RustCrypto Library Security Report Overview

This technical report presents the findings from a security audit of the RustCrypto library conducted by Cure53 for Bitwarden, focusing on cryptographic operations within the Bitwarden SDK. The audit, performed in November 2025, utilized a white-box testing methodology over a seven-day period, aiming for comprehensive coverage of the system. The report details the minor issues identified, including non-compliance with FIPS 203 standards regarding input checks and memory zeroization for sensitive data. Specifically, two issues were noted: the DecapsulationKey property not being adequately wiped from memory and certain input checks being only partially implemented. Despite these findings, the overall quality of the RustCrypto SDK implementations was deemed high, with effective timing attack resistance and memory safety practices in place. The report concludes with a commitment to address the identified issues to ensure compliance and enhance security measures.