fix(crypto): use real HMAC-SHA256 for attestations; refuse fake asymmetric keys

Two honesty/security fixes flagged by the threat model and STATE.a2ml.

B3 — attestation MAC:
- Replace the homerolled `SHA256(key || data || previous_hash)` (not a MAC;
  banned by the Trustfile `no-homerolled-hmac` invariant) with a real
  HMAC-SHA256 via the `hmac` crate (RFC 2104), with a versioned scheme
  label bound in as a domain separator (januskey.attestation.HMAC-SHA256.v1).
- `compute_attestation` now returns Result and hard-errors when no key is
  set, removing the `unwrap_or([0u8; 32])` all-zero-key fallback that
  silently produced forgeable, unkeyed attestations.
- Producer (log_event) and verifier (verify_integrity) both propagate the
  error, so they stay consistent.

B4 — fake asymmetric crypto:
- `SecretKey::generate()` only ever produces 32 random bytes and ignores
  the algorithm, so selecting ed25519/x25519 yielded a random blob merely
  labelled "Ed25519"/"X25519" — not a keypair. Refuse generation of these
  types at the CLI with a clear "not implemented" error. Enum variants are
  retained (documented as reserved/unimplemented) so historical serialized
  metadata and audit entries still deserialize.

Regression tests added: test_attestation_refused_without_key,
test_attestation_is_genuinely_keyed (wrong key fails verification — a plain
hash would not catch this, proving the MAC is genuinely keyed).

Verified: `cargo build -p januskey` clean; `cargo test -p januskey --lib`
26 passed / 0 failed; attestation E2E + P2P chain-integrity tests pass.
STATE.a2ml blockers updated (homerolled-hmac RESOLVED).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015qwVESTcbfanY2iJPQNoSz

Author: claude

.machine_readable/6a2/STATE.a2ml

@@ -53,8 +53,8 @@ compatibility = false
 
 [blockers]
 threat-model-signoff = "threat-model.a2ml status = draft-pending-human-review (since 2026-04-19); blocks any januskey-mcp cartridge"
-homerolled-hmac = "attestation.rs SHA256(key||data) pattern flagged by threat model; must be replaced with a real HMAC primitive before MCP exposure (Trustfile no-homerolled-hmac)"
-metadata-only-key-types = "Ed25519/X25519 enum entries lack real sign/DH implementations (threat-model flag)"
+homerolled-hmac = "RESOLVED: attestation.rs now uses a real HMAC-SHA256 (hmac crate, RFC 2104) with a versioned domain separator, and hard-errors instead of the unwrap_or([0u8;32]) unkeyed fallback. Regression tests: test_attestation_refused_without_key, test_attestation_is_genuinely_keyed. Satisfies Trustfile no-homerolled-hmac."
+metadata-only-key-types = "PARTIALLY MITIGATED: Ed25519/X25519 key generation is now refused at the CLI (was silently producing 32 random bytes mislabelled as an asymmetric key); enum variants retained only for backward-compatible deserialization. Real dalek-backed sign/DH still unimplemented."
 claude-md-maintainer-edits = ".claude/CLAUDE.md is guardrail-blocked for agents: line 46 still says 'Julia/Rust/ReScript' (leftover from #49); package-management section still cites flake.nix, removed by the estate wave"
 idris2-in-ci = "just test-proofs requires the idris2 binary; proof check not yet wired as a CI gate (READINESS D→C promotion item)"
 

