(tooling-agents) branch main updated: ASVS audit: 11.3.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new 88e358b  ASVS audit: 11.3.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
88e358b is described below

commit 88e358b1250b10eb05bf702342c04df893c16d75
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Tue May 5 22:51:58 2026 +0200

    ASVS audit: 11.3.1.md (redacted) [source: apache/steve/v3 @ d0aa7e9]
---
 ASVS/reports/steve/v3/d0aa7e9/all/11.3.1.md | 77 +++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)

diff --git a/ASVS/reports/steve/v3/d0aa7e9/all/11.3.1.md b/ASVS/reports/steve/v3/d0aa7e9/all/11.3.1.md
new file mode 100644
index 0000000..36ea290
--- /dev/null
+++ b/ASVS/reports/steve/v3/d0aa7e9/all/11.3.1.md
@@ -0,0 +1,77 @@
+# Security Audit Report: ASVS 11.3.1
+
+## Executive Summary
+
+| Field | Value |
+|-------|-------|
+| **Repository** | apache/steve/v3 |
+| **Audit Date** | May 05, 2026 |
+| **Auditor** | Tooling Agents (bundled-pass mode) |
+| **ASVS Requirement** | ASVS 11.3.1 |
+| **Files Analyzed** | 5 relevant / 49 total |
+| **Files Skipped** | 12 |
+
+**Requirement description:** Verify that insecure block modes (e.g., ECB) and weak padding schemes (e.g., PKCS#1 v1.5) are not used.
+
+### Findings Overview
+
+| Severity | Count |
+|----------|-------|
+| 🔴 Critical | 0 |
+| 🟠 High | 0 |
+| 🟡 Medium | 0 |
+| 🟢 Low | 0 |
+
+---
+
+## ASVS-11.3.1: No Insecure Block Modes or Weak Padding
+
+### Findings for 11.3.1
+
+No findings detected for insecure block modes (ECB) or weak padding schemes (PKCS#1 v1.5).
+
+### Security Controls Inventory for 11.3.1
+
+| Control | Location | Mode/Padding | Status |
+|---------|----------|-------------|--------|
+| Fernet encryption | `crypto.py:create_vote()` | AES-128-CBC with PKCS7 + HMAC-SHA256 | ✅ Not ECB, not PKCS#1 v1.5 |
+| No RSA usage | Entire codebase | N/A | ✅ PKCS#1 v1.5 not applicable |
+
+### Positive Patterns for 11.3.1
+
+1. **No ECB mode**: The application uses Fernet which internally uses AES-CBC, not ECB.
+2. **No PKCS#1 v1.5**: No RSA operations exist in the codebase; all encryption uses symmetric primitives.
+3. **PKCS7 padding with authentication**: While PKCS7 block cipher padding is used (inherent to Fernet/AES-CBC), it is protected by HMAC-SHA256 verification performed before decryption, preventing padding-based attacks.
+
+---
+
+
+
+## Cross-cutting Architecture Observations
+
+1. **Cryptographic key hierarchy is well-designed**: The system uses a layered key derivation approach: Election data → BLAKE2b → Argon2 → `opened_key` → per-voter tokens → per-vote encryption keys. This provides good key separation and ensures that compromise of one vote doesn't compromise others.
+
+2. **Incomplete migration from Fernet to AEAD**: The codebase is in a transitional state, as evidenced by the `### still using Fernet now, but will switch soon` comment and the `info=b'xchacha20_key'` parameter. The HKDF derives 32 bytes intended for XChaCha20-Poly1305 but actually feeds it to Fernet which only uses 16 bytes for AES-128. This means the full key material isn't utilized.
+
+3. **Security margin inconsistency**: The system uses strong 256-bit outputs from Argon2 and HKDF but then feeds them into Fernet which only provides 128-bit encryption security (AES-128). The 40-bit IDs (`create_id()`) are the weakest link in the entropy chain.
+
+4. **Side-channel considerations partially addressed**: The use of `secrets` module throughout is excellent. However, Argon2d and non-constant-time comparison in `is_tampered()` show that side-channel resistance wasn't uniformly applied.
+
+5. **Fernet's timestamp exposure**: Fernet tokens include a plaintext timestamp of when encryption occurred. In a voting system, this could leak information about when a specific vote was cast, potentially de-anonymizing voters if combined with server access logs.
+
+## Cross-cutting Recommendations
+
+### Immediate (Before Next Release)
+1. **Fix `is_tampered()` to use `hmac.compare_digest()`** — Simple one-line fix that eliminates the timing oracle (ASVS-1124-HIGH-001).
+2. **Switch from Argon2d to Argon2id** — Change `Type.D` to `Type.ID` in `_hash()` to gain side-channel resistance (ASVS-1124-MED-001).
+3. **Add error handling around `decrypt_votestring()`** — Wrap in try/except to prevent DoS via corrupted votes (ASVS-1125-MED-001).
+
+### Short-term (Next Development Cycle)
+4. **Complete migration to XChaCha20-Poly1305** — Replace Fernet with a proper AEAD cipher as already planned. This addresses ASVS 11.3.2 and eliminates the key material waste (ASVS-1132-MED-001).
+5. **Increase `create_id()` entropy to at least 128 bits** — Use `secrets.token_hex(16)` for 32-character hex IDs, updating schema constraints accordingly (ASVS-1123-MED-001).
+
+### Long-term (Architecture)
+6. **Implement a unified cryptographic abstraction layer** — Create a single module interface for all crypto operations with versioning, allowing cipher agility without code changes throughout the application.
+7. **Add integration tests for timing resistance** — Automated tests that verify constant-time behavior of security-critical comparisons.
+8. **Consider removing Fernet timestamp from vote tokens** — Or migrate to a scheme that doesn't embed plaintext metadata in ciphertext.
+        
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org