(tooling-agents) branch main updated: ASVS L3 audit: 11.3.1 (vote_encryption_and_crypto)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 4bf6b40  ASVS L3 audit: 11.3.1 (vote_encryption_and_crypto)
4bf6b40 is described below

commit 4bf6b40e0f3a03c962e0a903849f5ec6e7008b1f
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Wed Apr 22 02:42:06 2026 +0200

    ASVS L3 audit: 11.3.1 (vote_encryption_and_crypto)
---
 .../d0aa7e9/vote_encryption_and_crypto/11.3.1.md   | 193 +++++++++++++++++++++
 1 file changed, 193 insertions(+)

diff --git a/repos/apache/ASVS/reports/steve/v3/d0aa7e9/vote_encryption_and_crypto/11.3.1.md b/repos/apache/ASVS/reports/steve/v3/d0aa7e9/vote_encryption_and_crypto/11.3.1.md
new file mode 100644
index 0000000..e933f35
--- /dev/null
+++ b/repos/apache/ASVS/reports/steve/v3/d0aa7e9/vote_encryption_and_crypto/11.3.1.md
@@ -0,0 +1,193 @@
+# ASVS 11.3.1 Security Audit Report
+
+## Executive Summary
+
+**Audit Metadata:**
+- **Repository:** apache/steve
+- **Audit Date:** Apr 22, 2026
+- **Auditor:** Tooling Agents
+- **ASVS Requirement:** 11.3.1 — Verify that insecure block modes (e.g., ECB) and weak padding schemes (e.g., PKCS#1 v1.5) are not used.
+  - **Level:** 1
+  - **Section:** Encryption Algorithms
+  - **Section Description:** Authenticated encryption algorithms built on AES and CHACHA20 form the backbone of modern cryptographic practice.
+  - **Chapter:** Cryptography
+  - **Control Objective:** The objective of this chapter is to define best practices for the general use of cryptography, as well as to instill a fundamental understanding of cryptographic principles and inspire a shift toward more resilient and modern approaches. It encourages the following:
+    - Implementing robust cryptographic systems that fail securely, adapt to evolving threats, and are future-proof.
+    - Utilizing cryptographic mechanisms that are both secure and aligned with industry best practices.
+    - Maintaining a secure cryptographic key management system with appropriate access controls and auditing.
+    - Regularly evaluating the cryptographic landscape to assess new risks and adapt algorithms accordingly.
+    - Discovering and managing cryptographic use cases throughout the application's lifecycle to ensure that all cryptographic assets are accounted for and secured.
+
+**Files Analyzed:** 4 relevant out of 4 total, 0 skipped
+
+**Finding Counts:**
+
+| Severity | Count |
+|----------|-------|
+| Critical | 0 |
+| High | 0 |
+| Medium | 0 |
+| Low | 0 |
+
+**Summary:**
+
+After thorough analysis of the cryptographic implementation across all provided source files, **no CRITICAL findings** were identified for ASVS 11.3.1. The system does not use ECB mode or PKCS#1 v1.5 padding. The sole encryption mechanism is Python's `cryptography.fernet.Fernet`, which implements AES-128-CBC with HMAC-SHA256 in an Encrypt-then-MAC construction (authenticated encryption), avoiding the padding oracle vulnerabilities that would be present with unauthenticated CBC.
+
+---
+
+## Security Controls Inventory
+
+| Control | Location | Purpose | Coverage Status |
+|---------|----------|---------|-----------------|
+| Symmetric encryption via Fernet (AES-128-CBC + HMAC-SHA256) | `crypto.py:create_vote()` (L~75), `crypto.py:decrypt_votestring()` (L~83) | Vote encryption/decryption with authenticated encryption | ✅ All vote encryption/decryption paths |
+| Key derivation via HKDF-SHA256 | `crypto.py:_b64_vote_key()` (L~60) | Secure derivation of Fernet encryption keys | ✅ All Fernet key generation paths |
+| Hashing via Argon2 | `crypto.py:_hash()` (L~91) | Password/token hashing for `gen_opened_key()`, `gen_vote_token()` | ✅ All hash generation paths |
+| BLAKE2b pre-hashing | `crypto.py:gen_opened_key()` (L~40) | Election data integrity hashing | ✅ Election data hashing only |
+| No RSA or asymmetric encryption | Entire codebase | N/A — eliminates PKCS#1 v1.5 risk | ✅ N/A — PKCS#1 v1.5 cannot occur |
+
+**Coverage Analysis:**
+
+All encryption entry points flow through a single code path:
+
+```
+election.py:add_vote() → crypto.create_vote() → Fernet.encrypt()
+election.py:tally_issue() → crypto.decrypt_votestring() → Fernet.decrypt()
+```
+
+**No alternative encryption paths exist.** There are no raw AES calls, no manual CBC/ECB construction, and no RSA operations anywhere in the codebase.
