Security / Ops / Resilience — Repo State & Gap Analysis

Compiled 2026-02-14 by Security/Ops/Resilience Analyst Branch: main @ 86677ac6

1. Current Security Posture

1.1 Transport Security

QUIC/TLS implementation — icn-net/src/session.rs, icn-net/src/tls.rs

Key observations:

• Three critical vulnerabilities (unauthenticated QUIC, unverified DID-TLS binding, gateway scope escalation) were identified and fixed in Dec 2025 security hardening session (docs/archive/2025/security-hardening-2025-12-18.md)
• Rate limiting currently checks message.from before signature verification — attacker can forge from to exhaust another peer's rate limit budget (noted in hardening doc as "Low Priority Enhancement")

1.2 Message Security

SignedEnvelope — icn-net/src/envelope.rs:61

ReplayGuard — icn-net/src/replay_guard.rs

Remaining concern: Bloom filter saturation over very long-running sessions (noted in hardening doc).

1.3 Identity Security

Keystore — icn-identity/src/keystore.rs

Social Recovery — icn-identity/src/recovery.rs:1-831

1.4 Trust-Gated Access Control

Trust graph — icn-trust/src/

1.5 Gateway Security

Auth flow — icn-gateway/src/auth.rs, icn-gateway/src/api/auth.rs

Security headers — icn-gateway/src/security.rs

Rate limiting layers — icn-gateway/src/rate_limit.rs

QR Login — icn-gateway/src/api/sessions.rs

1.6 Gossip Security

Protocol — icn-gossip/src/

Weakness: Push handler (handlers/push.rs) processes announces without per-sender validation — relies entirely on upstream SignedEnvelope verification in NetworkActor. If a message reaches gossip without signature verification (bug), announces could be forged.

1.7 Sybil Resistance

VUI Registry — icn-steward/src/vui_registry.rs

Gap: VUI is implemented at the data structure level but the enrollment ceremony protocol (in-person verification, M-of-N steward attestation, bond mechanics) is not yet wired into the runtime for production use. Personhood levels are defined conceptually but not enforced in rate limiting or governance.

1.8 Post-Quantum Readiness

icn-crypto-pq — icn-crypto-pq/src/

Gap: Post-quantum encryption (ML-KEM) is not wired into the network layer. Current E2E encryption remains X25519-only even with PQ signatures enabled.

1.9 Byzantine Fault Detection

icn-security — icn-security/src/misbehavior.rs

2. Threat Model Assessment

3. Operational Readiness

3.1 Deployment Model

Concerns:

• Gateway binds to 0.0.0.0:8080 in K8s/devnet (intentional but requires proxy/firewall)
• Devnet uses hardcoded passphrase devnet-insecure and JWT secret (acceptable for dev, dangerous if pattern leaks to prod)
• Metrics endpoint binds to 0.0.0.0:9100 (mitigated by NetworkPolicy)

3.2 Monitoring & Observability

3.3 Key Management Operations

Gap: No automated key rotation schedule; no alerts for aging keys; no operational runbook.

3.4 NAT Traversal

Status: Implemented but not production-tested

Critical gap: NAT traversal modules exist but are not integrated into the actual QUIC session establishment flow. Nodes behind NAT cannot currently connect to each other without manual port forwarding. This blocks any deployment beyond LAN or single-server scenarios.

3.5 Naming / Discovery

Critical gap: Discovery is LAN-only via mDNS. No mechanism for WAN peer discovery without manual IP configuration. Combined with NAT traversal gap, this means the system is effectively LAN-only.

3.6 Packaging & Distribution

Gap: Currently requires either Docker or manual Rust compilation. No OS-level packaging.

4. Gap Analysis

Critical Gaps (Security Impact)

Important Gaps (Operational Impact)

5. Phase 0 Tasks (2-3 tasks)

These are security contributions needed for the immediate demo:

P0-S1: LAN Bind Address Safety

Threat: T5, T7 What: Ensure demo deployment gateway does NOT accidentally bind to WAN.

• Verify bind_addr in demo configs defaults to 127.0.0.1:8080 or LAN-only address
• Add startup warning when gateway binds to 0.0.0.0 (already exists: icnd/src/main.rs:466-483)
• Document firewall requirements for demo

P0-S2: QR Session Hardening

Threat: T7 (session hijacking) What: Prevent QR login session hijacking in demo environment.

