id: eb1408c004e947c59dddf5225f3b0d6d
parent_id: 47025f8ca660451ab07b5a4b91c918fa
item_type: 1
item_id: 1fbaa70f2fb94ffcaabbeca7b39482da
item_updated_time: 1787290155151
title_diff: "[]"
body_diff: "[{\"diffs\":[[0,\"KDF/` (1\"],[-1,\"2\"],[1,\"3\"],[0,\" sets) a\"]],\"start1\":153,\"start2\":153,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"2026-08-\"],[1,\"2\"],[0,\"1\"],[-1,\"8\"],[0,\")**\\\n> - \"]],\"start1\":409,\"start2\":409,\"length1\":18,\"length2\":18},{\"diffs\":[[0,\"moved).\\\n\"],[1,\"> - **klms-connection (added 2026-08-21)** — station↔KLMS connection security:\\\n>   mTLS handshake with BOTH certificate validations (server chain to Clypeum Root\\\n>   CA + hostname; client cert at the server), accept_invalid_certs dev caveat (C1),\\\n>   OAuth2 public-client token (empty user/pass BY DESIGN — mTLS is the auth),\\\n>   seed → NIST SP 800-108 → 32-B wrapper key (derived on BOTH sides, never\\\n>   transmitted), and AES-256-CBC(IV=0) container payload encryption/decryption.\\\n>   Verified against klms_client.rs + container_parser.rs.\\\n\"],[0,\"> - **HS\"]],\"start1\":855,\"start2\":855,\"length1\":16,\"length2\":558},{\"diffs\":[[0,\"oved\"],[-1,\" — PNGs checked by Jan 2026-08-18)**:\\\n>  \"],[1,\")**:\"],[0,\" lef\"]],\"start1\":1865,\"start2\":1865,\"length1\":49,\"length2\":12},{\"diffs\":[[0,\"dy chain\"],[1,\"\\\n>  \"],[0,\" (NXP → \"]],\"start1\":1897,\"start2\":1897,\"length1\":16,\"length2\":20},{\"diffs\":[[0,\"iHSM-1 →\"],[-1,\"\\\n>  \"],[0,\" DK repl\"]],\"start1\":1946,\"start2\":1946,\"length1\":20,\"length2\":16},{\"diffs\":[[0,\"iHSM-2);\"],[1,\"\\\n>  \"],[0,\" right c\"]],\"start1\":1976,\"start2\":1976,\"length1\":16,\"length2\":20},{\"diffs\":[[0,\" → their\"],[-1,\"\\\n>  \"],[0,\" YubiHSM\"]],\"start1\":2030,\"start2\":2030,\"length1\":20,\"length2\":16},{\"diffs\":[[0,\"B arrows\"],[1,\"\\\n>  \"],[0,\" attach \"]],\"start1\":2056,\"start2\":2056,\"length1\":16,\"length2\":20},{\"diffs\":[[0,\"NitroHSM\"],[-1,\"\\\n>  \"],[0,\" from th\"]],\"start1\":2115,\"start2\":2115,\"length1\":20,\"length2\":16},{\"diffs\":[[0,\"he right\"],[1,\"\\\n>  \"],[0,\" (`-left\"]],\"start1\":2130,\"start2\":2130,\"length1\":16,\"length2\":20},{\"diffs\":[[0,\"he 3-row\"],[-1,\"\\\n>  \"],[0,\" arrange\"]],\"start1\":2199,\"start2\":2199,\"length1\":20,\"length2\":16},{\"diffs\":[[0,\"ngement;\"],[1,\"\\\n>  \"],[0,\" one cro\"]],\"start1\":2212,\"start2\":2212,\"length1\":16,\"length2\":20},{\"diffs\":[[0,\" - All 1\"],[-1,\"7\"],[1,\"8\"],[0,\" diagram\"]],\"start1\":2439,\"start2\":2439,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"ders\"],[-1,\", no changes required after Jan's review\"],[0,\".\\\n\\\n#\"]],\"start1\":2474,\"start2\":2474,\"length1\":48,\"length2\":8},{\"diffs\":[[0,\"/KDF/ (1\"],[-1,\"2\"],[1,\"3\"],[0,\" sets)\\\n\\\n\"]],\"start1\":2511,\"start2\":2511,\"length1\":17,\"length2\":17},{\"diffs\":[[0,\"eanup |\\\n\"],[1,\"| `klms-connection` | Station↔KLMS connection: mTLS + cert validation, token, seed→wrapper key, AES-256-CBC container transport |\\\n\"],[0,\"| `flow-\"]],\"start1\":2938,\"start2\":2938,\"length1\":16,\"length2\":146}]"
metadata_diff: {"new":{},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-08-21T05:33:45.133Z
created_time: 2026-08-21T05:33:45.133Z
is_locked: 0
type_: 13