Harden CT barrier and secret string handling

Author: eldryoth

README.md

@@ -558,7 +558,10 @@ is unavoidable, call
 `into_exposed_unprotected_vec_caller_must_zeroize`; that method name is
 intentionally loud because cleanup becomes the caller's responsibility.
 `try_into_exposed_string` provides an explicit escape hatch for UTF-8 text and
-returns the redacted wrapper unchanged when the bytes are not valid UTF-8.
+returns an `ExposedSecretString`, which keeps redacted formatting and
+best-effort drop-time cleanup. If a raw `String` is unavoidable, call
+`into_exposed_unprotected_string_caller_must_zeroize`; cleanup then becomes the
+caller responsibility. Invalid UTF-8 returns the redacted wrapper unchanged.
 
 `SecretBuffer` also implements `From<Vec<u8>>` and `From<String>` for callers
 that already own sensitive bytes or text and want to move them into the

docs/API_AUDIT.md

@@ -158,6 +158,10 @@ Decision rationale:
   redacted formatting and drop-time cleanup. The raw-vector escape hatch is the
   deliberately loud
   `ExposedSecretVec::into_exposed_unprotected_vec_caller_must_zeroize`.
+- `SecretBuffer::try_into_exposed_string` returns `ExposedSecretString`, which
+  keeps redacted formatting and drop-time cleanup. The raw-string escape hatch
+  is the deliberately loud
+  `ExposedSecretString::into_exposed_unprotected_string_caller_must_zeroize`.
 - Drop-time cleanup uses the crate's volatile best-effort wipe helper for
   initialized bytes and vector spare capacity.
 - Equality is intentionally not exposed through `PartialEq`/`==`. Callers must
@@ -172,7 +176,8 @@ Stable boundary:
 - Keep redaction as the default formatting behavior.
 - Keep `expose_secret`, `into_exposed_vec`,
   `into_exposed_unprotected_vec_caller_must_zeroize`, and
-  `try_into_exposed_string` explicit.
+  `try_into_exposed_string`,
+  `into_exposed_unprotected_string_caller_must_zeroize` explicit.
 - Do not claim formal zeroization or allocator-wide cleanup.
 - Do not add broad conversions that hide profile, alphabet, padding, or
   wrapping policy.

docs/CONSTANT_TIME.md

@@ -264,10 +264,13 @@ Before reporting the opaque malformed-input result, the ct decoder passes the
 accumulated error mask through a non-inlined `ct_error_gate_barrier` that uses
 `core::hint::black_box`, a compiler fence, and architecture-specific hardware
 speculation barriers where available (`lfence` on x86/x86_64, `isb sy` on ARM,
-and `isb sy; hint #20` on AArch64). This is defense in depth around the final
-public success/failure gate; it does not make the ct decoder a formally
-verified hardware side-channel resistant primitive and does not change the
-transient-output window described above.
+and `isb sy; hint #20` on AArch64). On RISCV the gate uses `fence rw, rw`,
+which is an ordering fence rather than a canonical speculation barrier in the
+base ISA. The runtime backend report exposes this separately through
+`ct_gate_posture`. This is defense in depth around the final public
+success/failure gate; it does not make the ct decoder a formally verified
+hardware side-channel resistant primitive and does not change the transient
+output window described above.
 
 For shared-memory or in-process sandbox threat models where even that transient
 output window is unacceptable, use
@@ -306,9 +309,12 @@ type, and the final equality result as public. The helper scans every byte for
 equal-length inputs before returning. The per-byte difference is passed through
 `core::hint::black_box`; the accumulator is also passed through `black_box`
 after each OR reduction to reduce the risk of release-mode optimizer rewrites
-into early-exit equality checks. The helper is marked `#[inline(never)]` and
-the release evidence script checks that `constant_time_eq_public_len` remains
-visible as a separate text symbol in the LTO artifact.
+into early-exit equality checks. Before returning the public equality result,
+the helper also passes the accumulated difference through the same non-inlined
+CT gate barrier used by malformed-input reporting. The helper is marked
+`#[inline(never)]` and the release evidence script checks that
+`constant_time_eq_public_len` remains visible as a separate text symbol in the
+LTO artifact.
 
 This remains a best-effort API and does not upgrade `base64-ng` to a formally
 verified cryptographic constant-time comparison crate. Do not use this helper

docs/SECURITY_CONTROLS.md

@@ -46,6 +46,10 @@ The caller still owns:
 - treating `ExposedSecretVec::into_exposed_unprotected_vec_caller_must_zeroize`
   as a boundary where redacted formatting and crate-owned drop-time cleanup
   intentionally stop
+- treating
+  `ExposedSecretString::into_exposed_unprotected_string_caller_must_zeroize` as
+  a boundary where redacted formatting and crate-owned drop-time cleanup
+  intentionally stop
 - process-wide memory hygiene such as core-dump policy, swap policy, crash
   handling, allocator behavior, and log retention
 - deciding whether the constant-time-oriented API is sufficient for the local

docs/UNSAFE.md

@@ -161,7 +161,8 @@ Preconditions:
 Unsafe operation:
 
 - `core::arch::asm!` emits `lfence` on non-Miri `x86`/`x86_64`, `isb sy` on
-  non-Miri `arm`, and `isb sy; hint #20` on non-Miri `aarch64`.
+  non-Miri `arm`, `isb sy; hint #20` on non-Miri `aarch64`, and
+  `fence rw, rw` on non-Miri `riscv32`/`riscv64`.
 
 Safety argument:
 
@@ -176,6 +177,9 @@ Limitations:
 - This is defense in depth against speculation around the final public
   malformed-input result. It does not make the ct decoder a formally verified
   hardware side-channel resistant primitive.
+- RISC-V base ISA has no canonical speculation barrier. The crate reports its
+  CT gate posture as `ordering-fence` on RISCV rather than
+  `hardware-speculation-barrier`.
 - Unsupported architectures fall back to the compiler fence only.
 
 ### `wipe_vec_spare_capacity`

scripts/check_targets.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 set -eu
 
-targets="${*:-x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-unknown-freebsd wasm32-unknown-unknown thumbv7em-none-eabihf}"
+targets="${*:-x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-unknown-freebsd riscv64gc-unknown-linux-gnu riscv32imac-unknown-none-elf wasm32-unknown-unknown thumbv7em-none-eabihf}"
 installed="$(rustup target list --installed)"
 
 for target in $targets; do