fix: Phase 7 — key zeroization, OsRng, checked arithmetic, TOTP rate limits · d1eb01799f - archy

lfg2025/archy

fix: Phase 7 — key zeroization, OsRng, checked arithmetic, TOTP rate limits

- SecretsManager: raw key stored in Zeroizing<[u8; 32]>, auto-zeroed on drop
- SecretsManager: replaced thread_rng with OsRng (CSPRNG) for nonces
- Remember-me secret: derived from machine-id via SHA-256 (deterministic, no
  plaintext key storage)
- Bitcoin ecash balance: uses checked_add with u64::MAX saturation on overflow
- TOTP setup/confirm: added to EndpointRateLimiter (3 and 5 per 5min)
- AppId validation and Tor service name validation already existed

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

This commit is contained in:

Dorian

2026-03-18 01:00:57 +00:00

co-authored by

Claude Opus 4.6

parent 12ae3af981

commit d1eb01799f

5 changed files with 37 additions and 16 deletions

									
										core/security/Cargo.toml
									
		+1
		
												View File
												
				@@ -16,6 +16,7 @@ serde_json = "1.0"

				aes-gcm = "0.10"

				rand = "0.8"

				hex = "0.4"

				zeroize = { version = "1", features = ["derive"] }

				[dev-dependencies]

				tempfile = "3"