Security Posture

Security Posture & Compliance

When using a cryptographic library, clarity on validation claims, security boundaries, and vulnerability reporting is paramount.

Claim Boundary: What We Do (and Don't) Claim

pqcrypto makes a very specific set of claims:

1. Mathematical Conformance: The algorithms are mathematically conformant to FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA).
2. KAT Exactness: The library is byte-for-byte exact against the official NIST Known Answer Test corpora.
3. OpenSSL Interoperability: ML-KEM outputs precisely match those generated by OpenSSL >= 3.5.

What we DO NOT claim:

• This library is NOT "FIPS 140 Validated" or "CMVP Certified."
• CMVP (Cryptographic Module Validation Program) certification applies to specific compiled hardware/software boundaries tested by accredited labs, not source code libraries. Do not use this package if your specific legal compliance requires a CMVP certificate.

Side-Channel Resistance (Best-Effort)

Because Dart executes in highly abstracted environments (the Dart VM, JS engines, Wasm runtimes, and mobile AOT compilers), writing perfectly constant-time code is practically impossible. Modern JIT compilers often optimize away constant-time structures.

However, we implement a best-effort defensive posture:

• Branchless Decapsulation: In ML-KEM, the decision between returning the correct shared secret and the implicit rejection secret is done via bitwise masking (K' ^ (mask & (K' ^ J(z||c)))), completely avoiding if/else control flow leaks.
• No Early Exits: Polynomial norm checking (_normExceeds) evaluates all 256 coefficients regardless of when a failure is detected to avoid leaking the location of large coefficients.

Secret Zeroization

We implement a secureZero() utility that overwrites Uint8List arrays with zeroes. In KEM decapsulation and DSA signing, sensitive intermediate arrays are wiped in finally blocks before the function returns.

Note on Garbage Collection: Dart memory management cannot guarantee that copies of data haven't been made in hardware registers or moved by the garbage collector. secureZero() strictly cleans up the primary allocated buffers.

Vulnerability Reporting

If you find a security defect (e.g., a mathematical flaw causing incorrect signatures, a major timing leak, or an RNG failure), do not open a public issue.

Please review our SECURITY.md file in the repository root for our coordinated disclosure process. We treat all cryptographic flaws as critical.