Minor security hardening: nonce scrub - #21
Conversation
… unused serde feature Three small items from a security review of v0.1.0: - DHKEM decap/auth_decap now report the RFC 9180 §7.1.4 all-zeros shared-secret rejection as DecapError instead of leaking the encap-side EncapError label through the receiver path. Adds a regression test. - Context::seal/open wrap the per-message nonce in Zeroizing so the stack copy derived from the secret base_nonce is scrubbed after the AEAD call (defense-in-depth; the nonce alone does not endanger the AEAD). - Remove the 'serde' optional dependency and feature: nothing in the crate uses it, and its presence invites accidental serialization of key material in a future change. Reintroduce deliberately if wire serialization is ever designed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Please don't spam AI-generated PRs. |
|
hi @nadimkobeissi - could you suggest a preferred alternative method? just trying to close security gaps here in order to get this into our stack. (flagged by Mythos, confirmed by humans) is there something pragmatically wrong with the PR itself? |
|
None of your PRs address "security gaps." They're a small avalanche of minor nits. |
|
ok, unfortunately i'll have to run a patched fork instead to get these issues resolved. thank you for your feedback. |
|
@10d9e If you can fix the merge conflict and remove the useless Claude comments everywhere, I'll take another look at this. I merged your other PRs. |
10d9e
changed the title
should be gtg now. thanks for your review! (and especially thanks for this wonderful library) |
2 participants
Summary
Per-message nonce scrubbing.
Context::seal/opencomputed the nonce (derived from the secretbase_nonce) into a plain stack array. It's now wrapped inZeroizing. Pure defense-in-depth: nonce knowledge without the key doesn't endanger the AEAD, but the crate scrubs everything else it derives, and this closes the one exception.Testing
cargo test --features pq,kat-internals— all suites pass, including the new small-order-decap test.cargo clippy --all-targetsclean.🤖 Generated with Claude Code