You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by as...@apache.org on 2026/04/22 14:24:33 UTC
(tooling-agents) branch main updated: ASVS L3 audit: 6.5.4 (ch06_general)
This is an automated email from the ASF dual-hosted git repository.
asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git
The following commit(s) were added to refs/heads/main by this push:
new 5c5ea58 ASVS L3 audit: 6.5.4 (ch06_general)
5c5ea58 is described below
commit 5c5ea5851aeed56112fdf245fc34cd670f592b67
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Wed Apr 22 16:24:29 2026 +0200
ASVS L3 audit: 6.5.4 (ch06_general)
---
.../reports/steve/v3/d0aa7e9/ch06_general/6.5.4.md | 319 +++++++++++++++++++++
1 file changed, 319 insertions(+)
diff --git a/repos/apache/ASVS/reports/steve/v3/d0aa7e9/ch06_general/6.5.4.md b/repos/apache/ASVS/reports/steve/v3/d0aa7e9/ch06_general/6.5.4.md
new file mode 100644
index 0000000..525056c
--- /dev/null
+++ b/repos/apache/ASVS/reports/steve/v3/d0aa7e9/ch06_general/6.5.4.md
@@ -0,0 +1,319 @@
+# ASVS 6.5.4 Security Audit Report
+
+## Executive Summary
+
+- **Repository:** apache/steve
+- **Audit Date:** Apr 22, 2026
+- **Auditor:** Tooling Agents
+- **ASVS Requirement:** 6.5.4 — Verify that lookup secrets and out-of-band authentication codes have a minimum of 20 bits of entropy (typically 4 random alphanumeric characters or 6 random digits is sufficient).
+- **Files Analyzed:** 3 relevant out of 49 total, 12 skipped
+- **Finding Counts:**
+
+| Severity | Count |
+|----------|-------|
+| Critical | 0 |
+| High | 0 |
+| Medium | 0 |
+| Low | 0 |
+| **Total** | **0** |
+
+**Summary:** After thorough analysis of the provided codebase, the application does not generate lookup secrets (recovery codes, TANs) or out-of-band authentication codes. Authentication is fully delegated to the external ASF infrastructure via `asfquart.auth`. ASVS 6.5.4 is not applicable to this codebase as no lookup secrets or out-of-band authentication codes are generated within the application boundary.
+
+---
+
+## Security Controls Inventory
+
+### Authentication & MFA Controls
+
+| Control | Location | Type | Purpose | Coverage Status |
+|---------|----------|------|---------|-----------------|
+| Session authentication | `asfquart.session.read()` | External | Validates user sessions | ✅ All authenticated endpoints |
+| Committer authorization | `@asfquart.auth.require({R.committer})` | External decorator | Restricts access to committers | ✅ 15 endpoints |
+| PMC member authorization | `@asfquart.auth.require({R.pmc_member})` | External decorator | Restricts access to PMC members | ✅ 1 endpoint |
+| Session-only auth | `@asfquart.auth.require` (bare) | External decorator | Basic session validation | ✅ 3 endpoints |
+
+### Cryptographic Random Value Generation
+
+| Generator | Location | Entropy | Purpose | ASVS 6.5.4 Applicable? |
+|-----------|----------|---------|---------|------------------------|
+| `crypto.gen_salt()` | `crypto.py:36` | 128 bits (16 bytes) | Cryptographic salt generation | ❌ No — internal crypto material |
+| `crypto.create_id()` | `crypto.py:108` | 40 bits (5 bytes hex) | Election/Issue ID generation | ❌ No — identifiers, not auth codes |
+| `crypto.gen_vote_token()` | `crypto.py:51` | 256 bits (Argon2 output) | Vote encryption token | ❌ No — internal crypto token |
+| `crypto.gen_opened_key()` | `crypto.py:40` | 256 bits (Argon2 output) | Anti-tamper key | ❌ No — internal crypto key |
+| `secrets.randbelow()` | `crypto.py:100` | Variable | Secure shuffle operations | ❌ No — not an auth code |
+
+**Status:** All random value generation uses cryptographically secure methods (`secrets` module). No lookup secrets or OOB authentication codes are generated.
