2/ZK-PROOF-OF-PERSONHOOD: codify audit v2 invariants

[cc03668]

Summary

Reflects the security-correctness fixes from zkmopro#75 into normative spec text so future implementations inherit the constraints. Editorial only — no protocol changes. Each new MUST/SHOULD maps to a finding in audit_report_v2.md verified closed in audit_report_v3.md.

Changes

• §4 Nullifier: introduce canonical_message(app_id) with normative MUSTs on fixed length and per-byte binding; specify the 64-byte SHA-256-padded encoding used by the X.509-RSA-PKCS#1v1.5-SHA-256 profile. Closes audit v2 HIGH.
• CertChain Operations / serial-number extraction: require structural DER-walk binding for sn; SHOULD pin v3 version block as constants. Closes audit v2 CRITICAL.
• CertChain Circuit / user_pk_limbs extraction: require the modulus tag offset and content offset be bound together via the canonical DER long-form prefix. Closes audit v2 LOW Update README.md #1.
• Cryptographic Primitives / Poseidon: document the 128-bit security target. Closes audit v2 INFO.
• Security Considerations: three new subsections generalize the lessons (DER-Offset Structural Binding, Nullifier Payload Canonicalization, Format-Uniqueness Assumptions) so they survive into future profile annexes.
• References: cite audit reports v2 and v3.

Refs

• Audit (v2): docs(circom): circuit audit v2 + AUDIT_LOG zkmopro/zkID#73
• Regression tests: test(circom): add audit v2 regression tests for CRITICAL/HIGH/LOW findings zkmopro/zkID#74
• Implementation fix: fix(circom): apply audit v2 findings and refresh downstream assets zkmopro/zkID#75
• Post-fix re-audit confirms all v2 findings closed: wallet-unit-poc/circom/audit_report_v3.md in zkmopro/zkID

Review focus

• Each normative MUST/SHOULD maps to a constraint in PR Fix CICD failure #75's circuits or the v3 audit's verification table — please confirm none overshoots or undershoots what the implementation enforces.
• New cross-reference anchors (#canonical-signed-message-requirement, #nullifier-payload-canonicalization, #der-offset-structural-binding, #format-uniqueness-assumptions) resolve correctly in the rendered markdown.

Out of scope (separate PRs)

• DeviceSig → UserSig rename. PR Fix CICD failure #75 commit 72b6cc1 renamed the impl; spec still uses "DeviceSig" in 4 places. Naming drift, not security.
• Audit v3 "areas for further investigation" (limb canonicality, smtIsOld0 boolean enforcement, outer SEQUENCE-length consistency). Not findings; not yet ready for normative text.

🤖 Generated with Claude Code

[cc03668]

@moven0831 @vivianjeng I'd love to have your review for this. Thank you!!!

[moven0831]

Hey @cc03668 , should we also document the findings for audit tool here?

update: the findings will be documented here https://github.com/0xvikasrushi/noir-claude-auditor

• Observations & proposals from three rounds of Circom audits on zkID 0xVikasRushi/noir-claude-auditor#1

[cc03668]

Hey @cc03668 , should we also document the findings for audit tool here?

update: the findings will be documented here https://github.com/0xvikasrushi/noir-claude-auditor

• Observations & proposals from three rounds of Circom audits on zkID 0xVikasRushi/noir-claude-auditor#1

Just noting that we've documented it here: 0xVikasRushi/noir-claude-auditor#1

[moven0831]

Verified each normative MUST/SHOULD added by this PR against the current implementation in zkmopro/zkID@b4f151d. All load-bearing invariants are enforced by the circuit code; two inline suggestions below to reconcile spec wording with two known-open audit-v3 follow-ups, otherwise looks good.

[moven0831]

Follow-up on this PR's "Out of scope: DeviceSig → UserSig rename" note.

The reference impl renamed Circuit B to UserSigRSA256 in zkmopro#75 (commit 72b6cc1) — see userSig.circom and circuits/main/userSigRS2048.circom. The spec at PR HEAD 68a37c8 contains 15 DeviceSig references, not 4 — likely worth a sweep either in this PR or the planned follow-up:

Line	Context
L31	Overview intro
L113	"computed in the DeviceSig circuit" — inline suggestion below
L185	Proof-pipeline step 6
L191	Circuit Design intro
L198	DeviceSig responsibilities bullet
L210	Cross-circuit linkage
L214	Cross-circuit linkage detail
L224	RSA-2048 note
L285	### DeviceSig Circuit section header
L301	#### DeviceSig Operations section header
L303	MUST-enforce intro
L338	Verifier output schema
L427	PK_COMMIT_MISMATCH error description
L459	Verifier protocol bullet
L460	Verifier protocol assertion

Most are straightforward s/DeviceSig/UserSig/g renames. Section headers L285 / L301 change anchor IDs (#devicesig-circuit → #usersig-circuit, #devicesig-operations → #usersig-operations); I grepped the repo and there are no inbound cross-references to those anchors outside this file, so the anchor change is contained.