1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
|
Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
CHAT CRYPTOGRAPHY AND BUILDS
Application formats, authentication, recovery and security limits:
CHAT-APPLICATION.txt. Static native packaging and deployment:
CHAT-PRODUCTION.txt. Functional compatibility is not a cryptographic,
side-channel or application security audit.
FIXED ALGORITHMS AND BACKEND
Sequoia OpenPGP 2.4.2, RFC 9980 ML-KEM-1024 + X448 encryption,
ML-DSA-87 + Ed448 signatures, OpenPGP v6 keys, AES-256 content encryption.
Only crypto-openssl is enabled; no algorithm substitution, experimental/
variable-time backend opt-in, or ignored RustSec advisory. Native and browser
probes require the OpenSSL backend and expected key algorithms.
The superseded Rust backend's required curve arithmetic depended on an
incompatible crypto-bigint generation affected by RUSTSEC-2026-0387.
OpenSSL avoids that dependency; the resolved graph has no cx448,
crypto-bigint or rsa crate. This does not prove absence of C defects or
browser side channels. See https://rustsec.org/advisories/RUSTSEC-2026-0387.html.
SOURCE PROVENANCE
Rust: rust-toolchain.toml. Sequoia: exact Cargo.toml requirement/Cargo.lock.
OpenSSL: 3.6.5. WASI SDK: 34.0 x86_64 Linux, bundled Clang/libclang
23.1.0-wasi-sdk. Browser tooling: package.json/package-lock.json.
WASI SDK archive:
https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-34/wasi-sdk-34.0-x86_64-linux.tar.gz
SHA-256 b761e3a0721dbae9c09a0059e5fdb2bf917d1b4a8a7b430fb3b5aafb0984b2c4
OpenSSL archive:
https://github.com/openssl/openssl/releases/download/openssl-3.6.5/openssl-3.6.5.tar.gz
SHA-256 a2157c2830efdec3788939b00c9b0638306d3f0bbb76dc4832ee503bb397df98
Build scripts verify these digests before extraction. Pinned hashes do not
independently verify upstream signatures or promise cross-host identical
binaries. Sources, SDK and static libraries stay under ignored .tools/;
Cargo output stays under target/. Native development uses the host library;
production static native builds use the verified source, CHAT-PRODUCTION.txt.
WASI BUILD AND ENTROPY
infra/chat/openssl-wasi.conf adds a BASE_unix target with little-endian,
32-bit bignums. C uses -O2; no cryptographic routine or RNG patch is applied.
OpenSSL's --with-rand-seed=getrandom reaches WASI random_get through libc.
The browser bridge uses only crypto.getRandomValues, splitting requests
at 65536 bytes. Entropy failures reject; no fixed seed or success fallback.
The browser probe includes a failing-entropy negative control.
Static WASI builds disable assembly, async operations, automatic config
loading, DSO/modules, POSIX I/O, secure-memory arenas, shared libraries,
sockets, C stdio, thread pools, threads and interactive console UI.
Ordinary WASM memory provides no locked-page, secure-erasure or delivered-
JavaScript protection. OpenSSL uses C/FFI; first-party Rust unsafe-code
prohibition does not make dependencies memory-safe.
_WASI_EMULATED_GETPID and libwasi-emulated-getpid supply process-ID emulation.
getuid/geteuid/getgid/getegid map to getpagesize. These values provide neither
entropy nor identity credentials; there is no real OS user/privilege boundary.
This portability mapping does not emulate general POSIX security.
Bindgen uses SDK libclang/sysroot, wasm32-wasip1 and -fvisibility=default
so declarations remain available. Rust's bundled WASI libc precedes SDK
libraries to resolve __wasi_init_tp; SDK libraries supply emulated-getpid.
Generated cryptographic bindings are not edited. The linker caps WASM linear
memory at 256 MiB; browser/host copies add overhead.
BROWSER CAPABILITIES
crates/chat-crypto/browser/wasi.ts supplies clocks, browser CSPRNG, empty
arguments/environment, in-memory request stdin and captured stdout/stderr.
Empty stdin runs the compatibility probe; application commands use JSON.
Requests exceeding 8388608 JavaScript string units are rejected; combined
stdout/stderr exceeding 1048576 string units abort execution.
