improved tests

docs/crypto_key_management_review.md

@@ -0,0 +1,114 @@
+# SeedPass Crypto & Key Management Review (Item 2)
+
+Status: `In Progress (P0 partially implemented)`  
+Date: `2026-02-25`
+
+## Scope Reviewed
+
+1. `src/utils/key_derivation.py`
+2. `src/seedpass/core/encryption.py`
+3. `src/seedpass/core/vault.py`
+4. `src/seedpass/core/portable_backup.py`
+5. `src/seedpass/core/manager.py` (unlock/setup key paths)
+6. `src/seedpass/core/config_manager.py` (KDF config surface)
+
+## Crypto Inventory (Current)
+
+1. At-rest/index encryption:
+   - AES-GCM via `cryptography` (`EncryptionManager.encrypt_data/decrypt_data`).
+   - Format marker: `V3|` + 96-bit nonce + ciphertext+tag.
+2. Legacy compatibility:
+   - Fernet legacy decrypt paths (`V2:` fallback and raw legacy blobs).
+3. Password-to-seed key derivation:
+   - PBKDF2-HMAC-SHA256 (`derive_key_from_password`) with fingerprint-derived salt.
+   - Optional Argon2id path (`derive_key_from_password_argon2`).
+4. Seed-to-storage key derivation:
+   - deterministic hierarchy from mnemonic seed (`derive_index_key*`).
+5. Portable backup encryption:
+   - AES-GCM using key derived from parent seed (`derive_index_key`).
+6. Integrity checks:
+   - Cipher authentication tags (AES-GCM).
+   - JSON checksum validation for portable backups.
+
+## Exit Criteria Check (Item 2)
+
+1. Primitive/parameter review completed: `In Progress`
+2. Nonce/key lifecycle reviewed: `In Progress`
+3. Negative tests for corruption/tampering/wrong key path: `Partially Done`
+
+## Findings
+
+### Strong / Acceptable
+
+1. AES-GCM is used for current encrypted payloads.
+2. Migration compatibility from legacy formats is heavily tested.
+3. Portable backup import verifies checksum after decrypt.
+4. Nostr restore paths include strict error handling and migration fallback.
+
+### Gaps / Risks
+
+1. PBKDF2 default is low for 2026 threat levels:
+   - Config default appears to be `50_000` iterations.
+   - Legacy fallbacks include `50_000` and `100_000`.
+2. Argon2 config drift:
+   - `argon2_time_cost` exists in config, but active unlock code constructs
+     `KdfConfig(salt_b64=...)` without reading configured `time_cost`.
+   - This can create false confidence that tuning is active.
+3. AES-GCM nonce reuse guard:
+   - Additional guard uses CRC32 of nonce in-memory.
+   - CRC32 collision can create false positives under high operation counts.
+   - Not persisted across restarts, so not a true global nonce registry.
+4. Optional plaintext export mode:
+   - `encrypt=False` in portable export intentionally permits plaintext backups.
+   - This is a policy risk if used accidentally in production workflows.
+5. KDF metadata consistency:
+   - File wrapper carries `kdf` metadata, but operational seed-unlock
+     parameters are partly config-driven and partly hardcoded/defaulted.
+   - Clear authoritative KDF policy per profile is not yet centralized.
+
+## Recommended Remediation Plan
+
+### P0 (Do Next)
+
+1. Wire Argon2 runtime config into active unlock paths:
+   - In manager setup/load paths, pass configured `argon2_time_cost` (and any
+     agreed memory/parallelism values) into `KdfConfig.params`.
+   - Progress: completed in `PasswordManager._derive_seed_key` and wired across
+     seed-key callsites; tests added in `src/tests/test_kdf_modes.py`.
+2. Raise PBKDF2 default for new profiles:
+   - Choose a higher baseline and keep backward compatibility via fallback.
+3. Add explicit warnings for plaintext export mode:
+   - Keep capability, but require clear confirmation and warning text.
+
+### P1
+
+1. Replace CRC32 nonce tracking with deterministic monotonic counter mode for
+   backup/index encryption or remove CRC guard and rely on 96-bit randomness.
