Daemon: key cache, idle eviction and secret lifetimes

Open
#217 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
15/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Active
Tech stack
cryptography, rust
Domain
backend, security

Research direction

The issue names no source files, tests or entry points, so the first step is to read the referenced issues #147-#150, #100, #103 and #212 and the existing SecretBytes type. The checklist asks for a written current-state analysis and approval before any code change, so the first deliverable is that plan. Done means an approved plan covering cache limits, idle eviction, zeroization and mlock behaviour, with a small follow-up PR.

Written by the indexing model from the issue text.

Description

area:daemon priority:P3 type:security

Ziel und Abgrenzung

Native Daemon-Lebensdauer von Secrets: Cache-Limits, Idle-Timeouts, Entsperrfenster, Zeroization bei Evict/Shutdown/Cancel, Nebenläufigkeit, Crash-Grenzen und mlock/VirtualLock prüfen. Vorhandene SecretBytes wiederverwenden, keine zweite Speicherverwaltung oder XOR-Masking. #212 nutzt später diese native Funktion statt eigener Cache-Logik.

Priorität und Abhängigkeiten

  • P1
  • #147–#150, #100, #103; Schnittstelle #212

Verbindliche Umsetzung

  • Ist-Zustand, betroffene Dateien, Sicherheitsrisiken und Plan vor Änderungen dokumentieren; Freigabe einholen.
  • Ein kleiner unabhängiger PR; keine ungeplanten Refactorings, keine ungesicherte Netzwerkfreigabe.
  • Positiv-, Negativ-, Manipulations-, Abbruch-, Grenzwert- und Regressionstests nach Scope.
  • CI Windows/Linux soweit relevant, fmt/clippy/tests/Security-Checks grün.
  • Bestehende Schlüssel, CLI/API, Pakete und .pqkf v1/v2 bleiben kompatibel.
  • Dokumentation Deutsch/Englisch, Review, Definition of Done und Rollback nachgewiesen.

Rollback

ADR/PR revertieren oder opt-in Feature deaktivieren. Keine automatische Datenmigration; bestehende Installationen bleiben unverändert.

Dominant language
Rust
Stars
0
Forks
0
Avg merge
1h 22m
Merged PRs (30d)
72

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from SpecterAoD/pqkeep

All issues in SpecterAoD/pqkeep

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.