Copied the input validation caveat everywhere

diff --git a/doc/crypto_aead_lock.3monocypher b/doc/crypto_aead_lock.3monocypher
index cebeeb93459753047b71b7590bf4f1c461b47eac..5a6f38f4427660e4ecad3688eae524aaf92d4243 100644 (file)
--- a/doc/crypto_aead_lock.3monocypher
+++ b/doc/crypto_aead_lock.3monocypher
@@ -485,3 +485,9 @@ and
 were removed,
 Functions were renamed and arguments reordered for consistency,
 and the incremental interface was added.
+.Sh CAVEATS
+Monocypher does not perform any input validation.
+Any deviation from the specified input and output length ranges results
+in
+.Sy undefined behaviour .
+Make sure your inputs are correct.

diff --git a/doc/crypto_argon2.3monocypher b/doc/crypto_argon2.3monocypher
index 367876a74b7501b20f0458de34514cbb265bb288..8f0fb9d0f1ff4f2356d93122e7ed227531c045bb 100644 (file)
--- a/doc/crypto_argon2.3monocypher
+++ b/doc/crypto_argon2.3monocypher
@@ -384,6 +384,7 @@ Both were replaced by
 .Fn crypto_argon2
 in Monocypher 4.0.0.
 .Sh CAVEATS
+Monocypher does not perform any input validation.
 Any deviation from the algorithm constants,
 specified input and output length ranges results
 in

diff --git a/doc/crypto_chacha20_djb.3monocypher b/doc/crypto_chacha20_djb.3monocypher
index 6e22988fe45c391a7bc1daf73a4b68c8dc955464..17838e684a1c4340b299019660aeb2542168a969 100644 (file)
--- a/doc/crypto_chacha20_djb.3monocypher
+++ b/doc/crypto_chacha20_djb.3monocypher
@@ -403,6 +403,12 @@ It was renamed to
 in Monocypher 3.0.0, then
 .Fn crypto_chacha20_h
 in Monocypher 4.0.0.
+.Sh CAVEATS
+Monocypher does not perform any input validation.
+Any deviation from the specified input and output length ranges results
+in
+.Sy undefined behaviour .
+Make sure your inputs are correct.
 .Sh SECURITY CONSIDERATIONS
 .Ss Encrypted does not mean secure .
 ChaCha20 only protects against eavesdropping, not forgeries.

diff --git a/doc/crypto_ed25519_sign.3monocypher b/doc/crypto_ed25519_sign.3monocypher
index def8391e4e88fd178eea95cd13c0069ee07e9b86..b9c5ab3b5902c6cbab9717b20059a84b4f856d2c 100644 (file)
--- a/doc/crypto_ed25519_sign.3monocypher
+++ b/doc/crypto_ed25519_sign.3monocypher
@@ -153,3 +153,36 @@ and
 .Fn crypto_ed25519_key_pair
 replaced
 .Fn crypto_ed25519_public_key .
+.Sh CAVEATS
+Monocypher does not perform any input validation.
+Any deviation from the specified input and output length ranges results
+in
+.Sy undefined behaviour .
+Make sure your inputs are correct.
+.Sh SECURITY CONSIDERATIONS
+.Ss Signature malleability
+Signature malleability is the ability of an attacker to produce a valid
+signature with knowledge of only an existing signature and the public
+key.
+Monocypher prevents that by checking the encoding of the signature,
+and guarantees that generating new signatures requires the private key.
+.Pp
+On the other hand, EdDSA signatures are not unique like cryptographic
+hashes.
+The signing procedure is deterministic by specification and
+.Fn crypto_ed25519_sign
+follows this specification.
+However, someone with the private key can generate arbitrarily many
+valid, canonical, and different signatures of the same message.
+Because of this, never assume that signatures are unique.
+.Ss Fault injection and power analysis
+Fault injection (also known as glitching) and power analysis may be used
+to manipulate the resulting signature and recover the secret key in
+some cases.
+This requires hardware access.
+We can try to mitigate this attack by prefixing all hashes a random data
+block,
+in a construction similar to Ed25519ctx.
+Note that there may still be other power-related side channels (such as
+if the CPU leaks information when an operation overflows a register)
+that must be considered.

diff --git a/doc/crypto_eddsa_sign.3monocypher b/doc/crypto_eddsa_sign.3monocypher
index a1c0a3c9bec40ac743b90bb6bb33ca5fca1672de..d661547bd10b222481e7bf4234fb6359e506423a 100644 (file)
--- a/doc/crypto_eddsa_sign.3monocypher
+++ b/doc/crypto_eddsa_sign.3monocypher
@@ -488,6 +488,12 @@ and
 .Fn crypto_eddsa_key_pair
 replaced
 .Fn crypto_sign_public_key .
+.Sh CAVEATS
+Monocypher does not perform any input validation.
+Any deviation from the specified input and output length ranges results
+in
+.Sy undefined behaviour .
+Make sure your inputs are correct.
 .Sh SECURITY CONSIDERATIONS
 .Ss Signature malleability
 Signature malleability is the ability of an attacker to produce a valid

