From 97a366e8b7c540b246c7bf9d04625526cbdc88ba Mon Sep 17 00:00:00 2001 From: cirakg Date: Mon, 19 Oct 2026 15:27:37 +0200 Subject: docs: document the storage format and record M3 results; bump to 0.3.0 Co-Authored-By: Claude Opus 5.5 --- docs/TESTING.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'docs/TESTING.md') diff --git a/docs/TESTING.md b/docs/TESTING.md index 98d984c..a38fd76 100644 --- a/docs/TESTING.md +++ b/docs/TESTING.md @@ -26,6 +26,19 @@ Test devices (`TEST_DEVICES`): Forerunner 255S (weakest: 218 px round MIP, butto ## Results +### M3, 2026-10-19 (version 0.3.0) + +`make ci` passed in full. Monkey C unit tests: 65 of 65 on each of the four test devices. The 34 new tests in `test/storage/` and `test/util/` cover: + +- **Codec:** round trips of every TLV type, and rejection of malformed input (truncation, unknown types, wrong lengths, duplicate tags, invalid UTF-8). +- **Records:** round trips of TOTP, HOTP (64-bit counter), Steam and code entries, with and without encrypted names. Every single-byte change of a record is detected, as are wrong IDs, wrong keys and truncation. Entry validation and wiping are covered, and record sizes are measured. +- **Vault:** persistence across a restart, update, move, remove, the HOTP counter, damaged and swapped records, locked entries with the session locked, the pending queue, the 150-entry cap, and a full store at 67 fill levels with no half-written state. +- **PIN:** create, unlock and wrong PINs; malformed PINs; the delay schedule; lockout across an app restart on the trusted clock; uptime fallback with restart and timer reset; damaged lockout state; erase after 10 failures; PIN change (entries untouched) and reset; a tampered wrap; auto-lock with zeroed keys; wiped PBKDF2 buffers. +- **Migration:** fresh metadata, the v0 fixture to v1 (idempotent), and refusal of newer or damaged metadata without changing it. +- **UTF-8 validation:** overlong forms, surrogates, code points above U+10FFFF, truncation, NUL. + +Python tool tests: 44 passed. + ### M2, 2026-10-18 (version 0.2.0) `make ci` passed in full. Monkey C unit tests: 31 of 31 on each of the four test devices, covering 57 hash vectors, 21 HMAC vectors, 5 PBKDF2, 3 HKDF, 2 AES-CBC (encrypt and decrypt), 12 Base32, 100 HOTP/TOTP and 12 Steam vectors, plus tamper detection on every byte of a sealed record, PKCS#7 edge cases, Base32 error positions, period boundaries, the 2038 widening and the job runner. Python tool tests: 44 passed. -- cgit v1.2.3