hardening(signer): fail closed on stateless nonce primitives under the production profile

[mswilkison]

Finding (MEDIUM, fail-closed asymmetry — defense-in-depth)

The stateless FROST FFI primitives generate_nonces_and_commitments and sign_share in pkg/tbtc/signer/src/engine/frost_ops.rs hand a one-time signing nonce pair out to the host and later accept it back as opaque nonces_hex. Nonce custody — and the single-use invariant — is left entirely with the caller. The SignShareRequest contract even documents this: the caller "is cryptographically responsible for single use."

A host bug or compromise that replays one nonces_hex across two distinct signing packages yields two Schnorr shares under the same nonce, which algebraically solves for the long-term secret share. Catastrophic blast radius if reached.

The deterministic StartSignRound/FinalizeSignRound path is already fenced off in production by enforce_transitional_signing_disabled_in_production. The stateless primitives, by contrast, gated only on the provenance attestation (enforce_provenance_gate) and had no production-profile guard — a fail-closed asymmetry. A production signer could therefore be driven through the host-custody nonce path and inherit that blast radius.

No current production caller reaches these paths; this is defense-in-depth before activation.

Guard added

New enforce_stateless_nonce_primitives_disabled_in_production(operation) in frost_ops.rs, mirroring the deterministic guard's style:

• same predicate: signer_profile_is_production()
• same error type/shape: EngineError::LifecyclePolicyRejected
• reason_code: stateless_nonce_primitives_disabled_in_production

Under the production profile it fails closed (returns the error); non-production/test profiles keep current behavior.

The two call sites

Invoked immediately after enforce_provenance_gate()? — before any secret key package or nonce is deserialized — in:

• generate_nonces_and_commitments (enforce_stateless_nonce_primitives_disabled_in_production("GenerateNoncesAndCommitments"))
• sign_share (enforce_stateless_nonce_primitives_disabled_in_production("SignShare"))

The deterministic path is unchanged.

Test

engine::tests::stateless_nonce_primitives_reject_under_production_profile:

• Under the development profile, builds real key packages + nonces + signing package and confirms both primitives succeed.
• Flips to the production profile (with valid provenance so the new gate — not the provenance gate — is what fires) and feeds the same secret inputs: both primitives return LifecyclePolicyRejected with reason_code stateless_nonce_primitives_disabled_in_production, before any secret is deserialized (the gate is the second statement of each primitive).

Validation (from pkg/tbtc/signer)

• cargo fmt -- --check — clean
• cargo clippy --all-targets -- -D warnings — clean
• cargo test — 319 passed (lib), 25 passed (admission_checker bin), 1 passed (p2tr integration), 0 failed

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e3a1624f-b7b8-41b5-a576-c18e5bd56613

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch hardening/signer-stateless-nonce-fail-closed

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}