From 377ce297f1ec1c7bbb30e1d789d17e2477f5f824 Mon Sep 17 00:00:00 2001 From: michael Date: Wed, 17 Jun 2026 17:07:32 -0700 Subject: [PATCH] chore(applet): strip diagnostic INSes from prod CAP (M2F.3) Flip DIAGNOSTICS_ENABLED static-final boolean from true to false so the production j3r452 CAP rejects INS_DIAG_HMAC/ECDH/ECDSA_SIGN/GCM (0xD0-0xD3) with SW_INS_NOT_SUPPORTED. javac's constant-folding elides the diagnostic dispatch branch in process(); the JC converter keeps the unreachable processDiag method body and DIAG_KEY_32 etc. arrays so the byte saving is modest (the JC converter does not do whole-program DCE on private fields/methods). CAP size (j3r452): before 101008 B -> after 100989 B (delta -19 B, 0.02% reduction). This is smaller than the original ~2-3 KB estimate in the plan -- the estimate assumed javac/JC-converter DCE would prune the diag arrays and methods, but neither does. Reclaiming the ~2 KB diag-vector + diag-method footprint requires extracting the diag code to a separate class and excluding it from the production profile, which is out of scope for M2 (file-level surgery, not a constant flip). The runtime SW_INS_NOT_SUPPORTED rejection still delivers the security objective: no diag opcodes execute on a prod build. For CI/bench builds that need the diag opcodes, the constant can be locally flipped to true (no test changes required; no diag tests in the suite reference INS_DIAG_*). Regression: 147 tests, 0 failures, 3 pre-existing GCM errors (no new failures). Co-Authored-By: Claude Opus 4.7 --- applet/src/main/java/com/dangerousthings/aliro/AliroApplet.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/applet/src/main/java/com/dangerousthings/aliro/AliroApplet.java b/applet/src/main/java/com/dangerousthings/aliro/AliroApplet.java index b241830..a8028f4 100644 --- a/applet/src/main/java/com/dangerousthings/aliro/AliroApplet.java +++ b/applet/src/main/java/com/dangerousthings/aliro/AliroApplet.java @@ -46,7 +46,7 @@ public class AliroApplet extends Applet { // AUTH session scratch). The diagnostic keypair is allocated separately // from the protocol's ephemeral keypair, so calling diag mid-transaction // cannot clobber an in-flight AUTH0/AUTH1. - private static final boolean DIAGNOSTICS_ENABLED = true; + private static final boolean DIAGNOSTICS_ENABLED = false; private static final byte INS_DIAG_HMAC = (byte) 0xD0; private static final byte INS_DIAG_ECDH = (byte) 0xD1;