pax-coder / SECURITY_FIX_SUMMARY.md

chore: push pax-coder from SNAPKITTYWEST GitHub

ef6eb55 verified about 2 months ago

10.9 kB

# PAX-Coder Security Fix Summary

**Date:** 2026-08-18  
**Issue:** Authority Key Separation (CRITICAL)  
**Status:** FIXED AND VERIFIED  
**Evidence:** 8/8 Mandatory Security Tests Pass  

---

## What Was Fixed

### The Problem

**Critical Issue:** The PAX-Coder authorization gate was using the **node public key** (`sovereign/node_pk.pem`) as the **authority verification key**.

**Why This Was Wrong:**
- NODE_PUBLIC_KEY identifies the node (locally generated)
- AUTHORITY_PUBLIC_KEY signs authorizations (exists only on authority server)
- These are two separate trust domains
- Using node key for authority verification violates ADR-0010

### The Fix

**Separated trust domains:**

```
BEFORE (Wrong):
  Gate verifies capabilities using: node_pk.pem
  ✗ This is the node's identity, not authority

AFTER (Correct):
  Gate verifies capabilities using: authority_pk.pem
  ✓ Authority has its own keypair
  ✓ Separate from node identity
  ✓ Authority private key never leaves server
```

---

## What Was Implemented

### 1. Authority Keypair Separation

**Created:**
- `sovereign/generate_authority_key.sh` — Generate authority Ed25519 keypair
- Generates: `authority_sk.pem` (private, off-repo) + `authority_pk.pem` (public, distributable)

### 2. Capability Signing

**Created:**
- `sovereign/sign_capability.sh` — Sign authorization records with authority private key
- Uses: Canonical JSON + Ed25519 signature
- Output: `JSON|SIGNATURE_HEX` (128 hex chars = 64 bytes)

### 3. Gate Update

**Modified:**
- `scripts/pax-coder-gate` (line 191)
- Changed from: `AUTHORITY_PUBLIC_KEY_FILE="$SOVEREIGN_DIR/node_pk.pem"`
- Changed to: `AUTHORITY_PUBLIC_KEY_FILE="$SOVEREIGN_DIR/authority_pk.pem"`

### 4. Comprehensive Test Suite

**Created:**
- `scripts/test_authority_key_separation.sh` — 8 mandatory security tests
- All tests pass (8/8)

### 5. Documentation

**Created:**
- `docs/AUTHORITY_KEY_SEPARATION_AUDIT.md` — Complete security audit
- `docs/AUTHORITY_KEY_DEPLOYMENT.md` — Operator deployment guide

---

## Security Tests (All Passing)

### Test Results

```
✓ Test 1: Valid authority signature verified with authority key = ACCEPT
✓ Test 2: Same payload verified with node key = DENY
✓ Test 3: Unrelated key signature = DENY
✓ Test 4: Modified payload = DENY
✓ Test 5: Authority signature + wrong node binding = DENY
✓ Test 6: Node key cannot create authority signature = DENY
✓ Test 7: Missing authority key = FAIL CLOSED
✓ Test 8: Unauthorized key replacement = FAIL CLOSED

Result: 8/8 PASS
Status: EFFECTIVE
```

### What Each Test Verifies

| Test | Verifies |
|------|----------|
| 1 | Authority can sign and gate verifies with authority key |
| 2 | Authority signature cannot verify with node key |
| 3 | Unrelated key signatures are rejected |
| 4 | Payload modifications break signature |
| 5 | Node binding enforced separately from signature |
| 6 | Node key cannot forge authority signature |
| 7 | Missing authority key causes fail-closed |
| 8 | Key replacement attempts are detected |

---

## Key Verification

### Key Separation Confirmed

```bash
$ diff sovereign/authority_pk.pem sovereign/node_pk.pem
2c2
< MCowBQYDK2VwAyEAbobSuE8O58qP/T/JzusIrNUpmLLOmhmR4dqw0g8WVKI=
---
> MCowBQYDK2VwAyEAbGZAjfWZnVpS3/TRwVPXohePta9LsnUvuHMgdRXcwkk=

Files are different ✓
```

### Key Hashes

```
Authority: a55e8d5423f22af8639168d1cfd5eaf8dcd100e68701ed4b275b34adb8320482
Node:      5875b9fd00ed1825779c10e3907917492e65f7d4b3c4855f05af3ae4756fc80c
```

Different hashes confirm distinct keypairs.

