feat: encrypt stored records with AES-256-GCM

[DavidCozens]

Pull request

What this stage adds

SolidSyslogMbedTlsAesGcmPolicy replaces the HMAC policy on the store. Records at
rest gain confidentiality on top of tamper-evidence: the body is encrypted, the
record header is authenticated as associated data, and nonce and tag go in the
trailer.

Flash +13,780 B (+156 on the previous stage)
RAM +37,748 B (+8)
Log stack +712 B (unchanged)
Service +3,800 B (unchanged)

A hundred and fifty-odd bytes, because AES-GCM is already linked — a device that
negotiates a GCM ciphersuite for TLS is carrying the same primitive the store now
uses. No stack movement: the policy encrypts in place, into the buffer the store
already owns. The mbedTLS pool does not move either; encrypting a record of this
size asks nothing more of it, so peak x 1.5 still lands on 55 KiB.

The store key is unchanged. Its name says what it protects, not which algorithm
protects it, so escalating the policy does not need another key provisioned.

GCM needs a fresh nonce per record and mbedTLS has no context-free RNG, so the
policy takes the device's DRBG as well as the key. That is the only wiring
difference from the HMAC policy.

The pipeline element now reports what the store actually did, derived like the
transport value rather than asserted, and both fall back to the weakest honest
answer if the credentials behind them are missing.

Files

 README.md                     | 16 +++++++++-------
 app/syslog/Syslog.c           | 15 ++++++++++-----
 app/syslog/SyslogPipelineSd.c |  9 ++++++---
 app/syslog/SyslogPipelineSd.h |  8 +++-----
 measurements/aes-gcm.csv      | 13 +++++++++++++
 measurements/stages.tsv       |  1 +
 run-report.md                 | 30 +++++++++++++++---------------
 7 files changed, 57 insertions(+), 35 deletions(-)

Checklist

• The diff is application-only — no change to board bring-up, config headers, or build infra.
• measurements/aes-gcm.csv committed.
• Row added to measurements/stages.tsv.
• README regenerated: python3 scripts/gen-cost-table.py.
• ./run.sh green (build + QEMU + baseline self-check) — run-report.md committed.

---

Context for review: 20 of 21 sequential single-commit PRs replaying the integration on top of the Baseline root. Each lands green and reviewed before the next is built on it, because a change to an early commit would force every commit above it to be re-run and re-measured.

Summary by CodeRabbit

• New Features

  • Added AES-256-GCM encryption for stored syslog data.
  • Syslog pipeline status now reports configurable transport and at-rest encryption settings.

• Documentation

  • Updated stage descriptions, cost estimates, and validation reports to reflect AES-GCM at-rest encryption.
  • Updated example output and performance measurements for the AES-GCM configuration.

[coderabbitai]

📝 Walkthrough

Walkthrough

Syslog now configures AES-256-GCM for stored records, passes RNG-backed security settings into TLS and block-store components, and reports transport and at-rest modes through structured data. README and run-report measurements are updated for the AES-GCM stage.

Changes

AES-GCM syslog security

Layer / File(s)	Summary
Configurable pipeline security metadata app/syslog/SyslogPipelineSd.*	SyslogPipelineSd_Init now accepts transport and at-rest strings, and formatted structured data reflects both values.
RNG-backed AES-GCM integration app/syslog/Syslog.c	Syslog_Start wires DeviceCertStore_Rng() into TLS and AES-GCM block-store configuration, replacing the HMAC-SHA256 policy path.
AES-GCM documentation and run results README.md, run-report.md	Stage descriptions, cost values, memory measurements, and captured structured data now describe the AES-GCM run.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• cososo-ltd/solid-syslog-example#25: Directly mirrors the AES-GCM and configurable pipeline changes.
• cososo-ltd/solid-syslog-example#45: Directly relates to the pipeline atRest and transport parameter changes.
• cososo-ltd/solid-syslog-example#46: Extends the earlier mutual-TLS pipeline configuration with an AES-GCM at-rest mode.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: switching stored records to AES-256-GCM.
Description check	✅ Passed	The description follows the template, explains the stage, and includes the required checklist items with statuses.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch stage/aes-gcm

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

run-report.md (1)

50-62: 🔒 Security & Privacy | 🔵 Trivial | 🏗️ Heavy lift

Extend the self-check to prove at-rest encryption and tamper rejection.

The report validates the SD string and resource measurements, but does not inspect a spooled record, confirm plaintext is absent, or verify that modifying the header/body/tag is rejected. Add a deterministic QEMU or host check covering encryption, decryption, and tamper failure.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@run-report.md` around lines 50 - 62, Extend the self-check in run-report.md
beyond the existing SD string and resource measurements to inspect a
deterministic spooled record, confirm its stored content does not contain
plaintext, verify it decrypts to the expected message, and exercise tampering of
the header, body, and authentication tag with each modification being rejected.
Use the existing AES-GCM measurement flow and report clear pass/fail results for
encryption, decryption, and all tamper cases.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@run-report.md`:
- Around line 50-62: Extend the self-check in run-report.md beyond the existing
SD string and resource measurements to inspect a deterministic spooled record,
confirm its stored content does not contain plaintext, verify it decrypts to the
expected message, and exercise tampering of the header, body, and authentication
tag with each modification being rejected. Use the existing AES-GCM measurement
flow and report clear pass/fail results for encryption, decryption, and all
tamper cases.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: dfb45029-019b-4cd2-b5ca-f86a4c2e47b9

📥 Commits

Reviewing files that changed from the base of the PR and between 1b67e28 and da05a66.

⛔ Files ignored due to path filters (2)

• measurements/aes-gcm.csv is excluded by !**/*.csv
• measurements/stages.tsv is excluded by !**/*.tsv

📒 Files selected for processing (5)

• README.md
• app/syslog/Syslog.c
• app/syslog/SyslogPipelineSd.c
• app/syslog/SyslogPipelineSd.h
• run-report.md