docs: E2E KB-sharing security reviews, holistic reference, ADR-038/039, adversarial-testing principle - #159
Merged
Merged
Conversation
…w (ADR-037 #155) The design-pass cryptographic review (4 prior-art-grounded lenses: AEAD/key-wrap, key-management/trust/rotation, metadata/N-peer-scaling, prior-art positioning). Verdict: the core crypto is SOUND (no must-fix break in the primitives). MAE v1 (single per-KB symmetric content key, sealed-box-wrapped per member, distributed via the signed membership op-log, rotated on removal) ≈ Jazz/cojson, is more efficient than Signal Sender Keys (O(N) vs O(N²) on removal), and avoids Megolm's homeserver-trust mistakes; BeeKEM is the named FS/PCS + O(log N) evolution (ADR-037 §D4). Documents the threat model, primitives, key lifecycle, prior-art comparison, the honest "what we do NOT protect" list (no FS/PCS — the documented CRDT trade-off; O(N) rekey; metadata: edit sizes/timing/author/social-graph; cleartext manifest titles), and the review findings with disposition. F1/F2/F4/F6 fold into 3b (#151); F5/F7/F8/F9 + mesh anchor pinning tracked in #156; implementation-pass review re-runs after 3b/3c. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…view (#155) Prior-art-grounded design-pass audit of the identity + authorization foundations under E2E KB sharing (companion to E2E_ENCRYPTION.md). Adversary: MITM, malicious key-blind relay, unauthorized peer, removed member, concurrent races. Verdict: identity = sound SSH-style asymmetric trust (RFC-7250 raw-public-key TLS, authorized_keys/known_hosts TOFU, mesh node-id anti-spoof); authz = sound capability+ ReBAC hybrid (UCAN attenuation, Keybase sigchains, p2panda strong-removal, external- anchored signed op-log). NO auth-bypass / NO privilege-escalation found. Findings concentrate at the op-log↔legacy-member_roles boundary + enforcement coverage, sharing one fix (derive role+epoch+blocklist from the one op-log via a shared fence on every write path): - A1 (HIGH): epoch read from legacy member_roles not the op-log → non-epoch-0 mesh members wrongly fenced from editing. - N1 (HIGH): the ADR-023 epoch fence runs only on the hub path, not the mesh dialer. - A2 (MEDIUM): verify_content_op ignores the local blocklist. - N2 (MEDIUM): content-key authority frozen at the genesis owner under quorum. Identity: I1 single-key reuse (sign+TLS+node-id+X25519 wrap), I2 no key rotation/rebind, I3 at-rest plaintext, I4 non-unix chmod, I5 two-layer revocation, I6 TOFU first-contact. Each finding cites file:line + a primary-source prior-art basis (Zanzibar, UCAN, SPKI/SDSI, MLS RFC 9420, RFC 7250, p2panda-auth, Matrix cross-signing, age/SSH). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…g, not confirmation Codify the standing testing-rigor directive into the design principles: no fragile linear happy-path tests; no cherry-picked "unicorn" values; favor property/round-trip, N-way convergence, real/varied inputs, selective oracles, and the attacker's negative case that MUST fail (wrong key, forged sig, stale epoch, removed member, hostile relay). Per-phase adversarial review. Adds a matching bullet to the Scheme Testing Framework Design Principles and an adversarial-test clause to principle #9's regression guard. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…embership; identity+authz hardening) Ties identity → authorization → encryption → the hub/P2P lifecycle into one reference: - docs/KB_SHARING.md — "how it works in the wild": the three-layer model, both transports (one protocol), a worked end-to-end example (Alice enables+shares, Bob joins+approved+keyed, Carol removed+rotated, daemon key-blind throughout), the management surface, and the honest protected/not-protected summary. - docs/adr/038-editor-authored-membership.md — the owner editor authors the signed membership op-log via the key-blind kb/collection_op RPC (daemon stores opaque owner-signed bytes); member pubkey via PendingRequest; dual-write op-log+member_roles. - docs/adr/039-identity-authz-hardening.md — the security-review decisions: one unified op-log fence (role+epoch+blocklist on every write path, #157); signed encryption mode + fail-closed; E2e⇒SingleOwner; anchor pinned to the authenticated owner; identity follow-ups (key rotation/rebind, single-key separation, at-rest, Windows perms, #158). - CLAUDE.md — index ADR-038/039 + the three sharing/security docs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
E2E KB-sharing: security reviews, holistic reference, ADRs, testing-rigor principle
Documentation + decision records for the multi-user encrypted KB-sharing story (issue #131). Docs only — no code (the
content_key_storecode stays onfeat/e2e-key-lifecyclefor its own PR).What's here
docs/E2E_ENCRYPTION.md— the content-encryption design-of-record + the prior-art-grounded crypto review (ADR-037: E2E encryption security review + design/implementation docs (E2E_ENCRYPTION.md) #155). Verdict: sound core (≈ Jazz/cojson; more efficient than Signal Sender Keys; BeeKEM named as the FS/PCS next step) with the honest "what we do not protect" stated plainly.docs/SECURITY_REVIEW.md— the deep identity + authorization review, every finding grounded in primary sources (Zanzibar, UCAN, SPKI/SDSI, MLS RFC 9420, RFC 7250, p2panda-auth, Matrix cross-signing, SSH/age). Verdict: no auth-bypass, no privilege-escalation; findings cluster at the op-log↔legacy-member_rolesboundary + enforcement coverage → tracked in ADR-023/026: unified op-log epoch fence — derive role+epoch on every write path (A1+N1, HIGH) #157 (HIGH unified fence) + ADR-017/037: identity hardening — key rotation/rebind, single-key separation, at-rest, Windows perms (I1-I6) #158 (identity).docs/KB_SHARING.md— the holistic "how it works in the wild" reference: identity → authorization → encryption → the hub/P2P lifecycle, with a worked Alice-shares / Bob-joins / Carol-removed-and-rotated example showing who-can-read-what while the daemon stays key-blind.docs/adr/038-editor-authored-membership.md— the owner editor authors the signed membership op-log via the key-blindkb/collection_opRPC.docs/adr/039-identity-authz-hardening.md— the review's decisions: one unified op-log fence (role+epoch+blocklist on every write path), signed encryption mode + fail-closed, E2e⇒SingleOwner, anchor pinned to the authenticated owner, identity follow-ups.CLAUDE.md— new Architecture Principle feat: editor polish, version bump & new features (v0.3.0) #14, "Adversarial testing, not confirmation" (no fragile linear tests, no cherry-picked unicorn values, favor the attacker's negative case) + a regression-guard clause; ADR-038/039 indexed.Why a separate PR
Reviewable independently of the implementation; the code (
content_key_store, the enable surface, the fences) ships on feature branches per the cadence in the plan.🤖 Generated with Claude Code