Skip to content

SECURITY_AUDIT.md

Latest commit

 

History

History
157 lines (126 loc) · 10.5 KB

SECURITY_AUDIT.md

File metadata and controls

157 lines (126 loc) · 10.5 KB
Raw

Security Audit and Risk Register

Last updated: 2026-06-16

This document tracks security-relevant findings against the current repository state. It is evidence-scoped: when a finding is not directly verified in this pass, it is marked as open or needs verification.

Executive Summary

Component Current security posture
ML-KEM Supported surface with KAT, input-validation, Keccak, web, and OpenSSL/liboqs interop evidence.
ML-DSA FIPS 204-aligned; byte-exact on the checked-in KAT corpus; best-effort hardening.
SLH-DSA FIPS 205-aligned (all 12 sets); external API shipped in 0.4.0; 1,248 ACVP cases complete.
Common Partial vendored FIPS 202 + FIPS 180-4 SHA-2; SP 800-185 planned; no runtime dependencies.
Package Not FIPS 140/CMVP validated (see FIPS_140_BOUNDARY.md); zero runtime deps.

Current Verification Snapshot

  • dart analyze: exits 0 with no issues.
  • Focused VM gates are green for ML-KEM, ML-DSA, and SLH-DSA. The SLH-DSA evidence includes 120 byte-exact key generations, 624 byte-exact signatures, and 504 exact verification outcomes across all 12 sets.

Resolved or Evidence-Backed Improvements

ID Area Current evidence
KEM-01 ML-KEM input validation kem_validation_test.dart covers pk/sk/ct validation paths.
KEM-02 Canonical ML-KEM reduction poly_test.dart covers Poly.barrettReduce canonical residues.
KEM-03 KAT runner discovery Runner is test/kat_evaluator_test.dart, so it is discovered by dart test.
HASH-01 Vendored SHA3/SHAKE keccak_test.dart and fips202_examples_test.dart cover SHA3-224/256/384/512 and SHAKE behavior.
INTEROP-01 Native interoperability tool/openssl_interop/ and tool/liboqs_interop/ cover ML-KEM, ML-DSA, and SLH-DSA.
DSA-01 Per-level tau values DilithiumParams contains 39/49/60 for ML-DSA-44/65/87.
DSA-02 Production print leakage rg "print\\(" lib shows no production-library print() calls.
DSA-10 ML-DSA correctness mldsa_kat_test.dart: 300 keygens + 1800 signatures byte-exact, all verify.
DSA-11 ML-DSA KAT validation Repo-local corpus test/data/MLDSA (18 files); discovered runner.
DSA-12 Norm-check side channel _checkNorm replaced by no-early-exit _normExceeds (all 256 coeffs).
DSA-13 Sampler exhaustion RejNTTPoly/RejBoundedPoly/SampleInBall squeeze an incremental XOF.
SEC-01 Secret lifetime lib/src/common/zeroize.dart; applied in keygen/sign finally blocks.
SHA2-01 HashML-DSA pre-hash sha2_test.dart pins SHA-256/384/512 against direct NIST vectors.
KEM-10 Decapsulation selection Constant-time branchless select of K' vs implicit-rejection; 3000 KATs exact.
KEM-11 RNG allocation _secureRng is a cached Random.secure() reused across calls.

Open Findings

ID Severity Area Finding Required action
DSA-20 Medium ML-DSA side channels No early exit, but not provably constant-time in Dart. Deeper review; document best-effort.
DSA-21 Low HashML-DSA coverage Only the level-bound SHA-2 pre-hash is exposed. Add SHAKE pre-hash paths if needed.
DOC-01 Medium Assurance wording Any broad "FIPS validated" claim exceeds the evidence. Keep wording evidence-scoped.
HASH-20 Medium FIPS 202 completeness Non-byte examples and complete official corpus coverage remain incomplete. Complete FIPS 202 guide gates before broad SHA-3 claims.
HASH-21 Medium SP 800-185 cSHAKE, KMAC, TupleHash, and ParallelHash are not implemented. Implement only behind NIST example-vector gates.

DOC-01 detail: the acceptable/unacceptable wording list is in FIPS_140_BOUNDARY.md.

ML-KEM Security Boundary

ML-KEM is the package's supported security surface. Current evidence covers:

  • standard parameter sizes and encodings;
  • checked-in KAT vectors;
  • keygen/encaps/decaps and invalid decapsulation vectors;
  • public-key, secret-key, and ciphertext validation;
  • vendored FIPS 202 primitives;
  • web compiler round-trips;
  • OpenSSL/liboqs interop for ML-KEM-512/768/1024.

