2 Commits

Author	SHA1	Message	Date
Sterister	f6e4ac8aeb	test(crypto): stop letting the scheduler answer for the code ... Third flake found in the same hunt. `timing variance stays bounded across mismatch positions` took two single measurements of 50 000 iterations each and compared their ratio, which is one GC pause away from a false alarm — it failed about one run in fourteen on a loaded machine. Two things were wrong with the measurement, not the property: The first loop through that code pays for JIT compilation the second one does not, so whichever side ran first was biased upward. The old comment admitted it — "allow 2x variance for JIT/noise" — which is a tolerance covering a measurement artefact rather than the thing under test. There is a warm-up now. And a single pair has no defence against a scheduler hiccup. Five interleaved pairs compared by median throw the pause out instead of the property. The threshold is unchanged at 3, deliberately. An early-exit compare takes ~256x longer to reach a mismatch in the last byte than the first, on every round; nothing here weakens what the test catches. Verified that it still catches what it is for: with `constantTimeEqual` temporarily replaced by an early-exit loop the test fails, and passes again with the real one restored. A security test nobody has watched fail is a security test nobody knows works. A security test that cries wolf under load is worse than none — it teaches people to re-run until green, and then a real regression looks like the noise. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014489bKUtUEY1Zgs9xN9mt7	2026-09-08 16:42:37 +02:00
Sterister	96a8c210b2	feat(hardening): M-Hard 1-5 — crypto, auth, rate limit, fingerprints, rotation ... M-Hard 1: Cryptographic Hardening - constantTimeEqual, zeroize, randomUint32 on CryptoProvider - Fix Math.random() → crypto.randomUint32() for registrationId - Zero message keys and chain keys after use in ratchet.ts - Constant-time trust comparison in MemoryStorage + SQLiteStorage - Timing variance test catches early-exit regressions M-Hard 2: Self-Authenticated Prekey Server - Ed25519 signature verification on all write routes - signPayload/verifyPayload with canonical JSON, ±5 min replay window - Address validation (NFKC, alphanumeric + :_-.) - Global ShadeError → HTTP status mapping - ShadeFetchTransport signs requests when signingPrivateKey provided - Anonymous bundle fetches still allowed (read-only) M-Hard 3: Rate Limiting + DoS Protection - Token bucket rate limiter with pluggable store - Per-route limits: register 5/h/IP, fetch 60/min/IP, replenish 10/min/id - 64KB body size limit on POST - Retry-After header on 429 responses M-Hard 4: Auto-replenish + Fingerprints + Session Reset - Safety numbers (12 groups × 5 digits, Signal-style) - ensurePreKeyStock, resetSession, acceptIdentityChange - verifyRemoteIdentity for out-of-band comparison M-Hard 5: Identity Rotation with Grace Period - rotateIdentity archives old identity, generates fresh signed prekey - RetiredIdentity storage with addRetired/getRetired/pruneRetired - 7-day default grace period for decrypting old sessions - pruneExpiredIdentities for cleanup M-Hard 8: Error Hierarchy - New error types: Network, Storage, Validation, Timeout, RateLimit, Configuration, Unauthorized, Replay, IdentityRotation - All errors have stable SHADE_* codes - errorToHttpStatus for consistent HTTP mapping - toJSON() for network serialization 188 tests passing, zero failures. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-10 17:45:34 +02:00