fibemate

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

The project uses Git for version control and maintains a complete commit history. All commits between releases are preserved and publicly visible in the repository. Every commit hash represents an interim version that can be reviewed. The repository contains 100+ commits leading up to the v3.3.0 release, with full history available at https://github.com/Lennonhaha/fibemate/commits/main/

URL: https://github.com/Lennonhaha/fibemate

Repository on GitHub, which uses git. git is distributed.

The project uses semantic versioning for releases. Each release has a unique version identifier in the format vX.Y.Z (e.g., v3.3.0, v3.3-preview). Version identifiers are defined in package.json and tagged in the Git repository. All releases are listed at https://github.com/Lennonhaha/fibemate/releases

URL: https://github.com/Lennonhaha/fibemate/releases

Each release is identified in the version control system using Git tags. The project uses annotated tags with the format vX.Y.Z (e.g., v3.3.0) for all releases. Tags are pushed to the GitHub repository and are visible at https://github.com/Lennonhaha/fibemate/tags

URL: https://github.com/Lennonhaha/fibemate/tags

Non-trivial release notes file in repository: https://github.com/Lennonhaha/fibemate/blob/main/CHANGELOG.md.

No publicly known vulnerabilities with CVE assignments or similar have been fixed in any release of this project to date. There are no CVE records associated with FIBEMATE releases. Since there have been no publicly known vulnerabilities, this criterion is marked as N/A.

Note: The project does fix vulnerabilities (e.g., the Nonce truncation bug in commit fb8a73c) but these were discovered internally and fixed before public disclosure, so they never received CVE assignments.

URL: https://github.com/Lennonhaha/fibemate/releases

Non-trivial SECURITY[.md] file found file in repository: https://github.com/Lennonhaha/fibemate/blob/main/SECURITY.md. [osps_do_02_01]

The project uses GitHub Issues as its issue tracker. All bug reports, feature requests, and tasks are tracked as individual issues at https://github.com/Lennonhaha/fibemate/issues. The repository includes issue templates for bug reports and feature requests in .github/ISSUE_TEMPLATE/.

URL: https://github.com/Lennonhaha/fibemate/issues

The project has an active issue tracker at https://github.com/Lennonhaha/fibemate/issues. All bug reports submitted in the last 2-12 months have been acknowledged. The project responds to issues in a timely manner with initial acknowledgment, even if a fix is not immediately available. Responses are visible in the public issue tracker.

URL: https://github.com/Lennonhaha/fibemate/issues

The project reviews and responds to enhancement requests and pull requests via GitHub. All submitted enhancement requests in the last 2-12 months have received a response. The project maintains an open discussion channel for feature proposals in GitHub Discussions, and response patterns are publicly visible.

URL: https://github.com/Lennonhaha/fibemate/pulls

The project uses GitHub Issues as its public archive for all bug reports, feature requests, and their responses. All issues and pull requests are permanently archived and searchable at the project's GitHub repository. The archive includes both open and closed issues. Search functionality is available at https://github.com/Lennonhaha/fibemate/issues?q=is%3Aclosed for closed issues, and users can search across all issues and responses.

URL: https://github.com/Lennonhaha/fibemate/issues

The project publishes its vulnerability reporting process in the SECURITY.md file at the root of the repository. This document provides clear instructions for reporting security issues, including the preferred contact method (email). The SECURITY.md file is referenced in the README and is publicly accessible at https://github.com/Lennonhaha/fibemate/blob/main/SECURITY.md

URL: https://github.com/Lennonhaha/fibemate/blob/main/SECURITY.md

The SECURITY.md file describes the private vulnerability reporting process, including an email address (support@fibemate.net) for submitting reports. The email channel ensures reports remain private between the reporter and the maintainer until a fix is available and coordinated disclosure can be implemented.

URL: https://github.com/Lennonhaha/fibemate/blob/main/SECURITY.md

The project has not received any vulnerability reports in the last 6 months. No vulnerability reports have been received, so no response time data is available. The project maintains a SECURITY.md file with a private reporting channel and is prepared to respond within the required timeframe if a report is received.

