Repository navigation
keychain: Secure Enclave custody fixes — delegation works on SE roots, software keys are never silently discarded - #381
Merged
Conversation
… hardware-aware signer; software keys stored, never silently replaced Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 1/1 commits verified |
Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EPlN9Y8qKPDEq8gg80D6N_rCN3aANK6xAoMr8OTGJ1tR Auths-Anchor-Seq: 10
Auths Commit Verification
Result: ❌ 1/2 commits verified How to fixCommit |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Found by attempting the product's own flagship flow — delegating a headless release agent under a Secure Enclave root — which surfaced a chain of SE custody bugs:
stage_root_anchor_ixn): an SE blob is an opaque handle, so everyid agent addon an SE root died withUnknown encryption tag: 4. Anchors now sign throughsign_with_key— the same hardware-aware dispatch the commit-signing path trusts — with a curve cross-check. The call site no longer touches seed or passphrase material at all.SecureEnclaveKeyStorage::store_keydiscarded provided key material and minted an unrelated hardware key. Every store-existing-material flow (agent delegation, device pairing,key import, rotation persistence) silently lost the only copy of a key the KEL had already anchored — the delegation "succeeded" with its private key gone. Non-empty material is now stored as a real software item (.swkey, 0600) with metadata; the empty-blob convention (identity init) still hardware-generates.load_key/delete_key/list_aliaseshandle both forms.Also in this PR:
.auths/ci-bundle.jsonregenerated so the traveling evidence carries the new delegation anchors (14 KEL events, 6 device KELs).This commit is itself the proof: it is signed by
did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp— theclaude-releaseagent delegated under the maintainer's SE root via the fixed ceremony (scopessign_commit+sign_release, 30-day expiry, revocable withauths id agent revoke) — andauths verify HEADaccepts it through the pinned root. No fingerprint was involved in signing it.Known follow-ups (intentionally not here): the
key exportguard refuses per-backend instead of per-key, so software items in an SE backend can't export (worked around viakey copy-backend); a mid-ceremony SE auth failure leaves a partially-anchored delegation (keys stored, later seals missing) — the ceremony should be atomic or resumable;auths sign's trailer source (commit-trailersfile) and signer resolution don't follow--repo/env overrides cleanly for delegate machines.🤖 Generated with Claude Code