admin
47dd0bd244
internal/escrow: zero-knowledge escrow creation. R = 10 EFF-wordlist words (crypto/rand, ~129 bits); wrap K under R via PBS-native key change-passphrase driven over a stdlib pty (x/sys/unix; output discarded so R can't leak, F-A2); self-verify the blob recovers K (fingerprint match) before shipping. Opt-in (b) R-wrapped offline copy + (a) raw paperkey. Live K is byte-unchanged (operates on a copy). --selftest=escrow-create (-storage/-paperkey/-offline/-upload). Posture config field (zero_knowledge default). PBSEncKeyPath helper. Grounded by the escrow spike findings. Tests: R entropy>=128/format/uniqueness; integration round-trip (wrap->unwrap fingerprint match, wrong-R fails, K byte-unchanged) guarded to linux+pbc. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
17 lines
479 B
Go
17 lines
479 B
Go
//go:build !linux
|
|
|
|
package escrow
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"runtime"
|
|
)
|
|
|
|
// runWithPassphrase is unsupported off Linux — the agent runs only on Proxmox (Linux) hosts. This
|
|
// stub lets the package compile (and its pure-Go parts, e.g. recovery-code generation, be tested)
|
|
// on other platforms.
|
|
func runWithPassphrase(_ context.Context, _ string, _ int, _ string, _ ...string) error {
|
|
return fmt.Errorf("escrow: pty-driven key wrap is Linux-only (GOOS=%s)", runtime.GOOS)
|
|
}
|