security: close RT-002 and harden the verify path (#263)#264
Merged
Conversation
Close the red-team audit's systemic CRITICAL (RT-002: stateless verify paths replayed KELs by structure only and never checked event signatures) plus the surrounding findings, then harden the verify path at the type level so the class cannot recur. RT-002 — authenticate KEL signatures at every untrusted boundary: - Storage: all RegistryBackend impls (Git/Fake/Postgres/Arc) persist + expose CESR signature attachments; the lossy trait defaults that silently dropped them (the root cause) are removed and the methods are now required. - CI --identity-bundle: IdentityBundle carries kel_attachments; load_bundle_trust authenticates via validate_signed_kel before use (+ stripped/forged-signature negative e2e). - Org air-gapped bundle: offline_verify authenticates the org KEL and each delegated member KEL (+ forged-signature negative test). - WASM validateKelJson: takes a parallel attachments arg, routes through validate_signed_kel, fails closed on absent/short attachments. - A.0 lint: xtask check-verify-path-completeness (CI-wired) gates structural replay on the verifier + CLI-verify surfaces. #263 — architectural hardening: - P1 (type level): validate_kel/_with_lookup/_with_receipts/_with_policy are pub(crate) and the replay_kel alias is removed; the only cross-crate structural-replay surface is auths_keri::TrustedKel (minted via from_trusted_source for trusted-local reads, or implied by validate_signed_kel). Bare-&[Event] structural replay outside auths-keri is now a compile error. auths-id mints TrustedKel at its registry-read boundary; the lint gates the from_trusted_source assertion on verify paths. - P2: KelSealIndex (one O(1) index) replaces three duplicate DelegatorKelLookup impls (commit / presentation / offline-org verify). - P3: IdentityBundle.kel is Vec<Event>, not Vec<serde_json::Value>, which moves trusted_root_from_bundle onto typed accessors; the threaded (String, Vec<Event>) becomes a named BundleKel. Other findings closed: A.2 (i==d on replay), A.3/A.4/A.5, B.1 (SCIM capability allowlist, empty=deny), B.2, C.1/C.3/C.4, D.1, E.1/E.2, F.3/F.4. Tooling: E.2's fips/cnsa compile_error! makes --all-features uncompilable, so the clippy pre-commit hook + CI clippy/nextest now lint/test the bulk workspace with --all-features minus the five dual-provider crypto crates, then exercise those five under each provider (fips, cnsa) separately. Residuals tracked in #262 (remote/oobi/WASM signature-carrying transports) and #263 P3.3.
Resolved the verify_commit.rs trust-precedence conflict in favor of the RT-005 / A.4 security fix: a `--identity-bundle` is EVIDENCE ONLY and must match an independent pin (`.auths/roots` or the verifier's own self-trust); it never self-pins its own root. main's side had reverted to `pinned_roots.push(bundle_root)` (the RT-005 self-pinning vuln) — that is intentionally NOT taken. All other main 0.1.3 changes are adopted (FIPS error contract, release/CI workflow bumps, status snapshot, lockfiles). verify_identity_bundle e2e: 5/5 pass; workspace builds; RT-002 lint green.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Auths Commit Verification
Result: ❌ 0/2 commits verified (1 skipped) How to fixCommit 1. Install auths macOS: 2. One-time setup (creates your identity and configures Git) auths init3. Sign this branch and push auths sign origin/main..HEAD
git push --force-with-leaseFor CI to verify the signer, commit an identity bundle: auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 31536000 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes the red-team audit's systemic CRITICAL RT-002 (stateless verify paths replayed KELs by structure only, never checking event signatures) plus the surrounding findings, and hardens the verify path at the type level (#263).
RT-002 — authenticate KEL signatures at every untrusted boundary
RegistryBackendimpls (Git/Fake/Postgres/Arc) persist + expose CESR signature attachments; the lossy trait defaults that silently dropped them (the root cause) are removed.--identity-bundle:IdentityBundlecarrieskel_attachments;load_bundle_trustauthenticates viavalidate_signed_kel(+ stripped/forged-signature negative e2e).offline_verifyauthenticates the org KEL + each delegated member KEL.validateKelJson: takes attachments, routes throughvalidate_signed_kel, fails closed.xtask check-verify-path-completeness(CI-wired) gates structural replay on the verify surfaces.#263 — type-level hardening
validate_kel*arepub(crate); the only cross-crate structural-replay surface isauths_keri::TrustedKel. Bare-&[Event]structural replay outside auths-keri is now a compile error.KelSealIndexreplaces three duplicateDelegatorKelLookupimpls.IdentityBundle.kelisVec<Event>(notVec<serde_json::Value>); namedBundleKel.Other findings
A.2 (i==d on replay), A.3/A.4/A.5, B.1 (SCIM allowlist), B.2, C.1/C.3/C.4, D.1, E.1/E.2, F.3/F.4.
Tooling
E.2's fips/cnsa
compile_error!makes--all-featuresuncompilable, so the clippy hook + CI clippy/nextest now lint/test the bulk workspace--all-featuresminus the 5 dual-provider crypto crates, then exercise those 5 under each provider (fips, cnsa) separately.Merge note
The merge of
main(0.1.3) resolved averify_commit.rstrust-precedence conflict in favor of the RT-005/A.4 fix: a--identity-bundleis evidence-only and must match an independent pin; it never self-pins its own root (main's side had reverted to the self-pinning vuln — intentionally not taken).Residuals tracked in #262 (remote/oobi/WASM signature-carrying transports) and #263 (P1 design follow-ups).