rajames/LithosAnanke
1
1
Fork 0
Code Issues 76 Pull Requests 1 Actions Packages Projects 1 Releases 6 Activity

fix(v4): the identity code wipes Zuse's seed after every drive it handles (#176, the identity code)

Browse Source 
sk_v4_genesis never wiped its seed or its read-back; sk_v4_drive_arrived
never wiped the proxy's seed after her login; sk_v4_real_zuse_arrived wiped
the seed only on a match. (The logged-in Zuse's own key stays in g_zuse_seed,
by design.)

Option 1: the three use one buffer the identity module owns, g_seeds (seed,
then its read-back), and sk_v4_drive_arrived -- which every drive goes through,
and which alone calls the other two -- runs the drive's handling (now
handle_drive()) and then wipes it, whichever way it went.
sk_v4_identity_seeds() lets the host tests read it.

kernel/tests/test_sk_v4_identity.c, 10 checks, through the real drive-arrival
path: a fake xHCI controller marks a slot attach-pending, the identity code's
idle beat handles it, the real gpt.c reads the stick's table from the RAM disk;
the block layer, signatures, key mint, marker and console faked. Genesis; a
genesis not read back; the proxy logging in; a real Zuse named, then her stick
logging in. Against the code before the wipe: 5 failures (every case's seeds
left). Now: 0. The harness gains fake_disk_bind. Built for amd64, aarch64,
riscv64. #176 done with 2bac2ac8 (the mint).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm
This commit is contained in:
Claude
2026-11-12 18:20:09 +00:00
parent 2bac2ac8fc
commit d7b2f6bf54
8 changed files with 196 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/src/v4/sk_v4_identity.c
+26 -6
View File
@@ -66,6 +66,11 @@
static int g_zuse_session;
static int g_zuse_cert_installed;
static uint8_t g_zuse_seed[32], g_zuse_pubkey[32];
/* The seed being minted or read, and its read-back, while a drive is handled: seed the first 32
* bytes, rseed the next 32 (#176). The logged-in Zuse's own is g_zuse_seed, kept by design. */
static uint8_t g_seeds[64];
const uint8_t *sk_v4_identity_seeds(void) { return g_seeds; }
static uint8_t g_zuse_root_pubkey[32];
static int g_zuse_root_known;
static struct blkio_dev *g_zuse_dev;
@@ -242,7 +247,8 @@ static void sk_v4_login(blkio_dev_t *dev, const uint8_t seed[32], const uint8_t
* system headless. Returns 1 when she is logged in. */
static int sk_v4_genesis(blkio_dev_t *dev, blkio_dev_t *art)
{
uint8_t seed[32], pubkey[32], rseed[32], rpub[32];
uint8_t pubkey[32], rpub[32];
uint8_t *seed = g_seeds, *rseed = g_seeds + 32;
homeblocks_sig_t sig;
homeblocks_sig_result_t sig_rc;
uint32_t lbn, nblk;
@@ -289,7 +295,8 @@ static int sk_v4_real_zuse_arrived(sk_v4_drive_t *d, unsigned nparts)
{
homeblocks_sig_t sig;
homeblocks_sig_result_t sig_rc;
uint8_t seed[32], pubkey[32];
uint8_t pubkey[32];
uint8_t *seed = g_seeds;
int ii = gpt_find(g_gpt_parts, nparts, gpt_type_starship_identity);
if (!g_marker.present || !g_marker.has_real || ii < 0) return 0;
@@ -307,21 +314,23 @@ static int sk_v4_real_zuse_arrived(sk_v4_drive_t *d, unsigned nparts)
g_real_drive = d;
g_proxy_fallback = 0;
sk_v4_login(&d->part, seed, pubkey, "Zuse: identity confirmed from attached thumbdrive");
memset(seed, 0, sizeof seed);
memset(seed, 0, 32);
return 1;
}
/* A drive that has arrived. This system's stick: its Artemis partition is
* attached (the first disk slot, the block subsystem's), Zuse's public key is
* read from its genesis marker, then its identity partition is attached and,
* if it is Zuse's, her session begins. Any other drive is not used. */
static int sk_v4_drive_arrived(sk_v4_drive_t *d)
* if it is Zuse's, her session begins. Any other drive is not used.
* Called only by sk_v4_drive_arrived, which wipes g_seeds after it (#176). */
static int handle_drive(sk_v4_drive_t *d)
{
blkio_dev_t *dev;
homeblocks_sig_t sig;
homeblocks_sig_result_t sig_rc;
artemis_sig_t asig;
uint8_t seed[32], pubkey[32];
uint8_t pubkey[32];
uint8_t *seed = g_seeds;
zuse_drive_t which;
unsigned nparts;
int gpt_rc;
@@ -432,6 +441,17 @@ static int sk_v4_drive_arrived(sk_v4_drive_t *d)
return 1;
}
/* One place wipes the seeds, after every drive handled: genesis (seed and its read-back), the
* proxy's login and the real Zuse's (sk_v4_genesis, sk_v4_real_zuse_arrived, handle_drive) --
* whichever way each went. The logged-in Zuse's own key stays in g_zuse_seed, by design; the
* working copies did not, and were left in memory (#176). */
static int sk_v4_drive_arrived(sk_v4_drive_t *d)
{
int rc = handle_drive(d);
memset(g_seeds, 0, sizeof g_seeds);
return rc;
}
/* A drive that has left: its identity partition is let go, then its Artemis
* partition -- in that order, because blk_subsys_detach_device() removes
* only the chain's tail, and the identity partition was attached last. */