@amritk/nish-x86_64-linux 0.15.0 → 0.16.0

package/std/README.md

@@ -32,19 +32,33 @@ performance gate compiles every module with no diagnostics under both
 ChaCha20-Poly1305, AES-GCM, P-256 and X.509 also run their vectors in `f64`
 (`crypto_*_f64`).
 
+Every module here was security-audited (#363); the records are in
+[`docs/security/`](../docs/security/README.md), and how to report a
+vulnerability is in [`SECURITY.md`](../SECURITY.md). Two limits hold across the
+modules. **Lengths stop at 2^31 − 1.** No array built by `push` or `new Array`,
+and no array or string the runtime makes (a file read, a concatenation, a
+template), can pass 2^31 − 1 elements or bytes, and the one-shot functions
+below refuse a longer input as each row says. A string built by `join` still
+can, and under `--number-mode i32` its `length` is then wrong, which nothing in
+`std` can tell (CG-3, open): a program built in that mode must not hand these
+functions anything built from such a string. **Secrets are not wiped.** Private keys,
+nonces and intermediate state stay in arena memory after a call returns, until
+that memory is reused, because the language has no store the optimiser is
+barred from removing (ECC-2, X509-7, open).
+
 | Module | What it is | Reproduces |
 | --- | --- | --- |
-| [`crypto/sha256.ts`](./crypto/sha256.ts) | `sha256(data)`, and `Sha256`, a streaming hasher: `update(buf, off, len)` over a window of a `u8[]`, `copy()` for the hash of a prefix while the original keeps going, and `digest()`, a fresh 32-byte array. `SHA256_SIZE` and `SHA256_BLOCK` | FIPS 180-4 §6.2 |
-| [`crypto/sha512.ts`](./crypto/sha512.ts) | SHA-512 and SHA-384 on one compression function: `sha512` and `sha384`, and the streaming `Sha512` and `Sha384` with `Sha256`'s three methods; digests of 64 and 48 bytes. `SHA512_SIZE`, `SHA384_SIZE` and `SHA512_BLOCK` | FIPS 180-4 §6.4, §6.5 |
-| [`crypto/hmac.ts`](./crypto/hmac.ts) | `hmacSha256` and `hmacSha384`, the streaming `HmacSha256` and `HmacSha384` (keyed in the constructor, then `update` and `digest`), and `hmacSha256Verify` / `hmacSha384Verify`, which compare a received tag with `timingSafeEqual` | RFC 2104, RFC 4231 §4 |
-| [`crypto/hkdf.ts`](./crypto/hkdf.ts) | `hkdfExtractSha256` / `hkdfExtractSha384` (an empty salt is HashLen zeros) and `hkdfExpandSha256` / `hkdfExpandSha384`, which answer `null` for a length below zero or above 255 × HashLen. TLS 1.3's HKDF-Expand-Label is not here; it belongs with TLS | RFC 5869 §2, Appendix A |
-| [`crypto/ct.ts`](./crypto/ct.ts) | `timingSafeEqual(a, b)`, which reads every byte whatever it holds, and `timingSafeEqualAt(a, aOff, b, bOff, len)` over two windows, which answers `false` for a window outside its array. Two lengths that differ answer `false` at once, because a length is public | — |
-| [`crypto/base64url.ts`](./crypto/base64url.ts) | `base64urlEncode(data)` and `base64urlDecode(text)`, unpadded. Decoding is strict, so every byte string has one spelling: a `=`, a character outside the alphabet, a length of 1 mod 4 or nonzero unused low bits answer `null` | RFC 4648 §5, §10 |
-| [`crypto/x25519.ts`](./crypto/x25519.ts) | `x25519(scalar, u)` and `x25519Base(scalar)`, on ten 25.5-bit limbs in `i64`. Either answers `null` unless its arguments are `X25519_SIZE` (32) bytes; the scalar is clamped on a copy | RFC 7748 §5.2, §6.1 |
-| [`crypto/chacha20poly1305.ts`](./crypto/chacha20poly1305.ts) | `chacha20Poly1305Seal(key, nonce, aad, plaintext)`, which answers the ciphertext followed by the 16-byte tag, and `chacha20Poly1305Open`, which checks the whole tag before it decrypts anything and answers `null` for a message that does not authenticate. Beneath them `chacha20Block`, `chacha20`, `chacha20QuarterRound`, `poly1305` and `poly1305KeyGen`, and `chacha20HeaderMask`, QUIC's 5-byte header-protection mask. Every input of the wrong length answers `null` | RFC 8439 §2, RFC 9001 §5.4.4 |