+
+---
+
+## Critical File Review
+
+### v3/steve/crypto.py — Cryptographic Operations
+
+| Function | Lines | Security Sensitivity | Review Status | Notes |
+|----------|-------|---------------------|---------------|-------|
+| `gen_salt()` | 36-37 | High | ✅ Reviewed | Uses `secrets.token_bytes(16)` — 128 bits entropy |
+| `gen_opened_key()` | 40-48 | High | ✅ Reviewed | Argon2-based KDF, 256-bit output |
+| `gen_vote_token()` | 51-59 | High | ✅ Reviewed | Argon2-based KDF, 256-bit output |
+| `_hash()` | 62-78 | High | ✅ Reviewed | Argon2id with 64MB memory cost |
+| `shuffle()` | 100-105 | Medium | ✅ Reviewed | Fisher-Yates with `secrets.randbelow()` |
+| `create_id()` | 108-109 | Low | ✅ Reviewed | 40-bit hex identifier using `secrets.token_hex(5)` |
+
+### v3/server/pages.py — Request Handlers
+
+| Endpoint | Lines | Authentication Method | Review Status | Notes |
+|----------|-------|----------------------|---------------|-------|
+| `session()` | ~80 | `asfquart.session.read()` | ✅ Reviewed | External ASF session validation |
+| `new_election()` | ~175 | `@asfquart.auth.require({R.committer})` | ✅ Reviewed | Committer role required |
+| `view_election()` | ~190 | `@asfquart.auth.require` | ✅ Reviewed | Session validation only |
+
+### v3/steve/election.py — Election Logic
+
+| Function | Lines | Security Sensitivity | Review Status | Notes |
+|----------|-------|---------------------|---------------|-------|
+| Election initialization | Various | Medium | ✅ Reviewed | No authentication code generation |
+| Vote processing | Various | High | ✅ Reviewed | Uses crypto tokens, not auth codes |
+
+---
+
+## Findings
+
+**No findings identified.** ASVS 6.5.4 requirements are not applicable to this codebase.
+
+### Applicability Analysis
+
+**ASVS 6.5.4 Scope:**
+- Lookup secrets (recovery codes, TANs, pre-generated secret lists)
+- Out-of-band authentication codes (SMS, email verification codes)
+
+**Codebase Authentication Architecture:**
+
+The application does not implement:
+1. ❌ Recovery code generation
+2. ❌ Transaction Authorization Numbers (TANs)
+3. ❌ Pre-generated secret code lists
+4. ❌ SMS verification codes
+5. ❌ Email verification codes
+6. ❌ Any OOB authentication mechanisms
+
+Authentication is entirely delegated to external ASF infrastructure:
+
+```python
+# v3/server/pages.py, line ~80
+s = await asfquart.session.read()
+if s:
+ basic.update(
+ uid=s['uid'],
+ name=s['fullname'],
+ email=s['email'],
+ )
+```
+
+All authorization checks use external decorators:
+```python
+@asfquart.auth.require({R.committer})
+@asfquart.auth.require({R.pmc_member})
+```
+
+**Conclusion:** MFA implementation, including any lookup secrets or OOB codes, resides in the ASF identity provider, not this application. ASVS 6.5.4 compliance is the responsibility of the external authentication infrastructure.
+
+---
+
+## Positive Security Patterns
+
+### ✅ Cryptographically Secure Random Number Generation
+
+**Location:** `v3/steve/crypto.py` throughout
+
+All random value generation correctly uses the `secrets` module (CSPRNG):
+
+```python
+# Line 36 — Salt generation (128 bits)
+def gen_salt() -> bytes:
+ return secrets.token_bytes(SALT_LEN)
+
+# Line 108 — ID generation (40 bits)
+def create_id():
+ return secrets.token_hex(5)
+
+# Line 100 — Secure shuffle
+def shuffle(items: list):
+ for i in range(len(items) - 1, 0, -1):
+ j = secrets.randbelow(i + 1)
+ items[i], items[j] = items[j], items[i]
+```
+
+**Assessment:** No use of insecure `random` module for security-sensitive operations.
+
+### ✅ Generous Entropy for Identifiers
+
+**Location:** `crypto.py:108` — `create_id()`
+
+Even though election/issue IDs are not authentication codes, they use 40 bits of entropy, which exceeds the ASVS 6.5.4 minimum of 20 bits.
+
+### ✅ Strong Cryptographic Primitives
+
+**Location:** `crypto.py:62-78` — `_hash()`
+
+```python
+def _hash(password: str, salt: bytes) -> bytes:
+ return argon2.low_level.hash_secret_raw(
+ secret=password.encode('utf-8'),
+ salt=salt,
+ time_cost=TIME_COST, # 2 iterations
+ memory_cost=MEMORY_COST, # 64 MB
+ parallelism=PARALLELISM, # 1 thread
+ hash_len=HASH_LEN, # 32 bytes
+ type=argon2.low_level.Type.ID,
+ )
+```
+
+**Assessment:** Argon2id with 64MB memory cost provides strong resistance against brute-force attacks.
+
+### ✅ Clean Authentication Boundary
+
+**Location:** Throughout `pages.py`
+
+The application cleanly separates:
+- **Authentication** (external ASF infrastructure)
+- **Authorization** (internal session + database checks)
+
+This architectural pattern appropriately delegates MFA responsibility to the identity provider.
