archetech / archon / 30831203771

94%

main: 95%

Pull #836

github

docs: add SECURITY.md documenting key generation and entropy

The repo had no SECURITY.md and no disclosure policy — only a
point-in-time SECURITY_AUDIT.md from February. This adds the reporting
route and documents where private keys come from.

The substance is the entropy chain, written up because "the private key
is 256 bits" is true of the value and misleading about the entropy:

  bip39.generateMnemonic()  -> 128 bits (12 words; bip39's default, called
                               with no strength argument)
  mnemonicToSeedSync        -> 512-bit seed, still 128 bits of entropy
  HD derive m/44'/0'/N'/0/i -> 32-byte secp256k1 key, 128 bits of entropy

128 bits is the right choice rather than a shortfall: secp256k1 offers
~128-bit security via Pollard's rho, so the seed is matched to the curve
and a 24-word mnemonic would not make the keys harder to attack. The real
consequence is correlation — one mnemonic compromises every DID derived
from it, so separate mnemonics rather than separate accounts are what
isolate identities.

Also documented: vault keypairs are independently generated at ~256 bits
and are NOT recoverable from the seed (the opposite trade-off, worth
knowing before assuming a seed backup covers everything); DIDComm X25519
keys ARE seed-derived; the RNG throws rather than degrading to
Math.random() on any path; and the mnemonic is stored under PBKDF2-SHA512
at 100k iterations plus AES-GCM.

Every claim was verified against the code and by executing the relevant
paths, including confirming bip39's default strength empirically rather
than from its docs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

3605 of 4060 branches covered (88.79%)

Branch coverage included in aggregate %.

8229 of 8511 relevant lines covered (96.69%)

687.18 hits per line