-| [`crypto/aes.ts`](./crypto/aes.ts) | AES-128 and AES-256, bitsliced four blocks at a time with the Boyar–Peralta S-box circuit, so no table is read: `aesKey(key)` expands a 16- or 32-byte key into an `AesKey`, then `aesEncryptBlock`, `aesGcmSeal` / `aesGcmOpen` (tag last, checked in full before anything is decrypted; any non-empty IV) and `aesHeaderMask`. AES-192 is out of scope, and a wrong length answers `null` | FIPS 197, SP 800-38D, RFC 9001 §5.4.3, Wycheproof `aes_gcm` |
-| [`crypto/p256.ts`](./crypto/p256.ts) | ECDSA over P-256 with RFC 6979's deterministic nonces: `p256PublicKey(priv)` (65-byte uncompressed SEC1), `p256Sign` / `p256Verify` over a digest and `p256SignSha256` / `p256VerifySha256` over a message; a signature is `r` and `s`, 32 big-endian bytes each, not DER. A malformed key, a point off the curve or an `r` or `s` out of range answers `null` or `false`, never a panic | RFC 6979 A.2.5, Wycheproof `ecdsa_secp256r1_sha256` |
-| [`crypto/x509.ts`](./crypto/x509.ts) | DER, PEM and X.509 over P-256: `pemToDer` / `derToPem` (RFC 7468, padded standard base64, strict labels), `x509ParseP256PrivateKey` (SEC1 or PKCS#8), `x509ParseCertificate` / `x509ParseChain` into an `X509Certificate`, `x509VerifySignature` (ecdsa-with-SHA256 under an issuer's key), `x509MintSelfSigned`, the 1-to-14-day self-signed P-256 certificate WebTransport's `serverCertificateHashes` accepts, and `x509CertificateHash`, its SHA-256. DER is read strictly — non-minimal lengths and integers, indefinite lengths and trailing bytes answer `null` | X.690, RFC 5280, RFC 7468, RFC 5915, RFC 5208 / 5958; certificates checked against OpenSSL |
+| [`crypto/sha256.ts`](./crypto/sha256.ts) | `sha256(data)`, and `Sha256`, a streaming hasher: `update(buf, off, len)` over a window of a `u8[]`, `copy()` for the hash of a prefix while the original keeps going, and `digest()`, a fresh 32-byte array. `SHA256_SIZE` and `SHA256_BLOCK`. `sha256` panics on an array longer than 2^31 − 1 bytes | FIPS 180-4 §6.2 |
+| [`crypto/sha512.ts`](./crypto/sha512.ts) | SHA-512 and SHA-384 on one compression function: `sha512` and `sha384`, and the streaming `Sha512` and `Sha384` with `Sha256`'s three methods; digests of 64 and 48 bytes. `SHA512_SIZE`, `SHA384_SIZE` and `SHA512_BLOCK`. The one-shot `sha512` and `sha384` panic on an array longer than 2^31 − 1 bytes | FIPS 180-4 §6.4, §6.5 |
+| [`crypto/hmac.ts`](./crypto/hmac.ts) | `hmacSha256` and `hmacSha384`, the streaming `HmacSha256` and `HmacSha384` (keyed in the constructor, then `update` and `digest`), and `hmacSha256Verify` / `hmacSha384Verify`, which compare a received tag with `timingSafeEqual`. The one-shot functions panic on a message longer than 2^31 − 1 bytes | RFC 2104, RFC 4231 §4 |
+| [`crypto/hkdf.ts`](./crypto/hkdf.ts) | `hkdfExtractSha256` / `hkdfExtractSha384` (an empty salt is HashLen zeros) and `hkdfExpandSha256` / `hkdfExpandSha384`, which answer `null` for a length below zero or above 255 × HashLen, for an `info` longer than 2^31 − 1 bytes, and for a PRK shorter than HashLen. TLS 1.3's HKDF-Expand-Label is not here; it belongs with TLS | RFC 5869 §2, Appendix A |
+| [`crypto/ct.ts`](./crypto/ct.ts) | `timingSafeEqual(a, b)`, which reads every byte whatever it holds, and `timingSafeEqualAt(a, aOff, b, bOff, len)` over two windows, which answers `false` for a window outside its array. Two lengths that differ answer `false` at once, because a length is public, and so does an array longer than 2^31 − 1 bytes | — |