Remaining hardening work should focus on maintaining KAT/native-interop coverage, monitoring secret lifetime, and deepening side-channel review as the code changes.

FIPS 202 / SP 800-185 Security Boundary

Current FIPS 202 support is a shared primitive surface used by ML-KEM, ML-DSA, and SLH-DSA. It is not yet a complete standalone SHA-3 release surface. The planned completion work is controlled by FIPS202_SP800185_RELEASE_GUIDE.md.

Security controls to verify before expanding public claims:

  • The complete FIPS 202 example corpus, including non-byte cases, must be covered or explicitly scoped before broad FIPS 202 claims.
  • FIPS 202 tests must continue to cover rates, capacities, suffixes, Keccak constants, and official byte/non-byte examples.
  • SP 800-185 encodings must be tested before cSHAKE, KMAC, TupleHash, or ParallelHash are built on them.
  • KMAC API docs must warn about key length and tag length selection.
  • Byte-only public API limitations must be explicit if non-byte bit-string inputs remain test-only.
  • No hard constant-time or hard memory-erasure guarantee may be made for Dart.

ML-DSA Security Boundary

ML-DSA is now FIPS 204-aligned with byte-exact KAT evidence for 44/65/87. The Definition of Done in MLDSA_FIPS204_RELEASE_GUIDE.md is complete. The implemented security posture includes:

  • byte-exact KAT conformance across raw/pure/hashed × deterministic/hedged;
  • hedged-by-default signing (explicit, discouraged deterministic path);
  • total verification (returns false, never throws, on malformed input);
  • a no-early-exit norm check (_normExceeds) over all 256 coefficients;
  • unbounded incremental-XOF rejection sampling (no fixed-buffer exhaustion);
  • best-effort secret zeroization in keygen/sign finally blocks.

Residual, accepted risks (do not affect KAT conformance):

  • Per-iteration branch directions in the norm check and rejection loops are a best-effort, not provably constant-time, posture — a known limitation of pure Dart targeting the VM, dart2js, and dart2wasm. Best-effort zeroization is also not a hard memory-erasure guarantee under Dart's GC. See DSA-20.
  • HashML-DSA exposes only the level-bound SHA-2 pre-hash (DSA-21).
  • This is algorithm/KAT conformance evidence, not a CMVP/FIPS 140 validation.

SLH-DSA Security Boundary

SLH-DSA ships in 0.4.0. Its external API is exported from the package root. Algorithms 1-25 are implemented for both hash families, and all 1,248 cases in the pinned official NIST ACVP sample corpus are byte-exact. Hedged signing, explicit deterministic signing, context/pre-hash domain separation, total verification, slow-set opt-in, and optional verify-after-sign have focused regressions. BUFF/performance guidance and per-target benchmark baselines are published. The decomposed VM matrix and both web compiler suites are green. Cutting the release branch, tag, and publication remain maintainer actions.

ID Severity Area Status and residual
SLH-01 High Message-bound (BUFF) Mitigated/documented: context + unique payload identity required except for the *-128f sets; protocol enforcement remains external.
SLH-02 Medium Fault / grafting Mitigated/documented: hedged default plus optional verify-after-sign; hardware/mobile fault resistance remains best-effort.
SLH-03 Medium RBG strength Documented: fresh addrnd from Random.secure(); no SP 800-90 validation claim; deterministic mode remains explicit.
SLH-04 Low s-variant performance Mitigated/measured: explicit opt-in and 29-56 second signing baselines; deployment-specific latency remains the caller's concern.
SLH-05 Low Secret zeroization Mitigated/documented: generated secret material is wiped in finally; Dart GC prevents a hard memory-erasure guarantee.

The hash-based threat model differs from ML-DSA: there is no secret-dependent rejection-sampling timing loop (WOTS+ chain lengths and FORS leaf selection derive from the public digest), so constant-time work is largely not the issue; fault/grafting, RBG quality, and the BUFF gap are the real risks. See SLHDSA_FIPS205_RELEASE_GUIDE.md.

Audit Commands

rg "print\\(" lib
rg "Random\\.secure|_normExceeds|secureZero|fillRange" lib
dart analyze
dart test test/kat_evaluator_test.dart   # ML-KEM KAT
dart test test/mldsa_kat_test.dart       # ML-DSA KAT
dart test test/slhdsa_kat_test.dart      # SLH-DSA all-set ACVP (expensive)
dart test

Use the full suite result to constrain documentation claims. KAT conformance is algorithm evidence, not a CMVP/FIPS 140 module validation.