Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mcginty/snow

              main @ 8ac60f5
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

src/crypto_stuff.rs: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Issues: Critical failure to prevent nonce reuse in cipher operations can lead to the complete compromise of encrypted transport sessions. Nonce counters must strictly protect against wrap-around or integer overflow before execution.

CWE-323: Use of a Key Past its Lifetime: Failure to render a CipherState permanently unusable following a decryption failure violates Noise protocol specs and risks allowing attackers to probe or reuse invalid states.

Auth Bypass: Inadequate enforcement of handshake pattern directionality for one-way patterns can allow unauthorized message transmission or reception contrary to the active protocol phase.