[
https://issues.apache.org/jira/browse/CAMEL-26547?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen updated CAMEL-26547:
--------------------------------
Fix Version/s: 4.24.0
> camel-pqc - a stateful signature key can be loaded by two processes at once,
> so a one-time index is reused
> ----------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26547
> URL: https://issues.apache.org/jira/browse/CAMEL-26547
> Project: Camel
> Issue Type: Bug
> Components: camel-pqc
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.24.0
>
>
> XMSS, XMSSMT, LMS and HSS are one-time-signature schemes: signing twice from
> the same index breaks the key. CAMEL-25796 made the index durable within one
> JVM, but nothing stops two processes from holding the same key at the same
> time.
> * {{FileBasedKeyLifecycleManager}} takes no {{FileLock}} on the key file, so
> two containers sharing a volume both load index N and both sign from it.
> * The vault-backed managers - {{AwsSecretsManagerKeyLifecycleManager}},
> {{AzureKeyVaultKeyLifecycleManager}}, {{HashicorpVaultKeyLifecycleManager}} -
> make the situation more likely rather than less: a shared vault is the normal
> way two replicas end up with the same key.
> * {{pqc-key-lifecycle.adoc}} says "never reuse a stateful signature state
> (critical security requirement)" and then states that concurrent key
> operations are safe. That is true in-process only, and the document offers no
> mechanism and no warning for the multi-process case.
> Expected: take an exclusive lock or lease when a stateful key is loaded,
> refuse to hand out signatures (or fail the endpoint) when a stateful key
> comes from a store that cannot provide that guarantee, and document that a
> stateful key must be owned by exactly one process.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
