Security Documentation

Side-channel claim limit. Nothing on this page claims constant-time behaviour or side-channel resistance for any target: the side-channel harness covers nothing (finding A48) and no measurement exists. The Rust and C cores are designed for constant time and unmeasured; managed runtimes (JIT, GC, bounds checks) make no timing claim. Where this page names constant-time or side-channel techniques, in prose or in code, they are design intent or recommendations, not measured properties.

Comprehensive security documentation for MetaMUI Crypto Primitives, covering threat models, best practices, audit reports, and security procedures.

Overview

The MetaMUI Crypto Primitives library prioritizes security at every level, from algorithm implementation to API design. This section provides comprehensive security documentation for developers, security teams, and auditors.

Key Security Areas

Security Audits

• Security review status of the release candidate — no independent audit exists
• Security Audit Report 2025 — an internal review record of its date

Threat Models and Analysis

• Threat Modeling Documentation
• Side-channel attack considerations
• Quantum computing threat assessment

Best Practices

• Security Best Practices
• Security Implementation Guide
• Security Testing Guide

Algorithm Security

• ML-KEM 768 Security Design
• Side channels: unmeasured for every target (A48); no analysis page exists

Policies and Procedures

• Security Policies
• Security Procedures
• Security Module Interface

Security Features

Memory Safety

• Automatic zeroization of sensitive data
• Protected memory allocation
• Constant-time operations where applicable

Implementation Security

• Rigorous testing against known test vectors
• Compliance with security standards
• Regular security updates and patches

API Security

• Type-safe interfaces
• Input validation
• Error handling without information leakage

Quick Links

• Security Quick Reference
• Security Training Guide
• Security API Documentation

Reporting Security Issues

If you discover a security vulnerability, please report it through our responsible disclosure process:

1. Do not create a public GitHub issue
2. Email security concerns to [security contact]
3. Include detailed reproduction steps
4. Allow time for patch development and release

Compliance & Standards

Our implementations comply with:

• NIST standards for cryptographic algorithms
• The NIST algorithm specifications (FIPS 197/180-4/198-1/202/203/204/205, SP 800-90A/132); no FIPS 140-2 or 140-3 module validation exists or is claimed
• Industry best practices for secure coding

Related Documentation

• Performance & Security Trade-offs
• Algorithm Specifications