it too, and cannot alter, revoke, or condition it afterwards; whether the recipient agrees is said only by a credential they issue themselves. Its size is bounded by the issuer: at most 2048 bytes in canonical form, so no transport ever has to refuse one.
Spec: Encounter Layer §7
Try it
Section titled “Try it”The ceremony simulator runs one encounter between two devices in your browser, with both paths and the one-sided case. The other simulators are listed under Try it.