Address issues from AI security review

.github/workflows/rust.yml

@@ -42,24 +42,34 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
+
+      # cargo-valgrind's dependencies no longer build on the MSRV, so install
+      # the tool with stable and only use 1.63.0 for building/testing the crate.
+      - name: "Select stable toolchain for tooling"
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Setup
+        run: |
+          sudo apt-get update && sudo apt-get install -y valgrind
+          cargo install cargo-valgrind
+
+      # Use stable cargo's MSRV-aware resolver (driven by `rust-version` in
+      # Cargo.toml) to pick dependency versions that build on 1.63.0.
+      - name: "Generate MSRV-compatible lockfile"
+        run: cargo generate-lockfile
+        env:
+          CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS: fallback
+
       - name: "Select toolchain"
         uses: dtolnay/rust-toolchain@1.63.0
 
       - name: "Rust Version"
         run: rustc --version
 
-      - name: Setup
-        run: |
-          sudo apt-get update && sudo apt-get install -y valgrind
-          cargo install cargo-valgrind --version 2.0.0
-
       - name: Run tests
         run: |
-          rm Cargo.lock
-          cargo +1.63.0 generate-lockfile
-          cargo valgrind test
-          cargo test
+          cargo valgrind test --locked
+          cargo test --locked
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4

Cargo.toml

@@ -1,14 +1,15 @@
 [package]
 name = "ctaes-rs"
-version = "0.1.2"
+version = "0.2.0"
 authors = ["Philip Robinson <probinson@blockstream.com>"]
-license = "MIT"
+license = "MIT AND BSD-3-Clause"
 homepage = "https://github.com/ElementsProject/rust-ctaes/"
 repository = "https://github.com/ElementsProject/rust-ctaes/"
 description = "Rust bindings and API for CTAES a constant-time AES implementation from Bitcoin Core https://github.com/bitcoin-core/ctaes"
 keywords = [ "crypto", "bitcoin", "aes" ]
 readme = "README.md"
 edition = "2021"
+rust-version = "1.63"
 
 [dependencies]
 thiserror = "2"

README.md

@@ -13,8 +13,30 @@ buffers. Zero Padding and PKCS7 padding implementations are provided
 Run `cargo doc --nodeps` to generate the documentation of the library.
 
 # Note
-This is a low-level encryption library and should be employed in conjunction with a message 
-authentication scheme to avoid chosen-ciphertext and chosen-plaintext attacks.
+This is a low-level, unauthenticated encryption library. Callers MUST authenticate
+the IV, ciphertext, and relevant protocol metadata before decrypting or unpadding.
+Use encrypt-then-MAC with independent encryption and MAC keys, or use an
+authenticated-encryption library. Reject invalid tags before calling CBC decrypt;
+never expose padding results for unauthenticated ciphertext.
+
+Strict padding checks and constant-time byte comparisons do not eliminate a
+padding oracle: success versus failure still reveals padding validity.
+
+For AES padding `Padding::unpad` uses a block size of 16 by default. For any other block size
+use `Pkcs7::unpad_with_block_size(buffer, BLOCK_SIZE)`.
+
+CBC instances retain their chaining state across calls. CBC `encrypt` and
+`decrypt` require a mutable instance. Use separate instances with the same key
+and initial IV to encrypt and decrypt a message. Calls on one instance process
+successive block-aligned chunks of that message; they do not start new messages.
+For each independent message, construct a new instance with a fresh,
+unpredictable IV.
 
 # Compatibility
-This crate requires Rust 1.63.0 or later.
+This crate requires Rust 1.63.0 or later.
+
+# License
+This crate is licensed under the MIT license (see `COPYING`), except for
+`src/constant_time.rs`, which contains code derived from the
+[subtle](https://github.com/dalek-cryptography/subtle) crate and is licensed under
+the BSD-3-Clause license reproduced at the top of that file.