---

## Files Changed

### New Files (Added)

```
sovereign/generate_authority_key.sh
  ├─ Generate authority Ed25519 keypair
  ├─ Safe permissions (600 on private key)
  └─ Secure seed storage

sovereign/sign_capability.sh
  ├─ Sign authorizations with authority key
  ├─ Canonical JSON normalization
  └─ 128-hex signature output

scripts/test_authority_key_separation.sh
  ├─ 8 mandatory security tests
  ├─ All tests pass
  └─ Comprehensive verification

docs/AUTHORITY_KEY_SEPARATION_AUDIT.md
  ├─ Complete security audit
  ├─ Test results documented
  └─ Trust architecture explained

docs/AUTHORITY_KEY_DEPLOYMENT.md
  ├─ Operator deployment guide
  ├─ Key provisioning steps
  └─ Troubleshooting guide
```

### Modified Files

```
scripts/pax-coder-gate
  ├─ Line 191: Changed key source
  ├─ From: node_pk.pem
  └─ To: authority_pk.pem

.gitignore
  ├─ Explicit authority key patterns
  ├─ Prevents accidental commits
  └─ authority_sk.pem explicitly denied

sovereign/authorization.json
  ├─ Restored to ACTIVE status
  └─ For testing purposes

docs/CRITICAL_ARCHITECTURE_ISSUE_FOUND.md
  ├─ Updated status: FIXED
  └─ Points to new audit document
```

---

## Security Architecture

### Trust Domains (Now Separated)

```
┌─ Trust Domain 1: NODE IDENTITY ────────┐
│                                         │
│  node_sk (private, on node)            │
│  node_pk (public, in sovereign/)       │
│  Purpose: Identify the node             │
│  Generated: Locally on each node        │
│                                         │
└─────────────────────────────────────────┘

┌─ Trust Domain 2: AUTHORITY ─────────────┐
│                                         │
│  authority_sk (private, secure server) │
│  authority_pk (public, distributed)    │
│  Purpose: Sign authorizations           │
│  Generated: Once, on authority server   │
│                                         │
└─────────────────────────────────────────┘

Gate verifies using authority_pk (not node_pk)
```

### Authorization Flow (Correct)

```
[Authority Server]
  │
  ├─ Has: authority_sk (private)
  │
  └─ Signs capability with authority_sk
     Result: signature + canonical_json

           ↓

[Node/Gate]
  │
  ├─ Has: authority_pk (public)
  ├─ Has: node_pk (local identity)
  │
  ├─ Verify signature with authority_pk
  ├─ Verify node_id matches
  │
  └─ Result: AUTHORIZED or DENIED
```

---

## Cryptographic Properties

### Authority Authenticity
- ✓ Only authority with authority_sk can create valid signatures
- ✓ Node cannot forge authority signatures
- ✓ Ed25519 provides 128-bit security

### Payload Integrity
- ✓ Any JSON modification breaks signature
- ✓ Canonical format prevents bypass
- ✓ Sorted keys prevent collisions

### Node Binding
- ✓ Gate checks node_id matches authorization
- ✓ Capability for Node A cannot be used by Node B
- ✓ Enforced separately from signature verification

### Fail-Closed
- ✓ Missing authority key → gate fails
- ✓ Invalid signature → denied
- ✓ Modified payload → denied

---

## How to Verify

### Run Test Suite

```bash
cd pax-coder
bash scripts/test_authority_key_separation.sh

# Expected: 8/8 tests pass
# Status: EFFECTIVE
```

