wt
c73d9cef45
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution. Task: S00-003 Agent: auto-protocol-826aa6bc12ef Role: protocol Action: claim Status: blocked Task title: Проверить XMPP WSS/auth библиотеку
30 lines
2.5 KiB
JSON
30 lines
2.5 KiB
JSON
{
|
|
"title": "Establish fail-closed SCRAM server-final validation",
|
|
"reason": "StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.",
|
|
"reproduction": "Run the pinned-node parsed-event reproduction in state/evidence/S00-003-auto-protocol-826aa6bc12ef.md; both invalid server-final cases emit auth:success and request restart (wrapper exit 0 confirms defect). Exact installed source: stanza/plugins/sasl.js success branch.",
|
|
"role": "protocol",
|
|
"reviewer_role": "security",
|
|
"scope": [
|
|
"experiments/0002-xmpp-library/sasl-validation/**",
|
|
"docs/decisions/0002-xmpp-sasl-validation.md"
|
|
],
|
|
"outcome": "One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.",
|
|
"steps": [
|
|
"Read S00-003 blocker evidence and reproduce the missing/forged/premature success defect with exact candidate versions.",
|
|
"Evaluate supported SASL feature replacement or a maintained alternative; reuse vetted library crypto, never implement crypto primitives or modify ignored vendor source as the deliverable.",
|
|
"Build only a fixture-bound SASL validation experiment with exact dependency pins and document how S00-003 can integrate it through supported extension points; do not build production adapters/shared contracts.",
|
|
"Test valid RFC SCRAM transcript and missing/forged/premature server-final; record actual commands and limitations for independent security review."
|
|
],
|
|
"acceptance": [
|
|
"Missing, forged and premature SCRAM server-final cannot emit auth:success or request authenticated restart in the demonstrated integration.",
|
|
"A valid primary-spec SCRAM fixture is accepted only after server signature verification, with no handwritten crypto primitives, stub-success or plaintext fallback.",
|
|
"A supported integration path and pinned dependencies/licenses are documented; original library/WSS/parser/extension task remains separate."
|
|
],
|
|
"checks": [
|
|
"Reproduce original missing/forged/premature success rejection through the integrated SASL handler, not only a standalone mechanism.",
|
|
"Execute valid RFC SCRAM transcript and negative server-final cases with actual vetted implementation; do not log real credentials."
|
|
],
|
|
"depends_on": [],
|
|
"requires_user_input": false
|
|
}
|