Security Testing Guide

Side-channel claim limit. Nothing on this page claims constant-time behaviour or side-channel resistance for any target: the side-channel harness covers nothing (finding A48) and no measurement exists. The Rust and C cores are designed for constant time and unmeasured; managed runtimes (JIT, GC, bounds checks) make no timing claim. Where this page names constant-time or side-channel techniques, in prose or in code, they are design intent or recommendations, not measured properties.

Overview

This guide provides instructions for running security tests and validations for MetaMUI Crypto Primitives.

Automated Security Checks

Pre-commit Hooks

Install and configure pre-commit hooks for automatic security checks:

# Install pre-commit
pip install pre-commit

# Install the git hooks
pre-commit install

# Run manually on all files
pre-commit run --all-files

CI/CD Security Pipeline

Security checks run automatically on:

View results in GitHub Actions:

Manual Security Testing

1. Rust Security Tests

cd metamui-crypto-rust

# Run security-specific tests
cargo test --package metamui-security

# Run clippy with security lints
cargo clippy --all-targets -- \
  -D warnings \
  -W clippy::unwrap_used \
  -W clippy::expect_used

# Check for vulnerabilities in dependencies
cargo audit

# Analyze unsafe code usage
cargo geiger

# Run with address sanitizer
RUSTFLAGS="-Z sanitizer=address" cargo test --target x86_64-unknown-linux-gnu

2. Python Security Tests

cd metamui-crypto-python

# Run Bandit security scanner
bandit -r metamui_crypto -ll

# Check dependencies for vulnerabilities
safety check

# Run security-focused linting
pylint metamui_crypto --disable=all \
  --enable=W0102,W0106,W0107,W0108,W0109,W0110,W0120,W0122,W0150,W0199

# Type checking for security
mypy metamui_crypto --strict

3. TypeScript Security Tests

cd metamui-crypto-typescript

# Install security plugin
pnpm add -D eslint-plugin-security

# Run ESLint with security rules
pnpm eslint . --ext .ts,.tsx \
  --plugin security \
  --rule 'security/detect-object-injection: error'

# Audit dependencies
pnpm audit --audit-level=moderate

# Type checking
pnpm typecheck

4. Timing Analysis

cd metamui-crypto-rust

# Run timing tests
cargo test --features timing-tests timing_analysis

# Use custom timing harness
cargo run --example timing_analysis

# Statistical analysis
python3 ../scripts/analyze_timing.py target/timing_results.json

5. Memory Safety

# Run with Valgrind (Linux)
valgrind --leak-check=full --show-leak-kinds=all \
  ./target/debug/test_binary

# Run with Miri (Rust)
cargo +nightly miri test --package metamui-security

# Check for memory leaks in Python
python3 -m pytest tests/ --memray

6. Fuzzing

cd metamui-crypto-rust

# Install cargo-fuzz
cargo +nightly install cargo-fuzz

# List available fuzzers
cargo fuzz list

# Run a specific fuzzer
cargo +nightly fuzz run aes256_fuzzer -- -max_total_time=300

# Run all fuzzers
for fuzzer in $(cargo fuzz list); do
  cargo +nightly fuzz run $fuzzer -- -max_total_time=60
done

Security Test Scenarios

Constant-Time Verification

  1. Timing Tests 
    # Python example
from metamui_crypto.testing import timing_test
   
@timing_test(iterations=10000)
def test_constant_time_compare():
    # Test with different inputs
    # Should show no statistical correlation
  2. Statistical Analysis
    • Run operations with varying inputs
    • Measure execution time
    • Check for statistical anomalies
    • Use dudect or similar tools

Memory Security Verification

  1. Zeroing Tests 
    #[test]
fn test_memory_cleared() {
    let secret = SecretKey::new();
    let ptr = &secret as *const _ as *const u8;
    drop(secret);
    // Verify memory is zeroed
}
  2. Leak Detection
    • Use memory profilers
    • Check for dangling pointers
    • Verify cleanup in destructors

Side-Channel Resistance

  1. Cache Timing
    • Test with cache flush/reload
    • Measure access patterns
    • Verify no secret-dependent accesses
  2. Power Analysis
    • Simulate power traces
    • Check Hamming weight balance
    • Verify masking effectiveness

Security Regression Tests

Adding New Security Tests

  1. Create test in appropriate module
  2. Tag with #[security_test] or similar
  3. Add to CI/CD pipeline
  4. Document expected behavior

Test Categories

Security Metrics

Coverage Requirements

Performance Benchmarks

Track security overhead:

# Run benchmarks
cargo bench --features security-benchmarks

# Compare results
python3 scripts/compare_benchmarks.py \
  results/baseline.json \
  results/with_security.json

Reporting Security Issues

Internal Process

  1. Run full security test suite
  2. Document any failures
  3. Create issue with security label
  4. Assign to security team

External Reporting

Security Test Checklist

Before each release:

Tools and Resources

Required Tools

Continuous Improvement

Monthly Tasks

Quarterly Tasks