Keyfob Station — Real Test Vector Removed from Repo

# Keyfob Station — Real Test Vector Removed from Repo

> **Date:** 2026-06-26
> **Repo:** `keyfob-station` (commit `807b5b3`, force-pushed to origin @ 192.168.1.2)

## What changed

The real per-device master key + JCOP UID from the NXP JCShell provisioning
script were removed from the repository **and its entire git history**, to make
the repo safe to clone to the company GitHub account.

| Item | Status |
|---|---|
| Real MK `6aecc7bd…` | Purged from all commits + objects (local & remote) |
| Real UID `00002317229409204524` | Purged |
| Derived KENC/KMAC/KDEK | Purged |
| `AGENTS.md` (agent guidance) | Removed from repo + history, kept locally (gitignored) |
| `jcshell_reference_vector` test | Replaced with a **synthetic, non-secret** vector |
| `.kilo/plans/…md` reference | Scrubbed to point at synthetic vector |

## History rewrite details

- `git filter-branch` stripped `AGENTS.md` from all 5 commits.
- The real key only ever lived in one commit; that commit was amended to the
  sanitized version before the rewrite, so no reachable history contains it.
- `git reflog expire --expire=now --all` + `git gc --prune=now` run on **both**
  the local clone and the remote bare repo (`192.168.1.2`).
- Force-pushed; old commit `3e54fc0` confirmed **gone** on the remote
  (`git cat-file` fails).

## Local copy retained

The real vector is preserved locally (gitignored, never committed):

**`.local/jcshell-real-vector.md`**

```
MK  = 6aecc7bd2daf3cb4afeb7f9c4aebb48c
UID = 00002317229409204524   (10-byte JCOP UID, raw)
KENC = 0bcba32270ac1c1d7614938fe0e2e2e7
KMAC = d69cb92c76c0c5429182638f8fdef0d8
KDEK = 242640a7d2e0dbcd103936ac0f4ffb9b
```

`AGENTS.md` is also kept locally (gitignored).

## Synthetic vector now in-tree

`crates/kf-scp03/src/derive.rs` → `jcshell_reference_vector` now uses:

```
MK  = 00112233445566778899aabbccddeeff
UID = deadbeefcafebabe1234
```

with expected keys recomputed independently. This still validates the KDF
**construction and derivation-data layout** (purpose bytes 0x40/0x60/0x70,
raw 10-byte UID), but no longer proves byte-agreement with the **real** device
script value.

## Caveat / follow-up

The committed test no longer validates against the real device vector — only
the algorithm shape. **Before real-card provisioning**, re-validate by pasting
the values from `.local/jcshell-real-vector.md` into the
`jcshell_reference_vector` test temporarily, then revert before committing.

All checks green after the change: 81 tests pass, `clippy -D warnings` clean,
`fmt` clean (incl. `--features nitrokey` and `--release --features allow-software-key`).

id: 6fd567226ebd4fd89cf0cd4518a88a23
parent_id: 61ba8f290b7b4faf9199916387419665
created_time: 2026-06-26T13:07:20.144Z
updated_time: 2026-07-01T11:06:11.795Z
is_conflict: 0
latitude: 0.00000000
longitude: 0.00000000
altitude: 0.0000
author: 
source_url: 
is_todo: 0
todo_due: 0
todo_completed: 0
source: joplin-desktop
source_application: net.cozic.joplin-desktop
application_data: 
order: 1782479240144
user_created_time: 2026-06-26T13:07:20.144Z
user_updated_time: 2026-07-01T11:06:11.795Z
encryption_cipher_text: 
encryption_applied: 0
markup_language: 1
is_shared: 0
share_id: 
conflict_original_id: 
master_key_id: 
user_data: 
deleted_time: 0
type_: 1