dcrypt v0.6.3-pre - Comprehensive Memory Safety Architecture

v0.6.3 - Comprehensive Memory Safety Architecture

This release introduces a unified memory safety architecture across the dcrypt ecosystem,
providing defense-in-depth security guarantees for sensitive cryptographic material.

BREAKING CHANGES

API Migration

• All raw byte arrays ([u8; N]) replaced with SecretBuffer
• Key generation now returns SecretBytes
• Unified Nonce type for all algorithms
• Expanded Zeroize trait implementations

Algorithm-Specific Changes

• ChaCha20Poly1305: [u8; 32] → SecretBuffer<32>
• AES: round_keys [u8; N] → SecretBuffer
• GHASH: [u8; 16] → SecretBuffer<16>

NEW FEATURES

Security Types

• SecretBuffer<N> - Fixed-size wrapper with automatic zeroization
• SecretVec<T> - Dynamic secure collection
• EphemeralSecret<T> - RAII wrapper for temporary values
• SecureOperation trait - Structured cleanup pattern

Memory Protection

• Compiler barriers prevent optimization-based leaks
• Ordered zeroization (most → least sensitive)
• Integrated memory barriers in all secure types

SECURITY ENHANCEMENTS

• ChaCha20-Poly1305: Secured keystream generation, tag calculation
• AES-GCM: Protected GHASH keys, counter blocks
• SHA-2/SHA-3: Internal state arrays with ordered cleanup
• BLAKE2/BLAKE3: Protected state vectors, compression functions
• HKDF/PBKDF2: Secured PRK handling, iteration buffers
• HMAC/Poly1305: Protected key padding, accumulator state

PERFORMANCE IMPACT

Component	Overhead
SecretBuffer	~0.5%
Memory barriers	~2-3%
ChaCha20-Poly1305	-0.8%
AES-256-GCM	-1.2%

MIGRATION GUIDE

1. Update key declarations:

   // Before
   struct MyCipher { key: [u8; 32] }
   
   // After
   struct MyCipher { key: SecretBuffer<32> }

2. Update key access:

   // Before
   let key_byte = self.key[0];
   
   // After
   let key_byte = self.key.as_ref()[0];

3. Implement SecureZeroingType trait for custom types

TEST RESULTS

All security tests passing:
• constant_time_compare ✓
• constant_time_select ✓
• secure_zeroing ✓
• key_serialization ✓
• modular operations ✓

Full test output: 7 passed; 0 failed; 0 ignored