[Guardian] [3/3] Support individual KP cert rotation#785
Open
mskd12 wants to merge 1 commit into
Open
Conversation
mskd12
force-pushed
the
deepakmaram/iop-487-rotate-kp-cert
branch
4 times, most recently
from
July 9, 2026 16:47
d0444c1 to
4675429
Compare
mskd12
force-pushed
the
deepakmaram/iop-487-kp-share-distribution
branch
from
July 9, 2026 19:25
f302a4e to
63a2fce
Compare
mskd12
force-pushed
the
deepakmaram/iop-487-rotate-kp-cert
branch
4 times, most recently
from
July 9, 2026 20:02
507068a to
3527e67
Compare
mskd12
force-pushed
the
deepakmaram/iop-487-rotate-kp-cert
branch
from
July 9, 2026 20:17
3527e67 to
4ecfc62
Compare
mskd12
marked this pull request as ready for review
July 9, 2026 20:19
mskd12
force-pushed
the
deepakmaram/iop-487-kp-share-distribution
branch
from
July 9, 2026 20:22
63a2fce to
b3a431e
Compare
mskd12
force-pushed
the
deepakmaram/iop-487-rotate-kp-cert
branch
from
July 9, 2026 20:23
4ecfc62 to
4cffa25
Compare
Base automatically changed from
deepakmaram/iop-487-kp-share-distribution
to
main
July 9, 2026 20:39
mskd12
force-pushed
the
deepakmaram/iop-487-rotate-kp-cert
branch
from
July 9, 2026 20:40
4cffa25 to
eef7bc4
Compare
mskd12
marked this pull request as draft
July 9, 2026 21:08
mskd12
force-pushed
the
deepakmaram/iop-487-rotate-kp-cert
branch
from
July 15, 2026 23:47
eef7bc4 to
b7a4622
Compare
mskd12
changed the title
|
mskd12
force-pushed
the
deepakmaram/iop-487-rotate-kp-cert
branch
2 times, most recently
from
July 16, 2026 19:22
a33f5c6 to
d64f6ac
Compare
mskd12
marked this pull request as ready for review
July 16, 2026 20:04
mskd12
changed the title
mskd12
changed the title
mskd12
force-pushed
the
deepakmaram/iop-487-kp-cert-groups
branch
from
July 18, 2026 00:27
bcd3101 to
54d25a0
Compare
mskd12
force-pushed
the
deepakmaram/iop-487-rotate-kp-cert
branch
from
July 18, 2026 00:28
edfa208 to
34de4d9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #791.
Summary
This PR lets a key provisioner replace one OpenPGP certificate in its roster entry without changing the share or Bitcoin key.
The command uses
kp_pgp_cert_pathto decrypt and sign.--target-kp-pgp-fingerprintselects the certificate to replace. The signing certificate may be the target or another certificate in the same roster entry. This allows a lost YubiKey to be replaced when another certificate for that KP is still available.The proxy verifies the KP signature before forwarding the request. This is admission control that discards bulk unsigned or invalid traffic before it reaches the enclave. The guardian verifies the signature again, checks that the signer and target belong to the same share, verifies the submitted share against its commitment, replaces only the target ciphertext, and writes the next
cert_seq.The proxy code has a TODO for #781. Once that PR provides an S3-backed authorization roster, the proxy can also check signer membership and invalidate its cached roster after a successful rotation.
Validation
make fmt