This section has security-relevant information regarding Orion.

It is assumed that when using Orion, it is done so using release mode. debug mode is not supported, since it can impact things such as constant-time execution.

Orion must never be used with opt-level = 0, as this will, in most cases, result in variable time execution.

Orion has a best-effort approach to wiping sensitive memory. There are known obstacles for ensuring effective memory wiping using Rust (from zeroize):

However, be aware that Rust's current memory semantics (e.g. move) can leave copies of data in memory, and there isn't presently a good solution for ensuring all copies of data on the stack are properly cleared.

Furthermore, Orion partly uses destructors to wipe memory. According to the Rustonomicon, there are no guarantees that destructors are actually called, as safe Rust considers failing to call destructors safe, "However any program that actually manages to do such a thing is probably incorrect." (from Rustonomicon).

Due to such limitations, Orion offers no guarantees that all sensitive memory is wiped.

Orion also makes no attempts to avoid sensitive memory being written to the system swap space.

Orion only aims to protect against timing-based side-channel vulnerabilities.

Orion uses the formally-verified field arithmetic generated by fiat-crypto, for the underlying Curve25519 operations.

Orion itself forbids the use of so-called “unsafe” code, meaning that all memory-safety guarantees provided by Rust are enforced at compile-time. However, even though Orion itself does not allow unsafe code, it is used in some of its dependencies.

These are metrics that give an overview of which dependencies use unsafe code and how much:

Metric output format: x/y
    x = unsafe code used by the build
    y = total unsafe code found in the crate

Symbols: 
    :) = No `unsafe` usage found, declares #![forbid(unsafe_code)]
    ?  = No `unsafe` usage found, missing #![forbid(unsafe_code)]
    !  = `unsafe` usage found

Functions  Expressions  Impls  Traits  Methods  Dependency

0/0        0/0          0/0    0/0     0/0      :) orion 0.15.0
0/0        0/0          0/0    0/0     0/0      :) ├── base64 0.11.0
2/4        50/150       1/1    0/0     3/3      !  ├── getrandom 0.1.14
0/0        0/0          0/0    0/0     0/0      ?  │   ├── cfg-if 0.1.10
2/2        73/95        0/0    0/0     5/11     !  │   └── libc 0.2.67
0/0        4/4          0/0    0/0     0/0      !  ├── subtle 2.2.2
0/0        2/2          0/0    0/0     0/0      !  └── zeroize 1.1.0

4/6        129/251      1/1    0/0     8/14   

These metrics were made using cargo-geiger.

Orion has not yet received any formal security audit.