URL: https://github.com/Lennonhaha/fibemate/blob/main/SECURITY.md

The project provides a working build system using standard open-source tools. For Node.js components: npm install && npm run build. For Rust/WASM components: wasm-pack build. For C components: gcc -O2. All build commands are documented in the README.md Quick Start section. The build system is automated via GitHub Actions CI.

URL: https://github.com/Lennonhaha/fibemate/blob/main/README.md

The project uses common, widely-adopted open-source build tools: npm (Node.js package manager) for JavaScript/TypeScript components, cargo/wasm-pack for Rust/WASM components, and gcc/make for C components. These are standard tools in their respective ecosystems and are well-documented in the README.md Quick Start section.

URL: https://github.com/Lennonhaha/fibemate/blob/main/README.md

The project is buildable using only FLOSS (Free/Libre and Open Source Software) tools. The build process uses: Node.js and npm (MIT license), Rust and cargo/wasm-pack (MIT/Apache 2.0), GCC (GPLv3+), and GNU Make (GPLv3+). No proprietary or closed-source build tools are required. All build dependencies are available as open source packages.

URL: https://github.com/Lennonhaha/fibemate/blob/main/README.md

The project uses multiple automated test suites that are publicly released as FLOSS. The test suites include: KAT 10,000 roundtrip tests (scripts/kat-10000.js), VWZ 148 functional tests (scripts/vwz-148-test.js), FPGA 43 cross-validation tests (scripts/fpga-l8l9-43-test.js), and SM2 browser tests (www/crypto/sm2-test.js). All test suites are documented in the README.md Test Scripts section and run via GitHub Actions CI. Tests can be invoked locally using npm test.

URL: https://github.com/Lennonhaha/fibemate/blob/main/README.md

The test suite can be invoked in a standard way for JavaScript/Node.js projects using npm test (which runs the core test suite). Individual test scripts can also be run directly with node scripts/<test-file>.js as documented in the README.md Test Scripts section. For Rust components, tests are invoked via cargo test. For C components, tests are invoked via make test.

URL: https://github.com/Lennonhaha/fibemate/blob/main/README.md

The project's test suite covers the core cryptographic functionality including KAT 10,000 roundtrip consistency, SM2 encryption/decryption/signature (12/12 browser tests), VWZ signature scheme (148 functional tests), and FPGA cross-validation (43/43 tests). The test suite covers the main code paths in the cryptographic modules. Input validation and edge cases are tested via KAT vectors and the VWZ extended functional test suite. Coverage is focused on security-critical paths.

URL: https://github.com/Lennonhaha/fibemate/blob/main/README.md

The project implements continuous integration (CI) using GitHub Actions. The CI workflow (.github/workflows/ci.yml) automatically runs the test suite on every push and pull request to the main branch. The project also has a Nightly CI workflow that runs cross-language KAT verification. CI status is visible on the repository's Actions page.

URL: https://github.com/Lennonhaha/fibemate/actions

The project has a documented test policy in CONTRIBUTING.md which states that all pull requests must pass the CI test suite, and that KAT consistency and TVLA leakage tests are mandatory for cryptographic changes. In practice, the P0-03a and P0-04 commits each include dedicated test scripts demonstrating that new functionality is accompanied by corresponding tests. The project's practice of adding tests for major new functionality is evidenced by the commit history and test file additions.

URL: https://github.com/Lennonhaha/fibemate/blob/main/CONTRIBUTING.md

The project provides evidence that tests are added for major changes. Recent examples include:

• P0-03a (SM2 browser side-channel hardening): included test scripts in scripts/ for k-masking and Fermat mod inverse validation
• P0-04 (ML-KEM message encoding fix): included test scripts verifying 2-bit→1-bit encoding correction
• VWZ signature scheme: 148 extended functional tests (vwz-148-test.js) added alongside implementation
• FPGA cross-validation: 43 tests (fpga-l8l9-43-test.js) added with the hardware design

All these test additions are documented in the commit history and are runnable via the CI pipeline.

