Version: Plexius TSIG v0.6.0
License: See LICENSE for copyright and license information.

This document outlines security best practices, considerations, and recommendations for using the Plexius TSIG library in production environments.

• Algorithm Support

  • ✅ HMAC-SHA256 (Recommended)
  • ✅ HMAC-SHA384
  • ✅ HMAC-SHA512

• Message Security

  • ✅ Message integrity verification
  • ✅ Timestamp validation
  • ✅ Replay attack prevention
  • ✅ Signature verification

• Memory Protection

  • ✅ Secure memory handling (zeroize)
  • ✅ Zero-copy message operations
  • ✅ Thread-safe memory access
  • ✅ Protected memory regions
  • ✅ Memory leak prevention
  • ✅ Automatic key zeroization

use plexius_tsig::key::TsigKey;

// Generate a secure key
let mut key = TsigKey::new(
    "secure-key-name",
    "HMAC-SHA256",
    &base64_encoded_secret
)?;

// Enable test mode for testing
key.enable_test_mode();

• Rotate keys every 90 days.
• Use basic key rotation support.
• Monitor key usage.
• ⚠️ Test mode must be enabled for key rotation testing.

let mut key = TsigKey::new("key", "HMAC-SHA256", "secret")?;
key.enable_test_mode(); // Required for testing key rotation

• Use a secure key management system (KMS).
• Avoid hardcoded keys — prefer environment variables or configuration tools.
• Restrict access to key storage locations.

let message = TsigMessage::new()
    .with_fudge(300); // 5 minutes

let mut key = TsigKey::new("key", "HMAC-SHA256", "secret")?;
key.enable_test_mode(); // Required for testing

if !message.verify(&key)? {
    return Err(TsigError::InvalidSignature);
}

let mut key = TsigKey::new("key-name", "HMAC-SHA256", "secret")?;
// Automatically zeroized on drop

let message = TsigMessage::new();
// Message content handled without unnecessary copies

let manager = TsigManager::new();
// Keys protected during concurrent access

• Use built-in memory protections.
• Avoid manual memory management.
• Rely on library for sensitive data cleanup.
• Monitor for memory leaks in production.

• Cryptographic keys
• Message signatures
• Configuration data
• Audit logs
• Security tokens

• Use HMAC-SHA256 for general use.
• Use HMAC-SHA384/512 for higher-security applications.
• Tradeoff: SHA384/512 is more secure but may reduce performance.

• Always validate timestamps.
• Use proper fudge factor (e.g., 300s).
• Enable replay detection in production.
• ⚠️ Test mode disables replay protection.

• Monitor key usage and logs.
• Rotate keys periodically.
• Use secure, isolated storage.

• Verify message integrity.
• Check digital signatures.
• Validate message structure and source.

use plexius_tsig::config::SecurityConfig;

let config = SecurityConfig::new()
    .with_key_size_limits(32, 64)
    .with_timestamp_fudge(300)
    .with_algorithm("HMAC-SHA256")
    .with_key_rotation_days(90)
    .with_test_mode(true); // Enable test mode globally

let config = SecurityConfig::new()
    .with_security_logging(true)
    .with_log_level("info")
    .with_test_mode(true);

• Rotate the key immediately.
• Audit affected logs and systems.
• Update system configurations and policies.

• Investigate message origin and network path.
• Validate logging and alerting configurations.
• Apply configuration changes if needed.

Plexius TSIG supports:

• FIPS 140-2

  • HMAC-SHA256 implementation
  • Secure key generation

• NIST Guidelines

  • SP 800-107 (HMAC)
  • SP 800-131A (Transitions)
  • SP 800-57 (Key Management)

If you discover a vulnerability, please report it responsibly:

• 📧 Email: security@fastcomcorp.com
• 🔐 GitHub: Report via Security Advisories

Include:

• Clear vulnerability description
• Steps to reproduce
• Potential impact and mitigation (if any)

We will:

• Acknowledge within 2 business days
• Respond with mitigation plan within 7 business days

For confirmed and patched vulnerabilities, CVE IDs will be requested through GitHub's CNA process.

We welcome third-party audits. If interested, email us at security@fastcomcorp.com.

We follow a coordinated disclosure policy. Security issues will be disclosed publicly after a patch has been made available and users have been notified.

• Subscribe to release announcements
• Review release notes for patches
• Test updates in staging environments
• Apply patches as soon as possible

• RFC 2845 – TSIG Protocol
• RFC 8945 – TSIG Algorithm Requirements
• NIST Publications – Cryptographic Standards