Sanitization 1.1.0

[eldryoth]

sanitization v1.1.0

This release expands sanitization from fixed-size secret storage into a broader secret-lifecycle toolkit while keeping the default build no_std and dependency-free.

Added

• LockedSecretVec for dynamic-length secrets in native memory-locked mappings.
• SecretPool<N, SLOTS> for many fixed-size secrets under one locked allocation, reducing mlock/VirtualLock quota overhead.
• GuardedSecretVec dynamic guarded storage with optional locked backing.
• Canary integrity checks for locked, pooled, and guarded secrets.
• Optional OS-random canaries through random-canary.
• Explicit wasm-compat feature for reduced-guarantee WASM compatibility backends.
• No-std monotonic expiring secrets via caller-provided clocks.
• In-place secret transformation and derivation APIs for SecretBytes.
• ReadOnceSecret for secrets consumed and cleared on first access.
• Optional multi-pass volatile clear helpers.
• Runtime page-size handling for supported platform mappings.
• Optional SIMD/vector register scrubbing helpers.
• Optional x86_64 cache-line flush helpers.
• Optional x86_64 assembly-backed comparison path.
• Hardware-secret provider traits for enclave, HSM, TEE, and platform-keystore integrations.
• SplitSecretBytes<N, SHARES> N-of-N XOR split storage.
• Optional zeroize-interop and subtle-interop features.
• Optional serde loading support with redacted serialization.
• Sister crates:
  • sanitization-derive
  • sanitization-arrayvec
  • sanitization-bytes

Security and hardening

• Volatile clearing remains the default clear path.
• WASM memory-lock compatibility is now explicit with wasm-compat; native memory-lock expectations are not silently downgraded.
• SecretBytesMut in sanitization-bytes refuses implicit reallocation to avoid leaving old secret bytes in freed heap allocations.
• Register scrubbing now handles AVX-aware x86_64 paths with documented residual limits.
• Split-secret mask generation has stronger security documentation and debug checks for trivial generators.
• Documentation now covers remaining platform limits, WASM caveats, cache-flush side-channel scope, and serde ingestion caveats.

Verification

This release passed the project test matrix, clippy, Miri, Kani proofs, codegen checks, GitHub CI, and the final pentest review.

---

This discussion was created from the release Sanitization 1.1.0.