viktoruj_obsidian-cloud-kms/SECURITY.md

# Security Policy

## Threat Model

### Attacker Model

| Attacker | Capability | Access Level |
|----------|-----------|--------------|
| Cloud storage attacker | Has encrypted blobs only (S3 breach, Git repo leak) | Ciphertext only |
| Credential thief | Has stolen IAM credentials | Can call KMS if IAM allows |
| Local malware | Has filesystem access on user's machine | Can read encrypted files + potentially memory |
| Malicious Obsidian plugin | Has full Obsidian API access (DOM, editor, filesystem) | Can read decrypted content in editor |
| Network attacker (MITM) | Can intercept network traffic | TLS protects KMS calls |
| Physical access (powered off) | Has the device but no running session | Ciphertext only on disk |
| Physical access (powered on) | Has the device with active Obsidian session | Full access to decrypted content |

### Asset Classification

**Fully protected (encrypted at rest):**
- Note body content (inside `%%secret-start%%` blocks)
- Binary file content (PDF, images, audio)
- Data Encryption Keys (wrapped by KMS, zeroed after use)

**Partially protected:**
- File names (visible on disk, not encrypted)
- File timestamps (visible on disk)
- Vault structure / folder names (visible)
- Frontmatter metadata (visible, for Obsidian indexing)

**Not protected by this plugin:**
- AWS credentials (managed by OS/AWS CLI)
- Plugin settings (KMS key ARN — not a secret)
- Obsidian workspace state

### Security Assumptions

```
Assumes:
  - Secure WebCrypto API implementation (browser/Electron engine)
  - Uncompromised operating system and kernel
  - Correct AWS IAM configuration (least privilege)
  - TLS integrity for KMS API calls (AWS SDK handles this)
  - No malicious Obsidian plugins installed in the same vault
  - User does not disable the plugin and save files with secret markers
```

### Threat → Mitigation Matrix

| Threat | Mitigation | Residual Risk |
|--------|-----------|---------------|
| Stolen cloud storage (S3/Git) | Envelope encryption (AES-256-GCM + KMS) | None — ciphertext only |
| Man-in-the-middle | TLS (AWS SDK) + AEAD (GCM auth tag) | None |
| Ciphertext tampering | AES-256-GCM authentication tag | None — tamper detected |
| Key exposure | CMK never leaves AWS KMS HSM | None |
| DEK exposure in memory | Zero-fill after use, no caching | GC copies (JS limitation) |
| Replay / DEK reuse | Fresh random DEK + nonce per operation | None |
| Unauthorized decryption | IAM policies + KMS key policies + CloudTrail | Misconfiguration risk |
| Plugin disabled during save | Pre-commit hook blocks plaintext commits | User must install hook |
| KMS unavailable | Status bar indicator + graceful degradation | Plaintext in editor only (not on disk if plugin active) |
| Malicious plugin reads editor | No mitigation (Obsidian platform limitation) | Accept — documented |
| Memory dump | SecureBuffer zero-fill on release | JS heap copies (accept) |
| Supply chain attack | Pinned deps, SBOM, Scorecard, signed releases | Transitive dep risk remains |

### What this plugin protects against

| Threat | Protection |
|--------|-----------|
| Unauthorized access to vault storage (S3, Git, cloud sync) | ✅ Ciphertext-only on disk |
| Stolen laptop with powered-off device | ✅ Encrypted at rest |
| CloudTrail audit of who accessed secrets | ✅ Every KMS unwrap is logged |
| Accidental commit of secrets to Git | ✅ Only ciphertext in repo |
| Unauthorized KMS access | ✅ IAM policies + key policies |

### What this plugin does NOT protect against

| Threat | Reason |
|--------|--------|
| Malicious Obsidian plugin in same vault | Obsidian has no plugin sandbox — any plugin can read editor memory |
| Memory dump / cold boot attack | Plaintext exists in JS heap during editing session |
| Compromised workstation with active session | Attacker has same access as user |
| Keylogger / screen capture | Out of scope — OS-level threat |
| State-level adversary | Use dedicated HSM + isolated workstation instead |

