v2.2.2
This commit is contained in:
Cristian Cezar Moisés
parent
f3e39fb8e6
commit
e5f5d32aab
124 changed files with 11892 additions and 2461 deletions
172
SECURITY.md
172
SECURITY.md
|
|
@ -209,4 +209,174 @@ jasminc -arch x86-64 -o /dev/null jasmin/zupt_mlkem_select.jazz
|
|||
|
||||
---
|
||||
|
||||
© 2026 Cristian Cezar Moisés — AGPL-3.0-or-later (commercial: sac@securityops.co)
|
||||
© 2026 Cristian Cezar Moisés — AGPL-3.0-or-later
|
||||
|
||||
## Production deployment notes (v2.2.1)
|
||||
|
||||
Zupt is deployed in production environments. The following supported
|
||||
configurations are considered current and receive security fixes:
|
||||
|
||||
| Channel | Supported | Notes |
|
||||
|---|---|---|
|
||||
| 2.2.x (latest) | Yes | Recommended for new deployments |
|
||||
| 2.1.x | Yes (security only) | Supported through 2026-Q4 |
|
||||
| 2.0.x | No | End of life |
|
||||
| 1.x | No | End of life |
|
||||
|
||||
### Recommended configuration
|
||||
|
||||
For new archives, use the libzuptsdk-backed mode:
|
||||
|
||||
```bash
|
||||
zupt keygen --sdk -o key.priv
|
||||
zupt c --pq-sdk key.priv.pub backup.zupt /path/to/data
|
||||
zupt x --pq-sdk key.priv backup.zupt
|
||||
```
|
||||
|
||||
This selects:
|
||||
|
||||
- ML-KEM-768 + X25519 hybrid KEM with HKDF-SHA3-256 combiner (RFC-style
|
||||
KDF rather than ad-hoc XOR construction)
|
||||
- 32-byte HKDF-derived key commitment tag (protects against partitioning
|
||||
oracle attacks across recipients)
|
||||
- HPKE-style context binding (RFC 9180 §5)
|
||||
- Anti-fault double ML-KEM decapsulation
|
||||
- XChaCha20-Poly1305 AEAD with 24-byte random nonces
|
||||
- Argon2id (RFC 9106 OWASP minimums) when password mode is used
|
||||
|
||||
### Threat model
|
||||
|
||||
Zupt assumes:
|
||||
|
||||
- The recipient's private key file is kept secret and is not exfiltrated.
|
||||
- The execution environment has a working `getrandom(2)` / `/dev/urandom`.
|
||||
- The archive metadata (file list, sizes, mtimes) is not considered
|
||||
confidential. Padding to hide file sizes is not implemented.
|
||||
- An attacker may have full write access to the archive in transit; AEAD
|
||||
+ commitment + HPKE binding ensures any modification is detected.
|
||||
|
||||
Zupt does **not** defend against:
|
||||
|
||||
- Endpoint compromise (keylogger, malware on the machine where you type
|
||||
the password or hold the private key).
|
||||
- Side-channel attacks against the host OS that bypass the constant-time
|
||||
Jasmin-verified primitives (e.g. Spectre v1 in callers).
|
||||
- Quantum attacks against X25519 alone — but the ML-KEM-768 component
|
||||
guarantees post-quantum security via the hybrid KDF.
|
||||
|
||||
### Reporting findings
|
||||
|
||||
If you find a security issue:
|
||||
|
||||
1. **Do not** open a public issue on the project's git server.
|
||||
2. Email `zupt@riseup.net` with subject `SECURITY: <brief>`.
|
||||
3. Include the version (`zupt --version`), platform, and a
|
||||
reproduction (a minimal archive or a code snippet).
|
||||
4. Expect acknowledgement within 7 days. Coordinated disclosure
|
||||
timeline will be discussed case by case.
|
||||
|
||||
### Disclosure history
|
||||
|
||||
| Date | Version | Findings | Severity |
|
||||
|---|---|---|---|
|
||||
| 2026-04-27 | 2.2.1 | 6 internally-found bugs (audit pass) | 2 high, 1 medium, 3 low |
|
||||
|
||||
---
|
||||
|
||||
## v2.2.1 audit findings
|
||||
|
||||
The 2.2.1 release fixed six bugs found by code review and added a 10-check
|
||||
double-validated audit test suite. Detailed root-cause analysis for each
|
||||
finding is in `CHANGELOG.md` under the 2.2.1 entry.
|
||||
|
||||
| # | Severity | Component | Bug |
|
||||
|---|---|---|---|
|
||||
| 1 | Low (correctness) | format parser | varint reader truncated values at 2^63 |
|
||||
| 2 | Medium (data loss) | extract path | unchecked `fwrite` in 6 call sites — silent corruption on disk-full |
|
||||
| 3 | Low (defense-in-depth) | SDK keyring | `mac_key` was a copy of `enc_key` rather than KDF-derived |
|
||||
| 4 | High (memory safety) | LZ decoder | `size_t` overflow in length accumulator could enable out-of-bounds copy |
|
||||
| 5 | Medium (DoS / amplification) | dedup ref blocks | unbounded forward offset + recursion accepted |
|
||||
| 6 | Low (UX) | encrypt path | partial archive left on disk after encrypt-init failure |
|
||||
|
||||
All six fixed in 2.2.1. Regression tests added.