+
+---
+
+## Critical File Review
+
+### `v3/steve/crypto.py`
+
+**Security-Sensitive Functions Reviewed:**
+
+| Line(s) | Function | Block Mode | Padding | Authenticated | Status |
+|---------|----------|-----------|---------|--------------|--------|
+| ~75 | `create_vote()` | CBC (via Fernet) | PKCS7 (via Fernet) | Yes (HMAC-SHA256 Encrypt-then-MAC) | **PASS** ✅ |
+| ~83 | `decrypt_votestring()` | CBC (via Fernet) | PKCS7 (via Fernet) | Yes (HMAC verified before decrypt) | **PASS** ✅ |
+| ~60 | `_b64_vote_key()` | N/A (key derivation) | N/A | N/A | **PASS** ✅ |
+| ~91 | `_hash()` | N/A (hashing) | N/A | N/A | **PASS** ✅ |
+| ~40 | `gen_opened_key()` | N/A (hashing) | N/A | N/A | **PASS** ✅ |
+
+### `v3/steve/election.py`
+
+**Security-Sensitive Functions Reviewed:**
+
+| Line(s) | Function | Cryptographic Operation | Status |
+|---------|----------|------------------------|--------|
+| N/A | `add_vote()` | Calls `crypto.create_vote()` for encryption | **PASS** ✅ |
+| N/A | `tally_issue()` | Calls `crypto.decrypt_votestring()` for decryption | **PASS** ✅ |
+
+### `v3/schema.sql`
+
+**Cryptographic Data Storage:**
+
+| Column | Table | Content | Status |
+|--------|-------|---------|--------|
+| `ciphertext` | `vote` | Fernet ciphertext (includes version, timestamp, IV, ciphertext, HMAC) | **PASS** ✅ — stored as opaque BLOB |
+| `opened_key` | `election` | Argon2 hash output (not encrypted) | **N/A** — hash storage only |
+| `vote_token` | `vote` | Argon2 hash output (not encrypted) | **N/A** — hash storage only |
+
+### `v3/server/bin/tally.py`
+
+**Security-Sensitive Functions Reviewed:**
+
+| Line(s) | Function | Cryptographic Operation | Status |
+|---------|----------|------------------------|--------|
+| N/A | Vote tallying logic | Uses decryption functions from `crypto.py` | **PASS** ✅ |
+
+---
+
+## Findings
+
+**No findings identified for ASVS 11.3.1.**
+
+The codebase does not use ECB mode or PKCS#1 v1.5 padding. The sole encryption mechanism (Fernet) provides authenticated encryption via AES-128-CBC with HMAC-SHA256, which is a secure construction that prevents the padding oracle attacks associated with unauthenticated CBC mode.
+
+---
+
+## Positive Security Patterns
+
+1. **No ECB mode anywhere.** The only block cipher usage is through Fernet, which enforces CBC mode internally. There are no raw `Cipher` or `AES` instantiations that could accidentally use ECB.
+
+2. **No PKCS#1 v1.5 padding.** No RSA or asymmetric encryption exists in the codebase, eliminating any possibility of PKCS#1 v1.5 usage. The PKCS7 padding used by Fernet's CBC is a symmetric block padding scheme (not the weak RSA padding scheme cited in ASVS 11.3.1).
+
+3. **Authenticated encryption.** Fernet implements Encrypt-then-MAC (HMAC-SHA256 computed over ciphertext), which is verified before decryption. This prevents padding oracle attacks that could compromise unauthenticated CBC:
+   ```python
+   # crypto.py L~75-78
+   f = cryptography.fernet.Fernet(b64key)
+   return f.encrypt(votestring.encode())  # Internally: AES-128-CBC + HMAC-SHA256
+   ```
+
+4. **Single encryption library.** All cryptographic operations use the well-audited `cryptography` library, reducing the risk of custom insecure implementations.
