From 57ea8819b55049d87d30139555564814724b2491 Mon Sep 17 00:00:00 2001 From: japabu Date: Thu, 22 Oct 2026 06:35:41 +0200 Subject: [PATCH 1/2] sshserver: russh's p384 on its own bignum backend, so no fiat-crypto compiles in The owner ruled on 2026-10-21 that ToyOS takes fiat-crypto as a dependency of no kind. russh's `p384` 0.14.0-rc.8 depends on `fiat-crypto` 0.3.0 unless `cfg(p384_backend = "bignum")` is set (`[target.'cfg(not(p384_backend = "bignum"))'.dependencies]`), and nothing set it, so fiat's P-384 arithmetic was compiled into sshserver. The guest targets now set it, as the UEFI targets already set `curve25519_dalek_backend`. sshserver is the only guest crate that reaches `p384`, and the setting goes with russh at stage 2 of the SSH track, whose exit now says so. `Cargo.lock` still lists fiat-crypto: the lock records every optional target dependency whether or not a build selects it. Co-Authored-By: Claude Opus 5.5 --- .cargo/config.toml | 8 ++++++-- issues/the-ssh-server-is-toyos-own-and-russh-is-gone.md | 2 ++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.cargo/config.toml b/.cargo/config.toml index 798bc0d8739..020b40d22d6 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -37,11 +37,15 @@ rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes", "--cfg=curve25519_dalek [target.aarch64-unknown-uefi] rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes", "--cfg=curve25519_dalek_backend=\"serial\"", "-Clink-arg=/Brepro", "-Clink-arg=/DEBUG:NONE"] +# `p384`'s field and scalar arithmetic in its own `bignum` backend: its +# default is fiat-crypto, which ToyOS takes as a dependency of no kind +# (`issues/toyos-crypto-is-in-the-tree-on-par-with-ring-and-secure.md`). It +# reaches the guest only through russh in `system/sshserver`, and goes with it. [target.x86_64-unknown-toyos] -rustflags = ["-Dwarnings"] +rustflags = ["-Dwarnings", "--cfg=p384_backend=\"bignum\""] [target.aarch64-unknown-toyos] -rustflags = ["-Dwarnings"] +rustflags = ["-Dwarnings", "--cfg=p384_backend=\"bignum\""] # `tests/guest/osbench`'s Linux build, static so a bench runs it without a # toolchain, linked by the toolchain's own LLD so no C toolchain is needed, and diff --git a/issues/the-ssh-server-is-toyos-own-and-russh-is-gone.md b/issues/the-ssh-server-is-toyos-own-and-russh-is-gone.md index 1536315cd25..bfcb16fa63f 100644 --- a/issues/the-ssh-server-is-toyos-own-and-russh-is-gone.md +++ b/issues/the-ssh-server-is-toyos-own-and-russh-is-gone.md @@ -59,6 +59,8 @@ Compromises of `toyos-ssh` recorded on their own: entry. - `Cargo.lock` has no `russh`, `russh-cryptovec`, `rsa`, `pageant` or `internal-russh-num-bigint` package. + - The guest targets' `--cfg=p384_backend="bignum"` in `.cargo/config.toml`, + which keeps fiat-crypto out of russh's `p384`, is gone with it. - A recorded `sftp` session and a recorded shell session replay byte for byte under `cargo run -- --ci host`. 3. **ML-KEM.** Our own `mlkem768x25519-sha256`, on `toyos-crypto`'s From 177651f813987ea10828b6d8042681982d0b3a4c Mon Sep 17 00:00:00 2001 From: japabu Date: Thu, 22 Oct 2026 09:54:38 +0200 Subject: [PATCH 2/2] sshserver: p384's bignum backend on the host too, and its trade-off recorded Review r1 of #1005. `--ci host` compiled sshserver, and so fiat-crypto, for the host test and checked it for Linux and Windows: a build for a triple with no `[target]` table took no flags from the config. `[build] rustflags` is what cargo applies to exactly those builds, and the ToyOS tables, whose flags replace it, carry the cfg as well. The SSH track records the compromise: until stage 2, sshserver's P-384 (client `ecdsa-sha2-nistp384` verification before authentication, and an operator's P-384 host key) runs on the backend upstream calls experimental. The config comment no longer cites the crypto issue, whose record of the ruling lands with #993. