|
findings
New document:
- key-hierarchy.md: Full key derivation model, MUK lifecycle, SRP auth,
biometric unlock, Duo MFA, dSecret bypass, delegated sessions, password
timebox mechanism, crypto algorithm inventory
Major updates:
- architecture.md: Expanded WASM section with confirmed 80+ rA.* methods,
clarified WASM is portability layer not security boundary
- trust-boundaries.md: Corrected Zone A (keys in JS heap not just WASM),
Zone D (confirmed native messaging protocol with biometry messages),
Zone F (WASM is NOT a privilege boundary), detailed sensitive data table
with confirmed storage locations, new Critical attack surface category
- message-catalog.md: Added native messaging protocol (biometry save/unlock/
remove, availability check), desktop connection messages, server notification
events
- TODO.md: Marked completed items, added key material exposure assessment
section, authentication & session security section
|