+
+5. **CSPRNG for all randomness.** Salt generation uses `secrets.token_bytes()`, and IDs use `secrets.token_hex()`.
+
+6. **Strong key derivation chain.** The vote encryption key derivation path is:
+   ```
+   election_data → BLAKE2b → Argon2d(salt) → opened_key
+   opened_key + pid + iid → Argon2d(voter_salt) → vote_token
+   vote_token → HKDF-SHA256(voter_salt) → Fernet key
+   ```
+
+---
+
+## Architecture Observations
+
+1. **Planned migration to XChaCha20-Poly1305.** Comments in `_b64_vote_key()` and the HKDF `info=b'xchacha20_key'` parameter indicate a planned migration from Fernet to XChaCha20-Poly1305 (a native AEAD cipher). This would eliminate the CBC+HMAC construction entirely. The current HKDF `info` label is misleading but does not weaken security — it's a domain separation string that affects the derived key value but not its cryptographic strength.
+
+2. **Fernet enforces AES-128 (not AES-256).** Fernet splits its 32-byte key into 16 bytes for AES-128-CBC and 16 bytes for HMAC-SHA256. AES-128 meets minimum security requirements but provides a lower security margin than AES-256. This is a design consideration but not a violation of ASVS 11.3.1 (which concerns block modes and padding schemes, not key sizes).
+
+3. **Argon2d vs Argon2id inconsistency.** The production `_hash()` function uses `Type.D` (Argon2d) while the `benchmark_argon2()` function uses `Type.ID` (Argon2id). Argon2id is the OWASP-recommended variant. This is not related to ASVS 11.3.1 (block modes/padding) but is noted for completeness.
+
+4. **Comprehensive encryption path coverage.** All encryption and decryption operations funnel through a single, well-defined code path using Fernet, ensuring consistent application of security controls across the entire application.
+
+---
+
+## Recommendations Summary
+
+While no CRITICAL issues were found for this specific requirement, the following improvements would strengthen the cryptographic posture:
+
+### Immediate Actions
+- None required for ASVS 11.3.1 compliance
+
+### Short-term Improvements (1-3 months)
+1. **Align HKDF `info` parameter with actual algorithm.** Change `info=b'xchacha20_key'` to `info=b'fernet_key'` (or similar) in `crypto.py:_b64_vote_key()` (L~60) until the migration is complete, to prevent confusion during future audits.
+
+2. **Standardize on Argon2id** in the `_hash()` function (L~91) to align with OWASP recommendations and the benchmark function's own usage.
+
+### Long-term Strategic Enhancements (3-12 months)
+1. **Complete the planned migration to XChaCha20-Poly1305** (referenced in code comments). This would move from CBC+HMAC composite authentication to a native AEAD construction, reducing implementation complexity and eliminating any future debate about CBC acceptability. This aligns with the ASVS Chapter objective of "adapting to evolving threats" and utilizing "cryptographic mechanisms that are both secure and aligned with industry best practices."
+
+---
+
+## Appendix: Files Analyzed
+
+<details>
+<summary>Click to expand file list (4 files)</summary>
+
+1. **`v3/schema.sql`** (relevance: 10)
+   - Database schema defining cryptographic data storage
+   - Reviewed for encryption-related columns and data types
+
+2. **`v3/server/bin/tally.py`** (relevance: 10)
+   - Vote tallying and decryption logic
+   - Reviewed for decryption operations and cryptographic function usage
+
+3. **`v3/steve/crypto.py`** (relevance: 10)
+   - Core cryptographic implementation module
+   - Contains all encryption, decryption, key derivation, and hashing functions
+   - Primary focus of ASVS 11.3.1 audit
+
+4. **`v3/steve/election.py`** (relevance: 10)
+   - Election management and vote processing
+   - Reviewed for encryption/decryption call sites and data flow
+
+</details>
+
+---
+
+**Audit Conclusion:** The apache/steve repository **PASSES** ASVS requirement 11.3.1. No insecure block modes (ECB) or weak padding schemes (PKCS#1 v1.5) are used in the codebase. All encryption operations utilize Fernet's authenticated encryption (AES-128-CBC + HMAC-SHA256), which provides strong protection against padding oracle attacks and meets the security objectives outlined in the ASVS Cryptography chapter.
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org