alkdev/alknet
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tasks: mark vault/key-versioning-rotation completed

Browse Source
This commit is contained in:
glm-5.2
2026-06-23 13:39:37 +00:00
parent 9eab93100e
commit 968e3a09ee
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
tasks/vault/key-versioning-rotation.md
View File

@@ -1,7 +1,7 @@
--- ---
id: vault/key-versioning-rotation id: vault/key-versioning-rotation
name: Implement version-indexed encryption key paths, bump CURRENT_KEY_VERSION to 2, and add rotate method name: Implement version-indexed encryption key paths, bump CURRENT_KEY_VERSION to 2, and add rotate method
status: pending status: completed
depends_on: [vault/irpc-removal] depends_on: [vault/irpc-removal]
scope: moderate scope: moderate
risk: medium risk: medium
@@ -124,4 +124,11 @@ decrypt, rotate, derive_encryption_key_for_version), and possibly `derivation.rs
## Summary ## Summary
> To be filled on completion Bumped `CURRENT_KEY_VERSION` to 2 (HD-derived per ADR-020). Added
`encryption_path_for_version` in derivation.rs (v2 → `m/74'/2'/0'/0'`, v3 →
`m/74'/2'/0'/1'`, rejects version < 2). Added `derive_encryption_key_for_version`
+ version-aware `encrypt`/`decrypt` + `rotate` method on `VaultServiceHandle`
(ADR-021). Each version maps to a distinct derivation path; the blob carries
its own version. 68 lib + 14 integration tests pass; clippy clean. Merged to
develop (resolved conflicts with remove-password-derivation and
poisoned-lock-recovery).