Skip to content

security-audit-report.md

Latest commit

 

History

History
92 lines (68 loc) · 12.3 KB

security-audit-report.md

File metadata and controls

92 lines (68 loc) · 12.3 KB
Raw

Security Review: cose2

Scope

Standard repository-wide security scan of cose2, a Rust COSE/CWT library. The deterministic inventory selected all 21 runtime source-like files for deep review.

  • Scan mode: repository
  • Target kind: git_worktree
  • Target ID: target_sha256_abdeef65af2465cb9f058ce7570b8c6ee7a4295c045a0c66c4f50aad196bd53f
  • Revision: 4e643d819c2b39b8a080d2cb9b389434408f2cd4
  • Snapshot digest: codex-security-snapshot/v1:sha256:af637baa0821172ac115eaee661c2d3388dff23dd4d27e220776aca6d2bb77cf
  • Inventory strategy: repository
  • Included paths: .
  • Excluded paths: none
  • Runtime or test status: Source review plus targeted local test evidence from discovery workers; no code changes were made by the scan.
  • Artifacts reviewed: AGENTS.md repository instructions, Cargo.toml, 21 source-like files from deterministic rank_input.jsonl, targeted README, docs, tests, and examples as supporting evidence
  • Scan context: The scan used a generated repository threat model and a 100% deep-review worklist over deterministic source-like runtime files. Discovery, validation, and attack-path receipts were saved under artifacts/.

Limitations and exclusions:

  • Docs, examples, and tests were not treated as deployed runtime surfaces; selected files were read as supporting evidence.
  • No remediation was applied because no reportable findings survived validation and attack-path analysis.
  • Excluded tests/**: Test code was not treated as a deployed runtime surface; targeted tests were read as supporting evidence for reviewed controls.
  • Excluded examples/**: Examples were not treated as deployed runtime surfaces; selected examples were read as API guidance evidence.
  • Excluded docs/**: Documentation was not treated as runtime code; selected docs were read to validate public API contract and policy boundaries.

Scan Summary

Field Value
Reportable findings 0
Severity mix none
Confidence mix none
Coverage complete
Validation mode Static source review with targeted existing-test evidence and candidate-level validation/attack-path analysis.

Canonical artifacts: scan-manifest.json, findings.json, and coverage.json. This report is a deterministic projection of those files.

Threat Model

cose2 is a Rust library for COSE and CWT wire structures. Its primary trust boundary is untrusted CBOR/COSE/CWT data entering parsing, validation, signing, verification, MAC, encryption, decryption, and optional crypto-ring provider construction APIs. The main risks are protocol-soundness failures around protected bytes, AAD, detached data, nonces, headers, claims, key material, and algorithm selection.

Assets

  • COSE message authenticity, integrity, and confidentiality
  • CWT claim validity and custom claim preservation
  • Canonical protected header/key encoding for newly built messages
  • Raw decoded protected-header bytes used for verification/decryption structures
  • Optional crypto-ring algorithm and key-material correctness

Trust Boundaries

  • Untrusted encoded COSE/CWT/CBOR bytes versus the library APIs that decode and construct authenticated structures.
  • Application/operator-controlled key material and key-use policy versus this crate's structural key/provider validation.
  • Caller-controlled external AAD and detached bytes versus message creation and verification/decryption helpers.
  • Feature-gated optional ring crypto backend versus the crypto-free default build.

Attacker Capabilities

  • Supply untrusted COSE/CWT/CBOR bytes, including unusual encodings, headers, payloads, ciphertexts, signatures, tags, recipients, and claims.
  • Supply mismatched detached payloads, detached ciphertexts, or external AAD through an embedding application.
  • Attempt algorithm confusion, malformed crit, duplicate labels, unsupported algorithms, invalid key parameters, or nonce misuse patterns.

