[philipr-za]

An AI security review surfaced some potential footguns and vulnerabilities in the repo, mostly in the padding implementation.

This PR addresses those issues.

[apoelstra]

I don't like adding the subtle dependency. This adds supply chain risk for little value. (The constant-time functions are only used to protect the padding length, which is a pretty small privacy risk even if we took no protective measures at all.)

Just hand-roll constant time comparison ops like we do in rust-secp256k1.

[philipr-za]

I don't like adding the subtle dependency. This adds supply chain risk for little value. (The constant-time functions are only used to protect the padding length, which is a pretty small privacy risk even if we took no protective measures at all.)

Just hand-roll constant time comparison ops like we do in rust-secp256k1.

thanks for the review @apoelstra

Took a crack at that. Though the AI notes that the less-than comparitors are a bit trickier to do constant time than equals.

[apoelstra]

I'd just copy the algorithm from https://github.com/dalek-cryptography/subtle/blob/main/src/lib.rs#L879-L908 and it in its own file that's clearly labeled as being BSD-copyrighted to hdv and isis.

[philipr-za]

I'd just copy the algorithm from https://github.com/dalek-cryptography/subtle/blob/main/src/lib.rs#L879-L908 and it in its own file that's clearly labeled as being BSD-copyrighted to hdv and isis.

Alright, seeing as I was copying the GT/LT stuff I grabbed their equals impl too

[apoelstra]

Can you rebase/squash so that there is no commit adding the subtle dep?