Cargo.lock

@@ -18,6 +18,7 @@ clap = { version = "4", features = ["derive"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.10"
+hmac = "0.12"
 chrono = { version = "0.4", features = ["serde"] }
 uuid = { version = "1", features = ["v4", "serde"] }
 thiserror = "1"

crates/januskey-cli/Cargo.toml

@@ -6,6 +6,7 @@
 // Tamper-evident logging with cryptographic attestations
 
 use chrono::{DateTime, Utc};
+use hmac::{Hmac, Mac};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::fs::{self, File, OpenOptions};
@@ -118,6 +119,10 @@ pub struct AuditLog {
 }
 
 impl AuditLog {
+    /// Domain-separation / version label bound into every attestation MAC.
+    /// Bumping this string invalidates prior attestations by construction.
+    const ATTESTATION_SCHEME: &'static str = "januskey.attestation.HMAC-SHA256.v1";
+
     /// Create audit log manager for a directory
     pub fn new(root: &Path) -> Self {
         let log_path = root.join(".januskey").join("keys").join("audit.log");
@@ -179,16 +184,43 @@ impl AuditLog {
             .unwrap_or_else(|| "0".repeat(64)))
     }
 
-    /// Compute HMAC-SHA256 attestation
-    fn compute_attestation(&self, data: &str, previous_hash: &str) -> String {
-        let key = self.attestation_key.unwrap_or([0u8; 32]);
-
-        // Simple HMAC-SHA256: H(key || data || previous_hash)
-        let mut hasher = Sha256::new();
-        hasher.update(&key);
-        hasher.update(data.as_bytes());
-        hasher.update(previous_hash.as_bytes());
-        hex::encode(hasher.finalize())
+    /// Compute the attestation MAC for a log entry.
+    ///
+    /// Uses a real HMAC-SHA256 (RFC 2104) via the `hmac` crate, keyed on the
+    /// store-derived attestation key. This replaces the former homerolled
+    /// `SHA256(key || data || previous_hash)` construction, which was not a
+    /// MAC (length-extension–exposed and banned by the Trustfile
+    /// `no-homerolled-hmac` invariant).
+    ///
+    /// The scheme label is bound into the MAC as a domain separator; it
+    /// versions the construction, so entries written under the old homerolled
+    /// scheme will not verify under this one (an intentional, alpha-stage
+    /// breaking change — see the module changelog / STATE.a2ml).
+    ///
+    /// Errors if no attestation key is set: an unkeyed attestation is
+    /// forgeable and must never be silently produced (the previous
+    /// `unwrap_or([0u8; 32])` all-zero-key fallback did exactly that).
+    fn compute_attestation(
+        &self,
+        data: &str,
+        previous_hash: &str,
+    ) -> std::io::Result<String> {
+        let key = self.attestation_key.ok_or_else(|| {
+            std::io::Error::new(
+                std::io::ErrorKind::PermissionDenied,
+                "attestation key not set; refusing to produce an unkeyed \
+                 (forgeable) attestation — call init()/set_attestation_key() first",
+            )
+        })?;
+
+        let mut mac = <Hmac<Sha256>>::new_from_slice(&key)
+            .expect("HMAC accepts keys of any length");
+        mac.update(Self::ATTESTATION_SCHEME.as_bytes());
+        mac.update(b"\x00");
+        mac.update(data.as_bytes());
+        mac.update(b"\x00");
+        mac.update(previous_hash.as_bytes());
+        Ok(hex::encode(mac.finalize().into_bytes()))
     }
 
     /// Log an event
@@ -211,7 +243,7 @@ impl AuditLog {
             event_type,
             actor
         );
-        let attestation = self.compute_attestation(&attestation_data, &previous_hash);
+        let attestation = self.compute_attestation(&attestation_data, &previous_hash)?;
 
         let entry = AuditEntry {
             event_id,
@@ -408,7 +440,7 @@ impl AuditLog {
                 entry.actor
             );
             let expected_attestation =
-                self.compute_attestation(&attestation_data, &entry.previous_hash);
+                self.compute_attestation(&attestation_data, &entry.previous_hash)?;
 
