E02-GN: Pending
Rationale
The official GNUnet 0.20.0 release now establishes a concrete security-critical path: core run() reads PEER/PRIVATE_KEY with GNUNET_CRYPTO_eddsa_key_from_file() and passes that key to GSC_KX_init(). The helper resides in crypto_ecc_setup.c. Code Blau section 4.2 independently reviewed the historical GNUNET_CRYPTO_eddsa_key_create_from_file API in its commissioned 2020 Taler audit. This connects the reviewed subject, persistent private-key handling, to CORE rather than merely assuming generic library overlap.
Assessment method
Version-specific call-path mapping; historical and selected implementations distinguished
Source context
Code Blau 2020 audit section 4.2 and official GNUnet 0.20.0 CORE/private-key source
Outstanding qualification
The 2020 report names a different API and implementation. It describes deleting invalid key files and using access(); the selected 0.20 helper instead documents an error for invalid contents and implements read/create/retry logic. A successor with the same security purpose is not proof that the selected implementation was independently audited. Keep Pending until a documented version/patch mapping establishes applicable review coverage, or a directly applicable third-party analysis is found. The report marks issue 6149 resolved; no current vulnerability, full CORE/CADET/R5N audit, runtime test or clean security certification is claimed.
Public sources
- https://www.taler.net/papers/codeblau-report-2020-q2.pdf
- https://ftp.gnu.org/gnu/gnunet/gnunet-0.20.0.tar.gz
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round365-sources.json