+| [`crypto/base64url.ts`](./crypto/base64url.ts) | `base64urlEncode(data)` and `base64urlDecode(text)`, unpadded. Decoding is strict, so every byte string has one spelling: a `=`, a character outside the alphabet, a length of 1 mod 4 or nonzero unused low bits answer `null`, as does a text longer than 2^31 − 1 bytes; `base64urlEncode` panics on such an array | RFC 4648 §5, §10 |
+| [`crypto/x25519.ts`](./crypto/x25519.ts) | `x25519(scalar, u)` and `x25519Base(scalar)`, on ten 25.5-bit limbs in `i64`. Either answers `null` unless its arguments are `X25519_SIZE` (32) bytes; the scalar is clamped on a copy | RFC 7748 §5.2, §6.1, Wycheproof `x25519_test` |
+| [`crypto/chacha20poly1305.ts`](./crypto/chacha20poly1305.ts) | `chacha20Poly1305Seal(key, nonce, aad, plaintext)`, which answers the ciphertext followed by the 16-byte tag, and `chacha20Poly1305Open`, which checks the whole tag before it decrypts anything and answers `null` for a message that does not authenticate. Beneath them `chacha20Block`, `chacha20`, `chacha20QuarterRound`, `poly1305` and `poly1305KeyGen`, and `chacha20HeaderMask`, QUIC's 5-byte header-protection mask. Every input of the wrong length answers `null` | RFC 8439 §2, RFC 9001 §5.4.4, Wycheproof `chacha20_poly1305` (all 325 cases) |
+| [`crypto/aes.ts`](./crypto/aes.ts) | AES-128 and AES-256, bitsliced four blocks at a time with the Boyar–Peralta S-box circuit, so no table is read: `aesKey(key)` expands a 16- or 32-byte key into an `AesKey`, then `aesEncryptBlock`, `aesGcmSeal` / `aesGcmOpen` (tag last, checked in full before anything is decrypted; any non-empty IV) and `aesHeaderMask`. AES-192 is out of scope, and a wrong length answers `null`, as does an `AesKey` not made by `aesKey`; one whose H is zero opens nothing | FIPS 197, SP 800-38D, RFC 9001 §5.4.3, Wycheproof `aes_gcm` (all 316 cases; the 103 AES-192 ones check that the key is refused) |
+| [`crypto/p256.ts`](./crypto/p256.ts) | ECDSA over P-256 with RFC 6979's deterministic nonces: `p256PublicKey(priv)` (65-byte uncompressed SEC1), `p256Sign` / `p256Verify` over a digest and `p256SignSha256` / `p256VerifySha256` over a message; a signature is `r` and `s`, 32 big-endian bytes each, not DER (`crypto/x509.ts`'s `x509DerSignatureRS` converts one). A malformed key, a point off the curve or an `r` or `s` out of range answers `null` or `false`, never a panic. ECDSA is malleable, and `p256Verify` accepts a high `s`: when `(r, s)` verifies, so does `(r, n − s)` | RFC 6979 A.2.5, Wycheproof `ecdsa_secp256r1_sha256`, `_sha256_p1363`, `_sha512` and `_sha512_p1363` |
+| [`crypto/x509.ts`](./crypto/x509.ts) | DER, PEM and X.509 over P-256: `pemToDer` / `derToPem` (RFC 7468, padded standard base64, strict labels), `x509ParseP256PrivateKey` (SEC1 or PKCS#8), `x509ParseCertificate` / `x509ParseChain` into an `X509Certificate`, `x509VerifySignature` (ecdsa-with-SHA256 under an issuer's key), `x509DerSignatureRS` (a DER ECDSA-Sig-Value as the `r || s` `crypto/p256.ts` takes), `x509MintSelfSigned`, the 1-to-14-day self-signed P-256 certificate WebTransport's `serverCertificateHashes` accepts, and `x509CertificateHash`, its SHA-256. DER is read strictly — non-minimal lengths and integers, indefinite lengths and trailing bytes answer `null`. `x509ParseCertificate` and `x509ParseChain` parse and do not validate: there is no path validation, no extension is read or exposed, and no clock is consulted. `pemToDer` refuses a file in which any block, of any label, is malformed. `x509MintSelfSigned` refuses a common name that is not UTF-8 or holds a NUL, and its key and serial must come from `crypto.getRandomValues`, which the module cannot call itself without refusing wasm32 (X509-6) | X.690, RFC 5280, RFC 7468, RFC 5915, RFC 5208 / 5958; certificates checked against OpenSSL |
 
