origin-crypto-sdk 0.4.0

Standalone cryptographic SDK with classical (Ed25519) and post-quantum (Falcon, SLH-DSA, ML-DSA, NTRU Prime, Curve41417) primitives. Hybrid signing by default.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

# SPDX-License-Identifier: Apache-2.0

# Origin Crypto SDK — Security Notes

## Overview

The Origin Crypto SDK contains both external (battle-tested) and custom implementations of cryptographic primitives. Custom implementations have **not been independently audited** as of this writing.

## Implementations

| Component | Source | Notes |
|-----------|--------|-------|
| XChaCha20-Poly1305 (AEAD) | External | `chacha20poly1305` crate (battle-tested) |
| Argon2id (KDF) | External | `argon2` crate (battle-tested) |
| SHA3/SHA2 | External | `sha3`, `sha2` crates |
| HMAC-SHA3 | External | `hmac` crate |
| HKDF-SHA3 | External | `hkdf` crate |
| Serpent CBC | External | `serpent` crate |
| Falcon-512/1024 | External | `falcon-rust` crate |
| Reed-Solomon | Custom | Parallel encoding support |
| NTRU Prime (sntrup761) | Custom | Based on NIST Round 3 reference implementation |
| Ed41417 (Curve41417) | Custom | Based on Bernstein et al. CHES 2014 paper |
| Native ChaCha20-Poly1305 | Custom | RFC 8439 reference, native Rust (zero-dep) |
| Native Poly1305 | Custom | RFC 8439 §2.5, native Rust |
| Hybrid KEM | Custom | Combines X25519 + NTRU + Ed41417 |
| Hybrid signing | Custom | Combines Ed25519 + Falcon |
| Seed Blob | Custom | XChaCha20-Poly1305 + Argon2id |
| ChaCha20-DRBG | Custom | Auto-reseed after 16 MB |
| SipHash-c-d | Custom | Compute hardener (not a security boundary) |

## Known Properties

### Constant-time

- **NTRU Prime**: Uses constant-time comparisons where applicable
- **Falcon**: Relies on `falcon-rust` implementation
- **Ed41417**: Scalar multiplication uses Montgomery ladder
- **Poly1305**: Field arithmetic avoids secret-dependent branches
- **ChaCha20**: Standard ARX construction, no secret-dependent branches

### Side channels

- No timing-based side channels are explicitly mitigated in all paths
- Memory is zeroed where applicable (via `zeroize` crate)
- Key material should be locked in memory (requires `mlock` support)

## Recommendations

1. **Do not use custom implementations in production without independent audit**
2. The SDK provides both external (battle-tested) and native implementations — use the external versions via the `aead` module for production workloads
3. Native implementations are provided for environments requiring zero external crypto dependencies
4. For post-quantum components (NTRU Prime, Falcon, Ed41417), there are no battle-tested alternatives

## Reporting Vulnerabilities

If you discover a security vulnerability, please report it privately to the repository maintainers. Do not open a public issue.