### Trust Boundaries

```
┌─────────────────────────────────────────────────────────────────┐
│  User's Workstation                                              │
│                                                                  │
│  ┌───────────────────────────────────────────────────────────┐  │
│  │  Obsidian Process (Electron)                               │  │
│  │                                                            │  │
│  │  ┌─────────────────────────────────────────────────────┐  │  │
│  │  │  Cloud KMS Plugin (this plugin)                      │  │  │
│  │  │  - Plaintext in editor buffer (TRUSTED)              │  │  │
│  │  │  - DEK in memory briefly (TRUSTED)                   │  │  │
│  │  │  - Blob URLs for binary files (TRUSTED)              │  │  │
│  │  │  - Adapter patch intercepts read/write               │  │  │
│  │  └─────────────────────────────────────────────────────┘  │  │
│  │                                                            │  │
│  │  ┌─────────────────────────────────────────────────────┐  │  │
│  │  │  Other Obsidian Plugins (UNTRUSTED)                  │  │  │
│  │  │  - Can access: DOM, editor API, filesystem           │  │  │
│  │  │  - Can read: decrypted content in editor             │  │  │
│  │  │  - Cannot access: KMS credentials directly           │  │  │
│  │  └─────────────────────────────────────────────────────┘  │  │
│  │                                                            │  │
│  └───────────────────────────────────────────────────────────┘  │
│                                                                  │
│  ┌───────────────────────────────────────────────────────────┐  │
│  │  Local Filesystem (UNTRUSTED for plaintext)                │  │
│  │  - Only ciphertext written                                 │  │
│  │  - OCKE binary format / ````ocke-v1 base64                │  │
│  │  - File names and timestamps visible                       │  │
│  └───────────────────────────────────────────────────────────┘  │
│                                                                  │
│  ┌───────────────────────────────────────────────────────────┐  │
│  │  OS Credential Store (~/.aws/credentials)                  │  │
│  │  - Managed by AWS CLI / SSO                                │  │
│  │  - Plugin reads, never writes                              │  │
│  └───────────────────────────────────────────────────────────┘  │
└─────────────────────────────────────────────────────────────────┘
                    │                           │
                    │ TLS (HTTPS)               │ git push (ciphertext)
                    ▼                           ▼
┌──────────────────────────────┐  ┌──────────────────────────────┐
│  AWS KMS (TRUSTED)            │  │  Remote Storage (UNTRUSTED)   │
│  - CMK in HSM                 │  │  - S3 / Git / Cloud Sync      │
│  - Never exports key material │  │  - Only ciphertext             │
│  - All ops in CloudTrail      │  │  - No access to plaintext      │
│  - IAM + Key Policy           │  │                                │
└──────────────────────────────┘  └──────────────────────────────┘
```

### Cryptographic Flow

```
ENCRYPTION (on file write):
  ┌──────────┐     ┌──────────┐     ┌──────────────┐     ┌──────────┐
  │ Plaintext │────▶│ Generate │────▶│ AES-256-GCM  │────▶│Ciphertext│
  │  (editor) │     │ DEK+Nonce│     │ Encrypt      │     │ + AuthTag│
  └──────────┘     └────┬─────┘     └──────────────┘     └──────────┘
                         │
                         ▼
                   ┌──────────┐     ┌──────────────┐
                   │   DEK    │────▶│  KMS Encrypt │────▶ Wrapped DEK
                   │(plaintext)│     │  (wrap)      │     (safe to store)
                   └──────────┘     └──────────────┘
                         │
                         ▼
                   Zero-fill DEK

DECRYPTION (on file read):
  ┌───────────┐     ┌──────────────┐     ┌──────────┐
  │Wrapped DEK│────▶│  KMS Decrypt │────▶│   DEK    │
  │(from disk) │     │  (unwrap)    │     │(plaintext)│
  └───────────┘     └──────────────┘     └────┬─────┘
                                               │
  ┌──────────┐     ┌──────────────┐           │
  │Ciphertext│────▶│ AES-256-GCM  │◀──────────┘
  │ + AuthTag│     │ Decrypt+Verify│
  └──────────┘     └──────┬───────┘
                           │
                           ▼
                     ┌──────────┐
                     │ Plaintext │────▶ Editor (memory only)
                     └──────────┘
                           │
                     Zero-fill DEK
```

## Cryptographic Design

### Envelope Encryption

Each secret block or binary file is encrypted with a unique Data Encryption Key (DEK):

1. **GenerateDataKey** → KMS returns plaintext DEK + wrapped DEK
2. **Encrypt** → AES-256-GCM(plaintext, DEK, nonce) → ciphertext + auth tag
3. **Store** → wrapped DEK + nonce + auth tag + ciphertext (DEK is zeroed)
4. **Decrypt** → KMS unwraps DEK → AES-256-GCM decrypt → plaintext (DEK is zeroed)

### Primitives

| Component | Choice | Rationale |
|-----------|--------|-----------|
| Symmetric cipher | AES-256-GCM | AEAD, hardware-accelerated, WebCrypto native |
| Nonce | 96-bit random | crypto.getRandomValues(), unique per encryption |
| Auth tag | 128-bit | GCM default, tamper detection |
| Key wrap | AWS KMS | HSM-backed, auditable, IAM-controlled |
| DEK size | 256-bit | AES-256 key length |
| Key derivation | None (KMS generates DEK directly) | No custom KDF needed |

### What we explicitly avoid

- ❌ Custom cryptographic algorithms
- ❌ CBC mode (no authentication)
- ❌ Deterministic IVs/nonces
- ❌ Hardcoded salts or keys
- ❌ Password-based encryption (PBKDF2, scrypt)
- ❌ Client-side key storage