 Three rules hold across the modules:
 
@@ -55,8 +69,10 @@ Three rules hold across the modules:
   that is itself spent, so any `update` or `digest` on it panics. Either way,
   copy *before* `digest` when the computation has to go on.
 - **An all-zero X25519 result is returned, not refused.** It is what a
-  low-order `u` gives, and RFC 7748 §6.1 leaves the check to the protocol; TLS
-  1.3 (WP34 T1) makes it. A key exchange outside TLS has to make it itself.
+  low-order `u` gives, and RFC 7748 §6.1 leaves the check to the protocol.
+  Nothing in this tree makes that check yet (TLS 1.3, WP34 T1, is planned to),
+  so every caller doing a key exchange must refuse an all-zero answer itself,
+  with `timingSafeEqual` against 32 zero bytes, since the answer is a secret.
 - **Constant time by construction, and verified where the check reaches.** No
   module branches on, or indexes by, a secret: comparisons OR the differences
   into one word and test it once, the ladder swaps with a mask and always runs
@@ -65,13 +81,22 @@ Three rules hold across the modules:
   rather than a table. Every branch is on a length, a loop counter or a bit
   position. WP34 N6 checks that the machine code kept that shape:
   `tests/ct-asm.js` disassembles golden fixtures on x86-64 and aarch64 and
-  refuses a branch, a call or a secret-addressed load in them. What it holds,
-  per module, is what that module's header says:
+  refuses a branch, a call, a secret-addressed load, or a divide or square
+  root of a secret (whose latency follows its operands) in them. It reads what
+  `clang -O2` emits for each target's baseline CPU, and only the functions a
+  fixture names: the fixtures are copies of each module's straight-line cores,
+  so the module functions themselves, and every loop, rest on review.
+  [`docs/security/ct-verification.md`](../docs/security/ct-verification.md)
+  lists every secret-handling function no fixture reads. What it holds, per
+  module, is what that module's header says:
   - `tests/cases/ct_asm_mac` pins the two loop shapes the others are built
-    from, a full tag compare and a masked table read. `crypto/ct.ts` and
-    `crypto/hmac.ts`'s verifiers compare in the first shape and
-    `crypto/base64url.ts` selects by mask, but none of those K1 modules is
-    itself in a fixture, so they remain discipline.
+    from, a full tag compare and a masked table read; `crypto/hmac.ts`'s
+    verifiers compare in the first shape.
+  - `tests/cases/ct_asm_k1_ct`: copies of `timingSafeEqual`'s loop at 32 and
+    48 bytes and `timingSafeEqualAt`'s at a 16-byte window.
+  - `tests/cases/ct_asm_k1_base64url`: the two character maps verbatim, and
+    one encode group and one decode group. The length-driven loops, the
+    decoder's store guard and the encoder's string building remain discipline.
   - `tests/cases/ct_asm_x25519`: X25519's field multiply, square, add,
     subtract and multiply by a24, its conditional swap, and one step of the
     Montgomery ladder, the check following each call into the field functions.

package/std/crypto/aes.ts

@@ -59,10 +59,11 @@
  *
  * **What is refused.** A key of any length but 16 or 32 bytes (AES-192 is out
  * of scope), a block or a sample that is not 16 bytes, an empty IV (SP 800-38D
- * §5.2.1.1 asks for at least one bit), a sealed input shorter than its tag and
- * a plaintext too long for its sealed form to be an array answer `null`; so
- * does a tag that does not verify. An IV of any other non-zero
- * length is hashed into the first counter block as §7.1 says.
+ * §5.2.1.1 asks for at least one bit), a sealed input shorter than its tag, a
+ * plaintext too long for its sealed form to be an array, and an `AesKey`
+ * `aesKey` did not make answer `null`; so does a tag that does not verify. An
+ * IV of any other non-zero length is hashed into the first counter block as
+ * §7.1 says.
  *
  * Private names carry the `aes` / `ghash` prefix because a `std/` module's
  * private functions share the importing program's flat symbol namespace
@@ -80,6 +81,12 @@ const AES_BATCH: i32 = 64
 /**
  * An AES key, expanded: the round keys already bitsliced, and GCM's hash key
  * H = E(K, 0^128), so a key used for many messages is expanded once.
+ *
+ * Make one with `aesKey`. The constructor and the fields are public only
+ * because the language has no private ones, and a key built or edited by hand
+ * is not trusted: one whose shape is not what `aesKey` makes answers `null`
+ * everywhere (`aesKeyUsable`), and one whose H is zero opens nothing
+ * (`aesGcmOpen`).
  */
 export class AesKey {
   /** Nr: 10 for AES-128, 14 for AES-256. */
@@ -574,6 +581,19 @@ const aesCopyPrefix = (dst: u8[], src: u8[], count: i32): void => {
   }
 }
 
+/**
+ * Whether `key` has the shape `aesKey` makes: 10 or 14 rounds and the
+ * `(rounds + 1) * 8` round-key words the cipher reads. A key of another shape
+ * could only have been built or edited by hand, and would index past its round
+ * keys and panic, so every entry point answers `null` for it instead. The
+ * branch is on the shape, which is not secret.
+ */
+const aesKeyUsable = (key: AesKey): boolean => {
+  const rounds: i32 = key.rounds
+  const words: i32 = (rounds + 1) * 8
+  return (rounds === 10 || rounds === 14) && toI32(key.roundKeys.length) === words
+}
+
 /**
  * The first 16 bytes of `block` encrypted, in the first 16 bytes of a fresh
  * batch; the rest of the batch is the cipher of zeros and is not read.
@@ -605,7 +625,7 @@ export const aesKey = (key: u8[]): AesKey | null => {
 
