Skip to content

README.md

Latest commit

 

History

History
118 lines (85 loc) · 3.91 KB

README.md

File metadata and controls

118 lines (85 loc) · 3.91 KB
Raw

Security Test Suite

Adversarial tests verifying Tenuo's security properties.

Quick Verification

# Verify all security properties in 30 seconds
pytest tests/security/ -v --tb=short

# Expected: 43 passed, 0 failed

Running

# Run all security tests
pytest tests/security/ -v

# Run specific category
pytest tests/security/test_signature_trust.py -v

# Run with verbose output
pytest tests/security/ -v -s

# Run only integration responsibility tests (expected to document, not fail)
pytest tests/security/ -m integration_responsibility -v

Categories

Category File Tests Status
Signature/Trust test_signature_trust.py 5 ✅ All pass
Monotonicity test_monotonicity.py 11 ✅ All pass
PoP Binding test_pop_binding.py 6 ✅ All pass
Delegation Limits test_delegation_limits.py 6 ✅ All pass
Implementation test_implementation.py 9 ✅ All pass
Edge Cases test_edge_cases.py 6 ✅ All pass

Test Markers

@pytest.mark.security           # All security tests
@pytest.mark.signature          # Signature/trust verification
@pytest.mark.monotonicity       # Capability attenuation rules  
@pytest.mark.pop                # Proof-of-Possession binding
@pytest.mark.delegation         # Delegation depth/chain limits
@pytest.mark.implementation     # Implementation-level bypasses
@pytest.mark.integration_responsibility  # App responsibilities (not Tenuo bugs)

Critical Security Properties Verified

✅ Cryptographic Guarantees

  1. Signature verification - Warrants signed by attacker keys rejected
  2. Root trust - Only trusted roots accepted by Authorizer
  3. Holder binding - PoP signature requires correct keypair
  4. PoP binding - Signature covers (tool, args, timestamp)

✅ Monotonicity Guarantees

  1. Tool narrowing - Cannot add tools not in parent
  2. Constraint narrowing - Cannot widen Pattern, Range, OneOf
  3. Type safety - Cannot change constraint types
  4. TTL shrinking - Cannot extend expiration
  5. No re-widening - Cannot attenuate back to Wildcard

✅ Delegation Limits

  1. Depth limit - MAX_DELEGATION_DEPTH (64) enforced
  2. Terminal warrants - Cannot delegate further (max_depth=0)
  3. Issuer/Execution separation - Each type has distinct capabilities

✅ Extraction Security

  1. Default inclusion - Default parameter values always checked
  2. Complete extraction - All parameters extracted automatically
  3. Fail-closed - Extraction failures deny authorization

⚠️ Application Responsibilities

These are documented by @pytest.mark.integration_responsibility tests:

  1. Wrapper usage - Must call warrant.authorize()
  2. Root trust - Must use Authorizer with trusted_roots
  3. Path canonicalization - Must resolve .. before authorization
  4. Node coverage - Must wrap ALL nodes in LangGraph
  5. Nonce/idempotency - App-level for replay prevention

Contributing

Found an attac scenario we missed? Please:

  1. Open an issue with [SECURITY] prefix
  2. Or submit a PR with a failing test

See SECURITY.md for responsible disclosure.

Expected Results

  • Most tests should PASS (attacks are blocked by Tenuo)
  • integration_responsibility tests document app-level concerns
  • Info messages explain expected behavior or limitations

Adding New Attack Scenarios

  1. Create test in appropriate category file
  2. Add @pytest.mark.security and category marker
  3. Print attack description and result
  4. Use pytest.raises() for expected failures
  5. Document in this README

Rust-Level Tests

Some attacks require binary manipulation and are tested at the Rust level:

  • ChainLink tampering - tenuo-core/tests/red_team.rs
  • CBOR payload tampering - tenuo-core/tests/red_team.rs

See tenuo-core/tests/red_team.rs for those tests.