From f3c72863474c7d7db7d39d09c705f84c0f7599b9 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Sat, 7 Nov 2026 10:17:56 -0800 Subject: [PATCH 1/2] chore(quest): plan CBC and rustls security checks Co-Authored-By: Codex --- quest/m3/README.md | 6 ++++-- quest/m3/cbc-padding-oracle.md | 15 +++++++++++++++ quest/m3/rustls-provider-panics.md | 15 +++++++++++++++ 3 files changed, 34 insertions(+), 2 deletions(-) create mode 100644 quest/m3/cbc-padding-oracle.md create mode 100644 quest/m3/rustls-provider-panics.md diff --git a/quest/m3/README.md b/quest/m3/README.md index 25fca3fa9..97efc562a 100644 --- a/quest/m3/README.md +++ b/quest/m3/README.md @@ -2,8 +2,8 @@ ## Goal -Work that waits on something besides priority: an outside party, an upstream -release, or a consumer that does not exist yet. +Work deferred by priority or waiting on an outside party, an upstream release, +or a consumer that does not exist yet. ## Plan @@ -13,6 +13,8 @@ quest names how to check it and is deleted once it holds. ## Required +- [Check CBC consumers for padding-oracle exposure](/quest/m3/cbc-padding-oracle.md) - confirm current callers authenticate before exposing padding failures, and fix a reachable defect +- [Check rustls provider panic reachability](/quest/m3/rustls-provider-panics.md) - trace malformed peer input to the adapter's key and IV conversions, and fix a reachable defect - [armv7 debug ctgrind, end of m2](/quest/m3/armv7-debug-ct.md) - recurring check that armv7 stays constant-time in debug builds - [cargo-llvm-cov builds with its tests again](/quest/m3/cargo-llvm-cov-check.md) - waiting on a nixpkgs rustc fix, then drop the doCheck override - [instant-acme 0.9 is released](/quest/m3/instant-acme-release.md) - waiting on the release with a pluggable `CryptoProvider` diff --git a/quest/m3/cbc-padding-oracle.md b/quest/m3/cbc-padding-oracle.md new file mode 100644 index 000000000..e47c704d5 --- /dev/null +++ b/quest/m3/cbc-padding-oracle.md @@ -0,0 +1,15 @@ +# [XS] Check CBC consumers for padding-oracle exposure + +## Goal + +No current consumer of rind's AES-CBC exposes a distinguishable padding result for attacker-controlled ciphertext before authenticating it. Reproduce and fix any reachable defect; otherwise close this quest with the evidence. + +## Plan + +- Trace current production callers of `cipher::AesCbcDecryptingKey`, including adapters and their downstream use, to the point where a decryption failure can be observed. +- [The AES-CBC PR](https://github.com/moq-dev/rind/pull/381) deliberately kept the generic unauthenticated primitive and documented its padding-oracle risk. That risk alone is not a defect to fix here. +- Change a consumer only if its actual input and error path exposes the oracle. Reproduce that path before the fix and verify the result after it. Leave a broader rind API redesign for a separate decision if the evidence calls for one. + +## Related + +- [Test coverage audit](/quest/m3/confidence/audit.md) - maps primitive tests across backends, rather than consumer misuse diff --git a/quest/m3/rustls-provider-panics.md b/quest/m3/rustls-provider-panics.md new file mode 100644 index 000000000..fe0e3c801 --- /dev/null +++ b/quest/m3/rustls-provider-panics.md @@ -0,0 +1,15 @@ +# [S] Check rustls provider panic reachability + +## Goal + +Malformed peer input cannot reach the `rind-rustls` AEAD key or IV conversions that use `unwrap`. Reproduce and fix any reachable panic; otherwise close this quest with the input-provenance and trait-contract evidence. + +## Plan + +- Trace `rind-rustls/src/aead.rs`'s `aead_key` and TLS 1.2 IV conversions from rustls's key schedule and public provider traits. Check whether a peer, a caller using the provider normally, or only a direct trait caller can supply malformed lengths. +- Compare the rustls 0.23 provider contract and its built-in providers. Exercise a malformed path only where the contract permits it; reproduce any reachable panic before fixing it. +- If the only concern is direct misuse outside rustls's contract, record that boundary and close this quest. Plan broader rind-specific API hardening separately if the evidence warrants it. + +## Related + +- [Test coverage audit](/quest/m3/confidence/audit.md) - maps primitive tests rather than adapter input provenance From 0170b71a5a0ce8310a269d5e57041a0f1589f4f7 Mon Sep 17 00:00:00 2001 From: quest fixer Date: Sat, 7 Nov 2026 15:37:29 -0800 Subject: [PATCH 2/2] docs(quest): follow completed coverage audit to TESTING.md --- quest/m3/cbc-padding-oracle.md | 2 +- quest/m3/rustls-provider-panics.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/quest/m3/cbc-padding-oracle.md b/quest/m3/cbc-padding-oracle.md index e47c704d5..5606898be 100644 --- a/quest/m3/cbc-padding-oracle.md +++ b/quest/m3/cbc-padding-oracle.md @@ -12,4 +12,4 @@ No current consumer of rind's AES-CBC exposes a distinguishable padding result f ## Related -- [Test coverage audit](/quest/m3/confidence/audit.md) - maps primitive tests across backends, rather than consumer misuse +- [Test coverage](/TESTING.md) - maps primitive tests across backends, rather than consumer misuse diff --git a/quest/m3/rustls-provider-panics.md b/quest/m3/rustls-provider-panics.md index fe0e3c801..bd627b33f 100644 --- a/quest/m3/rustls-provider-panics.md +++ b/quest/m3/rustls-provider-panics.md @@ -12,4 +12,4 @@ Malformed peer input cannot reach the `rind-rustls` AEAD key or IV conversions t ## Related -- [Test coverage audit](/quest/m3/confidence/audit.md) - maps primitive tests rather than adapter input provenance +- [Test coverage](/TESTING.md) - maps primitive tests rather than adapter input provenance