|
||||
|
||||
## Reporting vulnerabilities
|
||||
|
||||
Email `zupt@riseup.net` with `[security]` in the subject. PGP key on the
|
||||
project's keyserver entry. Coordinated disclosure preferred; we will
|
||||
acknowledge within 5 business days and aim for a fix within 30 days for
|
||||
high-severity issues.
|
||||
|
||||
The project does not yet have an external audit. The 2.2.1 audit pass was
|
||||
internal code review combined with the 169-check libzuptsdk audit suite
|
||||
inherited via vendored linkage. For high-stakes deployments, treat this as
|
||||
"reviewed but unaudited" and do your own review.
|
||||
|
||||
---
|
||||
|
||||
## v2.2.2 formal audit findings (2026-04-27)
|
||||
|
||||
A formal cryptographic audit pass was conducted using the methodology
|
||||
documented in `FORMAL_AUDIT_PROMPT.md` (auditor profile: senior
|
||||
cryptographic engineer with 15+ years of production crypto systems
|
||||
experience). Two security-relevant bugs and two robustness bugs found
|
||||
and fixed; version unchanged at 2.2.2 — same release with hardened
|
||||
internals.
|
||||
|
||||
| # | Severity | Component | Bug |
|
||||
|---|---|---|---|
|
||||
| 11 | **HIGH** | extract path | Zip Slip / path traversal — `e->path` from archive used directly in `fopen` |
|
||||
| 12 | **MEDIUM** | extract output | symlink-following — `fopen "wb"` followed symlinks at output target |
|
||||
| 13 | LOW (32-bit only) | size cap | 4 GiB cap exceeds `size_t` on 32-bit |
|
||||
| 14 | LOW (32-bit only) | calloc on parsed count | `count * sizeof(entry)` overflowed `size_t` before calloc internal check |
|
||||
|
||||
All four fixed and regression-tested.
|
||||
|
||||
### Threat model coverage (post-audit)
|
||||
|
||||
The following attack vectors are now explicitly defended against:
|
||||
|
||||
- **Malicious archive with path-traversal entries** (Zip Slip 2018 pattern):
|
||||
rejected by `zupt_path_is_safe()` — blocks `..`, absolute paths, Windows
|
||||
drive letters, UNC paths, embedded NULs.
|
||||
- **Symlink at extract target** (TOCTOU pre-extraction): refused by
|
||||
`zupt_safe_fopen_output()` using `O_NOFOLLOW` on POSIX. Windows path
|
||||
unchanged — relies on directory ACLs (documented limitation).
|
||||
- **Malformed archive headers**: bounds-checked offsets (`encryption_header_off`,
|
||||
`index_offset`); rejected if outside file size.
|
||||
- **Format parser overflow**: varint truncation, dedup-ref recursion,
|
||||
realloc-pair atomicity, length-overflow in LZ decoder — all fixed in
|
||||
prior 2.2.x sprints.
|
||||
- **Cryptographic key reuse / nonce misuse**: per-block nonce is `base ⊕
|
||||
block_seq`; `base_nonce` is per-archive random; mac_key is KDF-split
|
||||
from enc_key (defense in depth even though SDK path doesn't use it).
|
||||
- **Block-swap (reorder) attack on encrypted archives** (bug #16, fixed
|
||||
in 2.2.2 god-tier audit): MAC binds 8-byte AAD seq computed as
|
||||
`((file_index_in_archive + 1) << 32) | per_file_block_seq`. An attacker
|
||||
who swaps two valid encrypted blocks between positions in the archive
|
||||
produces blocks whose AAD no longer matches their position; both MAC
|
||||
candidates (v2 with AAD, v1 legacy fallback) reject the swapped block.
|
||||
Empty/partial output files are `unlink()`'d on auth failure.
|
||||
Limitation: dedup mode uses sentinel seq=0 (refs can't derive source
|
||||
AAD); plaintext XXH64 still provides per-block integrity.
|
||||
|
||||
### Path traversal — operational guidance
|
||||
|
||||
Even with the in-binary defenses, operators extracting untrusted archives
|
||||
should:
|
||||
|
||||
1. Extract into a dedicated empty directory (not `~/Downloads` or `/tmp`).
|
||||
2. Audit symlinks in the target directory before extraction.
|
||||
3. Run extraction as a low-privilege user, never root.
|
||||
4. On Windows, pre-create the target directory with restrictive ACLs
|
||||
(the `O_NOFOLLOW` defense is POSIX-only).
|
||||
|
||||
These are belt-and-suspenders — the in-binary defenses are the primary
|
||||
control, but defense in depth is good practice.
|
||||
|
||||
### Out-of-scope (still)
|
||||
|
||||
- External independent audit (cost-bound, on roadmap)
|
||||
- Side-channel testing on production hardware (timing leaks)
|
||||
- Formal verification beyond Jasmin constant-time primitives
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue