mca/parking_solution
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

docs(wiki): ATECC608 is upcoming — retag ledger signing to the on-host reality

Browse Source 
No secure element is on-site: event signing runs on the software HMAC
(EVENT_SIGNING_KEY, an env var on the host disk), so the ledger is
tamper-EVIDENT but forgeable by anyone who owns the host. Several pages
overstated it as present-tense "ATECC608-signed / unforgeable"; correct them.

- NEW concepts/hardware-signer-options.md: four options for a non-extractable
  signing key (USB HSM / YubiKey / reuse the TPM / plain-dongle trap) + the
  recommendation (TPM interim → USB-HSM target; ATECC608 stays for the embedded
  ESP32, wrong part for a PC host).
- entities/atecc608.md: UPCOMING-not-present status banner + PC-vs-embedded.
- disk-os-hardening.md: fix the live-USB row (BIOS boot-order password is
  load-bearing, not Secure Boot — a signed live USB runs); add a physical-tamper
  chain (Dell 7070 CMOS-reset → live-USB → PCR-7 same-signer unseal) + accepted
  risks (that unseal, unsigned-initramfs evil-maid, operator-USB read TODO).
- open-questions #6 reframed; standing-decisions / overview / threat-model /
  index de-overstated; log query entry.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V
This commit is contained in:
Julian Çuni
2026-07-04 13:41:11 +02:00
parent 306d136a08
commit c142166972
9 changed files with 274 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wiki/decisions/open-questions.md
+13 -4
View File
@@ -40,10 +40,19 @@ procurement. (See [[parking-system-architecture]] §10.)
but **unverifiable after the machine dies**). **Restore is admin-only/out-of-band** (operator-adversary
surface — [[threat-model]]). See [[backup-recovery]], [[fleet-deployment-komodo]], [[disk-os-hardening]],
[[reconciliation]] (#4).
6. **Secure-element integration.** Confirm [[atecc608]] wiring/usage on the host (event
signing). The [[esp32-custom-controller]] command-authentication use is **deferred — not
being implemented for now** (access control is the [[dingtian-relay]] behind
[[network-isolation]]); revisit only if prevention-grade device auth becomes a requirement.
6. **Secure-element integration.** _(Updated 2026-07-02: no secure element is on-site today.)_
Event signing currently runs on the **software `SoftwareSigner`** (HMAC-SHA256, key in
`EVENT_SIGNING_KEY` — an env var **on the host disk**). So the ledger is tamper-EVIDENT but
**not** unforgeable by anyone who owns the host: a case-opening adversary who decrypts the disk
reads the key and can re-sign a doctored chain (see [[append-only-event-chain]] "pull-the-disk",
[[disk-os-hardening]] physical-tamper chain). The **[[atecc608]] is UPCOMING, not present** — and
it isn't even the right host part: on a PC appliance the realistic non-extractable host signer is
the **[[tpm|TPM 2.0]]** the box already has, or a **USB HSM** (Nitrokey HSM 2 / SmartCard-HSM);
reserve the ATECC608 for the (deferred) [[esp32-custom-controller]]. The concrete menu +
recommendation (TPM interim → USB-HSM target) is in [[hardware-signer-options]]. The
controller command-authentication use is **deferred — not being implemented for now** (access
control is the [[dingtian-relay]] behind [[network-isolation]]); revisit only if prevention-grade
device auth becomes a requirement.
7. **JWT signing: symmetric vs. asymmetric key.** _(Raised by the commit security review, not the
source doc.)_ Auth currently uses a symmetric HMAC secret (`@fastify/jwt`, see
[[local-jwt-auth]]) — the same secret signs *and* verifies, so it must live on every host that