Repository navigation
Conversation
ADR 0009 (proposed) designs unlocking the locked PC with the phone's fingerprint: a credential provider that returns the user's password, which the PC keeps only sealed under a key the phone holds wrapped by a non-exportable, biometric-bound Keystore key. Neither the PC's disk nor the phone alone can recover it. It covers the options Windows allows, the threat model, the guards (LAN only, single-use requests, rate limit, unlock only, off by default) and open questions for the owner. docs/protocol/unlock.md drafts the messages. core::unlock has the parts that can be tested on their own: sealing and opening the password (AES-256-GCM via ring, bound to the PC, phone and Windows user), secrets wiped on drop and never printed, and the request rules. Nothing is wired to the network, and no credential provider exists yet: that needs a VM and an external review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
The groundwork for unlocking a locked Windows session with the phone's fingerprint (
docs/PLAN.md§3.10). It's a draft on purpose: nothing here reaches the apps yet, and the design needs decisions before the rest is built.docs/adr/0009-unlock-with-phone.md, Proposed): a credential provider that returns the user's password, kept split so the PC can't use it alone. The PC stores the password sealed with AES-256-GCM under a keyK; only the phone holdsK, wrapped by a Keystore key that needs a strong biometric for every use. It covers the guards (local network only, single-use 30 s requests, 5 failures locks it for 15 minutes, unlock only, off by default), the threat model, and where each piece runs.docs/protocol/unlock.md):unlock.enroll,unlock.wrapped,unlock.request,unlock.release,unlock.forget.core/nectarlink-core/src/unlock.rs): sealing and opening with the PC, the phone and the Windows user bound in as associated data, a secret type that's wiped on drop and never printed, and the request rules (expiry, single use, failure lockout). Usesring, already a dependency.Open questions (from the ADR)
Still to do
The phone's Keystore key and biometric prompt, the protocol handlers on both sides, the credential provider DLL (
desktop/credprov), its install and removal, a VM test plan, and an external security review before any of it ships.How it was tested
The vault's 7 unit tests: a sealed password opens only with its key and binding, a changed one doesn't open, each seal uses a new nonce and keys must be 32 bytes, secrets are never printed, a request is answered once, in time, by its phone, repeated failures lock it out for a while, and old failures and a success don't count.
scripts/check.ps1passes.