# Security Audit — Zupt v1.0.0

## Cryptographic Correctness

| Check | Status | Evidence |
|-------|--------|----------|
| ML-KEM-768 keygen+encaps+decaps roundtrip | ✅ | 10/10 trials pass (`test_pq.sh`) |
| ML-KEM-768 constant-time basemul | ✅ | No secret-dependent branches; Montgomery reduction is branchless |
| ML-KEM-768 FO implicit rejection | ✅ | cmov selects rejection key on invalid ct; both paths always execute |
| X25519 Montgomery ladder | ✅ | Constant-time by construction (cswap on every iteration) |
| AES-256-CTR | ✅ | Verified against NIST SP 800-38A via regression tests |
| HMAC-SHA256 | ✅ | Verified via password-mode archive integrity tests |
| PBKDF2-SHA256 | ✅ | 600,000 iterations, 32-byte random salt per archive |
| SHA-256 | ✅ | Used by HMAC/PBKDF2, verified transitively |
| SHA3-256/512 | ✅ | Used by ML-KEM; Keccak-f[1600] per FIPS 202 |
| SHAKE-128/256 | ✅ | Used by ML-KEM sampling; verified via KEM roundtrip |

## Constant-Time Verification

| Operation | Constant-Time | Method |
|-----------|---------------|--------|
| HMAC comparison | Yes | XOR accumulation (`diff \|= a[i] ^ b[i]`) |
| ML-KEM decaps implicit rejection | Yes | cmov with branchless fail detection |
| ML-KEM NTT/basemul | Yes | No secret-dependent branches; Barrett/Montgomery reduction branchless |
| ML-KEM CBD sampling | Yes | Bitwise operations only |
| X25519 ladder | Yes | fe_cswap with masked XOR on every bit |
| AES-256 | **No** | Table-based (T-tables). Vulnerable to cache-timing on shared hardware. |
| SHA-256 | **No** | Standard implementation. Not constant-time w.r.t. message length. |

**Documented limitation:** AES-256 and SHA-256 use lookup tables susceptible to cache-timing side channels. Do not use on shared multi-tenant hardware where an attacker can measure cache access patterns.

## Memory Safety

| Check | Status |
|-------|--------|
| `make test-asan`: zero errors | ✅ All modes: normal, solid, encrypted, PQ, MT |
| All `malloc()` return values checked | ✅ Propagated via `ZUPT_ERR_NOMEM` |
| All ML-KEM polynomial buffers wiped | ✅ `zupt_secure_wipe()` in keygen/encaps/decaps |
| All X25519 scalars wiped | ✅ `memset(e, 0, 32)` after ladder |
| All intermediate key material wiped | ✅ In `zupt_crypto.c` hybrid encrypt/decrypt init |
| Keyring copy wiped in parallel pool destructor | ✅ `zupt_secure_wipe(&ctx->keyring, ...)` |

## Format Stability

| Check | Status |
|-------|--------|
| v1.0 reads v0.3+ archives | ✅ Regression test covers password-encrypted v0.5 format |
| v0.6 rejects v1.4 PQ archives cleanly | ✅ Version check returns `ZUPT_ERR_BAD_VERSION` |
| FORMAT.md documents all fields | ✅ See FORMAT.md |
| FORMAT_STABLE flag set in v1.0 archives | ✅ Bit 4 of global_flags |

## Known Bugs Fixed (v0.7.0)

| Bug | Impact | Fix |
|-----|--------|-----|
| ML-KEM basemul OOB (`zetas[64+i]`, i up to 127) | Buffer overread → undefined behavior | Fixed to 64 iterations, 4-coeff groups |
| ML-KEM missing `poly_tomont` in keygen | Public key in wrong domain → K-PKE roundtrip fails | Added `poly_tomont()` after basemul in keygen |
| ML-KEM inverted cmov in FO decaps | Always selected rejection key → KEM roundtrip fails | Fixed fail detection: `(-(int64_t)diff) >> 63` |
| ML-KEM `inv_ntt` used wrong zetas table | NTT/invNTT roundtrip failed | Uses same `zetas[]` table, k counts 127→0 |
| PQ hybrid nonce mismatch | Encrypt/decrypt used different random nonces | Store base_nonce in enc_hdr; decrypt reads it back |