 /** One block encrypted (FIPS 197 §5.1, ECB): 16 bytes in, 16 fresh bytes out, or `null` for another length. */
 export const aesEncryptBlock = (key: AesKey, block: u8[]): u8[] | null => {
-  if (toI32(block.length) !== AES_BLOCK) {
+  if (!aesKeyUsable(key) || toI32(block.length) !== AES_BLOCK) {
     return null
   }
   const out: u8[] = new Array<u8>(AES_BLOCK)
@@ -619,7 +639,7 @@ export const aesEncryptBlock = (key: AesKey, block: u8[]): u8[] | null => {
  * a sample of another length.
  */
 export const aesHeaderMask = (key: AesKey, sample: u8[]): u8[] | null => {
-  if (toI32(sample.length) !== AES_BLOCK) {
+  if (!aesKeyUsable(key) || toI32(sample.length) !== AES_BLOCK) {
     return null
   }
   const mask: u8[] = new Array<u8>(5)
@@ -781,6 +801,17 @@ const aesGcmJ0 = (key: AesKey, iv: u8[]): u8[] => {
   return j0
 }
 
+/**
+ * Whether GCTR can encrypt `length` bytes from inc32(J0) without its 32-bit
+ * counter coming back round to J0's, whose block masks the tag: SP 800-38D
+ * §5.2.1.1 caps a plaintext at 2^32 - 2 blocks (2^39 - 256 bits). An array
+ * length is below 2^31, so this never refuses today; it is here so that the
+ * bound is stated where the counter is, rather than left to the width of an
+ * array length.
+ */
+const aesGcmLengthFits = (length: i32): boolean =>
+  (toI64(length) + toI64(15)) >> toI64(4) <= (toI64(1) << toI64(32)) - toI64(2)
+
 /**
  * GCTR (SP 800-38D §6.5) from inc32(J0): `dst[i] = src[i] ⊕ keystream[i]` for
  * `i` below `length`, four blocks per pass of the cipher. The counter is the
@@ -844,16 +875,16 @@ export const aesGcmTagMask = (tagHi: u64, tagLo: u64, gotHi: u64, gotLo: u64): u
 /**
  * GCM authenticated encryption (SP 800-38D §7.1): the ciphertext followed by
  * the 16-byte tag, in one fresh array. The IV may be any non-zero length; 12
- * bytes is the fast and usual one. `null` for an empty IV, and for a
- * plaintext longer than 2^31 - 17 bytes, whose sealed form would not fit in an
- * array.
+ * bytes is the fast and usual one. `null` for an empty IV, for a key
+ * `aesKey` did not make, and for a plaintext longer than 2^31 - 17 bytes,
+ * whose sealed form would not fit in an array.
  */
 export const aesGcmSeal = (key: AesKey, iv: u8[], aad: u8[], plaintext: u8[]): u8[] | null => {
   const length: i32 = toI32(plaintext.length)
   // 2^31 - 17: the longest plaintext whose sealed form, sixteen bytes longer,
   // is still an array length.
   const longest: i32 = 0x7fffffef
-  if (toI32(iv.length) === 0 || length > longest) {
+  if (!aesKeyUsable(key) || toI32(iv.length) === 0 || length > longest || !aesGcmLengthFits(length)) {
     return null
   }
   const j0: u8[] = aesGcmJ0(key, iv)
@@ -869,18 +900,22 @@ export const aesGcmSeal = (key: AesKey, iv: u8[], aad: u8[], plaintext: u8[]): u
 /**
  * GCM authenticated decryption (SP 800-38D §7.2): `sealed` is the ciphertext
  * followed by its 16-byte tag, and the answer is the plaintext, or `null` when
- * the tag does not verify, the IV is empty or `sealed` is shorter than a tag.
+ * the tag does not verify, the IV is empty, `sealed` is shorter than a tag or
+ * the key is not one `aesKey` made.
  * The tag is computed over the received ciphertext and compared in constant
  * time before anything is decrypted, so a forgery yields no plaintext at all.
  */
 export const aesGcmOpen = (key: AesKey, iv: u8[], aad: u8[], sealed: u8[]): u8[] | null => {
   const total: i32 = toI32(sealed.length)
-  if (toI32(iv.length) === 0 || total < AES_GCM_TAG_SIZE) {
+  if (!aesKeyUsable(key) || toI32(iv.length) === 0 || total < AES_GCM_TAG_SIZE) {
     return null
   }
   // `total` is an array length and at least a tag, so neither this nor the
   // tag's second word at `length + 8` can leave the range of an `i32`.
   const length: i32 = total - AES_GCM_TAG_SIZE
+  if (!aesGcmLengthFits(length)) {
+    return null
+  }
   const j0: u8[] = aesGcmJ0(key, iv)
   const tag: u64[] = new Array<u64>(2)
   aesGcmTag(tag, key, j0, aad, sealed, length)
@@ -890,7 +925,12 @@ export const aesGcmOpen = (key: AesKey, iv: u8[], aad: u8[], sealed: u8[]): u8[]
     aesLoad64(sealed, length, total),
     aesLoad64(sealed, length + 8, total)
   )
-  if (same === toU64(0)) {
+  // Under H = 0 GHASH is zero for every input, so the tag E(K, J0) would
+  // authenticate any ciphertext and AAD. Only a key built or edited by hand
+  // has it (for one from `aesKey` the chance is 2^-128), and such a key opens
+  // nothing. H is secret, so this is folded into the mask, not branched on.
+  const hashKeySet: u64 = ~ctEq(key.hHi | key.hLo, toU64(0))
+  if ((same & hashKeySet) === toU64(0)) {
     return null
   }
   const out: u8[] = new Array<u8>(length)