diff --git a/doc/crypto_elligator_map.3monocypher b/doc/crypto_elligator_map.3monocypher
index 5eaeef571e3d063312ea83c44fa6e596138d2551..9972ebac8f6f3994b6eb4d9c0cfa6a6218df7f54 100644 (file)
--- a/doc/crypto_elligator_map.3monocypher
+++ b/doc/crypto_elligator_map.3monocypher
@@ -275,6 +275,12 @@ they were renamed
 and
 .Fn crypto_elligator_key_pair
 respectively.
+.Sh CAVEATS
+Monocypher does not perform any input validation.
+Any deviation from the specified input and output length ranges results
+in
+.Sy undefined behaviour .
+Make sure your inputs are correct.
 .Sh SECURITY CONSIDERATIONS
 The secret keys for the public keys fed into
 .Fn crypto_elligator_rev

diff --git a/doc/crypto_poly1305.3monocypher b/doc/crypto_poly1305.3monocypher
index 039dbfa0becd0d166639c6dde8508f4ace0cf326..5fb3e259bc482476d52610c121801e080cfbe457 100644 (file)
--- a/doc/crypto_poly1305.3monocypher
+++ b/doc/crypto_poly1305.3monocypher
@@ -208,6 +208,12 @@ and
 functions first appeared in Monocypher 0.1.
 .Fn crypto_poly1305
 first appeared in Monocypher 1.1.0.
+.Sh CAVEATS
+Monocypher does not perform any input validation.
+Any deviation from the specified input and output length ranges results
+in
+.Sy undefined behaviour .
+Make sure your inputs are correct.
 .Sh SECURITY CONSIDERATIONS
 Poly1305 is difficult to use correctly.
 Do not use it unless you are absolutely sure what you are doing.

diff --git a/doc/crypto_sha512.3monocypher b/doc/crypto_sha512.3monocypher
index 4c86beaaf25a012238a13e9798709083fa8e0d7a..a1a163ce4b6c3481bc71dab064a01158f334c864 100644 (file)
--- a/doc/crypto_sha512.3monocypher
+++ b/doc/crypto_sha512.3monocypher
@@ -543,6 +543,12 @@ in Monocypher 4.0.0.
 and
 .Fn crypto_sha512_hkdf_expand
 were added in Monocypher 4.0.0.
+.Sh CAVEATS
+Monocypher does not perform any input validation.
+Any deviation from the specified input and output length ranges results
+in
+.Sy undefined behaviour .
+Make sure your inputs are correct.
 .Sh SECURITY CONSIDERATIONS
 SHA-512 is a general-purpose cryptographic hash function;
 this means that it is not suited for hashing passwords and deriving

diff --git a/doc/crypto_verify16.3monocypher b/doc/crypto_verify16.3monocypher
index a8ce0e4710fbf20e0db408c00d944e8ad4a3e647..09a7dcd50ac5f27a1e16d3aa0321fb18620b1ce0 100644 (file)
--- a/doc/crypto_verify16.3monocypher
+++ b/doc/crypto_verify16.3monocypher
@@ -124,3 +124,9 @@ They replaced the
 and
 .Fn crypto_zerocmp
 functions that were present until Monocypher 1.0.1.
+.Sh CAVEATS
+Monocypher does not perform any input validation.
+Any deviation from the specified input and output length ranges results
+in
+.Sy undefined behaviour .
+Make sure your inputs are correct.

diff --git a/doc/crypto_wipe.3monocypher b/doc/crypto_wipe.3monocypher
index 63b45ed2076b725c10eb21193c3bf56469cfd3ba..4f299fb94d39c132ff506f88afe94eae2f3b209c 100644 (file)
--- a/doc/crypto_wipe.3monocypher
+++ b/doc/crypto_wipe.3monocypher
@@ -108,3 +108,9 @@ This function returns nothing.
 The
 .Fn crypto_wipe
 function first appeared in Monocypher 1.1.0.
+.Sh CAVEATS
+Monocypher does not perform any input validation.
+Any deviation from the specified input and output length ranges results
+in
+.Sy undefined behaviour .
+Make sure your inputs are correct.

diff --git a/doc/crypto_x25519.3monocypher b/doc/crypto_x25519.3monocypher
index 607def9e967205106bab627a4503fc489f0af1b7..a4dedd7692a2065bc4e4f5ad56712ba0b1ec123e 100644 (file)
--- a/doc/crypto_x25519.3monocypher
+++ b/doc/crypto_x25519.3monocypher
@@ -298,6 +298,12 @@ The
 and
 .Fn crypto_x25519_to_eddsa
 functions first appeared in Monocypher 3.1.0.
+.Sh CAVEATS
+Monocypher does not perform any input validation.
+Any deviation from the specified input and output length ranges results
+in
+.Sy undefined behaviour .
+Make sure your inputs are correct.
 .Sh SECURITY CONSIDERATIONS
 If either of the long-term secret keys leaks, it may compromise
 .Em all past messages .

diff --git a/doc/intro.3monocypher b/doc/intro.3monocypher
index ff4a2f47b29359c2febfe0a7b12d5eadd16b8097..d93f0dd2db2bb3c9699c3cf97e3f1975cc889e9d 100644 (file)
--- a/doc/intro.3monocypher
+++ b/doc/intro.3monocypher
@@ -194,6 +194,12 @@ and
 .Xr crypto_sha512_hmac_update 3monocypher ,
 .Xr crypto_sha512_init 3monocypher ,
 .Xr crypto_sha512_update 3monocypher
+.Sh CAVEATS
+Monocypher does not perform any input validation.
+Any deviation from the specified input and output length ranges results
+in
+.Sy undefined behaviour .
+Make sure your inputs are correct.
 .Sh SECURITY CONSIDERATIONS
 Using cryptography securely is difficult.
 Flaws that never manifest under normal use might be exploited by a