gabriel / muse public
feat patch security dev
AI Agent gabriel · 148 days ago · Apr 25, 2026 · Diff

feat(security): Phase 6 — DerivedKey zeroing hardening

slip010.py: - SecretByteArray: bytearray subclass with zero() method and __del__ safety net - DerivedKey.__del__: calls zero() as GC backstop for forgotten explicit calls

hdkeys.py: - derive_agent_sub_seed now returns SecretByteArray instead of bytearray - public_bytes_from_seed: try/finally around dk.zero()

keypair.py: - derive_hd_public_info: try/finally around dk.zero() - generate_hd_keypair: try/finally around dk.zero()

identity.py: - resolve_signing_identity._derive: try/finally; exception returns None, dk always zeroed

auth.py: - run_register inline derivation: try/finally around dk.zero()

Tests: Z1-Z7 (test_security_zeroing.py) Doc: Phases 1-6 complete, Phase 7 pending

sha256:7ee0315af150d5a334c4668b5fbd944174095711a13e432568f66ad9fec528cd sha
sha256:a1157e1c48b653cabd6ebc9d43abbc7464ea0fc74413e1921c896ad45eb7e9df parent
+34 ~19 −2 symbols
sha256:daabee059e081141393c7965383e57e72aea2dc54904c1af659a3f860c338007 snapshot
+34
symbols added
~19
symbols modified
−2
symbols removed
0
dead code introduced
Semantic Changes 55 symbols
~ tests/test_security_zeroing.py .py 26 symbols added
+ TestAgentSubSeedType class class TestAgentSubSeedType L170–207
+ test_Z5_derive_agent_sub_seed_returns_secret_bytearray method method test_Z5_derive_agent_sub_seed_returns_secret_bytearray L171–181
+ test_Z5b_sub_seed_zeroes_on_del method method test_Z5b_sub_seed_zeroes_on_del L183–207
+ TestDeriveHdPublicInfoZeroing class class TestDeriveHdPublicInfoZeroing L215–261
+ test_Z6_dk_zeroed_when_from_private_bytes_raises method method test_Z6_dk_zeroed_when_from_private_bytes_raises L216–261
+ TestDerivedKeyAutoZero class class TestDerivedKeyAutoZero L45–65
+ test_Z1_del_zeroes_private_bytes method method test_Z1_del_zeroes_private_bytes L46–59
+ test_Z1b_explicit_zero_still_works method method test_Z1b_explicit_zero_still_works L61–65
+ TestResolveSigningIdentityZeroing class class TestResolveSigningIdentityZeroing L73–126
+ _make_identity_file method method _make_identity_file L74–97
+ test_Z2_dk_zeroed_even_when_materialise_raises method method test_Z2_dk_zeroed_even_when_materialise_raises L99–126
+ TestRunRegisterDerivationZeroing class class TestRunRegisterDerivationZeroing L269–314
+ test_Z7_dk_zeroed_when_materialise_raises_in_register method method test_Z7_dk_zeroed_when_materialise_raises_in_register L270–314
+ TestSecretByteArray class class TestSecretByteArray L134–162
+ test_Z3_is_bytearray_subclass class method test_Z3_is_bytearray_subclass L135–139
+ test_Z4_del_calls_zero method method test_Z4_del_calls_zero L141–156
+ test_Z4b_explicit_zero_method method method test_Z4b_explicit_zero_method L158–162
+ _MNEMONIC variable variable _MNEMONIC L28–31
+ _PATH variable variable _PATH L32–32
+ _seed function function _seed L35–37
+ DerivedKey import import DerivedKey L24–24
+ annotations import import annotations L17–17
+ derive_path import import derive_path L24–24
+ gc import import gc L19–19
+ pathlib import import pathlib L20–20
+ pytest import import pytest L22–22
~ docs/key-material-security-audit.md .md 3 symbols added, 2 symbols removed, 3 symbols modified
~ table@L247
− Phase 5 — Orphan PEM Cleanup 🔴 IN PROGRESS section Phase 5 — Orphan PEM Cleanup 🔴 IN PROGRESS L187–203
− Phase 6 — DerivedKey Zeroing Hardening (M1, M2) section Phase 6 — DerivedKey Zeroing Hardening (M1, M2) L203–212
+ Phase 5 — Orphan PEM Cleanup ✅ COMPLETE section Phase 5 — Orphan PEM Cleanup ✅ COMPLETE L187–196
+ Phase 6 — DerivedKey Zeroing Hardening (M1, M2) ✅ COMPLETE section Phase 6 — DerivedKey Zeroing Hardening (M1, M2) ✅ COMPLETE L196–225
+ table@L202 section table@L202 L202–211
~ Key Material Security Audit — Muse + MuseHub
~ Implementation Plan
~ muse/cli/commands/auth.py .py 1 symbol modified
~ run_register
~ muse/core/hdkeys.py .py 1 symbol added, 10 symbols modified
+ SecretByteArray import import SecretByteArray L187–187
~ derive_agent_sub_seed
~ DerivedKey
~ MUSE_PURPOSE
~ Slip010Error
~ child_key
~ derive_path
~ hardened
~ master_key
~ to_ed25519_private_key
~ public_bytes_from_seed
~ muse/core/identity.py .py 1 symbol modified
~ resolve_signing_identity
~ muse/core/keypair.py .py 2 symbols modified
~ derive_hd_public_info
~ generate_hd_keypair
~ muse/core/slip010.py .py 4 symbols added, 2 symbols modified
+ __del__ method method __del__ L249–259
+ SecretByteArray class class SecretByteArray L159–186
+ __del__ method method __del__ L182–186
+ zero method method zero L178–180
~ DerivedKey
~ __all__
← Older Oldest on dev
All commits
Newer → Latest on dev

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:7ee0315af150d5a334c4668b5fbd944174095711a13e432568f66ad9fec528cd --body "your comment"