clock-bigint 1.0.1

Deterministic constant-time big integers for blockchain consensus engines
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110

# Security and Testing Scripts

This directory contains scripts for security testing and verification of the clock-bigint library.

## Scripts

### `verify_constant_time.sh`

Verifies constant-time properties of cryptographic operations.

**Usage:**
```bash
./scripts/verify_constant_time.sh
```

**What it does:**
- Runs basic test suite
- Executes constant-time specific tests
- Performs fuzz testing for timing verification
- Checks code for timing-dependent patterns
- Analyzes performance for anomalies
- Looks for branch-free implementation patterns

### `security_test.sh`

Comprehensive security testing suite covering all security aspects.

**Usage:**
```bash
./scripts/security_test.sh
```

**What it does:**
- Unit tests
- Integration tests
- Compliance/property-based tests
- Constant-time verification
- No-std compatibility testing
- Fuzz testing (short runs)
- Security vulnerability scanning
- Code linting
- Memory safety testing
- Documentation coverage
- Benchmark execution
- Cross-platform compatibility

## Continuous Integration

These scripts are designed to be used in CI/CD pipelines:

### GitHub Actions

The scripts are automatically run in the following workflows:
- `ci.yml`: Basic testing and linting
- `fuzz.yml`: Extended fuzz testing
- `bench.yml`: Performance verification

### Local Development

Run these scripts locally during development:

```bash
# Quick security check
./scripts/verify_constant_time.sh

# Full security test suite
./scripts/security_test.sh
```

## Test Results

Both scripts provide detailed output with:
- ✅ Passed tests
- ⚠️ Warnings (non-blocking issues)
- ✗ Failed tests (blocking issues)

## Dependencies

The scripts require:
- `cargo` and `rustc`
- `cargo-fuzz` (optional, for fuzz testing)
- `cargo-audit` (optional, for vulnerability scanning)
- `cross` (optional, for cross-platform testing)

Install optional dependencies:
```bash
cargo install cargo-fuzz
cargo install cargo-audit
cargo install cross
```

## Adding New Tests

When adding new security-related functionality:

1. Update the relevant test functions in the scripts
2. Add new test cases to the existing test suites
3. Update this README with new script capabilities
4. Ensure CI workflows are updated if needed

## Security Considerations

These scripts help verify:
- **Constant-time execution**: No timing leaks
- **Mathematical correctness**: Correct cryptographic results
- **Memory safety**: No buffer overflows or corruption
- **Code quality**: Linting and documentation
- **Performance**: No regressions in critical operations

Always review script output carefully and address any warnings or failures before releasing code.