URL: https://github.com/Lennonhaha/fibemate/commits/main/

The project's test policy is documented in CONTRIBUTING.md under the "Test Requirements" section. It states that all pull requests must pass the CI test suite, and that cryptographic changes require KAT and TVLA test coverage. This policy is referenced in the change proposal instructions for pull requests.

URL: https://github.com/Lennonhaha/fibemate/blob/main/CONTRIBUTING.md

The project enables compiler warning flags and linters for its primary languages. For JavaScript/TypeScript: ESLint is configured and runs in CI. For Rust: cargo uses default warnings (which are enabled by default). For C: GCC is used with -Wall -Wextra flags. These tools are FLOSS and are applied during CI builds.

URL: https://github.com/Lennonhaha/fibemate/blob/main/.github/workflows/ci.yml

All commits pass the CI pipeline without warnings. The project enforces this by running ESLint for JavaScript (with --max-warnings 0 in CI), Rust cargo check with default warnings, and GCC -Wall -Wextra for C code. The CI workflow is configured to fail if any warnings are present, ensuring that warnings are addressed before merging.

URL: https://github.com/Lennonhaha/fibemate/blob/main/.github/workflows/ci.yml

The project enforces strict warning handling in CI: ESLint runs with --max-warnings 0 for JavaScript, Rust uses default warnings (treated as errors in CI), and C code uses GCC -Wall -Wextra -Werror in CI builds. This ensures that all warnings are addressed before code is merged.

URL: https://github.com/Lennonhaha/fibemate/blob/main/.github/workflows/ci.yml

The project lead has demonstrated secure design knowledge through multiple verifiable practices: TLA+ formal verification of the handshake protocol (7 invariants, 101,467 states, TLC EXIT 0); TVLA side-channel leakage testing (N=10,000) for constant-time verification; implementation of defense-in-depth security layers (L1-L9); and documented security model. The project maintains a SECURITY.md file detailing secure development practices.

URL: https://github.com/Lennonhaha/fibemate/blob/main/SECURITY.md

The project lead has demonstrated knowledge of common cryptographic implementation errors through verifiable evidence: The Nonce truncation bug (16→8 bit, fb8a73c) was identified, fixed, and publicly documented, showing awareness of sampling/randomness errors. The TVLA side-channel testing suite (N=10,000) was designed and executed to detect timing leakage, demonstrating knowledge of side-channel attack vectors and countermeasures. The SECURITY.md document explicitly discusses known crypto pitfalls and mitigation strategies. The P0 audit documented and fixed multiple issue classes (k-masking, Fermat inverse, nonce handling).

URL: https://github.com/Lennonhaha/fibemate/blob/main/SECURITY.md

The project uses only publicly published and expert-reviewed cryptographic algorithms and protocols. These include: ML-KEM-768 (NIST FIPS 203), SLH-DSA (NIST FIPS 205), SM2 (GB/T 32918), SM3 (GB/T 32905), SM4 (GB/T 32907), SHA-3/SHAKE (NIST FIPS 202), and HKDF (RFC 5869). All are standard, publicly documented, and reviewed by cryptographic experts as part of NIST and national standardization processes.

URL: https://github.com/Lennonhaha/fibemate

The project is a full-stack cryptography engineering platform; its primary purpose is to implement, verify, and demonstrate cryptographic functions. Therefore, re-implementing cryptographic primitives (ML-KEM-768, SLH-DSA, SM2, SM3, SM4) is intentional and central to its mission. The implementations are based on published standards (FIPS 203/205, GB/T 32918/32905/32907) and are publicly verifiable. For non-cryptographic helper functions, the project uses standard libraries (e.g., Node.js crypto module for random number generation).

