gabriel / muse public
patch dev
AI Agent gabriel · 162 days ago · Apr 17, 2026 · Diff

security: zero DerivedKeys and seeds in agent.py and public_bytes_from_seed

agent.py: - _derive_agent_seed: zero intermediate seed bytearray after derive_agent_sub_seed - _sub_seed_to_public: call dk.zero() after Ed25519PrivateKey creation

hdkeys.py: - public_bytes_from_seed: call dk.zero() after Ed25519PrivateKey creation; convenience fn was discarding the DerivedKey without wiping it

Add tests/test_agent_seed_zeroing.py (3 tests) — all RED before this commit

sha256:c44cbb64fc0de98cd78382790a8db82180b17f17f37b9fbd4eabe9ff3b24f2da sha
sha256:e503af6ad34feaa2dad274389984a7f01df7df6c2f234819b7911f8f1a9f4664 parent
+17 ~3 symbols
sha256:117459cb803f45be68bb1372bb367e6d0ddf583e6cc8876e5496fb25f88d54bc snapshot
+17
symbols added
~3
symbols modified
0
dead code introduced
Semantic Changes 20 symbols
~ tests/test_agent_seed_zeroing.py .py 17 symbols added
+ TestDeriveAgentSeedZeroesIntermediateSeed class class TestDeriveAgentSeedZeroesIntermediateSeed L49–69
+ test_I1_seed_zeroed_after_derive_agent_sub_seed method method test_I1_seed_zeroed_after_derive_agent_sub_seed L50–69
+ TestSubSeedToPublicZeroesDerivedKey class class TestSubSeedToPublicZeroesDerivedKey L76–117
+ test_II1_private_bytes_zeroed method method test_II1_private_bytes_zeroed L77–96
+ test_II2_chain_code_zeroed method method test_II2_chain_code_zeroed L98–117
+ _MNEMONIC variable variable _MNEMONIC L37–40
+ _SEED variable variable _SEED L41–41
+ _SUB_SEED variable variable _SUB_SEED L42–42
+ DOMAIN_IDENTITY import import DOMAIN_IDENTITY L33–33
+ DerivedKey import import DerivedKey L34–34
+ _bip39_mod import import _bip39_mod L35–35
+ _hdkeys import import _hdkeys L31–31
+ annotations import import annotations L25–25
+ derive_agent_sub_seed import import derive_agent_sub_seed L33–33
+ mnemonic_to_seed import import mnemonic_to_seed L32–32
+ patch import import patch L27–27
+ pytest import import pytest L29–29
~ muse/cli/commands/agent.py .py 2 symbols modified
~ _derive_agent_seed
~ _sub_seed_to_public
~ muse/core/hdkeys.py .py 1 symbol modified
~ public_bytes_from_seed
← Older Oldest on dev
All commits
Newer → Latest on dev

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:c44cbb64fc0de98cd78382790a8db82180b17f17f37b9fbd4eabe9ff3b24f2da --body "your comment"