package/std/crypto/base64url.ts

@@ -9,9 +9,10 @@
  * **Decoding is strict, so that each byte string has exactly one spelling.**
  * `base64urlDecode` answers `null` for a `=` anywhere, for any character outside
  * the alphabet (whitespace included), for a length of 1 mod 4 — six bits, not a
- * byte — and for a final character whose unused low bits are not zero (RFC 4648
- * §3.5). A lenient decoder would let `AB` and `AA` both mean `00`, and a token
- * compared or cached by its text would then have two identities.
+ * byte — for a final character whose unused low bits are not zero (RFC 4648
+ * §3.5), and for a text longer than 2^31 - 1 bytes. A lenient decoder would let
+ * `AB` and `AA` both mean `00`, and a token compared or cached by its text
+ * would then have two identities.
  *
  * **Neither direction indexes or branches on the data.** What is encoded here
  * is usually a key, a nonce or a MAC, and a lookup table indexed by a secret
@@ -69,9 +70,15 @@ const base64urlSextetOf = (c: i32): i32 => {
  *
  * Bytes go into a bit accumulator eight at a time and come out six at a time,
  * so one index walks the input and the only branches are on how many bits are
- * waiting — which depends on the position, never on the bytes.
+ * waiting — which depends on the position, never on the bytes. An array longer
+ * than 2^31 - 1 bytes panics.
  */
 export const base64urlEncode = (data: u8[]): string => {
+  // Refused before `toI32`, which saturates a longer length under
+  // `--number-mode f64` and would end the loop at a prefix.
+  if (data.length > 2147483647) {
+    panic("base64urlEncode: more than 2^31 - 1 bytes")
+  }
   const parts: string[] = []
   let acc: i32 = 0
   let bits: i32 = 0
@@ -96,12 +103,18 @@ export const base64urlEncode = (data: u8[]): string => {
 /**
  * The bytes `text` spells in unpadded base64url, or `null` when it is not the
  * one canonical spelling of any byte string — see the module comment for the
- * four refusals.
+ * five refusals.
  *
  * The same accumulator as `base64urlEncode`, run the other way: six bits in per
  * character, eight out per byte.
  */
 export const base64urlDecode = (text: string): u8[] | null => {
+  // A text past 2^31 - 1 bytes is refused before `toI32`, which would
+  // saturate it under `--number-mode f64` and decode only a prefix: a second
+  // spelling of that prefix's bytes, which strictness exists to refuse.
+  if (text.length > 2147483647) {
+    return null
+  }
   const n: i32 = toI32(text.length)
   const tail: i32 = n & 3
   // Six bits cannot finish a byte, so a single character after the last full

package/std/crypto/chacha20poly1305.ts

@@ -274,7 +274,10 @@ const chacha20Poly1305Setup = (state: u32[]): u8[] => {
  * Whether the blocks `len` bytes need, from `counter` on, fit before the
  * 32-bit counter wraps.
  * RFC 8439 §2.4 leaves a wrap undefined, and a wrapped counter repeats the
- * keystream, so a request that would need one answers `null` instead.
+ * keystream, so a request that would need one answers `null` instead. The
+ * AEAD asks it too, from counter 1: an array length is below 2^31, so that
+ * never refuses today, but the bound is then stated where the counter is
+ * rather than left to the width of an array length.
  */
 const chacha20CounterFits = (counter: u32, len: i32): boolean => {
   const blocks: i64 = (toI64(len) + toI64(63)) >> toI64(6)
@@ -634,7 +637,8 @@ export const chacha20Poly1305Seal = (key: u8[], nonce: u8[], aad: u8[], plaintex
   if (
     toI32(key.length) !== CHACHA20_KEY_SIZE ||
     toI32(nonce.length) !== CHACHA20POLY1305_NONCE_SIZE ||
-    len > longest
+    len > longest ||
+    !chacha20CounterFits(1, len)
   ) {
     return null
   }
@@ -668,6 +672,9 @@ export const chacha20Poly1305Open = (key: u8[], nonce: u8[], aad: u8[], sealed:
     return null
   }
   const len: i32 = total - POLY1305_TAG_SIZE
+  if (!chacha20CounterFits(1, len)) {
+    return null
+  }
   const state: u32[] = chacha20State(key, 0, nonce, 0)
   const polyKey: u8[] = chacha20Poly1305Setup(state)
   const tag: u8[] = chacha20Poly1305Tag(polyKey, aad, sealed, 0, len)

