Repository navigation

Security pass over the legacy Kyber code (WP-9, #18) - #42

Merged

Zikithezikit merged 10 commits into

wp9-legacy-security

Oct 31, 2026

Merged

Security pass over the legacy Kyber code (WP-9, #18)#42
Zikithezikit merged 10 commits into
dev-v2from
wp9-legacy-security

Commits on Oct 30, 2026
- security: put an optimization barrier around the poly_frommsg mask
  
  Zikithezikit
  and
  claude
  committed
  a7c254d
- security: put an optimization barrier in legacy verify and cmov
  
  Zikithezikit
  and
  claude
  committed
  f036a09
- security: take legacy Kyber randomness from OsRng and fail closed
  
  Zikithezikit
  and
  claude
  committed
  fd20a17
- security: wipe every secret intermediate of legacy decapsulation
  
  Zikithezikit
  and
  claude
  committed
  d3b76f0
- fix: make Kyber from_keys reject a public key that is not the one in the secret key
  
  Zikithezikit
  and
  claude
  committed
  cad7acd
- security: wipe the Rust copies of secrets returned to Python
  
  Zikithezikit
  and
  claude
  committed
  c32640d
- fix: return an error from the unused DummyRng instead of panicking
  
  Zikithezikit
  and
  claude
  committed
  fb57aca
- fix: check buffer and seed lengths in the legacy keypair and encapsulation functions
  
  Zikithezikit
  and
  claude
  committed
  a2a4c9b
- chore: update rand to 0.8.6 for RUSTSEC-2026-0097
  
  Zikithezikit
  and
  claude
  committed
  a81a779
Commits on Oct 31, 2026
- docs: log the legacy Kyber security pass and the CVE review in SECURITY.md
  
  Zikithezikit
  and
  claude
  committed
  e034b47