fix: floor the seal policy timestamp so it is never in the future#116
Conversation
The PKG rejects a USK request whose timestamp is > now ("chronology error").
The seal timestamp was stamped with Math.round(Date.now()/1000), which can
land up to ~1s ahead of the real time, so an encrypt→decrypt within the same
second could fail. In normal usage the multi-second gap masks it; the e2e
harness's headless flow (encryptionall/postguard-e2e) completes in <1s and
surfaced it.
Extract nowSeconds() (floor) and use it for both seal timestamps. Adds unit
tests pinning the floor behavior.
|
Thanks for the detailed write-up, @rubenhensen! I'm on it — kicking off a review of this PR now (correctness + rule-compliance), and I'll follow up with a consolidated review (approve / request changes / comment). |
![dobby-coder[bot]](https://avatars.githubusercontent.com/in/3365457?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — approving.
Correctly diagnosed and cleanly scoped: nowSeconds() uses Math.floor, so the seal policy timestamp is always ≤ wall-clock now and can no longer trip the PKG's > now "chronology error" on a same-second encrypt→decrypt. Both stamping sites (encryptPipeline and sealRaw) now go through it, and the regression tests pin the floor behaviour (1000.700s → 1000, where Math.round would have given 1001).
No wire-format or API change, no rule findings.
|
Approved! The fix is clean and correctly scoped — routing both |
|
🎉 This PR is included in version 2.3.1 🎉 The release is available on: Your semantic-release bot 📦🚀 |
1 participant
The PKG rejects a USK request whose timestamp is
> now("chronology error"). The seal policy timestamp was stamped withMath.round(Date.now() / 1000), which can land up to ~1 second in the future — so an encrypt→decrypt within the same second can fail.In normal usage the multi-second encrypt→decrypt gap masks this, which is why it's gone unnoticed. The e2e harness (encryption4all/postguard-e2e#15) runs the full flow headless in <1s and surfaced it:
decryptfailed with[http 400] {"error":true,"message":"chronology error"}.Fix: extract
nowSeconds()(usesMath.floor, always ≤ now) and use it for both seal timestamps (encryptPipeline+sealRaw). Adds unit tests pinning the floor behavior (a sub-second past 0.5 must not round up to the next second).No wire-format or API change — the timestamp is already wall-clock-derived; this only removes the ≤1s forward skew.