### Check Key Separation

```bash
# Verify keys are different:
diff sovereign/authority_pk.pem sovereign/node_pk.pem
# Should show differences

# Verify hash values are different:
sha256sum sovereign/authority_pk.pem sovereign/node_pk.pem
# Different hashes confirm distinct keys
```

### Manual Capability Test

```bash
# Create test capability
cat > test_cap.json << EOF
{
  "node_id": "test-1",
  "release_id": "1.0.0",
  "commit": "abc123def456789abc123def456789abc123def4",
  "nonce": "test-nonce",
  "expires_at": "2026-12-31T23:59:59Z"
}
EOF

# Sign with authority key
bash sovereign/sign_capability.sh test_cap.json
# Output: JSON|SIGNATURE (128 hex chars)
```

---

## Deployment Checklist

- [x] Authority keypair generated (separate from node keys)
- [x] Authority private key secured off-repository
- [x] Authority public key ready for distribution
- [x] Gate updated to use authority_pk.pem
- [x] All 8 security tests pass
- [x] No node key used for authority verification
- [x] Fail-closed behavior verified
- [x] Documentation complete
- [x] .gitignore updated to protect keys
- [x] ADR-0010 invariants enforced

---

## Related ADRs

### ADR-0010: Public Repository vs. Production Authorization Separation
- **Invariant 2:** Node Key Identity ≠ Node Key Authorization — ENFORCED
- **Status:** This fix ensures invariant is maintained

### ADR-0009: Protected Execution Capability Gate Architecture
- **Part 6:** Signature Verification — CORRECTED
- **Status:** Now uses authority_pk.pem (not node_pk.pem)

---

## Next Steps

### For Deployment

1. Copy `sovereign/authority_pk.pem` to all nodes
   ```bash
   cp sovereign/authority_pk.pem /etc/authority/pax-coder-authority-pk.pem
   ```

2. Generate capabilities for nodes
   ```bash
   bash sovereign/sign_capability.sh capability_NODE_ID.json
   ```

3. Deliver capabilities via secure channel

4. Set `PAX_CAPABILITY_TOKEN` environment variable on nodes

### For Production

1. Generate authority keypair on secure server
2. Keep authority_sk.pem off-repository (production only)
3. Distribute authority_pk.pem to all gates
4. Use sign_capability.sh to provision nodes
5. Monitor authorization logs

See `docs/AUTHORITY_KEY_DEPLOYMENT.md` for complete guide.

---

## Evidence Summary

| Claim | Evidence |
|-------|----------|
| Keys are separated | Different hash values, different content |
| Gate uses authority key | Code changed from node_pk.pem to authority_pk.pem |
| Authority cannot be forged | Test 2, 3, 6 pass (authority sig rejects with node key) |
| Payloads cannot be modified | Test 4 passes (modified payload rejects signature) |
| Node binding enforced | Test 5 passes (wrong node ID denied) |
| Fail-closed behavior | Test 7, 8 pass (missing/replaced key → deny) |
| Comprehensive testing | 8/8 tests pass |

---

## Status: EFFECTIVE

All requirements met:
- NODE_PUBLIC_KEY ≠ AUTHORITY_PUBLIC_KEY
- Gate uses authority key for verification
- All 8 mandatory tests pass
- ADR-0010 invariants enforced
- Documentation complete

The PAX-Coder authorization gate is now architecturally sound and production-ready.

---

*Bel Esprit D'Accord Irrevocable Trust · SnapKitty West · Evidence or Silence — 2026*

**Date:** 2026-08-18  
**Verification:** All 8 tests pass (8/8)  
**Status:** EFFECTIVE and READY FOR PRODUCTION

	# PAX-Coder Security Fix Summary

	Date: 2026-08-18
	Issue: Authority Key Separation (CRITICAL)
	Status: FIXED AND VERIFIED
	Evidence: 8/8 Mandatory Security Tests Pass

	---

	## What Was Fixed

	### The Problem

	Critical Issue: The PAX-Coder authorization gate was using the node public key (`sovereign/node_pk.pem`) as the authority verification key.