+
+### ✅ Cryptographic Shuffle for Sensitive Operations
+
+**Location:** `election.py` — tally shuffling
+
+Security-sensitive shuffling operations use `crypto.shuffle()` with CSPRNG, not the standard library's `random.shuffle()`.
+
+---
+
+## Architecture Observations
+
+### 1. Authentication Delegation Pattern
+
+The application implements a clean separation of concerns:
+
+```
+┌─────────────────────────────────────┐
+│ ASF Identity Provider │
+│ (OAuth/SAML/MFA) │
+│ • User authentication │
+│ • MFA enforcement │
+│ • Session management │
+└──────────────┬──────────────────────┘
+ │
+ │ Session token
+ ▼
+┌─────────────────────────────────────┐
+│ Apache Steve Application │
+│ • Session validation │
+│ • Role-based authorization │
+│ • Election management │
+│ • Vote cryptography │
+└─────────────────────────────────────┘
+```
+
+**Implication:** Any ASVS requirements related to password storage, MFA, account recovery, or authentication code generation are the responsibility of the ASF identity provider.
+
+### 2. No Self-Service Authentication Flows
+
+The codebase contains no:
+- Password reset mechanisms
+- Account recovery flows
+- Self-registration endpoints
+- Email/SMS verification
+
+These would be the typical locations requiring lookup secrets or OOB codes per ASVS 6.5.4.
+
+### 3. Cryptographic Material Generation
+
+All cryptographic operations use appropriate entropy levels:
+
+| Material | Entropy | Purpose | Adequacy |
+|----------|---------|---------|----------|
+| Salt | 128 bits | KDF input | ✅ Excellent |
+| Vote token | 256 bits | Vote encryption | ✅ Excellent |
+| Opened key | 256 bits | Anti-tamper | ✅ Excellent |
+| Election ID | 40 bits | Identifier | ✅ Adequate for non-auth use |
+
+### 4. Minor Observation: Non-Cryptographic RNG Usage
+
+**Location:** `pages.py:266`
+
+Standard library `random.shuffle()` is used for candidate display ordering. While not a security issue for ASVS 6.5.4 (display order is not security-sensitive), the codebase has `crypto.shuffle()` available for consistency.
+
+---
+
+## Recommendations Summary
+
+### Immediate Actions (0-30 days)
+
+**None required.** No security findings were identified related to ASVS 6.5.4.
+
+### Short-term Actions (1-3 months)
+
+1. **Document Authentication Architecture**
+ - Create architectural documentation explicitly stating that authentication, including MFA, is delegated to ASF infrastructure
+ - Document the security boundary between the application and identity provider
+ - Include this in security review materials for future auditors
+
+2. **Verify External Infrastructure Compliance**
+ - Request ASVS 6.5.4 compliance documentation from ASF infrastructure team
+ - Confirm that any lookup secrets or OOB codes generated by the identity provider meet the 20-bit entropy minimum
+ - Document verification results
+
+### Long-term Actions (3-12 months)
+
+1. **Prepare for Standalone Deployment Scenarios**
+ - If the application may ever be deployed outside ASF infrastructure, design recovery code generation using existing `crypto.py` patterns
+ - Recommended implementation: `secrets.token_hex(3)` for 24-bit recovery codes (6 hex characters)
+ - Document that this would be required for standalone deployments
+
+2. **Consider Consistency Improvements**
+ - Replace `random.shuffle()` at `pages.py:266` with `crypto.shuffle()` for consistency
+ - This is a code quality improvement, not a security requirement
+
+---
+
+## Appendix: Files Analyzed
+
+<details>
+<summary>Click to expand full file list (3 relevant files analyzed)</summary>
+
+### High Relevance (Relevance Score: 10)
+
+- **`v3/steve/crypto.py`**
+ - All cryptographic operations
+ - Random value generation
+ - Salt, token, and key derivation
+ - Secure shuffle implementation
+
+### Medium Relevance (Relevance Score: 4)
+
+- **`v3/server/pages.py`**
+ - Request handlers
+ - Session validation
+ - Authentication decorators
+ - Authorization checks
+
+- **`v3/steve/election.py`**
+ - Election management
+ - Vote processing
+ - Cryptographic token usage
+
+### Files Skipped (12 files)
+
+Files not relevant to ASVS 6.5.4 (lookup secrets and OOB authentication codes):
+- Configuration files
+- Database models without authentication logic
+- Frontend templates
+- Utility modules
+- Test files
+- Documentation
+
+</details>
+
+---
+
+**End of Report**
\ No newline at end of file
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org