+2. Define a single profile KDF policy object:
+   - Algorithm + parameters + migration behavior in one place.
+3. Expand negative tests to include:
+   - wrong Argon2 params,
+   - tampered kdf metadata wrapper,
+   - downgraded KDF policy attempts.
+
+### P2
+
+1. Add release-time crypto policy checks:
+   - lint/test gate ensuring configured KDF policy is actually used in unlock paths.
+
+## Test Coverage Snapshot (Relevant)
+
+1. Legacy migration and iteration fallback tests exist.
+2. Encryption fuzz and corruption tests exist.
+3. Portable backup corruption/checksum tests exist.
+4. Additional tests needed for active Argon2 parameter usage in unlock paths.
+
+## Proposed Completion Criteria for Item 2
+
+Item 2 can move to `Done` when:
+
+1. Argon2 config is verifiably wired into unlock path and covered by tests.
+2. PBKDF2 policy baseline is explicitly set and documented for new profiles.
+3. Plaintext export policy is documented with explicit user safeguards.
+4. One nonce-lifecycle decision is implemented (improved guard or rationale for removal).
+5. Checklist evidence links are updated to include merged PR/tests.

docs/security.md

@@ -28,3 +28,8 @@ PY
 ```
 
 The selected `time_cost` is stored in the profile's configuration and used for subsequent key derivations.
+
+## Readiness Documents
+
+- Production readiness checklist: `docs/security_readiness_checklist.md`
+- Threat model draft: `docs/threat_model.md`

docs/security_readiness_checklist.md

@@ -0,0 +1,63 @@
+# SeedPass Security Readiness Checklist
+
+Status legend: `Not Started`, `In Progress`, `Blocked`, `Done`
+
+| # | Area | Status | Owner | Evidence / Link |
+|---|------|--------|-------|-----------------|
+| 1 | Threat model (attacker profiles, trust boundaries, assumptions) | Done | Security / Core | `docs/threat_model.md` (provisional approvals recorded 2026-02-25) |
+| 2 | Crypto and key management review | In Progress | Security / Core | `docs/crypto_key_management_review.md`, `src/tests/test_kdf_modes.py` |
+| 3 | Secret handling and local data exposure hardening | Not Started | Core | |
+| 4 | Backup and restore integrity validation | In Progress | Core / QA | `src/tests/test_account_roundtrip_restore.py`, `src/tests/test_portable_backup.py` |
+| 5 | Nostr sync security and resilience validation | In Progress | Core / QA | `src/tests/test_nostr_real.py`, `src/tests/test_nostr_index_size.py` |
+| 6 | Auth, lock/unlock, and access-control hardening | Not Started | Core | |
+| 7 | Testing gates and quality thresholds | In Progress | QA | `scripts/check_critical_coverage.py`, CI workflows |
+| 8 | Supply chain and release integrity | Not Started | DevOps | |
+| 9 | Operational readiness and incident runbooks | Not Started | Security / Ops | |
+| 10 | External audit and staged production rollout | Not Started | Maintainers | |
+
+## Exit Criteria Per Item
+
+1. Threat model:
+   - Assets, trust boundaries, and attacker capabilities documented.
+   - Explicit assumptions and non-goals documented.
+   - Top risks prioritized with mitigations and owners.
+
+2. Crypto and key management:
+   - Primitive/parameter review completed.
+   - Nonce/key lifecycle reviewed.
+   - Negative tests for corruption/tampering/wrong key path.
+
+3. Secret handling:
+   - No secret leakage in logs/temp files/exports by default.
+   - Clipboard, memory lifetime, and file permission checks documented.
+
+4. Backup/restore:
+   - Seed-only recovery and encrypted export/import validated.
+   - Corruption and checksum mismatch behavior validated.
+
+5. Nostr:
+   - Real-relay publish/retrieve/restore tested.
+   - Failure modes (delay/outage/stale state) tested.
+
+6. Auth/access:
+   - Lock/unlock/timeout/quick unlock behavior reviewed with tests.
+
+7. Testing gates:
+   - Critical module coverage gates enforced.