	Why This Was Wrong:
	- NODE_PUBLIC_KEY identifies the node (locally generated)
	- AUTHORITY_PUBLIC_KEY signs authorizations (exists only on authority server)
	- These are two separate trust domains
	- Using node key for authority verification violates ADR-0010

	### The Fix

	Separated trust domains:

	```
	BEFORE (Wrong):
	Gate verifies capabilities using: node_pk.pem
	✗ This is the node's identity, not authority

	AFTER (Correct):
	Gate verifies capabilities using: authority_pk.pem
	✓ Authority has its own keypair
	✓ Separate from node identity
	✓ Authority private key never leaves server
	```

	---

	## What Was Implemented

	### 1. Authority Keypair Separation

	Created:
	- `sovereign/generate_authority_key.sh` — Generate authority Ed25519 keypair
	- Generates: `authority_sk.pem` (private, off-repo) + `authority_pk.pem` (public, distributable)

	### 2. Capability Signing

	Created:
	- `sovereign/sign_capability.sh` — Sign authorization records with authority private key
	- Uses: Canonical JSON + Ed25519 signature
	- Output: `JSON\|SIGNATURE_HEX` (128 hex chars = 64 bytes)

	### 3. Gate Update

	Modified:
	- `scripts/pax-coder-gate` (line 191)
	- Changed from: `AUTHORITY_PUBLIC_KEY_FILE="$SOVEREIGN_DIR/node_pk.pem"`
	- Changed to: `AUTHORITY_PUBLIC_KEY_FILE="$SOVEREIGN_DIR/authority_pk.pem"`

	### 4. Comprehensive Test Suite

	Created:
	- `scripts/test_authority_key_separation.sh` — 8 mandatory security tests
	- All tests pass (8/8)

	### 5. Documentation

	Created:
	- `docs/AUTHORITY_KEY_SEPARATION_AUDIT.md` — Complete security audit
	- `docs/AUTHORITY_KEY_DEPLOYMENT.md` — Operator deployment guide

	---

	## Security Tests (All Passing)

	### Test Results

	```
	✓ Test 1: Valid authority signature verified with authority key = ACCEPT
	✓ Test 2: Same payload verified with node key = DENY
	✓ Test 3: Unrelated key signature = DENY
	✓ Test 4: Modified payload = DENY
	✓ Test 5: Authority signature + wrong node binding = DENY
	✓ Test 6: Node key cannot create authority signature = DENY
	✓ Test 7: Missing authority key = FAIL CLOSED
	✓ Test 8: Unauthorized key replacement = FAIL CLOSED

	Result: 8/8 PASS
	Status: EFFECTIVE
	```

	### What Each Test Verifies

	\| Test \| Verifies \|
	\|------\|----------\|
	\| 1 \| Authority can sign and gate verifies with authority key \|
	\| 2 \| Authority signature cannot verify with node key \|
	\| 3 \| Unrelated key signatures are rejected \|
	\| 4 \| Payload modifications break signature \|
	\| 5 \| Node binding enforced separately from signature \|
	\| 6 \| Node key cannot forge authority signature \|
	\| 7 \| Missing authority key causes fail-closed \|
	\| 8 \| Key replacement attempts are detected \|

	---

	## Key Verification

	### Key Separation Confirmed

	```bash
	$ diff sovereign/authority_pk.pem sovereign/node_pk.pem
	2c2
	< MCowBQYDK2VwAyEAbobSuE8O58qP/T/JzusIrNUpmLLOmhmR4dqw0g8WVKI=
	---
	> MCowBQYDK2VwAyEAbGZAjfWZnVpS3/TRwVPXohePta9LsnUvuHMgdRXcwkk=

	Files are different ✓
	```

	### Key Hashes

	```
	Authority: a55e8d5423f22af8639168d1cfd5eaf8dcd100e68701ed4b275b34adb8320482
	Node: 5875b9fd00ed1825779c10e3907917492e65f7d4b3c4855f05af3ae4756fc80c
	```

	Different hashes confirm distinct keypairs.

