diff options
Diffstat (limited to 'CLAUDE.md')
| -rw-r--r-- | CLAUDE.md | 26 |
1 files changed, 25 insertions, 1 deletions
@@ -96,6 +96,25 @@ Scope: `hub`, `node`, `common`, or omitted for cross-cutting - **Never log GEK, private keys, or plaintext passwords** — even at DEBUG level - **meshbay.org is internet-facing** — open port → test → close port + kill processes in same block +## First security review (2026-08-10) — see `first-review.md` + +**Critical (before Phase 7):** +- **C1** Chat: Sender Keys protocol, NOT shared Double Ratchet (pairwise protocol + would cause key/nonce reuse in group context). `ratchet.py` kept for future 1:1 DM. +- **C2** JWT must carry `"groups": [group_ids]` claim. Node MNP handshake must verify + group membership before serving content. Without this, any authenticated user + accesses any group. + +**Significant (Phase 7-8):** +- **S1** Admin revocation endpoint has no authz check → Phase 8.1 +- **S2** Email stored in plaintext (spec says encrypted at rest) → Phase 8.2 +- **S3** jti denylist push via hub→node WebSocket → Phase 7.2 +- **S4** AES-GCM keystore IV fixed: 128-bit → 96-bit (NIST SP 800-38D) ✅ DONE +- **S5** Refresh token rotation (one-time use) → Phase 8.3 + +**Architecture validated:** crypto primitives, GEK wrapping (ECIES), trust model, +key hierarchy, on-the-fly encryption, transport abstraction. + ## Known calibration TODOs - Argon2id `memory_cost`: currently 65536 (64 MB, 78ms) — increase to 262144 (256 MB) before prod @@ -121,7 +140,8 @@ SFR résidentiel Fedora 44 → meshbay.org OVH VPS : | Dérivation clés depuis password | `meshbay_common.keyderive` | `keyderive.py` | | Bundle clés (web) | `meshbay_common.keyderive` | `keyderive.py` + `static/keyderive.js` | | GEK wrap/unwrap (ECIES) | `meshbay_common.crypto` | `crypto.py` | -| Double Ratchet (chat) | `meshbay_common.ratchet` | `ratchet.py` | +| Double Ratchet (1:1 DM, future) | `meshbay_common.ratchet` | `ratchet.py` | +| Sender Keys (group chat) | `meshbay_common.senderkeys` | `senderkeys.py` (Phase 7.5) | | AES-GCM (navigateur) | `meshbay_common.webcrypto` | `webcrypto.py` + `static/crypto.js` | | Keystore node | `meshbay_node.keystore` | `keystore.py` | | NAT traversal | `QE/demo-v2/nat.py` | non versionné — résultats dans devel-phases.md | @@ -137,3 +157,7 @@ SFR résidentiel Fedora 44 → meshbay.org OVH VPS : - Services légitimes : `meshbay-hub.service`, Caddy, PostgreSQL (local) - Inventaire détaillé : `QE/server-state/meshbay.org.md` - Deploy hub : voir `QE/server-state/meshbay.org.md` + +## new rules, from now +Documents and demo/comments are written in english unless requested in french. + |