Invitation for external cryptographic review

[rossbuckley1990-hash]

Call for cryptographic review

The Actenon Kernel has not yet received an external cryptographic review. We are inviting security researchers to review the crypto surface.

What needs review

The following surfaces handle cryptographic correctness:

1. Canonicalisation — ACTENON-JCS-STRICT-1 (RFC 8785 subset with float rejection, duplicate-key rejection, depth/size limits)
2. Replay atomicity — atomic claim-once against a durable store under concurrent access
3. Key lifecycle — 5-state machine (active/retired/suspended/revoked/hard_revoked) with external-anchor recovery
4. Attestation envelopes — v2alpha1 Ed25519-signed wrappers around v1 receipts/refusals

How to start

1. Read docs/CRYPTO_REVIEW.md for exact file pointers and specific reviewer questions for each surface.
2. Read SECURITY.md for the reporting policy.
3. Read docs/AUDIT_RESPONSES.md for the self-review already done.
4. File findings via GitHub Security Advisories (private, supports coordinated disclosure) or email ross.buckley1990@gmail.com with subject [ACTENON SECURITY].

What we have done so far

• Automated static analysis (bandit) on the crypto surface — 3 findings, all false positives (documented in CRYPTO_REVIEW.md).
• Self-review in AUDIT_RESPONSES.md covering canonicalisation, clock skew, concurrency replay, key lifecycle, signature verification, and refusal oracle.
• 51 conformance vectors testing the verifier pipeline.
• 129 protocol conformance vectors testing the wire format.

What we have NOT done

• No external cryptographic review has been performed.
• No formal security audit has been commissioned.
• Automated analysis is not a substitute for manual cryptographic review.

We welcome external review and will publish findings (with credit, anonymised if preferred) in docs/CRYPTO_REVIEW.md.