 zeekay
|
4e3bfa0a87
|
fix: address red team findings — auth, TLS, KMS fallback, AAD
M-1: compose.yml commented section now enforces JWT_SECRET required syntax
M-3: TLS client config uses TOFU certificate pinning instead of blind
InsecureSkipVerify — SHA-256 fingerprint pinned on first connect,
mismatches rejected on subsequent connections
M-4: TLSOnlyListener plaintext escape hatch gated behind both
ALLOW_PLAINTEXT=true AND ENVIRONMENT=development
M-5: KMS fallback to unencrypted storage is now log.Fatal in production
(ENVIRONMENT != "development"), including Put-time failures
M-6: isKeyShare() now checks org: prefix, key-type prefixes (frost:,
bls:, sr25519:, tfhe:), and hex wallet IDs instead of returning true
M-9: AES-GCM Encrypt/Decrypt accept optional AAD variadic parameter
for context-binding; existing callers remain backward compatible
M-12: Internal /keygen endpoint requires org_id in request body (400 if
missing); orgID propagated to GenerateKeyMessage and audit log
|
2025-12-28 02:59:23 -08:00 |
|
anhthii