MarketTakers/arbiter
5
0
Fork 0
Code Issues 27 Pull Requests 4 Packages Projects Releases Wiki Activity

feat(auth): add seal-key-derived pubkey integrity tags with auth enforcement and unseal backfill #43

Manually merged
Skipper merged 0 commits from Client-key-replacement-attack into main 2026-04-05 08:26:59 +00:00
Conversation 2 Commits - Files Changed -
CleverWild commented 2026-03-29 22:17:39 +00:00
Member
Copy Link

closes #40

closes #40
CleverWild added 1 commit 2026-03-29 22:17:40 +00:00
feat(auth): add seal-key-derived pubkey integrity tags with auth enforcement and unseal backfill
Some checks failed
ci/woodpecker/pr/server-lint Pipeline failed
Details
ci/woodpecker/pr/server-audit Pipeline was successful
Details
ci/woodpecker/pr/server-vet Pipeline failed
Details
ci/woodpecker/pr/server-test Pipeline failed
Details
a02ef68a70
Skipper requested changes 2026-04-02 19:12:00 +00:00
Skipper left a comment
Owner
Copy Link

ed25519 signing and generalization plz

ed25519 signing and generalization plz
server/crates/arbiter-server/Cargo.toml Outdated
@@ -49,6 +49,7 @@ pem = "3.0.6"
k256.workspace = true
rsa.workspace = true
sha2.workspace = true
hmac = "0.12"
Skipper commented 2026-04-02 18:58:12 +00:00
Owner
Copy Link

not sure we should bring hmac.
maybe better approach would be to derive ed25519 key from root key and sign with that.

not sure we should bring hmac. maybe better approach would be to derive ed25519 key from root key and sign with that.
Skipper marked this conversation as resolved
server/crates/arbiter-server/src/actors/keyholder/encryption/v1.rs Outdated
@@ -170,2 +173,4 @@
}
/// Derives a dedicated key used only for user-agent pubkey integrity tags.
pub fn derive_useragent_integrity_key(seal_key: &mut KeyCell) -> KeyCell {
Skipper commented 2026-04-02 19:03:11 +00:00
Owner
Copy Link

I would generalize this piece of code for all data that might require signing by seal key.
there is no point in specializing it for useragent pubkey only, and in future (very near future) we might need to sign every piece of data.

For example, program client, grants, etc -- all should be signed, because in practice this attack applies to each database table

I would generalize this piece of code for all data that might require signing by seal key. there is no point in specializing it for useragent pubkey only, and in future (very near future) we might need to sign every piece of data. For example, program client, grants, etc -- all should be signed, because in practice this attack applies to each database table
CleverWild marked this conversation as resolved
server/crates/arbiter-server/src/actors/keyholder/mod.rs Outdated
@@ -257,6 +262,28 @@ impl KeyHolder {
}
// Decrypts the `aead_encrypted` entry with the given ID and returns the plaintext
Skipper commented 2026-04-02 19:03:51 +00:00
Owner
Copy Link

comment drifted

comment drifted
CleverWild marked this conversation as resolved
server/crates/arbiter-server/src/actors/user_agent/auth/state.rs
@@ -223,0 +314,4 @@
return Err(Error::UnregisteredPublicKey);
};
let Some(expected_tag) = self.try_sign_pubkey_integrity_tag(pubkey).await? else {
Skipper commented 2026-04-02 19:07:46 +00:00
Owner
Copy Link

this is a very dangeours code.
Better solution long term would be to return AttestationStatus enum instead of ().
I image those variants:

  • Attested
  • NotAttested (db tamper detected)
  • Unavailable (db sealed)
this is a very dangeours code. Better solution long term would be to return `AttestationStatus` enum instead of `()`. I image those variants: - Attested - NotAttested (db tamper detected) - Unavailable (db sealed)
👍 1
CleverWild marked this conversation as resolved
server/crates/arbiter-server/src/actors/user_agent/session/connection.rs Outdated
@@ -88,2 +86,4 @@
}
}
async fn backfill_missing_useragent_pubkey_integrity_tags(&mut self) -> Result<(), Error> {
Skipper commented 2026-04-02 19:09:52 +00:00
Owner
Copy Link

nice thinking, but this is not needed because we are pre-deploy. So it's fine to make breaking changes

this is probably llm output tho

nice thinking, but this is not needed because we are pre-deploy. So it's fine to make breaking changes ~~this is probably llm output tho~~
CleverWild commented 2026-04-04 10:12:10 +00:00
Author
Member
Copy Link

Your both guesses are right. That was my order to LLM to implement this :3

Your both guesses are right. That was my order to LLM to implement this :3
CleverWild commented 2026-04-04 10:14:40 +00:00
Author
Member
Copy Link

And... should I remove this or what?

