Security context

Highlights

Cryptographic Issues: 25 prior fixes. Scrutinize any change in this area.

src/AESNI.c: most-fixed (11 issues). Treat as high-risk during review.

39 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Side-Channel Information Leak: The implementation of PKCS#1 OAEP decryption padding and hash validation was vulnerable to Manger's timing attacks. If errors are handled non-constantly or are checked too early, an attacker can recover decrypted plaintexts. Constant-time checks must be enforced strictly when verifying the structures in padding db.

Memory Safety: Vectorized operations using SSE2 instructions in AES-NI suffered from alignment crashes, out-of-bounds reads/writes when handling non-block-aligned inputs, and strict aliasing violations. Compiler options, heap allocations, and vector pointer loads must be rigorously realigned to 16-byte boundaries.

Timing Attack: PKCS#1 v1.5 decryption was historically vulnerable to Bleichenbacher padding oracle timing attacks because it raised explicit errors immediately upon padding failure instead of consistently returning a uniform sentinel value to hide the decryption outcome.