+   - Network and stress tests are opt-in and documented.
+
+8. Supply chain:
+   - Locked dependencies, CVE review process, signed artifacts/checksums.
+
+9. Operational:
+   - Incident playbooks and recovery drills documented.
+
+10. External validation:
+   - Independent audit completed.
+   - Critical findings resolved before broad production use.
+
+## How To Use
+
+1. Update each row with current status and owner.
+2. Attach concrete evidence links (PRs, test files, docs, reports).
+3. Treat `Done` as requiring evidence for all exit criteria.

docs/threat_model.md

@@ -0,0 +1,173 @@
+# SeedPass Threat Model (Draft v0.2)
+
+## Scope
+
+This draft covers SeedPass core vault operations, local storage, portable backups,
+and Nostr synchronization paths.
+
+## Security Objectives
+
+1. Confidentiality of parent seed and derived secrets.
+2. Integrity of vault/index data across local and synced states.
+3. Reliable recovery from seed phrase and/or encrypted backup.
+4. Deterministic derivation of artifacts across supported platforms/versions.
+
+## Assets
+
+1. Parent seed phrase.
+2. Derived artifacts (passwords, TOTP secrets, key material).
+3. Encrypted vault index (`seedpass_entries_db.json.enc` and equivalents).
+4. Portable backup payloads and metadata.
+5. Account metadata:
+   - Fingerprints.
+   - Relay configuration.
+   - Sync state (manifest IDs, timestamps).
+
+## Trust Boundaries
+
+1. Local host boundary:
+   - Application process, filesystem, clipboard, terminal.
+2. Network boundary:
+   - Nostr relay transport and storage (untrusted relays).
+3. Backup boundary:
+   - Exported files and any external backup path.
+4. Build/dependency boundary:
+   - Package dependencies, installers, and release artifacts.
+
+## Attacker Profiles
+
+1. Remote observer:
+   - Can observe Nostr traffic metadata and timing; cannot break strong cryptography.
+2. Malicious relay operator:
+   - Can drop, reorder, replay, or withhold events; can inspect ciphertext and metadata.
+3. Local unprivileged attacker:
+   - Can read user-level files on a compromised host.
+4. Local privileged attacker / malware:
+   - Can inspect process memory, keypresses, clipboard, and runtime state.
+5. Supply-chain attacker:
+   - Can attempt dependency or build artifact compromise.
+
+## Assumptions
+
+1. Cryptographic primitives and libraries are implemented correctly.
+2. User keeps parent seed secret and offline where possible.
+3. Host OS is not fully compromised during sensitive operations.
+4. Relay operators are untrusted for confidentiality/integrity.
+5. Users can securely verify installation provenance.
+
+## Non-Goals
+
+1. Protection against a fully compromised endpoint with active malware.
+2. Guaranteed metadata privacy from global traffic analysis.
+3. Protection if the parent seed is disclosed.
+
+## High-Risk Scenarios
+
+1. Parent seed leakage:
+   - Impact: total compromise of all deterministic artifacts.
+   - Mitigations: strict secret handling, no logging, secure backup guidance.
+2. Local plaintext leakage (logs/temp/clipboard):
+   - Impact: credential theft despite encrypted-at-rest vault.
+   - Mitigations: clipboard auto-clear, log redaction, temp file minimization.
+3. Relay manipulation/replay/stale restore:
+   - Impact: rollback or inconsistent state across devices.
+   - Mitigations: checksum verification, manifest/delta integrity checks, explicit sync guidance.
+4. Export backup mishandling:
+   - Impact: offline brute-force or direct exposure if unencrypted export is used.
+   - Mitigations: encrypted export default, warnings, permissions hardening.
+5. Dependency/build compromise:
+   - Impact: malicious code exfiltration of seed/secrets.
+   - Mitigations: lockfiles + hashes, dependency audit, signed releases.
+
+## Required Decisions (Item 1 Completion Gate)
+
+1. Acceptable metadata leakage:
+   - Are payload size/timing/fingerprint-derived identifiers acceptable for production use?
+2. Endpoint compromise stance:
+   - What user guidance is mandatory for host hardening and safe operation?