Security Objectives

  • Authenticate exactly the protected-header bytes and AAD required by RFC 9052 structures.
  • Fail closed on malformed message, header, key, recipient, CWT, map, label, and optional crypto provider inputs.
  • Keep the default build crypto-free and gate ring behind crypto-ring.
  • Expose explicit APIs for detached payload/ciphertext and nonce construction so callers do not silently skip security-critical bytes.

Assumptions

  • The crate does not decide whether a key is trusted for a business identity; key trust and key-use policy are application-owned.
  • The crate does not generate randomness or nonces; AEAD nonce uniqueness is an embedding application's responsibility.
  • Applications processing untrusted messages must enforce private critical-header understanding with Header::ensure_crit_understood.
  • Optional crypto providers must reject unsupported algorithm/key combinations rather than silently falling back.

Findings

No findings

No reportable findings survived the canonical discovery, validation, and reportability gates.

Reviewed Surfaces

Surface Risk Area Outcome Notes
Signature messages and headers COSE signature integrity, protected header bytes, detached payloads, AAD, and algorithm selection No issue found Reviewed Sign1Message, SignMessage, Header, and shared structure helpers. Protected-header raw bytes are preserved for verification, detached payload APIs are explicit, crit is structurally validated, and alg selection uses protected headers. Evidence: artifacts/02_discovery/work_ledger.jsonl, artifacts/03_coverage/repository_coverage_ledger.md
MAC messages and recipients MAC authenticity, external AAD, and recipient structure No issue found Reviewed Mac0Message, MacMessage, Recipient, and KdfContext. MAC structures bind expected fields, recipients are structurally validated, and recipient cryptography is application-owned. Evidence: artifacts/02_discovery/work_ledger.jsonl, artifacts/03_coverage/repository_coverage_ledger.md
Encryption messages and nonce handling AEAD AAD, IV/Partial IV, detached ciphertext, and empty plaintext No issue found Reviewed Encrypt0Message, EncryptMessage, Encryptor, tag helpers, and nonce helpers. AAD is bound, decoded protected bytes are reused, IV/PIV conflicts and malformed sizes fail closed, and detached ciphertext APIs are explicit. Evidence: artifacts/02_discovery/work_ledger.jsonl, artifacts/03_coverage/repository_coverage_ledger.md
Optional crypto-ring providers and keys Feature gating, algorithm mapping, key material parsing, AEAD nonce size, and key-use metadata Rejected Reviewed feature gating, algorithm mapping, key parsing, AEAD nonce length, and key_ops. One candidate around key_ops enforcement was validated and rejected because key-use policy is application-owned under the current crate contract. Evidence: artifacts/02_discovery/work_ledger.jsonl, artifacts/02_discovery/raw_candidates.jsonl, artifacts/04_reconciliation/deduped_candidates.jsonl, artifacts/05_findings/cose2-crypto-key-ops-not-enforced/candidate_ledger.jsonl, artifacts/05_findings/cose2-crypto-key-ops-not-enforced/validation_report.md, artifacts/05_findings/cose2-crypto-key-ops-not-enforced/attack_path_analysis_report.md, artifacts/03_coverage/repository_coverage_ledger.md
CWT claims and validation Custom claims, temporal validation, issuer, and audience No issue found Reviewed Claims, ClaimsMap, and Validator. Custom claims are preserved and expiration, not-before, issued-at, issuer, and audience checks fail closed under the documented validator semantics. Evidence: artifacts/02_discovery/work_ledger.jsonl, artifacts/03_coverage/repository_coverage_ledger.md
Core maps, labels, tags, and public exports Duplicate labels, label type confusion, unsafe/default-safety guarantees, and public API guidance No issue found Reviewed CoseMap, Label, Error, lib.rs, tag helpers, and public guidance. Duplicate labels and label type confusion fail closed; unsafe is forbidden and default features are crypto-free. Evidence: artifacts/02_discovery/work_ledger.jsonl, artifacts/03_coverage/repository_coverage_ledger.md