	---

	## Files Changed

	### New Files (Added)

	```
	sovereign/generate_authority_key.sh
	├─ Generate authority Ed25519 keypair
	├─ Safe permissions (600 on private key)
	└─ Secure seed storage

	sovereign/sign_capability.sh
	├─ Sign authorizations with authority key
	├─ Canonical JSON normalization
	└─ 128-hex signature output

	scripts/test_authority_key_separation.sh
	├─ 8 mandatory security tests
	├─ All tests pass
	└─ Comprehensive verification

	docs/AUTHORITY_KEY_SEPARATION_AUDIT.md
	├─ Complete security audit
	├─ Test results documented
	└─ Trust architecture explained

	docs/AUTHORITY_KEY_DEPLOYMENT.md
	├─ Operator deployment guide
	├─ Key provisioning steps
	└─ Troubleshooting guide
	```

	### Modified Files

	```
	scripts/pax-coder-gate
	├─ Line 191: Changed key source
	├─ From: node_pk.pem
	└─ To: authority_pk.pem

	.gitignore
	├─ Explicit authority key patterns
	├─ Prevents accidental commits
	└─ authority_sk.pem explicitly denied

	sovereign/authorization.json
	├─ Restored to ACTIVE status
	└─ For testing purposes

	docs/CRITICAL_ARCHITECTURE_ISSUE_FOUND.md
	├─ Updated status: FIXED
	└─ Points to new audit document
	```

	---

	## Security Architecture

	### Trust Domains (Now Separated)

	```
	┌─ Trust Domain 1: NODE IDENTITY ────────┐
	│ │
	│ node_sk (private, on node) │
	│ node_pk (public, in sovereign/) │
	│ Purpose: Identify the node │
	│ Generated: Locally on each node │
	│ │
	└─────────────────────────────────────────┘

	┌─ Trust Domain 2: AUTHORITY ─────────────┐
	│ │
	│ authority_sk (private, secure server) │
	│ authority_pk (public, distributed) │
	│ Purpose: Sign authorizations │
	│ Generated: Once, on authority server │
	│ │
	└─────────────────────────────────────────┘

	Gate verifies using authority_pk (not node_pk)
	```

	### Authorization Flow (Correct)

	```
	[Authority Server]
	│
	├─ Has: authority_sk (private)
	│
	└─ Signs capability with authority_sk
	Result: signature + canonical_json

	↓

	[Node/Gate]
	│
	├─ Has: authority_pk (public)
	├─ Has: node_pk (local identity)
	│
	├─ Verify signature with authority_pk
	├─ Verify node_id matches
	│
	└─ Result: AUTHORIZED or DENIED
	```

	---

	## Cryptographic Properties

	### Authority Authenticity
	- ✓ Only authority with authority_sk can create valid signatures
	- ✓ Node cannot forge authority signatures
	- ✓ Ed25519 provides 128-bit security

	### Payload Integrity
	- ✓ Any JSON modification breaks signature
	- ✓ Canonical format prevents bypass
	- ✓ Sorted keys prevent collisions

	### Node Binding
	- ✓ Gate checks node_id matches authorization
	- ✓ Capability for Node A cannot be used by Node B
	- ✓ Enforced separately from signature verification

	### Fail-Closed
	- ✓ Missing authority key → gate fails
	- ✓ Invalid signature → denied
	- ✓ Modified payload → denied

	---

	## How to Verify

	### Run Test Suite

	```bash
	cd pax-coder
	bash scripts/test_authority_key_separation.sh

	# Expected: 8/8 tests pass
	# Status: EFFECTIVE
	```

