id: 6be1c89f0ede4112920e1603f889ed4c
parent_id: 
item_type: 1
item_id: 6fd567226ebd4fd89cf0cd4518a88a23
item_updated_time: 1782903971795
title_diff: "[{\"diffs\":[[1,\"Keyfob Station — Real Test Vector Removed from Repo\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":51}]"
body_diff: "[{\"diffs\":[[1,\"# Keyfob Station — Real Test Vector Removed from Repo\\\n\\\n> **Date:** 2026-06-26\\\n> **Repo:** `keyfob-station` (commit `807b5b3`, force-pushed to origin @ 192.168.1.2)\\\n\\\n## What changed\\\n\\\nThe real per-device master key + JCOP UID from the NXP JCShell provisioning\\\nscript were removed from the repository **and its entire git history**, to make\\\nthe repo safe to clone to the company GitHub account.\\\n\\\n| Item | Status |\\\n|---|---|\\\n| Real MK `6aecc7bd…` | Purged from all commits + objects (local & remote) |\\\n| Real UID `00002317229409204524` | Purged |\\\n| Derived KENC/KMAC/KDEK | Purged |\\\n| `AGENTS.md` (agent guidance) | Removed from repo + history, kept locally (gitignored) |\\\n| `jcshell_reference_vector` test | Replaced with a **synthetic, non-secret** vector |\\\n| `.kilo/plans/…md` reference | Scrubbed to point at synthetic vector |\\\n\\\n## History rewrite details\\\n\\\n- `git filter-branch` stripped `AGENTS.md` from all 5 commits.\\\n- The real key only ever lived in one commit; that commit was amended to the\\\n  sanitized version before the rewrite, so no reachable history contains it.\\\n- `git reflog expire --expire=now --all` + `git gc --prune=now` run on **both**\\\n  the local clone and the remote bare repo (`192.168.1.2`).\\\n- Force-pushed; old commit `3e54fc0` confirmed **gone** on the remote\\\n  (`git cat-file` fails).\\\n\\\n## Local copy retained\\\n\\\nThe real vector is preserved locally (gitignored, never committed):\\\n\\\n**`.local/jcshell-real-vector.md`**\\\n\\\n```\\\nMK  = 6aecc7bd2daf3cb4afeb7f9c4aebb48c\\\nUID = 00002317229409204524   (10-byte JCOP UID, raw)\\\nKENC = 0bcba32270ac1c1d7614938fe0e2e2e7\\\nKMAC = d69cb92c76c0c5429182638f8fdef0d8\\\nKDEK = 242640a7d2e0dbcd103936ac0f4ffb9b\\\n```\\\n\\\n`AGENTS.md` is also kept locally (gitignored).\\\n\\\n## Synthetic vector now in-tree\\\n\\\n`crates/kf-scp03/src/derive.rs` → `jcshell_reference_vector` now uses:\\\n\\\n```\\\nMK  = 00112233445566778899aabbccddeeff\\\nUID = deadbeefcafebabe1234\\\n```\\\n\\\nwith expected keys recomputed independently. This still validates the KDF\\\n**construction and derivation-data layout** (purpose bytes 0x40/0x60/0x70,\\\nraw 10-byte UID), but no longer proves byte-agreement with the **real** device\\\nscript value.\\\n\\\n## Caveat / follow-up\\\n\\\nThe committed test no longer validates against the real device vector — only\\\nthe algorithm shape. **Before real-card provisioning**, re-validate by pasting\\\nthe values from `.local/jcshell-real-vector.md` into the\\\n`jcshell_reference_vector` test temporarily, then revert before committing.\\\n\\\nAll checks green after the change: 81 tests pass, `clippy -D warnings` clean,\\\n`fmt` clean (incl. `--features nitrokey` and `--release --features allow-software-key`).\"]],\"start1\":0,\"start2\":0,\"length1\":0,\"length2\":2612}]"
metadata_diff: {"new":{"id":"6fd567226ebd4fd89cf0cd4518a88a23","parent_id":"61ba8f290b7b4faf9199916387419665","latitude":"0.00000000","longitude":"0.00000000","altitude":"0.0000","author":"","source_url":"","is_todo":0,"todo_due":0,"todo_completed":0,"source":"joplin-desktop","source_application":"net.cozic.joplin-desktop","application_data":"","order":1782479240144,"markup_language":1,"is_shared":0,"share_id":"","conflict_original_id":"","master_key_id":"","user_data":"","deleted_time":0},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-07-01T11:07:50.899Z
created_time: 2026-07-01T11:07:50.899Z
type_: 13