docs(docs): add documentation site with Blume config and initial MDX pages

2026-09-17 07:26:25 +00:00 · 2026-09-02 16:53:24 -04:00
parent 9b357128cc
commit b1a622ea13
121 changed files with 23710 additions and 0 deletions
@@ -0,0 +1,118 @@
+---
+title: "Cryptographic Security Enhancements"
+description: "Comprehensive overview of cryptographic security enhancements in the Sonr blockchain"
+icon: "lock"
+sidebar:
+  label: "Cryptography Usage"
+---
+
+:::info
+This document details the comprehensive cryptographic security enhancements
+implemented in the Sonr blockchain to address critical vulnerabilities and
+strengthen the overall security posture.
+:::
+
+:::note
+This page is a historical summary of the hardening work tracked in the
+changelog. The primitives themselves — `mpc`, `keys`, `ucan`, `vrf`, `argon2`,
+`password`, and `wasm` — live in
+[`github.com/sonr-io/crypto`](https://github.com/sonr-io/crypto) and are
+documented on that repository's own docs site. Chain-side usage is covered in
+the [module reference](/reference/modules/did).
+:::
+
+## WASM Plugin Security
+
+### SHA256 Hash Verification
+
+:::warning
+All WASM plugins are now verified using SHA256 hashes before execution to
+prevent tampering and ensure integrity.
+:::
+
+**Implementation**: `crypto/wasm/verifier.go`
+
+```go
+// Usage example
+verifier := wasm.NewHashVerifier()
+hash := verifier.ComputeHash(wasmBytes)
+verifier.AddTrustedHash("motr.wasm", hash)
+
+// Verify before execution
+err := verifier.VerifyHash("motr.wasm", wasmBytes)
+if err != nil {
+// Plugin verification failed - do not execute
+}
+```
+
+**Features**:
+
+- Automatic hash computation on plugin load
+- Hash chain verification for secure updates
+- Trusted hash whitelist management
+- Maximum size enforcement (10MB default)
+
+### Ed25519 Code Signing
+
+:::warning
+WASM plugins must be signed with Ed25519 signatures to ensure authenticity and
+prevent unauthorized modifications.
+:::
+
+**Implementation**: `crypto/wasm/signer.go`
+
+```go
+// Sign a plugin
+signer := wasm.NewSigner(privateKey, publicKey)
+signature, err := signer.SignModule(wasmBytes, "motr.wasm", "v1.0.0")
+
+// Verify signature
+manifest := &wasm.SignatureManifest{
+ModuleHash: hash,
+Signatures: []wasm.SignatureEntry{\*signature},
+TrustedKeys: trustedKeys,
+}
+err = signer.VerifyWithManifest(wasmBytes, manifest)
+```
+
+### Further sections
+
+The remaining hardening areas — password policy, deterministic ECDSA,
+signature canonicalization, and key derivation — are implemented in
+[`github.com/sonr-io/crypto`](https://github.com/sonr-io/crypto); see that
+repository's docs for parameter-level detail.
+
+## Security Considerations
+
+:::warning
+### Best Practices 1. **Always validate passwords** before use 2. **Never
+store passwords in plaintext** or logs 3. **Use deterministic ECDSA** for all
+signatures 4. **Canonicalize all signatures** before storage 5. **Verify WASM
+plugins** before execution
+:::
+
+## Support
+
+:::info
+For questions or issues related to cryptographic security: 1. Check the test
+suites for usage examples 2. Review the security test scenarios 3. Open an
+issue on GitHub with the `security` label 4. Contact the security team for
+sensitive issues
+:::
+
+## Changelog
+
+### Version 0.10.34
+
+- Added WASM hash verification (`crypto/wasm/verifier.go`)
+- Added Ed25519 code signing (`crypto/wasm/signer.go`)
+- Replaced hardcoded passwords with secure validation (`crypto/password/validator.go`)
+- Implemented Argon2id key derivation (`crypto/argon2/kdf.go`)
+- Added RFC 6979 deterministic ECDSA (`crypto/ecdsa/deterministic.go`)
+- Implemented signature canonicalization (`crypto/ecdsa/canonical.go`)
+- Added comprehensive security test suite (`crypto/security_test.go`)
+
+---
+
+_Last Updated: 2024_
+_Security Contact: security@sonr.io_