test(xtest): demonstrate session-key audit gap against unpatched web-sdk - #572
test(xtest): demonstrate session-key audit gap against unpatched web-sdk#572dmihalcik-virtru wants to merge 1 commit into
Conversation
Adds test_session_key_ec_roundtrip, a sibling of test_session_key_rsa_roundtrip and test_session_key_mlkem_roundtrip, isolating the gap documented in assert_rewrap_session_key_type()'s TODO into its own unambiguous test. Expected to fail when run with an unpatched web-sdk (main) as the decrypt SDK, paired with a platform build that emits eventMetaData.sessionKeyType (opentdf/platform#3814): web-sdk main silently ignores the requested session-key algorithm on EC rewrap and always negotiates rsa:2048 instead of the requested ec:secp256r1 -- the same bug already fixed in opentdf/web-sdk#975 (untested there, since that fix hasn't merged). Reproduced locally: passes for go/java (all branch combos) and for web-sdk's PR branch, fails specifically for js@main: FAILED test_pqc.py::test_session_key_ec_roundtrip[small-js@refs--pull--975--head-js@main-in_focus0] FAILED test_pqc.py::test_session_key_ec_roundtrip[small-js@main-js@main-in_focus0] AssertionError: Expected rewrap session_key_type='ec:secp256r1', but platform reported {'rsa:2048'} This commit is intentionally stacked on top of (not merged into) DSPX-4221-pq-sessions, as a linkable reproduction of a known, tracked gap -- not part of the feature itself. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
|
Reproduced in CI: triggered Run: https://github.com/opentdf/tests/actions/runs/30833192027
(Note for reproducing this yourself: |
1 participant
Stacked on #571 — do not merge into
maindirectly.Adds
test_session_key_ec_roundtrip, isolating a known gap flagged in that PR's review (see theTODO(DSPX-4221)inassert_rewrap_session_key_type(),xtest/audit_logs.py): the audit-log assertion added for ML-KEM/RSA/EC session keys can't statically tell "platform too old to emiteventMetaData.sessionKeyType" apart from "platform new enough, but the client sent the wrong session-key type" — there's no released platform version yet to gate on (opentdf/platform#3814 is still unmerged).That gap is real, not hypothetical:
web-sdkatmainsilently ignores the requested session-key algorithm on EC rewrap and always negotiatesrsa:2048, regardless of what's requested — the same bug already fixed in opentdf/web-sdk#975, just not yet merged tomain. Against today's unpatched platform CI matrix, this is invisible (the field is absent for every rewrap, so the assertion falls back to a warning). Paired with a patched platform (opentdf/platform#3814's branch), it's a hard failure:Reproduced locally against go/java (all branch combos, all pass) and web-sdk's own PR branch (passes) — fails specifically for
js@main.To reproduce in CI, trigger
xtest.ymlviaworkflow_dispatchon this branch withplatform-ref: pr:3814,js-ref: main,focus-sdk: js.Purpose: give the TODO in #571 something concrete to link to, and a CI job that will go green on its own once opentdf/web-sdk#975 merges (or start reliably red-flagging regressions once opentdf/platform#3814 releases and the TODO's version gate lands).