• Validate X-Forwarded-* headers come from trusted proxy (or pin GATEWAY_BASE_URL env var)
• Consider HMAC-signing QR data to prevent tampering
• Ensure one-time token consumption is atomic (already implemented: consume_session)

P0-S3: Operational Monitoring for Demo

Threat: T7 What: Basic security monitoring during demo.

• Verify ServiceMonitor alerts are active for: failed signatures, Byzantine quarantine, auth failures
• Ensure metrics endpoint is reachable by monitoring stack
• Test alert firing for a simulated violation

6. Phase 5 Tasks (5-8 tasks)

Full resilience for production-grade deployment:

P5-S1: NAT Traversal End-to-End

Threat: T5 Censorship What: Wire STUN/TURN into QUIC session establishment.

• Integrate NatTraversal::discover_public_address() into SessionManager
• Add TURN fallback path when direct QUIC fails
• Test behind symmetric NAT (most restrictive)
• Replace Google STUN defaults with self-hosted or diverse set
• Add NAT type to peer discovery announcements

P5-S2: DNS-Independent Naming & Discovery

Threat: T5 Censorship What: Bootstrap peers without DNS dependency.

• Implement configurable bootstrap node list (hardcoded fallback)
• DHT-based peer discovery or gossip-over-rendezvous
• .onion / Tor hidden service support for censorship resistance
• Remove Google dependency in default STUN config

P5-S3: Anti-Censorship Relay Infrastructure

Threat: T5 Censorship What: Deploy relay nodes for peers behind restrictive NAT/firewalls.

• Deploy TURN relay with ICN DID authentication
• Implement onion routing (scaffolding exists in icn-privacy/src/onion_routing.rs)
• Pluggable transport interface for domain fronting

P5-S4: Key Recovery End-to-End Test

Threat: T4 Coercion What: Verify social recovery works under realistic conditions.

• Multi-node test: key loss → attestation gathering → delay period → finalization
• Test cancellation during delay (fraud detection)
• Test with gossip network partitions
• Document recovery operational runbook

P5-S5: System Packaging

Threat: T5 Censorship, T6 Dependency What: Make node installation trivial.

• .deb package for Ubuntu/Debian (systemd service unit included)
• .rpm package for RHEL/Fedora
• install.sh one-liner (curl | sh)
• Auto-update mechanism (version announcements via gossip)

P5-S6: Supply Chain Security

Threat: T6 Dependency What: Protect against compromised dependencies.

• Reproducible builds (deterministic output from same source)
• SBOM generation (SPDX/CycloneDX format)
• Pin exact dependency hashes in Cargo.lock verification
• Migrate away from sled (resolve 4 RUSTSEC advisories)
• Binary signing for releases

P5-S7: Threat Model Documentation

Threat: All What: Formal threat model document for security review.

• STRIDE analysis of all subsystems
• Attack trees for T1-T7
• Security boundary diagram
• Penetration test scope document
• Incident response playbook

P5-S8: Sybil Resistance Production Wiring

Threat: T3 Sybil What: Make enrollment ceremonies enforceable.

• Wire steward ceremonies into identity creation flow
• Implement bond mechanics (economic cost to Sybil)
• Personhood levels gate governance participation
• Rate limit DID creation per ceremony window

7. Relevant Open Issues

Based on code TODOs and documented follow-ups:

1. Rate limit ordering: Move rate limit check after signature verification (noted in docs/archive/2025/security-hardening-2025-12-18.md:161)
2. Bloom filter cleanup: Periodic rotation task for long-running ReplayGuard sessions (noted in hardening doc:157)
3. Trust graph TLS integration: Connect trust scores to TLS certificate validation decisions (noted in hardening doc:145-149)
4. Phase 2.3 TODO: Trust score from PolicyOracle for topology decisions (handlers/hello.rs:231 — currently hardcoded trust_score = 0.5f32)
5. Snapshot encryption: Caller must encrypt snapshots at rest (not enforced by code — icn-snapshot/src/lib.rs)
6. PQ encryption integration: ML-KEM not wired into EncryptedEnvelope (noted in docs/design/post-quantum-crypto.md:234)