If you discover a security vulnerability in go-qrllib, please report it responsibly:

1. Do NOT open a public issue
2. Email security concerns to security@theqrl.org
3. Or report via https://www.theqrl.org/security-report/
4. Include detailed steps to reproduce
5. Allow reasonable time for a fix before public disclosure

This library assumes:

1. Trusted execution environment - The code runs on a system not compromised by malware
2. Secure random source - crypto/rand provides cryptographically secure randomness
3. No physical access attacks - Attacker cannot probe hardware or extract memory
4. Correct usage - Caller follows documented usage patterns (especially for XMSS)

Security Level: NIST Level 5 (equivalent to AES-256)

Security Level: NIST Level 5

Security Level: Configurable based on parameters

CRITICAL: XMSS security is COMPLETELY BROKEN if the same index is used twice.

Note: Dilithium is the pre-FIPS version. Prefer ML-DSA-87 for new applications.

The following operations are implemented in constant-time to prevent timing attacks:

• All signature verification uses subtle.ConstantTimeCompare (SPHINCS+, ML-DSA-87, Dilithium)
• NTT operations (fixed loop bounds, no data-dependent branches)
• Polynomial rounding (MakeHint, UseHint use arithmetic masking)
• Coefficient norm checks (fixed iteration count)

All signature schemes enforce canonical encoding, verified by comprehensive negative tests:

ML-DSA-87 / Dilithium:

• Hint indices stored in strictly increasing order
• z coefficients bounded by GAMMA1 - BETA
• Zero padding enforced in hint section
• Cumulative counts must be non-decreasing and ≤ OMEGA

SPHINCS+ / XMSS:

• Hash-based signatures are inherently canonical
• Fixed signature sizes enforced

Non-canonical encodings are rejected by the verification functions. This is verified by:

Run canonicality tests:

go test -v -run TestCanonicality ./crypto/...

All crypto types implement Zeroize() to clear sensitive material:

func (d *MLDSA87) Zeroize() {
    for i := range d.sk {
        d.sk[i] = 0
    }
    for i := range d.seed {
        d.seed[i] = 0
    }
}

Limitation: Go's garbage collector may copy memory before zeroization. For highest security, use hardware security modules.

The XMSS index MUST be persisted to durable storage before using any signature:

1. Generate signature (index auto-increments)
2. Persist new index to durable storage
3. Verify persistence succeeded
4. Only then use/broadcast the signature

For production XMSS usage:

1. Use append-only storage for index tracking
2. Implement "high water mark" that can never decrease
3. Log all signing operations for audit
4. Monitor remaining signatures (2^height limit)
5. Plan key rotation before exhaustion

• go mod verify runs in CI to detect tampering
• Dependabot monitors for vulnerable dependencies
• Minimal dependency footprint
• Sigstore attestations for all release artifacts
• SLSA Level 3 provenance for build verification
• SBOM published in SPDX and CycloneDX formats

All releases include cryptographic attestations and checksums for verification.

# Verify attestations for go.mod and go.sum
gh attestation verify go.mod --owner theQRL
gh attestation verify go.sum --owner theQRL

# Verify SBOM attestation
gh attestation verify sbom-spdx.json --owner theQRL

Download and verify checksums from the release:

# Download checksums file
curl -LO https://github.com/theQRL/go-qrllib/releases/download/vX.Y.Z/checksums-sha256.txt

# Verify go.mod and go.sum
sha256sum -c checksums-sha256.txt

# Install slsa-verifier
go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@latest

# Download provenance
curl -LO https://github.com/theQRL/go-qrllib/releases/download/vX.Y.Z/provenance.intoto.jsonl

# Verify provenance
slsa-verifier verify-artifact go.mod \
  --provenance-path provenance.intoto.jsonl \
  --source-uri github.com/theQRL/go-qrllib

Each release includes SBOMs in two formats:

• SPDX: sbom-spdx.json
• CycloneDX: sbom-cyclonedx.json

These can be analyzed with tools like:

# Using grype for vulnerability scanning
grype sbom:sbom-spdx.json

# Using syft for inspection
syft convert sbom-cyclonedx.json -o table

Attestations are signed using GitHub's Sigstore integration:

• Identity: GitHub Actions OIDC token
• Transparency: Logged in Sigstore's Rekor transparency log
• Verification: Proves release came from official CI workflow

This provides equivalent (or stronger) guarantees than GPG-signed tags:

• No key management or distribution required
• Tied to repository's GitHub Actions identity
• Publicly auditable via transparency logs

• golangci-lint enforces code quality
• go test -race detects race conditions
• govulncheck scans for known vulnerabilities
• Fuzz testing for parsing robustness

All changes to cryptographic code require:

1. Code review by maintainers
2. Passing CI (lint, test, vulncheck)
3. No new security warnings

For security concerns, contact security@theqrl.org.