File size: 1,911 Bytes
0081600 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 | # Expert Review Checklist
Use this checklist to attack HVCE v4 as a hostile reviewer.
## Compression claims
- Verify that all ratio claims are corpus-specific.
- Confirm that random/encrypted/already-compressed data claims are not entropy-violating.
- Compare against 7-Zip, WinRAR, WinZip, zstd, brotli, xz, lzip, lrzip, paq/zpaq, cmix, and domain-specific codecs where appropriate.
- Measure both compressed size and total cost: compression time, decompression time, RAM, external dictionaries, model files, side information, and metadata.
## Correctness
- Run `python hvce.py test`.
- Run `python -m pytest -q`.
- Fuzz random file trees.
- Fuzz archive corruption with and without recovery records.
- Verify safe path extraction against absolute paths and `..` attacks.
- Verify encrypted archives reject wrong passwords before attempting extraction.
## Security
- Audit ChaCha20 block function against known test vectors.
- Audit HMAC coverage.
- Audit KDF iteration handling and salt/nonce uniqueness.
- Confirm no unauthenticated metadata leaks in password mode except public encryption parameters.
- Consider replacing the Python crypto path with a bindings-backed audited library in production.
## Metadata
- Test Linux permissions/timestamps.
- Test Windows file attributes.
- Test symlink policy.
- Test Unicode paths.
- Test very long paths.
## Performance
- Benchmark on SSD/NVMe.
- Benchmark many tiny files.
- Benchmark large single files.
- Benchmark already-compressed media.
- Benchmark versioned backups/checkpoints.
- Benchmark synthetic and real office folders.
- Benchmark source trees and scientific arrays.
## Production blockers
- Native Rust/C core.
- Streaming archive writer/reader for huge files without full memory buffering.
- Signed Windows installer.
- Long-term fuzz corpus.
- Independent crypto review.
- More metadata coverage: ACLs, ADS, xattrs, resource forks.
|