And... should I remove this or what?
Skipper commented 2026-04-04 10:18:53 +00:00
Owner
Copy Link

yes

yes
Skipper marked this conversation as resolved
CleverWild added 3 commits 2026-04-04 10:15:11 +00:00
refactor(keyholder): generalize derive_useragent_integrity_key and compute_useragent_pubkey_integrity_tag corespondenly to derive_integrity_key and compute_integrity_tag 78895bca5b
fix(keyholder): comment drift 881f16bb1a
feat(auth): implement attestation status verification for public keys
Some checks failed
ci/woodpecker/pr/server-audit Pipeline was successful
Details
ci/woodpecker/pr/server-lint Pipeline failed
Details
ci/woodpecker/pr/server-vet Pipeline failed
Details
ci/woodpecker/pr/server-test Pipeline failed
Details
ci/woodpecker/pr/useragent-analyze Pipeline failed
Details
0bb6e596ac
Skipper added 2 commits 2026-04-04 12:31:08 +00:00
refactor(server): separate crypto by purpose and moved outside of actor into separate module dd51d756da
fix(server): previously, user agent auth accepted invalid signatures
Some checks failed
ci/woodpecker/pr/server-lint Pipeline failed
Details
ci/woodpecker/pr/server-audit Pipeline was successful
Details
ci/woodpecker/pr/server-vet Pipeline failed
Details
ci/woodpecker/pr/server-test Pipeline failed
Details
ci/woodpecker/pr/useragent-analyze Pipeline failed
Details
352ee3ee63
Skipper added 1 commit 2026-04-04 12:32:07 +00:00
refactor(user-agent): remove backfill pubkey integrity tags
Some checks failed
ci/woodpecker/pr/server-audit Pipeline was successful
Details
ci/woodpecker/pr/server-lint Pipeline failed
Details
ci/woodpecker/pr/server-vet Pipeline failed
Details
ci/woodpecker/pr/server-test Pipeline failed
Details
ci/woodpecker/pr/useragent-analyze Pipeline failed
Details
4a50daa7ea
Skipper added 1 commit 2026-04-04 12:33:54 +00:00
housekeeping(server): fixed clippy warns
Some checks failed
ci/woodpecker/pr/server-audit Pipeline was successful
Details
ci/woodpecker/pr/server-vet Pipeline failed
Details
ci/woodpecker/pr/server-lint Pipeline failed
Details
ci/woodpecker/pr/server-test Pipeline failed
Details
ci/woodpecker/pr/useragent-analyze Pipeline failed
Details
01b12515bd
CleverWild commented 2026-04-04 14:01:26 +00:00
Author
Member
Copy Link

@Skipper, is it assigned?

@Skipper, is it assigned?
Skipper manually merged commit 7aca281a81 into main 2026-04-05 08:26:59 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Skipper
Labels
Clear labels
Compat
Breaking
Breaking change that won't be backward compatible
Difficulty
High
3
Hard difficulty. Experience needed to fix: A lot.
Difficulty
Low
1
Easy difficulty. Experience needed to fix: Not much. Good first issue.
Difficulty
Medium
2
Medium difficulty. Experience needed to fix: Intermediate.
Kind
Bug
This is a bug.
Kind
Enhancement
Improve existing functionality.
Kind
Feature
New functionality
Kind
RFC
Request for comments
Kind
Security
This is security issue
Kind
Testing
This is testing issue.
Kind
Tracking issue
An issue tracking the progress of sth. like the implementation of an RFC
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Pending
4
Requires review by dev
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
CleverWild Skipper goodvin testuser
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: MarketTakers/arbiter#43
Delete Branch "Client-key-replacement-attack"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?