This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-wss4j.git
The following commit(s) were added to refs/heads/master by this push:
new d2a7450e8 Updating threat model with bounds
d2a7450e8 is described below
commit d2a7450e83bd61cd2ac9cb5550df9caa31aa4c46
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Mon Sep 21 07:33:40 2026 +0100
Updating threat model with bounds
---
THREAT-MODEL.md | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/THREAT-MODEL.md b/THREAT-MODEL.md
index ba981e41a..c7884d411 100644
--- a/THREAT-MODEL.md
+++ b/THREAT-MODEL.md
@@ -380,6 +380,20 @@ on each is captured in §14 Q10–Q11.
bound on signed-data compression
*(documented: `ws-security-stax/.../wss-config-compression.xml`,
exercised by `VulnerabliltyVectorsDecompressedBytesTest`)*.
+- The shared derived-key derivation bounds the `wsc:Length` of a
+ DerivedKeyToken to between `MINIMUM_DERIVED_KEY_LENGTH` (16 bytes) and
+ `MAXIMUM_DERIVED_KEY_LENGTH` (512), and its `wsc:Offset` to at most
+ `MAXIMUM_DERIVED_KEY_OFFSET` (4096) *(`DerivedKeyUtils`, exercised by
+ `DerivedKeyUtilsTest`)*. Both values are attacker-controlled message
+ content: without a ceiling the derivation is an amplifier, and without a
+ floor a one-byte HMAC key is a forgeable signature (CVE-2026-85532).
+- A UsernameToken's `wsse11:Iteration` is capped at
+ `UsernameTokenUtil.MAX_ITERATION` (10000) in both engines, the
+ derivation performing one SHA-1 round per iteration *(`UsernameToken`
+ for DOM, `UsernameSecurityTokenImpl` for StAX)*.
+- Transported symmetric key material is capped at 1024 bytes, and must
+ otherwise match exactly the length its algorithm requires
+ *(`KeyUtils.prepareSecretKey`)*.
- The DOM engine bounds how deeply a message may nest tokens inside
tokens. A processor that uncovers a security structure inside the one
it is processing hands it to the processor for that structure, which
