amadan
docs: secrets.md — home identity-anchor peppers + SES sender key (#1138)
The prod home.env gained the sign-in env this morning (SiwA + email doors); the vault rule says docs/secrets.md records every new secret in the same change.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 file changed,
+20
−4
docs/secrets.md+20 −4
diff --git a/docs/secrets.md b/docs/secrets.md| index b4c4774..bfbcfbb 100644 |
| --- a/docs/secrets.md |
| +++ b/docs/secrets.md |
| @@ -46,10 +46,26 @@ private — is `docs/secrets-vault.md`. |
| - **Session key** (`LCHAT_HOME_SESSION_KEY`) — HMAC ceremony proofs + sealed |
| WebAuthn session params (both keys derived from it with distinct labels). |
| Cannot open any vault. *Blast radius*: forge a 5-minute ceremony proof — |
| - i.e. the destructive-op gate (device revocation, blob delete) for a user |
| - whose uid you already know; vault *content* stays ciphertext. *Rotate*: |
| - swap the env and restart; in-flight ceremonies fail once, harmless. Unset, |
| - home mints an ephemeral key per boot (self-hoster default). |
| + i.e. the destructive-op gate (device revocation, blob delete, sign-in-method |
| + add/remove) for a user whose uid you already know; vault *content* stays |
| + ciphertext. *Rotate*: swap the env and restart; in-flight ceremonies fail |
| + once, harmless. Unset, home mints an ephemeral key per boot (self-hoster |
| + default). |
| +- **Identity-anchor peppers** (`LCHAT_HOME_SIWA_PEPPER`, |
| + `LCHAT_HOME_EMAIL_PEPPER`, per-provider `LCHAT_HOME_<PROVIDER>_PEPPER`) — |
| + HMAC the provider's stable subject (or lowercased email) into the blind |
| + index that maps a sign-in anchor to an account; identity anchors can never |
| + decrypt. *Blast radius*: pepper plus a DB copy lets an attacker test |
| + whether a *known* email/Apple ID has an account (membership probing) — |
| + content stays sealed. *Rotate*: last-resort only — a new pepper orphans |
| + every existing anchor of that kind; users re-link via a remaining sign-in |
| + method. |
| +- **SES sender key** (`AWS_*` on home when the email door is on; IAM user |
| + `ses-sender-production`, dev twin `ses-sender-dev`) — scoped to |
| + `ses:SendEmail` from `sign-in@elevenmessenger.com` only. *Blast radius*: |
| + send mail as the sign-in address (phishing paper). *Rotate*: standard IAM |
| + two-key rotation. Note it shares the `AWS_*` env with the S3 store below — |
| + an instance running both needs one IAM user carrying both scopes. |
| - **S3 backend credentials** (`AWS_*` when `LCHAT_HOME_STORE=s3`) — object |
| access to the home bucket. *Blast radius*: read/overwrite vault ciphertext |
| and WebAuthn public credentials; versioning keeps the last 5, so vandalism |