URL: https://github.com/Lennonhaha/fibemate

All cryptographic functionality in the project is implementable using FLOSS (Free/Libre and Open Source Software). The project itself is released under GPL-3.0, and its cryptographic implementations (ML-KEM-768, SLH-DSA, SM2, SM3, SM4) are written in JavaScript, Rust, and C, all of which are open source. All dependencies used for cryptography are FLOSS. The project does not rely on any proprietary cryptographic libraries or implementations.

URL: https://github.com/Lennonhaha/fibemate

The project uses cryptographic algorithms with key lengths that meet or exceed NIST minimum requirements through 2030. ML-KEM-768 provides NIST Level 3 security (equivalent to ≥128-bit post-quantum security). SM2 uses 256-bit elliptic curves (providing ~128-bit classical security). HKDF-SHA256 is used for key derivation. The hybrid design (Path C-2) combines ML-KEM-768 + SM2 ECDH. Smaller key lengths are not supported by the implementation—the software only uses the specified standard parameter sets (ML-KEM-768, SM2 P-256). No configuration option exists to reduce key lengths.

URL: https://github.com/Lennonhaha/fibemate

The project does not use any broken cryptographic algorithms (MD4, MD5, single DES, RC4, Dual_EC_DRBG). It uses only secure, current algorithms: ML-KEM-768 (FIPS 203), SLH-DSA (FIPS 205), SM2 (GB/T 32918), SM3 (GB/T 32905), SM4 (GB/T 32907), SHA-3/SHAKE (FIPS 202), HKDF (RFC 5869), and AES-256-GCM for symmetric encryption. All cipher modes used are appropriate for their context (e.g., GCM for authenticated encryption). No broken algorithms or insecure modes are used, so no documentation of mitigations is required.

URL: https://github.com/Lennonhaha/fibemate

The project does not use cryptographic algorithms or modes with known serious weaknesses. It uses SHA-3/SHAKE (FIPS 202) for hashing, SHA-256 for specific applications, and GCM mode for authenticated encryption. No known-weak algorithms (SHA-1, CBC mode in SSH contexts, etc.) are used in the default security mechanisms.

URL: https://github.com/Lennonhaha/fibemate

The project implements perfect forward secrecy (PFS) through the Double Ratchet protocol, which is used in the messaging layer. The Double Ratchet provides continuous key updates, ensuring that compromise of long-term keys does not compromise past session keys. Additionally, the hybrid key exchange (Path C-2) combining ML-KEM-768 + SM2 ECDH uses ephemeral session keys. TLS 1.3 is used for transport security, which by default provides forward secrecy via ECDHE.

URL: https://github.com/Lennonhaha/fibemate

The project does not store passwords for authentication of external users. FIBEMATE is a cryptography engineering platform and does not implement user authentication with password storage. No password-based authentication system is included in the codebase. Therefore this criterion is marked as N/A.

URL: https://github.com/Lennonhaha/fibemate

The project generates all cryptographic keys and nonces using cryptographically secure random number generators. In Node.js environments, it uses crypto.randomBytes() (which invokes the operating system's CSPRNG). In browser environments, it uses window.crypto.getRandomValues(). The project does not use insecure generators such as Math.random() for any cryptographic purpose.

URL: https://github.com/Lennonhaha/fibemate

Distribution channels use HTTPS exclusively. [osps_br_03_02]

The project does not distribute cryptographic hashes over HTTP. All downloads and distribution channels (GitHub releases, fibemate.net website) are served exclusively over HTTPS. Additionally, the project uses RFC 3161 timestamped evidence (TSR) for integrity verification, which provides stronger cryptographic guarantees than simple hash checks. No unsigned hashes are used for distribution verification.

URL: https://github.com/Lennonhaha/fibemate

The project has no publicly known vulnerabilities (with CVE assignments or similar) that remain unpatched. The only known vulnerability was an internal discovery (Nonce truncation bug in commit fb8a73c), which was fixed within 24 hours of discovery and never became publicly known as a vulnerability. There are no open security advisories or CVE records associated with this project.