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01PXEk8BBMDT8tXu4AnENB9Q --- .cargo/config.toml | 15 +++++++++------ ...e-ssh-server-is-toyos-own-and-russh-is-gone.md | 15 +++++++++++++-- 2 files changed, 22 insertions(+), 8 deletions(-) diff --git a/.cargo/config.toml b/.cargo/config.toml index 020b40d22d6..5584339528f 100644 --- a/.cargo/config.toml +++ b/.cargo/config.toml @@ -1,11 +1,18 @@ # One table per guest triple, since the workspace builds for all of them and for -# the host: a guest build names its triple with `--target`, and a host build -# takes no flags from here. +# the host: a guest build names its triple with `--target`. A build for a triple +# with no table here, the host's and the host apps' included, takes `[build]`'s. # A checkout's own configuration, untracked: a fork clone under edit is listed # there (`.claude/agents/implementer.md`, "A fork"). include = [{ path = "local.toml", optional = true }] +# `p384`'s field and scalar arithmetic in its own `bignum` backend, here and in +# the ToyOS tables, whose flags replace these: its default is fiat-crypto, which +# ToyOS takes as a dependency of no kind. Only russh reaches `p384` 0.14 +# (`system/sshserver`, on the host and the guest), and this goes with it. +[build] +rustflags = ["--cfg=p384_backend=\"bignum\""] + [target.x86_64-unknown-none] rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes"] @@ -37,10 +44,6 @@ rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes", "--cfg=curve25519_dalek [target.aarch64-unknown-uefi] rustflags = ["-Dwarnings", "-Cforce-frame-pointers=yes", "--cfg=curve25519_dalek_backend=\"serial\"", "-Clink-arg=/Brepro", "-Clink-arg=/DEBUG:NONE"] -# `p384`'s field and scalar arithmetic in its own `bignum` backend: its -# default is fiat-crypto, which ToyOS takes as a dependency of no kind -# (`issues/toyos-crypto-is-in-the-tree-on-par-with-ring-and-secure.md`). It -# reaches the guest only through russh in `system/sshserver`, and goes with it. [target.x86_64-unknown-toyos] rustflags = ["-Dwarnings", "--cfg=p384_backend=\"bignum\""] diff --git a/issues/the-ssh-server-is-toyos-own-and-russh-is-gone.md b/issues/the-ssh-server-is-toyos-own-and-russh-is-gone.md index bfcb16fa63f..6e6bc5ec7d3 100644 --- a/issues/the-ssh-server-is-toyos-own-and-russh-is-gone.md +++ b/issues/the-ssh-server-is-toyos-own-and-russh-is-gone.md @@ -32,6 +32,18 @@ Compromises of `toyos-ssh` recorded on their own: `issues/toyos-ssh-offers-only-a-classical-key-exchange.md` and `issues/toyos-ssh-leaves-its-secrets-in-freed-memory.md`. +A compromise of the server shipped today, until stage 2: russh's `p384` +runs on its `bignum` backend (`--cfg=p384_backend="bignum"` in +`.cargo/config.toml`), which keeps fiat-crypto out under the owner's ruling +that ToyOS takes it as a dependency of no kind. `p384` 0.14.0-rc.8 calls that +backend experimental and says it "might also have bugs", where fiat's is +formally verified (`src/lib.rs`). sshserver reaches P-384 in two places: +it verifies a client's `ecdsa-sha2-nistp384` publickey signature, which is +untrusted input before authentication, and it signs with a P-384 host key +when the operator's host-key file holds one (a minted key is Ed25519). It +negotiates no `ecdh-sha2-nistp384`: russh's default order leaves it out. +Owner: this track's. Exit: stage 2, which deletes russh and the setting. + ## Stages 1. **The core, on the host.** `toyos-ssh`: strict `curve25519-sha256`, the @@ -59,8 +71,7 @@ Compromises of `toyos-ssh` recorded on their own: entry. - `Cargo.lock` has no `russh`, `russh-cryptovec`, `rsa`, `pageant` or `internal-russh-num-bigint` package. - - The guest targets' `--cfg=p384_backend="bignum"` in `.cargo/config.toml`, - which keeps fiat-crypto out of russh's `p384`, is gone with it. + - `.cargo/config.toml` sets no `p384_backend`. - A recorded `sftp` session and a recorded shell session replay byte for byte under `cargo run -- --ci host`. 3. **ML-KEM.** Our own `mlkem768x25519-sha256`, on `toyos-crypto`'s