Security Policy

Threat Model

This library is designed to securely store cryptographic private keys for blockchain wallets (Ethereum, Solana) using the Web3 Secret Storage format.

At-Rest Key Exposure
- Private keys are encrypted with AES-128-CTR using keys derived from passwords
- Uses memory-hard KDFs (Scrypt, PBKDF2) to resist brute-force attacks
- Default Scrypt parameters (N=2^18) provide strong protection
Password Brute-Force Attacks
- Scrypt default: N=262,144, r=8, p=1 (~256 MB memory, ~1-2 seconds)
- PBKDF2 default: 600,000 iterations (OWASP recommended)
- Sensitive mode: N=2^20 (~1 GB memory, ~5-10 seconds)
Timing Attacks on Password Verification
- MAC comparison uses constant-time equality (subtle::ConstantTimeEq)
- Password correctness is not leaked via timing side-channels
Memory Disclosure
- Sensitive data (derived keys, plaintext, IVs) is zeroized after use
- Chain key types implement ZeroizeOnDrop
- to_keystore_bytes() returns Zeroizing<Vec<u8>> for automatic cleanup
File Permission Exposure (Unix)
- Keystore files are written with mode 0600 (owner read/write only)

Weak Passwords
- The library does not enforce password strength requirements
- Users are responsible for choosing strong, unique passwords
- Recommendation: 12+ characters with mixed case, numbers, and symbols
Memory Forensics While Running
- While keys are in use, they exist in memory
- A sufficiently privileged attacker with memory access can extract keys
- For highest security, use hardware security modules (HSMs)
Malicious Dependencies
- Users should audit dependencies and use cargo audit
- Consider using vendored dependencies in high-security contexts
Side-Channel Attacks Beyond Timing
- Power analysis, electromagnetic emissions, etc. are out of scope
- Use dedicated hardware for protection against these attacks
Compromised System
- If the system is compromised (rootkit, keylogger), all bets are off
- Key material can be captured during password entry or key generation
Key Generation Entropy
- The library relies on the OS CSPRNG (rand::thread_rng())
- On systems with poor entropy sources, keys may be predictable

This library uses well-audited RustCrypto implementations:

Run cargo audit regularly to check for known vulnerabilities.