No real files, preopened directories, sockets or process launch are supplied.
Filesystem/network access is refused; unknown imports fail before
instantiation. The application runs crypto in one-shot
workers with a timeout; CHAT-APPLICATION.txt documents memory/state limits.
Capability denials prevent accidental host storage/network access, not
malicious JavaScript from the same server. Memory, clocks, randomness and
bridge imports remain trusted. Browsers/OSes can retain memory, caches,
crash dumps, swap and restored state; no complete erasure is guaranteed.
DEPENDENCY EXCEPTIONS
deny.toml allows only exact older duplicate versions; advisory/license
checks still apply. No RustSec ignore. Wildcards, unknown Git/registry sources
and unreviewed duplicates remain rejected. Cargo.lock pins both API lines:
block-buffer 0.10.4 vs 0.12.1
crypto-common 0.1.7 vs 0.2.2
digest 0.10.7 vs 0.11.3
Sequoia's Argon2 0.5.3 -> BLAKE2 0.10 needs the older digest API;
root SHA-256 and parser-generator SHA3 use the newer API.
cpufeatures 0.2.17 vs 0.3.1
Argon2 uses 0.2; root SHA-256/parser-generator SHA3 use 0.3.
generic-array 0.14.7 vs 1.4.5
Argon2/BLAKE2 digest uses 0.14; SHA1 collision detection uses 1.x.
getrandom 0.2.17 vs 0.4.3
Sequoia's unknown-unknown WASM dependencies declare 0.2; root
tempfile uses 0.4. Browser WASI uses OpenSSL/bridge entropy.
Audit the all-target graph rather than excluding this edge.
hashbrown 0.15.5 vs 0.17.1
Parser-generator petgraph uses 0.15; its indexmap 2.14 uses 0.17.
itertools 0.13.0 vs 0.15.0
shlex 1.3.0 vs 2.0.1
Bindgen uses older APIs; lalrpop and cc require newer ones.
syn 2.0.119 vs 3.0.9
Bindgen/prettyplease and Windows support use syn 2; root derives
and other dependencies use syn 3. Unification needs upstream API
migration or unrelated downgrades, not a lockfile update.
Build dependencies remain audited. Clippy's name-only exceptions for
generic-array/getrandom/syn do not replace exact cargo-deny checks.
LINTING.txt documents the lint policy.
EXTERNAL LIBRARIES AND LICENSES
cargo-deny does not audit external OpenSSL C or the SDK. Review separately:
https://openssl-library.org/news/timeline/
https://openssl-library.org/news/vulnerabilities-3.6/
A Rust audit does not guarantee the pinned C version's future security.
Updates require upstream advisory review, every affected URL/hash,
native/WASI rebuilds, both browsers, cargo-deny, regenerated notices/sources
and release recovery. Never waive advisories to pass.
libloading used by bindgen/clang has a package-scoped ISC allowance.
cargo-about covers workspace Rust licenses, not external C/SDK obligations.
Distributed OpenSSL/SDK artifacts retain their required licenses/sources;
OpenSSL LICENSE.txt is Apache-2.0. Rust notices alone are insufficient.
Corresponding sources include the unmodified OpenSSL archive; toolchain
declarations/download locations remain public.
BUILD AND CHECK FROM THE STACK ROOT
Native development: OpenSSL >=3.5 headers/library, libclang, pkg-config,
C compiler and pinned Rust. WASI cross-build: x86_64 GNU/Linux, Perl, make,
curl, tar, sha256sum. Browser tooling/install instructions: TYPESCRIPT.txt.
cargo test --locked -p stack-chat-crypto
cargo run --locked -p stack-chat-crypto
sh infra/chat/build-openssl-wasi.sh
npm run build
PLAYWRIGHT_BROWSERS_PATH="$PWD/.tools/browsers" npm run test:crypto
cargo stack check
The WASI script builds verified OpenSSL into .tools/openssl-wasi, links the
Rust WASI command and prints its SHA-256. Rust-only edits may reuse inputs
with sh infra/chat/build-browser.sh; source/version/configuration/flag changes
require an OpenSSL rebuild. Extracted sources can be reused; independent
verification needs a fresh ignored tools/build tree. Native and browser
probe results must explicitly identify the OpenSSL backend.
|
