Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

fix trust model: signing key rotation is manual, not automatic

Browse source 
Old key stays is_active=true after SetPrimaryKey with no TTL or auto-deprecate.
README now says what actually exists: operator promotes new key, then explicitly
deprecates the old one. No sliding-window automation yet.
This commit is contained in:
Fimeg 2026-05-30 13:33:13 -04:00
commit 018c0a4104
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -84,7 +84,7 @@ Agents run at the OS level and query the Docker socket directly — there's no s
Agents register with a one-time token plus a hardware fingerprint. The server stores the fingerprint; future check-ins that don't match the registered machine are rejected. This prevents config copying between hosts.
On first connect, the agent fetches and caches the server's Ed25519 public key (TOFU). Every subsequent command is verified against it. The `signing_keys` table supports multiple concurrent active keys with a sliding window — a new key is promoted to primary while the old key remains active, so agents that cached the previous key continue verifying successfully until the operator deactivates it. Rotation is zero-downtime; no coordinated restart required.
On first connect, the agent fetches and caches the server's Ed25519 public key (TOFU). Every subsequent command is verified against it. The `signing_keys` table supports multiple concurrent active keys — a new key can be promoted to primary while the old key is deprecated separately. Agents cache the key by `key_id` fingerprint and re-fetch when they see an unknown signer. Rotation currently requires the operator to promote the new key, then explicitly deprecate the old one; there is no automatic TTL on signing keys yet (SEC-006 tracks adding one).
Every command includes a signed nonce with a 10-minute validity window. The agent tracks executed nonces and rejects replays, including from an attacker who intercepted a valid command.