             if entry.attestation != expected_attestation {
                 return Ok(IntegrityReport {
@@ -552,4 +584,49 @@ mod tests {
             .expect("failed to get key history");
         assert_eq!(history.len(), 3);
     }
+
+    #[test]
+    fn test_attestation_refused_without_key() {
+        // An AuditLog with no attestation key must refuse to produce an
+        // attestation rather than silently sign with an all-zero key
+        // (the former unwrap_or([0u8; 32]) forgery hazard).
+        let tmp = TempDir::new().expect("failed to create temp dir");
+        let log = AuditLog::new(tmp.path()); // note: no init()/set_attestation_key()
+
+        let err = log
+            .log_store_init()
+            .expect_err("logging without a key must fail");
+        assert_eq!(err.kind(), std::io::ErrorKind::PermissionDenied);
+    }
+
+    #[test]
+    fn test_attestation_is_genuinely_keyed() {
+        // Verifying with the wrong key must fail. A plain unkeyed hash would
+        // still "verify" here; only a real keyed MAC catches this, proving the
+        // attestation is HMAC-keyed and not the old homerolled concatenation.
+        let tmp = TempDir::new().expect("failed to create temp dir");
+
+        {
+            let mut log = AuditLog::new(tmp.path());
+            log.init([7u8; 32]).expect("init");
+            log.log_store_init().expect("log");
+            log.log_key_generated(
+                Uuid::new_v4(),
+                "fp",
+                KeyAlgorithm::Aes256Gcm,
+                KeyPurpose::Encryption,
+            )
+            .expect("log");
+            assert!(log.verify_integrity().expect("verify").valid);
+        }
+
+        // Re-open the same log with a DIFFERENT attestation key.
+        let mut wrong = AuditLog::new(tmp.path());
+        wrong.set_attestation_key([9u8; 32]);
+        let report = wrong.verify_integrity().expect("verify");
+        assert!(
+            !report.valid,
+            "verification must fail under a different key (keyed MAC)"
+        );
+    }
 }

crates/januskey-cli/src/attestation.rs

@@ -63,8 +63,15 @@ const KEY_LENGTH: usize = 32;
 /// Key algorithm types
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub enum KeyAlgorithm {
+    /// AES-256-GCM symmetric key — the only algorithm actually implemented.
     Aes256Gcm,
+    /// Reserved / NOT IMPLEMENTED. No Ed25519 keypair is generated; key
+    /// generation for this variant is refused at the CLI. Retained so
+    /// historical serialized metadata/audit entries still deserialize.
     Ed25519,
+    /// Reserved / NOT IMPLEMENTED. No X25519 keypair is generated; key
+    /// generation for this variant is refused at the CLI. Retained so
+    /// historical serialized metadata/audit entries still deserialize.
     X25519,
 }
 

crates/januskey-cli/src/keys.rs

@@ -279,15 +279,23 @@ fn cmd_generate(
 
     let algorithm = match key_type.to_lowercase().as_str() {
         "aes256" | "aes-256" | "aes256gcm" => KeyAlgorithm::Aes256Gcm,
-        "ed25519" => KeyAlgorithm::Ed25519,
-        "x25519" => KeyAlgorithm::X25519,
-        _ => {
+        // Ed25519/X25519 are NOT implemented: SecretKey::generate() only
+        // produces 32 random bytes and ignores the algorithm, so generating
+        // one would yield a random blob merely labelled "Ed25519"/"X25519",
+        // not a real keypair. Refuse rather than advertise a capability that
+        // does not exist. (Re-enable once dalek-backed signing/DH lands.)
+        "ed25519" | "x25519" => {
             return Err(format!(
-                "Unknown key type: {}. Use: aes256, ed25519, x25519",
-                key_type
+                "Key type '{}' is not implemented yet: JanusKey has no \
+                 asymmetric key generation (only AES-256-GCM symmetric keys). \
+                 Refusing to generate a random blob mislabelled as {}.",
+                key_type, key_type
             )
             .into())
         }
+        _ => {
+            return Err(format!("Unknown key type: {}. Use: aes256", key_type).into())
+        }
     };
 
     let key_purpose = match purpose.to_lowercase().as_str() {