polyengine host: key seams extend to every slot-determined kind; provenance goes uniform - #393
Merged
Conversation
…enance goes uniform (#391) Tier rule, stated once in signature.ts's seams block: fromCryptoKey exists exactly where the platform key's slots fully determine the mint record and policy. That admits HMAC (sign/verify 1:1), AES-KW (wrap/unwrap 1:1), PBKDF2 (derive usages 1:1), and RSASSA-PKCS1-v1_5 on the existing signature classes (hash/modulus/exponent all ride RsaHashedKeyAlgorithm; admission calls the mint path's own validators, including the RSA private-key posture, so injection cannot bypass a declined operation). It excludes, with the file:line facts written down: AEAD, AES-CBC/CTR and RSA-OAEP's private half (mint policy COLLAPSES into fewer platform usages - seal|wrap -> encrypt - so a bare key underdetermines it), key agreement (constant platform usages; policy lives only in the WeakMap), and ECDSA/RSA-PSS (mint bindings the key does not carry). Admitting an excluded kind needs a policy/bindings parameter whose design waits for a consumer. Constructor provenance is now uniform: every CryptoKey-holding class is token-gated (MINT, src/internal.ts, unexported) or WeakMap-stated - 44 internal mint sites updated, shared seam plumbing consolidated in internal.ts (launder, shape gates, the at-least-one-usage rule). Gates: deno task check/test 38/38; conformance-ct::run-polyengine byte-identical to the pre-round baseline under git stash on all eight counts - with 44 mint call sites rewritten, the proof they all still mint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Round 2 of #391, on top of #392 (merged mid-round — hence the fresh branch).
The tier rule, now written in signature.ts's seams block:
fromCryptoKeyexists exactly where the platform key's slots fully determine the mint record and policy.Admitted this round:
MacKey.fromCryptoKey/toCryptoKey— HMAC; sign/verify usages are 1:1 with mint policy; served digest set read from the mint tables (SHA-1 + SHA-2 family), length rules mirrored.KwKey.fromCryptoKey/toCryptoKey— AES-KW; wrap/unwrap 1:1; served lengths (128/256, aes192 declined) from the mint's own table.Password.fromCryptoKey/toCryptoKey— PBKDF2; derive usages 1:1; WeakMap-stated likeIkm.SigningKey/VerifyingKey.fromCryptoKeywiden to RSASSA-PKCS1-v1_5: hash/modulus/exponent all rideRsaHashedKeyAlgorithm, and admission calls the mint path's own validators (RSA_VARIANTS,rsaAdmittedModulusLengthwith the private-signing vs public-verification windows, andrequireRsaPrivateKeysServed— so an embedding that declined RSA private-key operations can't have the decline bypassed by injection). The record is built byrsaSigningAlgorithm, the same builder the import paths use.Excluded, with the facts written down where the next person will look: AEAD, AES-CBC/CTR, and RSA-OAEP's private half (mint policy collapses into fewer platform usages —
seal||wrap → "encrypt"— so a bare key underdetermines it); key agreement (constant platform usages; policy lives only in the WeakMap); ECDSA/RSA-PSS (mint bindings the key doesn't carry). Admitting any of these needs a policy/bindings parameter whose design waits for a consumer; the mint-options resources are the anticipated shape.Provenance goes uniform: every CryptoKey-holding class is now token-gated (
MINT) or WeakMap-stated — 44 internal mint sites updated across the aead/cipher/keyWrap/publicEncryption/keyAgreement/ecdh families; shared seam plumbing (launder, shape gates, at-least-one-usage) consolidated insrc/internal.ts(still unexported, still unforgeable via thedeno.jsonexports gate).Gates:
deno task check/test38/38 (21 seam cases now, incl. RSASSA-2048 round trip, KW wrap/unwrap through an extract/inject cycle, PBKDF2 derives-equals-platform, and a provenance sweep over all gated classes);conformance-ct::run-polyenginebyte-identical on all eight counts to the pre-round baseline undergit stash— with 44 mint call sites rewritten, that's the proof they all still mint.One structural note for review: signature.ts ↔ rsaSignature.ts is now an import cycle (the RSASSA admission lives with the family's validators; importing rather than restating them is the point). Safe by evaluation order — neither module reads the other's bindings at module-evaluation time — and documented at the import site.