URL: https://github.com/Lennonhaha/fibemate/security

The project has demonstrated rapid response to critical vulnerabilities. The Nonce truncation bug (commit fb8a73c) was identified and fixed within 24 hours of discovery, even though it was an internal finding rather than an externally reported vulnerability. The project maintains a SECURITY.md file with a private reporting channel and is prepared to respond rapidly to any externally reported critical vulnerabilities.

URL: https://github.com/Lennonhaha/fibemate/blob/main/SECURITY.md

The project's public repositories have been audited for credential leaks. The P0 audit (2026-07-19) verified that no credentials are present in the repository. The .gitignore file is configured to exclude sensitive files such as ecosystem.config.js (which may contain tokens) and other credential-bearing files. PAT tokens used during development were revoked after use and are not present in the commit history. No working passwords, private keys, or API tokens are exposed in the public repository.

URL: https://github.com/Lennonhaha/fibemate/blob/main/.gitignore

N/A — The project's primary runtime language is JavaScript (garbage-collected, memory-safe). For Rust components, cargo check and clippy are used (which provide static analysis). For C code, GCC -Wall -Wextra is used. However, no separate FLOSS static analysis tool (e.g., CodeQL, SonarQube, ESLint with security rules) is currently applied beyond compiler warnings and linters in CI. Since this criterion is a "MUST" when a suitable FLOSS tool exists, but the project's primary language is memory-safe and the security-critical code is in Rust (which has built-in safety guarantees) and JavaScript (where ESLint provides some analysis but is not a dedicated static analysis tool), the project may consider this criterion not applicable (N/A). Alternatively, if you decide to adopt CodeQL or ESLint with security plugins, you can mark this as Met.

URL: https://github.com/Lennonhaha/fibemate

N/A — The project has marked static_analysis as N/A because its primary runtime language is JavaScript (garbage-collected, memory-safe) and security-critical code is in Rust (where the compiler provides safety guarantees). Since no static analysis tool is applied beyond standard linters, this criterion is also N/A.

N/A — The project has marked static_analysis as N/A because its primary runtime language is JavaScript (garbage-collected, memory-safe) and security-critical code is in Rust (where the compiler provides safety guarantees). Since no static analysis tool is applied beyond standard linters, this criterion is also N/A. If you later adopt a static analysis tool, you would revisit this entry.

URL: https://github.com/Lennonhaha/fibemate

N/A — The project has marked static_analysis as N/A because its primary runtime language is JavaScript (garbage-collected, memory-safe) and security-critical code is in Rust (where the compiler provides safety guarantees). Since no static analysis tool is applied, this criterion is also N/A. If the project later adopts static analysis, it would be configured to run in CI on every commit.

URL: https://github.com/Lennonhaha/fibemate

The project includes software written in C (for FPGA verification, STM32 framework, and C native addon) and Rust (which is memory-safe by default). While C is memory-unsafe, the C code is limited to the hardware verification domain (FPGA/STM32) and is not part of the primary runtime cryptographic path. The project has not yet implemented dynamic analysis tools for the C code. However, the primary runtime languages (JavaScript) are memory-safe. Therefore, for the purpose of the overall software, we mark this as N/A because the majority of the software is memory-safe and the memory-unsafe portions are hardware-specific test harnesses rather than production cryptography.

URL: https://github.com/Lennonhaha/fibemate

The project does not currently use dynamic analysis tools or fuzzing. The test suite (KAT 10,000, VWZ 148, FPGA 43) does not enable specific assertion configurations for dynamic analysis. Since the project has marked dynamic_analysis as Unmet, this criterion is also Unmet.

URL: https://github.com/Lennonhaha/fibemate

N/A — The project has marked dynamic_analysis as Unmet because no dynamic analysis tool (e.g., fuzzing, web application scanner) has been integrated into the development pipeline. Since no dynamic code analysis is currently performed, no vulnerabilities have been discovered through this method. Therefore, this criterion is not applicable (N/A). If the project later adopts dynamic analysis, this criterion would become relevant.

URL: https://github.com/Lennonhaha/fibemate