package/std/crypto/ct.ts

@@ -23,12 +23,18 @@
  *
  * Arrays of different lengths answer `false` at once, because a length is
  * public; arrays of one length are compared in full, with no early exit.
+ *
+ * The lengths are compared as the `number`s they are, before any `toI32`:
+ * under `--number-mode f64` `toI32` saturates at 2^31 - 1, so two arrays past
+ * it would have looked the same length and been compared only that far. An
+ * array longer than that answers `false` too — no `i32` index reaches its end,
+ * and a compare that cannot read every byte must not say "equal".
  */
 export const timingSafeEqual = (a: u8[], b: u8[]): boolean => {
-  const n: i32 = toI32(a.length)
-  if (n !== toI32(b.length)) {
+  if (a.length !== b.length || a.length > 2147483647) {
     return false
   }
+  const n: i32 = toI32(a.length)
   let diff: i32 = 0
   // Bounded by both lengths, which are equal here, so the prover drops both
   // bounds checks rather than trusting the comparison above.

package/std/crypto/hkdf.ts

@@ -16,7 +16,11 @@
  * The counter `i` is one byte, so `L` is at most 255 × HashLen (§2.3): 8160
  * bytes for SHA-256 and 12240 for SHA-384. A longer `L`, or a negative one,
  * answers `null` rather than panicking, because `L` usually comes from a
- * protocol field; `L = 0` answers an empty array.
+ * protocol field; `L = 0` answers an empty array. So does an `info` longer
+ * than 2^31 - 1 bytes, which `toI32` would cut to a prefix under
+ * `--number-mode f64`, so that two `info`s sharing it gave one key, and a PRK
+ * shorter than HashLen, which §2.3 does not allow: an empty one is a key
+ * anybody can compute with.
  *
  * HKDF-Expand-Label, TLS 1.3's wrapper around `expand`, belongs with TLS and is
  * not here. Written from RFC 5869, not ported from another implementation.
@@ -64,10 +68,16 @@ export const hkdfExtractSha384 = (salt: u8[], ikm: u8[]): u8[] => hmacSha384(hkd
 /**
  * HKDF-Expand with HMAC-SHA-256 (RFC 5869 §2.3): `length` bytes of output
  * keying material from `prk` and `info`, or `null` when `length` is negative
- * or past 255 × 32.
+ * or past 255 × 32, when `info` is longer than 2^31 - 1 bytes, or when `prk`
+ * is shorter than 32 bytes.
  */
 export const hkdfExpandSha256 = (prk: u8[], info: u8[], length: i32): u8[] | null => {
-  if (length < 0 || length > HKDF_MAX_BLOCKS * SHA256_SIZE) {
+  if (
+    length < 0 ||
+    length > HKDF_MAX_BLOCKS * SHA256_SIZE ||
+    info.length > 2147483647 ||
+    toI32(prk.length) < SHA256_SIZE
+  ) {
     return null
   }
   const out: u8[] = new Array<u8>(length)
@@ -92,10 +102,16 @@ export const hkdfExpandSha256 = (prk: u8[], info: u8[], length: i32): u8[] | nul
 /**
  * HKDF-Expand with HMAC-SHA-384 (RFC 5869 §2.3): `length` bytes of output
  * keying material from `prk` and `info`, or `null` when `length` is negative
- * or past 255 × 48.
+ * or past 255 × 48, when `info` is longer than 2^31 - 1 bytes, or when `prk`
+ * is shorter than 48 bytes.
  */
 export const hkdfExpandSha384 = (prk: u8[], info: u8[], length: i32): u8[] | null => {
-  if (length < 0 || length > HKDF_MAX_BLOCKS * SHA384_SIZE) {
+  if (
+    length < 0 ||
+    length > HKDF_MAX_BLOCKS * SHA384_SIZE ||
+    info.length > 2147483647 ||
+    toI32(prk.length) < SHA384_SIZE
+  ) {
     return null
   }
   const out: u8[] = new Array<u8>(length)

package/std/crypto/hmac.ts

@@ -127,15 +127,31 @@ export class HmacSha384 {
   }
 }
 
-/** The HMAC-SHA-256 of all of `data` under `key`, as a fresh 32-byte array. */
+/**
+ * The HMAC-SHA-256 of all of `data` under `key`, as a fresh 32-byte array.
+ *
+ * `data` longer than 2^31 - 1 bytes panics, as `sha256` does and for its
+ * reason: under `--number-mode f64` the tag would be of a prefix, and a tag
+ * that verifies every message sharing that prefix is a forgery. A key that
+ * long reaches `sha256` in the constructor and panics there.
+ */
 export const hmacSha256 = (key: u8[], data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("hmacSha256: a message longer than 2^31 - 1 bytes")
+  }
   const mac = new HmacSha256(key)
   mac.update(data, HMAC_FROM, toI32(data.length))
   return mac.digest()
 }
 
