Andrea Cosentino created CAMEL-26547:
----------------------------------------
Summary: camel-pqc - a stateful signature key can be loaded by two
processes at once, so a one-time index is reused
Key: CAMEL-26547
URL: https://issues.apache.org/jira/browse/CAMEL-26547
Project: Camel
Issue Type: Bug
Components: camel-pqc
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
XMSS, XMSSMT, LMS and HSS are one-time-signature schemes: signing twice from
the same index breaks the key. CAMEL-25796 made the index durable within one
JVM, but nothing stops two processes from holding the same key at the same time.
* {{FileBasedKeyLifecycleManager}} takes no {{FileLock}} on the key file, so
two containers sharing a volume both load index N and both sign from it.
* The vault-backed managers - {{AwsSecretsManagerKeyLifecycleManager}},
{{AzureKeyVaultKeyLifecycleManager}}, {{HashicorpVaultKeyLifecycleManager}} -
make the situation more likely rather than less: a shared vault is the normal
way two replicas end up with the same key.
* {{pqc-key-lifecycle.adoc}} says "never reuse a stateful signature state
(critical security requirement)" and then states that concurrent key operations
are safe. That is true in-process only, and the document offers no mechanism
and no warning for the multi-process case.
Expected: take an exclusive lock or lease when a stateful key is loaded, refuse
to hand out signatures (or fail the endpoint) when a stateful key comes from a
store that cannot provide that guarantee, and document that a stateful key must
be owned by exactly one process.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
