Skip to content

keys: add derivation_version to DerivedKey - #40

Merged
marctrem merged 1 commit into
mainfrom
mc-derived-key-derivation-version
Aug 31, 2026
Merged

keys: add derivation_version to DerivedKey#40
marctrem merged 1 commit into
mainfrom
mc-derived-key-derivation-version

Conversation

@marctrem

@marctrem marctrem commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds a version discriminator to splitsecure.keys.v1.DerivedKey:

uint32 derivation_version = 4;
  • Version 0 is the legacy derivation construction. Because proto3 scalars default to 0, every already-stored DerivedKey reads 0 and keeps deriving byte-identically — no data migration.
  • Version 1 will be a FIPS 186-5 §A.2.2 construction (implemented downstream in priv).
  • Consumers must reject an unknown version before deriving, instead of falling back to a default.

Field number 4 was unclaimed and the message has no reserved ranges.

Verification

  • ./bufgen.sh (buf format + lint + generate); generated Go and TS committed
  • buf breaking --against '.git#branch=main' passes
  • go build ./... passes

🤖 Generated with Claude Code

https://claude.ai/code/session_01TyAMGaLYMykDnnCA5ZNKsS

monday: 12937366421

@marctrem @claude
keys: add derivation_version to DerivedKey
78e8332 
Add a version discriminator so consumers can distinguish derivation
constructions. Version 0 is the legacy construction; proto3 scalar
defaults make every already-stored DerivedKey read 0 and keep
deriving byte-identically. Consumers must reject an unknown version
instead of falling back to a default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TyAMGaLYMykDnnCA5ZNKsS
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown

The latest Buf updates on your PR. Results from workflow Buf CI / buf (pull_request).

BuildFormatLintBreakingUpdated (UTC)
✅ passed✅ passed✅ passed✅ passedAug 31, 2026, 7:38 PM

@coderabbitai

coderabbitai Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b7fa6e6f-b872-448f-9155-bc82901a2109

📥 Commits

Reviewing files that changed from the base of the PR and between 131902a and 78e8332.

⛔ Files ignored due to path filters (2)
  • gen/es/proto/splitsecure/keys/v1/derived_key_pb.ts is excluded by !**/gen/**, !gen/**
  • gen/go/proto/splitsecure/keys/v1/derived_key.pb.go is excluded by !**/*.pb.go, !**/gen/**, !gen/**
📒 Files selected for processing (1)
  • proto/splitsecure/keys/v1/derived_key.proto

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📜 Recent review details
🔇 Additional comments (1)
proto/splitsecure/keys/v1/derived_key.proto (1)

11-14: LGTM!

Walkthrough

The public DerivedKey message now includes a derivation_version field. Version 0 identifies the legacy construction. Consumers must reject unknown versions.

Changes

Derived key contract

Layer / File(s) Summary
Add derivation version field
proto/splitsecure/keys/v1/derived_key.proto		 Adds DerivedKey.derivation_version as a uint32 field. Defines version 0 as legacy and requires rejection of unknown versions.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 78e83

This adds a backward-compatible derivation version field while preserving legacy behavior for existing keys; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main change: adding derivation_version to DerivedKey.
Description check ✅ Passed The description directly explains the new field, legacy compatibility, version handling, validation, and verification results.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

Comment @coderabbitai help to get the list of available commands.

@marctrem
marctrem merged commit 43a02ae into main Aug 31, 2026
3 checks passed
@marctrem
marctrem deleted the mc-derived-key-derivation-version branch August 31, 2026 20:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jeanne-split jeanne-split jeanne-split approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@marctrem @jeanne-split