-/** The HMAC-SHA-384 of all of `data` under `key`, as a fresh 48-byte array. */
+/**
+ * The HMAC-SHA-384 of all of `data` under `key`, as a fresh 48-byte array.
+ * `data` longer than 2^31 - 1 bytes panics, as in `hmacSha256`.
+ */
 export const hmacSha384 = (key: u8[], data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("hmacSha384: a message longer than 2^31 - 1 bytes")
+  }
   const mac = new HmacSha384(key)
   mac.update(data, HMAC_FROM, toI32(data.length))
   return mac.digest()

package/std/crypto/p256.ts

@@ -4273,6 +4273,11 @@ export const p256Sign = (priv: u8[], digest: u8[]): u8[] | null => {
  * that is not a point on the curve, and a sum that is the identity all answer
  * `false`. Every value here is public, so the answer may be reached by
  * branches; the multiplications are the constant-time ones all the same.
+ *
+ * ECDSA is malleable, and so is this: when `(r, s)` verifies, `(r, n - s)`
+ * verifies too, as FIPS 186-4 and SEC 1 have it. Nothing here asks for the
+ * lower `s`, so a protocol that needs one signature per message and key (a
+ * signature used as an identifier, say) has to refuse the upper half itself.
  */
 export const p256Verify = (pub: u8[], digest: u8[], sig: u8[]): boolean => {
   if (toI32(sig.length) !== 64) {

package/std/crypto/sha256.ts

@@ -435,8 +435,19 @@ export class Sha256 {
   }
 }
 
-/** The SHA-256 digest of all of `data`, as a fresh 32-byte array. */
+/**
+ * The SHA-256 digest of all of `data`, as a fresh 32-byte array.
+ *
+ * An array longer than 2^31 - 1 bytes panics. A window's length is an `i32`,
+ * and under `--number-mode f64` `toI32` of a longer length saturates, so
+ * hashing `toI32(data.length)` bytes would answer the digest of a prefix: one
+ * digest for every message that shares its first 2^31 - 1 bytes. The length
+ * is compared as the `number` it is, before any `toI32`.
+ */
 export const sha256 = (data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("sha256: a message longer than 2^31 - 1 bytes")
+  }
   const hasher: Sha256 = new Sha256()
   const from: i32 = 0
   hasher.update(data, from, toI32(data.length))

package/std/crypto/sha512.ts

@@ -495,15 +495,29 @@ export class Sha384 {
   }
 }
 
-/** The SHA-512 digest of all of `data`, as a fresh 64-byte array. */
+/**
+ * The SHA-512 digest of all of `data`, as a fresh 64-byte array. An array
+ * longer than 2^31 - 1 bytes panics, for the reason `sha256` gives: a longer
+ * length does not survive `toI32` under `--number-mode f64`, and the digest
+ * would be of a prefix.
+ */
 export const sha512 = (data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("sha512: a message longer than 2^31 - 1 bytes")
+  }
   const hasher = new Sha512()
   hasher.update(data, OFFSET_ZERO, toI32(data.length))
   return hasher.digest()
 }
 
-/** The SHA-384 digest of all of `data`, as a fresh 48-byte array. */
+/**
+ * The SHA-384 digest of all of `data`, as a fresh 48-byte array. An array
+ * longer than 2^31 - 1 bytes panics, as in `sha512`.
+ */
 export const sha384 = (data: u8[]): u8[] => {
+  if (data.length > 2147483647) {
+    panic("sha384: a message longer than 2^31 - 1 bytes")
+  }
   const hasher = new Sha384()
   hasher.update(data, OFFSET_ZERO, toI32(data.length))
   return hasher.digest()

package/std/crypto/x25519.ts

@@ -480,9 +480,10 @@ const x25519Ladder = (k: u8[], u: i64[]): u8[] => {
  *
  * Answers `null` unless both arguments are exactly `X25519_SIZE` bytes. An
  * all-zero answer is **returned, not refused**: it is what a low-order `u`
- * gives, and RFC 7748 §6.1 leaves checking for it to the protocol, which is
- * where TLS 1.3 (WP34 T1) makes that check. A caller doing a key exchange
- * outside TLS should make it too.
+ * gives, and RFC 7748 §6.1 leaves checking for it to the protocol. Nothing in
+ * this tree makes that check for you yet (TLS 1.3, WP34 T1, is planned to), so
+ * every caller doing a key exchange must refuse an all-zero answer itself —
+ * with `timingSafeEqual` against 32 zero bytes, since the answer is a secret.
  */
 export const x25519 = (scalar: u8[], u: u8[]): u8[] | null => {
   if (toI32(scalar.length) !== 32 || toI32(u.length) !== 32) {