mirror of
https://github.com/luxfi/lamport.git
synced 2026-10-30 16:21:45 +00:00
zeekay
d070cd618e
Security improvements from audit: 1. SignUnsafe → signUnsafe (unexported) - No longer accessible outside primitives package - Prevents accidental double-signing in external code - Tests within package can still use it 2. VerifyConstantTime added - No early return on mismatch - Accumulates XOR differences across all 256 hashes - Prevents timing side-channel attacks - Use when verification timing is observable Both Verify (fast) and VerifyConstantTime (secure) available.