security: deep security review — 5 vulnerability fixes + full report

[Copilot]

Summary

Deep security review of the kMOSAIC-Go post-quantum cryptography library. Five vulnerabilities were identified and fixed, and one design limitation is documented. All existing tests pass.

---

Vulnerabilities Fixed

V-01 — Dependency CVE: golang.org/x/crypto ≤ 0.34.0 (High)

Upgraded golang.org/x/crypto v0.31.0 → v0.35.0 to fix a DoS vulnerability (slow/incomplete SSH key exchange). Also upgraded golang.org/x/sys v0.28.0 → v0.30.0 as required.

V-02 — tdd.Decrypt panics on malformed ciphertext (High)

ct.Data[:len(ct.Data)-8] panicked when len(ct.Data) < 8. Since tdd.Decrypt runs inside a goroutine in kem.Decapsulate, a panic there terminates the entire host process — a trivial remote DoS. Fixed by adding a len(ct.Data) < encMsgLen guard that returns nil instead.

V-03 — slss.Decrypt panics on mismatched vector lengths (High)

innerProduct(ct.U, sk.S, q) iterates over ct.U and indexes into sk.S. If len(ct.U) > len(sk.S), Go panics with index-out-of-bounds — again inside a goroutine, causing a process crash. Fixed by adding a len(ct.U) != len(sk.S) guard at the top of slss.Decrypt.

V-04 — DebugEncrypt exposes sensitive LWE ephemeral error vectors (High)

The exported DebugEncrypt function returned e1/e2 error-vector heads and r support positions/values via SlssDebugInfo. In LWE, the error vector is the mathematical secret; exposing even partial values assists lattice reduction attacks and can allow plaintext recovery. The CLI kem slss-debug command serialised this to JSON. Fixed by redacting all sensitive fields from SlssDebugInfo (now contains only structural info: ULen, VLen, W, RNNz), adding security warning doc-comments, and adding missing zeroization calls.

V-05 — kem.DeserializePublicKey missing MaxComponentSize checks (Medium)

sign.DeserializePublicKey validates each length-prefixed component against MaxComponentSize (10 MB); the kem equivalent did not. A crafted input with component lengths near len(data) could cause large allocations (memory-exhaustion DoS). Added consistent > MaxComponentSize guards for all four components plus the missing offset+4 > len(data) pre-checks.

---

Design Limitation Documented

D-01 — EGRW Decrypt does not use the secret key (Medium, design)

egrw.Decrypt derives its keystream solely from public-key components and the ciphertext vertex — the secret walk sk.Walk is never used. Any public-key holder can recover the EGRW share, reducing the effective security barrier from three components to two (SLSS + TDD). This limitation stems from the non-commutativity of SL(2, Z_p) which prevents a DH-style exchange. A package-level SECURITY NOTE comment has been added to problems/egrw/egrw.go documenting the limitation and recommending future remediation.

---

Files Changed

File	Change
go.mod / go.sum	Dependency upgrade
problems/tdd/tdd.go	Panic guard in Decrypt
problems/slss/slss.go	Panic guard in Decrypt; redact SlssDebugInfo; add zeroization
kem/kem.go	MaxComponentSize constant + bounds checks in DeserializePublicKey
problems/egrw/egrw.go	Security note doc-comment
cmd/k-mosaic-cli/main.go	Update slss-debug output fields
cmd/k-mosaic-cli/main_test.go	Update test to check non-sensitive fields
SECURITY_REPORT.md	Full security report

All tests pass. CodeQL scan and code review show no alerts.