kaidokert / krabitls-rs / 33087254063

80%

main: 80%

Build Type

Pull #156

github

Committed by kaidokert

Commit Message

Review fixes: DTLS honors C::Kx, zeroize-bound KxGroup::Secret, drop redundant mlkem_ct

Address the PR #156 review round. Thread the config's `C::Kx::X25519` through
`DtlsClient::connect` so a hardware KX backend protects the DTLS private scalar
too, not just TLS (Codex P1). Bound `KxGroup::Secret: ZeroizeOnDrop` with honest
marker impls on the bundled ephemerals, so a custom backend can't park the raw
scalar in a buffer that leaks on a drop-on-error (CodeRabbit). Drop the redundant
`ServerHelloView::mlkem_ct` — the hybrid derive consumes `hybrid_share`, which
subsumes it. Version stays 0.6.0 (unreleased; ships all the API refactoring at once).

Pull Request Pull Request #156: Pluggable key exchange: ClientConfig::Kx + KxBackend (X25519 / P-256 / X25519MLKEM768)

Coverage Stats

63 of 68 new or added lines in 4 files covered. (92.65%)

82 existing lines in 4 files now uncovered.

5219 of 6487 relevant lines covered (80.45%)

146.33 hits per line