+3. Recovery policy:
+   - Which recovery path is canonical for production: seed-only, backup-only, or both?
+4. Relay trust posture:
+   - Minimum relay set diversity and failover recommendations.
+5. Release trust chain:
+   - Required artifact signing and verification process.
+
+## Proposed Defaults
+
+Status: `Approved (Provisional)`
+
+1. Metadata leakage posture:
+   - Proposed default: Accept ciphertext-size and sync-timing leakage as an
+     explicit tradeoff for relay-based recovery.
+   - Requirement: Document this clearly in user-facing security docs and warn
+     users not to treat relay metadata as private.
+   - Constraint: No plaintext secret material or deterministic secret-derived
+     fields should be published to relays.
+
+2. Endpoint compromise stance:
+   - Proposed default: SeedPass is not secure against active local malware or
+     a fully compromised host.
+   - Requirement: Add explicit operational guidance:
+     - Use dedicated, hardened device profile for high-value seeds.
+     - Keep offline mode enabled unless sync is required.
+     - Minimize clipboard usage for sensitive workflows.
+   - Requirement: Add periodic hygiene checklist in docs.
+
+3. Recovery policy:
+   - Proposed default: Canonical recovery is seed-first; encrypted portable
+     backup import is secondary for convenience and fast restore.
+   - Requirement: Every release must preserve both:
+     - seed-only deterministic recovery path
+     - encrypted backup export/import compatibility
+   - Requirement: Keep migration tests for legacy indexes and backup formats.
+
+4. Relay trust posture:
+   - Proposed default: Minimum 3 independent relays from different operators.
+   - Requirement: Recommend at least 1 high-availability relay + 2 alternates.
+   - Requirement: Treat relay data as untrusted input; require checksum and
+     integrity validation before accepting restored data.
+   - Requirement: Keep retry/backoff behavior for eventual consistency.
+
+5. Release trust chain:
+   - Proposed default: Signed tags/releases plus published checksums for all
+     distributable artifacts.
+   - Requirement: Dependency lockfile with hashes remains mandatory in CI.
+   - Requirement: Reject release if provenance checks fail or lockfile drift is
+     detected without review.
+
+## Decision Approval Record
+
+Use this table to convert proposed defaults to approved policy.
+
+| Decision Area | Proposed | Approved | Date | Reviewer | Notes |
+|---|---|---|---|---|---|
+| Metadata leakage posture | Yes | Yes | 2026-02-25 | Maintainers (Provisional) | Accepted as explicit recovery tradeoff. |
+| Endpoint compromise stance | Yes | Yes | 2026-02-25 | Maintainers (Provisional) | Not secure against active local malware. |
+| Recovery policy | Yes | Yes | 2026-02-25 | Maintainers (Provisional) | Seed-first canonical recovery. |
+| Relay trust posture | Yes | Yes | 2026-02-25 | Maintainers (Provisional) | Minimum 3 independent relays recommended. |
+| Release trust chain | Yes | Yes | 2026-02-25 | Maintainers (Provisional) | Signed releases + checksums required. |
+
+## Initial Risk Ranking
+
+1. Critical: parent seed compromise.
+2. High: endpoint malware/memory scraping.
+3. High: insecure backup handling and accidental plaintext exposure.
+4. Medium: relay replay/staleness causing wrong-state restore.
+5. Medium: supply-chain compromise.
+
+## Mapping to Existing Evidence
+
+1. Real-relay restore/sync E2E coverage:
+   - `src/tests/test_nostr_real.py`
+2. Portable backup/import integrity tests:
+   - `src/tests/test_portable_backup.py`
+3. Account lifecycle roundtrip tests:
+   - `src/tests/test_account_roundtrip_restore.py`
+4. Large-index relay syncability probe:
+   - `src/tests/test_nostr_index_size.py`
+
+## Next Actions
+
+1. Convert provisional approvals to formal release-policy signoff before external audit.
+2. Add a risk register table with owner and target date per high-risk scenario.
+3. Link resulting mitigations back to code/tests/docs in `docs/security_readiness_checklist.md`.