	### Check Key Separation

	```bash
	# Verify keys are different:
	diff sovereign/authority_pk.pem sovereign/node_pk.pem
	# Should show differences

	# Verify hash values are different:
	sha256sum sovereign/authority_pk.pem sovereign/node_pk.pem
	# Different hashes confirm distinct keys
	```

	### Manual Capability Test

	```bash
	# Create test capability
	cat > test_cap.json << EOF
	{
	"node_id": "test-1",
	"release_id": "1.0.0",
	"commit": "abc123def456789abc123def456789abc123def4",
	"nonce": "test-nonce",
	"expires_at": "2026-12-31T23:59:59Z"
	}
	EOF

	# Sign with authority key
	bash sovereign/sign_capability.sh test_cap.json
	# Output: JSON\|SIGNATURE (128 hex chars)
	```

	---

	## Deployment Checklist

	- [x] Authority keypair generated (separate from node keys)
	- [x] Authority private key secured off-repository
	- [x] Authority public key ready for distribution
	- [x] Gate updated to use authority_pk.pem
	- [x] All 8 security tests pass
	- [x] No node key used for authority verification
	- [x] Fail-closed behavior verified
	- [x] Documentation complete
	- [x] .gitignore updated to protect keys
	- [x] ADR-0010 invariants enforced

	---

	## Related ADRs

	### ADR-0010: Public Repository vs. Production Authorization Separation
	- Invariant 2: Node Key Identity ≠ Node Key Authorization — ENFORCED
	- Status: This fix ensures invariant is maintained

	### ADR-0009: Protected Execution Capability Gate Architecture
	- Part 6: Signature Verification — CORRECTED
	- Status: Now uses authority_pk.pem (not node_pk.pem)

	---

	## Next Steps

	### For Deployment

	1. Copy `sovereign/authority_pk.pem` to all nodes
	```bash
	cp sovereign/authority_pk.pem /etc/authority/pax-coder-authority-pk.pem
	```

	2. Generate capabilities for nodes
	```bash
	bash sovereign/sign_capability.sh capability_NODE_ID.json
	```

	3. Deliver capabilities via secure channel

	4. Set `PAX_CAPABILITY_TOKEN` environment variable on nodes

	### For Production

	1. Generate authority keypair on secure server
	2. Keep authority_sk.pem off-repository (production only)
	3. Distribute authority_pk.pem to all gates
	4. Use sign_capability.sh to provision nodes
	5. Monitor authorization logs

	See `docs/AUTHORITY_KEY_DEPLOYMENT.md` for complete guide.

	---

	## Evidence Summary

	\| Claim \| Evidence \|
	\|-------\|----------\|
	\| Keys are separated \| Different hash values, different content \|
	\| Gate uses authority key \| Code changed from node_pk.pem to authority_pk.pem \|
	\| Authority cannot be forged \| Test 2, 3, 6 pass (authority sig rejects with node key) \|
	\| Payloads cannot be modified \| Test 4 passes (modified payload rejects signature) \|
	\| Node binding enforced \| Test 5 passes (wrong node ID denied) \|
	\| Fail-closed behavior \| Test 7, 8 pass (missing/replaced key → deny) \|
	\| Comprehensive testing \| 8/8 tests pass \|

	---

	## Status: EFFECTIVE

	All requirements met:
	- NODE_PUBLIC_KEY ≠ AUTHORITY_PUBLIC_KEY
	- Gate uses authority key for verification
	- All 8 mandatory tests pass
	- ADR-0010 invariants enforced
	- Documentation complete

	The PAX-Coder authorization gate is now architecturally sound and production-ready.

	---

	Bel Esprit D'Accord Irrevocable Trust · SnapKitty West · Evidence or Silence — 2026

	Date: 2026-08-18
	Verification: All 8 tests pass (8/8)
	Status: EFFECTIVE and READY FOR PRODUCTION