## Memory Handling

### Secure cleanup

- `SecureBuffer` class: zero-fills buffer on release
- DEK zeroed immediately after encrypt/decrypt operation
- Blob URLs revoked on plugin unload
- LRU cache evicts old decrypted binary files (max 20)

### Known limitations

- JavaScript garbage collector may retain copies of plaintext
- Obsidian undo buffer contains decrypted text
- Electron renderer process holds editor state in memory
- OS swap/pagefile may contain memory pages with plaintext

## Credential Handling

### How credentials are loaded

```
AWS SDK credential chain:
1. ~/.aws/credentials (fromIni)
2. AWS SSO session
3. IAM instance role (EC2/ECS)
4. Environment variables
```

### What is NOT stored by the plugin

- ❌ AWS access keys
- ❌ AWS secret keys
- ❌ Session tokens
- ❌ Any credential material

### What IS stored in plugin settings

- ✅ KMS Key ARN (not a secret — it's a resource identifier)
- ✅ User preferences (auto-decrypt toggle, suffix)

## Logging

- Structured JSON logs via `structured-logger.ts`
- Sanitizer strips sensitive fields before logging
- No plaintext, DEK, or credential values in logs
- Only metadata: provider, file path, payload size, timing

## Supply Chain

- Dependencies pinned in `package-lock.json`
- `npm audit` runs in CI on every push
- Reproducible builds via Docker (`make docker-release`)
- No telemetry, no analytics, no network calls except to AWS KMS

## Reporting Vulnerabilities

If you discover a security vulnerability, please report it privately:

- Email: viktoruj@gmail.com
- Do NOT open a public GitHub issue for security vulnerabilities
- I will respond within 48 hours and work on a fix

## Recommended Usage

### Good fit

- Personal API keys and tokens
- Terraform/infrastructure secrets
- Internal documentation with sensitive data
- Developer secret workflows (similar to SOPS/git-crypt)
- Team knowledge bases with access-controlled secrets

### Consider alternatives for

- Production root credentials → use AWS Secrets Manager / HashiCorp Vault
- Regulated data (HIPAA, PCI-DSS) → use certified solutions with compliance attestation
- State-level adversary threat model → use hardware-backed auth + isolated workstation

## Secure Deployment Recommendations

### Dedicated Vault for Secrets

For maximum security, use a **separate Obsidian vault** for encrypted content:

```
~/vaults/
├── work/              ← General notes, many plugins installed
├── personal/          ← Personal notes
└── secrets/           ← Encrypted vault (minimal plugins)
```

**Why:** Other plugins in the same vault can read decrypted content from the editor. A dedicated vault minimizes this attack surface.

### Minimal Plugin Configuration

In the encrypted vault, install only:
- This plugin (Cloud KMS Encryption)
- Essential plugins you trust (e.g., built-in plugins only)

**Avoid** in the encrypted vault:
- Community plugins with network access
- Plugins that sync content to external services
- Plugins that read/modify file content
- Plugins from unknown/unverified authors

### Workstation Hardening

| Measure | Purpose |
|---------|---------|
| Full-disk encryption (BitLocker/FileVault) | Protects swap/pagefile containing memory pages |
| Screen lock on idle | Prevents physical access to active session |
| Disable swap/pagefile (if RAM allows) | Eliminates plaintext in swap |
| Use AWS SSO with short-lived tokens | Limits credential exposure window |
| Enable MFA on AWS account | Prevents credential theft from granting KMS access |
| Regular `aws sso logout` when done | Invalidates cached session |

### Network Security

| Measure | Purpose |
|---------|---------|
| VPN for KMS access | Ensures connectivity, prevents MITM on corporate networks |
| AWS VPC PrivateLink for KMS | Eliminates internet dependency for KMS calls |
| DNS-over-HTTPS | Prevents DNS-based traffic analysis |

### Monitoring

| What to monitor | How |
|-----------------|-----|
| KMS Decrypt calls | CloudTrail → CloudWatch alarm on unusual patterns |
| Failed KMS auth | CloudTrail → alert on AccessDeniedException |
| New IAM grants on KMS key | AWS Config rule |
| Plugin status indicator | Visual check: 🔓 = OK, 🔒 ⚠️ = problem |

### Incident Response

If you suspect compromise:

1. **Immediately:** `aws sso logout` or rotate IAM credentials
2. **Assess:** Check CloudTrail for unauthorized KMS Decrypt calls
3. **Contain:** Disable KMS key if unauthorized access confirmed (`aws kms disable-key`)
4. **Recover:** Re-enable key after investigation, rotate if needed (`tools/ocke-rekey.mjs`)
5. **Prevent:** Review IAM policies, enable MFA, audit plugin list