feat(ca): decentralized threshold CA with RFC 9591 FROST, single-round enrollment, and ROAST (#39)

.pre-commit-config.yaml

@@ -32,3 +32,13 @@ repos:
         language: system
         types: [rust]
         pass_filenames: false
+      - id: deny
+        name: cargo deny
+        entry: cargo deny check
+        language: system
+        pass_filenames: false
+      - id: shear
+        name: cargo shear
+        entry: cargo shear
+        language: system
+        pass_filenames: false

CHANGELOG.md

@@ -9,6 +9,10 @@ No release has been cut yet — everything below is tracked under `[Unreleased]`
 until 0.1.0.
 
 ### Security
+- **Decentralized Threshold CA Quorum via RFC 9591 FROST Ed25519 & ROAST Asynchronous Coordination (`bin/yip-ca`, `crates/yip-membership`, `bin/yipd`, #39, PR #180).**
+  Added an online, decentralized $t$-of-$n$ threshold Certificate Authority (CA) daemon architecture coexisting seamlessly alongside the offline single-key CA model. Uses the RFC 9591 FROST(Ed25519, SHA-512) ciphersuite (`frost-ed25519 v3.0.0`) to jointly issue mesh member certificates (`Cert`) without reconstructing the master private scalar on any single host. Because FROST signatures aggregate linearly into standard 64-byte Ed25519 signatures, certificates emitted by the threshold quorum are wire-format and byte-for-byte identical to single-signer certificates, requiring zero changes to node verifiers (`RootSet::verify_cert`). Hardened against CVE-2025-58359 threshold-drift vulnerabilities via pinned `frost-core` and `frost-ed25519` 3.0.0. Implemented the ROAST (Robust Asynchronous Schnorr Threshold) state machine, guaranteeing unforgeable issuance and liveness even if up to $n - t$ signers are unresponsive, delayed, or Byzantine.
+- **Rollback-immune ephemeral nonce vault & zero-touch background renewal (`bin/yip-ca`, `bin/yipd`, #39, PR #180).**
+  Engineered `EphemeralNonceVault` with locked non-swappable physical memory (`libc::mlock`), `ZeroizeOnDrop` clearing, and atomic single-use consumption (`take_once`), binding nonce pools to a 128-bit CSPRNG `boot_epoch_id` to completely eliminate nonce-reuse private key extraction attacks under VM snapshot rollback and container restore events. Implemented automated certificate lifetime monitoring in `bin/yipd`, triggering non-blocking background threshold renewal at $\ge 70\%$ of elapsed certificate TTL, alongside UNIX domain control socket commands `yipd cert status` and `yipd cert renew`.
 - **Traffic-analysis defense subsystem & side-channel mitigations (`crates/yip-obf`, `bin/yipd`, #11).**
   Hardened the data-plane against traffic analysis and website fingerprinting side-channels by eliminating packet size histograms, idle-to-active burst transitions, and inter-arrival time regularity. Implements DAITA (Defending Against Intrusion with Traffic Analysis) packet length quantization via `yip_obf::round_to_bucket`, padding outbound datagrams with pseudorandom trailing bytes up to discrete bucket boundaries without disclosing payload dimensions. Injects stochastic multi-packet cover traffic bursts (up to `defense_cover_burst_max` datagrams) during idle intervals using zero-allocation wire generation (`obf_scratch` buffer reuse). Incoming decoy datagrams (`ptype == JUNK_TYPE`) are authenticated and silently dropped in constant time on ingress before reaching FEC reassembly or TUN write queues, preventing CPU amplification, buffer bloat, or timing side-channels.
 - **Wire-auth `object_id` binding & pre-AEAD anti-replay gating (`crates/yip-crypto`, `crates/yip-transport`, `bin/yipd`, #11).**
@@ -37,6 +41,8 @@ until 0.1.0.
   Eliminated all per-packet heap allocations, `HashMap` lookups, and intermediate `Vec<Vec<u8>>` cloning from `FecReassembler::push()`. Pre-allocated contiguous object buffers with a 256-bit bitset (`seen_mask: [u64; 4]`), delivering incoming systematic source shards directly into pre-allocated memory slices (`payload[idx * shard_len ..]`) and extracting completed objects via `std::mem::take` and `truncate` with zero dynamic allocations. Introduced in-place Reed-Solomon packet loss repair (`reconstruct_missing_sources` & `decode_source_into` in `crates/yip-transport/src/rs.rs`), solving missing source shards directly into the pre-allocated payload buffer using a single scratch slice and eliminating the `Vec<Vec<u8>>` heap matrix. Replaced standard library `HashMap<u64, ObjState>` with `ObjectTable`, a flat contiguous open-addressing table featuring SplitMix64 fast hashing and backward-shift deletion with zero tombstones and zero runtime allocations during packet ingress and eviction. Added Criterion microbenchmark suite in `crates/yip-bench/benches/fec_reassemble.rs`, verifying a 3.1x speedup on clean $K=1$ packets (117.11 ns vs 361.98 ns, -67.6% latency), 4.0x speedup on clean $K=3$ objects (173.12 ns vs 690.73 ns, -74.9% latency), and 1.65x speedup on loss recovery under $K=3, R=1$ (631.83 ns vs 1.0401 µs, -39.3% latency).
 
 ### Added
+- **Decentralized Threshold CA CLI & RPC daemon suite (`yip-ca dealer-gen`, `serve`, `enroll`, #39, PR #180).**
+  Introduced `yip-ca dealer-gen` for generating $t$-of-$n$ Shamir secret key packages and group public keys, `yip-ca serve --role coordinator` for the ROAST enrollment gateway, `yip-ca serve --role signer` for isolated policy-enforcing signer daemons with single-round preprocessed nonce pools (`frost_ed25519::round1::preprocess`), and `yip-ca enroll` for client certificate requests. Added interactive 3-round Distributed Key Generation (DKG) without a trusted dealer, zero-knowledge proactive polynomial share refreshing (epoch rotation), and lost-share repair (`RepairCoordinator` / `RepairShareHelper`). Added `bin/yipd/tests/run-netns-threshold-ca.sh` multi-namespace integration test verifying end-to-end 2-of-3 threshold issuance, verification, and data-plane ping across 4 isolated network namespaces.
 - **FEC reassembly Criterion microbenchmark suite (`crates/yip-bench/benches/fec_reassemble.rs`, #171, PR #176).**
   Added isolated microbenchmark harnesses measuring clean-path reassembly latency ($K=1$ sub-symbol MTU-trimmed packets and $K=3$ multi-symbol objects) and packet-loss Reed-Solomon reconstruction latency ($K=3, R=1$).
 - **Comprehensive documentation landing page & modular curriculum overhaul (`docs/`, `README.md`, #170, PR #175).**