This document describes the security hardening measures applied in F-017.

All structs holding sensitive key material implement Zeroize or custom Drop impls that zero secret bytes when the struct is deallocated. This prevents key material from lingering in memory after use.

The following types already had zeroization via their underlying crate implementations:

• x25519_dalek::StaticSecret — zeroized on drop
• x25519_dalek::SharedSecret — zeroized via DhOutput::to_bytes()
• ml_kem::DecapsulationKey — zeroized by ml-kem crate

All MAC and authentication tag comparisons use constant-time operations to prevent timing side-channel attacks:

Fuzz targets exist in fuzz/fuzz_targets/ for all parser and deserializer entry points that process untrusted input.

Fuzzing requires a nightly Rust toolchain and cargo-fuzz:

# Install cargo-fuzz (one time)
cargo install cargo-fuzz

# Run a specific fuzz target for 60 seconds
cd fuzz/
cargo +nightly fuzz run fuzz_wire_message -- -max_total_time=60

# Run with a maximum input length
cargo +nightly fuzz run fuzz_encrypted_channel_recv -- -max_len=2048 -max_total_time=60

Criterion benchmarks cover all critical crypto and transport operations.

# Run all benchmarks
make bench

# Run specific benchmark suite
cargo bench --bench crypto_benchmarks

# Quick mode (fewer iterations)
cargo bench -- --quick

The client supports two certificate verification modes controlled by the --insecure CLI flag or insecure_skip_verify config option:

When insecure mode is active, a warning is logged at startup: TLS certificate verification disabled (--insecure). Do NOT use in production.

The verification is implemented in src/transport/tls.rs::build_cert_verifier(insecure) and used by all three client config builders: build_masque_client_config, build_client_config (QUIC), and build_mimicked_client_config (TLS mimicry).

The server supports loading CA-signed TLS certificates from PEM files via transport.tls_cert and transport.tls_key config fields. This is critical for DPI evasion — self-signed certificates are trivially detectable.

When using self-signed fallback, a warning is logged: no TLS certificate configured, generating self-signed (not recommended for production)

The loading is implemented in src/transport/tls.rs::load_pem_cert_and_key() using rustls-pemfile. The full certificate chain (including intermediates) is passed to the server config builders, which is required for proper chain validation by clients.

The client --server-name flag has no default value and must be explicitly set via CLI or [server].server_name in the config file. This prevents the SNI/IP mismatch that occurs when a generic placeholder domain (e.g., "www.google.com") is sent in the TLS ClientHello while connecting to a different server IP.

The prrr client doctor command checks SNI configuration:

• Warns if server_name is not configured
• Warns if server_name is "www.google.com" (legacy dangerous default)
• Warns if server_name doesn't look like a valid domain (no dot or contains whitespace)

The server --server-name defaults to "localhost" for dev/test self-signed certificate generation. In production, set it to the server's actual domain.

• All dependencies are pinned to specific versions in Cargo.toml
• cargo audit should be run periodically to check for known vulnerabilities
• The make lint target includes cargo audit (requires cargo-audit installed)

cargo install cargo-audit
cargo audit

The project enforces #![deny(unsafe_code)] globally via Cargo.toml:

[lints.rust]
unsafe_code = "deny"

No unsafe code is permitted without explicit justification and safety proof.