deardaniel/secdata-raw huggingface dataset:
Elastic SIEM Detection Rules: defense evasion multiple application sso authentication repeat source

# Multiple Application SSO Authentication from the Same Source

---

## Metadata

- **Author:** Elastic
- **Description:** This hunting query identifies when a user authenticates to multiple applications using Single Sign-On (SSO) from the same source. Adversaries may attempt to authenticate to multiple applications using SSO to gain unauthorised access to sensitive data or resources. Adversaries also rely on refresh tokens to maintain access to applications and services. This query identifies when a source IP authenticates to more than 15 applications using SSO within a 5-minute window.

- **UUID:** `03bce3b0-6ded-11ef-9282-f661ea17fbcc`
- **Integration:** [okta](https://docs.elastic.co/integrations/okta)
- **Language:** `[ES|QL]`
- **Source File:** [Multiple Application SSO Authentication from the Same Source](../queries/defense_evasion_multiple_application_sso_authentication_repeat_source.toml)

## Query

```sql
from logs-okta*
| eval target_time_window = DATE_TRUNC(5 minutes, @timestamp)

// truncate the timestamp to a 5-minute window
| where @timestamp > now() - 7 day

// filter for SSO authentication events where the authentication step is 0
// filter on request URI string '/app/' to identify applications for a user
| where
    event.action == "user.authentication.sso"
    and okta.authentication_context.authentication_step == 0
    and okta.debug_context.debug_data.request_uri RLIKE "(.*)/app/(.*)"

// dissect the request URI to extract the target application
| dissect okta.debug_context.debug_data.request_uri"%{?}/app/%{target_application}/"

// count the number of unique applications per source IP and user in a 5-minute window
| stats application_count = count_distinct(target_application), window_count = count(*) by target_time_window, source.ip, okta.actor.alternate_id

// filter for at least 15 distinct applications authenticated from a single source IP
| where application_count > 15
```

## Notes

- `okta.debug_context.debug_data.dt_hash` field can be used to identify the device token hash used for authentication. This can be used to pivot for additional activity from the same device.
- `okta.debug_context.debug_data.flattened` contains additional information such as request ID, trace ID, sign-on mode and more to review for anomalies in the authentication flow.
- `okta.request.ip_chain` can be used to understand more about the source address, which is potentially useful for profiling.
- If `okta.security_context.is_proxy` is `true`, then an adversary may be attempting to mask their true source behind a proxy or VPN.

## MITRE ATT&CK Techniques

- [T1550.001](https://attack.mitre.org/techniques/T1550/001)

## License

- `Elastic License v2`
Open Quantum Safe Library Documentation: SECURITY

# Security Policy

## Supported Versions

We only support the most recent release.

Using any code prior to 0.12.0 is strongly discouraged due to a [known security vulnerability in HQC](https://github.com/open-quantum-safe/liboqs/security/advisories/GHSA-gpf4-vrrw-r8v7).

| Version | Supported          |
| ------- | ------------------ |
| 0.15.0  | :white_check_mark: |
| < 0.15  | :x:                |

## Reporting a Vulnerability

Please follow [this information to report a vulnerability](https://openquantumsafe.org/liboqs/security.html#reporting-security-bugs).

## Threat Model

Some timing-based side-channel attacks are within the scope of our threat model. OQS tests for secret-dependent branches and memory accesses on Linux on x86\_64 for some algorithms. Where executed, all test failures are documented as either "passes," which we have assessed to be false positives, or "issues," which may constitute non–constant-time behaviour. The [algorithm datasheets](https://github.com/open-quantum-safe/liboqs/tree/main/docs/algorithms) indicate whether or not an implementation passes our constant-time tests, as well as whether or not it is expected to pass; a no-pass expectation also encompasses the case that no constant-time analysis has been done and not just the case that the algorithm is expected/has been ascertained to not pass. Details about passes and issues are available in the [tests/constant_time directory](https://github.com/open-quantum-safe/liboqs/tree/main/tests/constant_time). These tests do not encompass all classes of non–constant-time behaviour; for example, they do not detect possible variable-time instructions, such as `DIV`. Reports of non–constant-time behaviour that fall outside this scope will be considered on a case-by-case basis, with a priority on [Tier 1 platforms](https://github.com/open-quantum-safe/liboqs/blob/main/PLATFORMS.md#tier-1).


The following types of attacks are outside the scope of our threat model:

- same physical system side channel
- CPU / hardware flaws
- physical fault injection attacks (including Rowhammer-style attacks)
- physical observation side channels (such as power consumption, electromagnetic emissions)

Mitigations for security issues outside the stated threat model may still be applied depending on the nature of the issue and the mitigation.

(Based in part on https://openssl-library.org/policies/general/security-policy/index.html)

## Security Response Process

Security reports for liboqs will be handled in accordance with the [OQS security response process](https://github.com/open-quantum-safe/tsc/blob/main/security/response-process.md). Please also see the general [support disclaimer](README.md#support-limitations) for liboqs.
Open Quantum Safe Library Documentation: CMakeLists

# SPDX-License-Identifier: MIT

set(_XKCP_LOW_OBJS "")

# Determine which of the implementations we're building
if(OQS_DIST_X86_64_BUILD AND OQS_ENABLE_SHA3_xkcp_low_avx2)
  set(BUILD_PLAIN64 ON)
  set(BUILD_AVX2 ON)
elseif(OQS_ENABLE_SHA3_xkcp_low_avx2)
  set(BUILD_AVX2 ON)
else()
  set(BUILD_PLAIN64 ON)
endif()

if(BUILD_PLAIN64)
  add_library(xkcp_low_keccakp_1600_plain64 OBJECT KeccakP-1600/plain-64bits/KeccakP-1600-opt64.c)

  add_library(xkcp_low_keccakp_1600times4_serial OBJECT KeccakP-1600times4/serial/KeccakP-1600-times4-on1.c)
  target_include_directories(xkcp_low_keccakp_1600times4_serial PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/KeccakP-1600/plain-64bits)

  if(OQS_DIST_X86_64_BUILD)
    target_compile_definitions(xkcp_low_keccakp_1600_plain64 PRIVATE ADD_SYMBOL_SUFFIX)
    target_compile_definitions(xkcp_low_keccakp_1600times4_serial PRIVATE ADD_SYMBOL_SUFFIX)
  endif()

  set(_XKCP_LOW_OBJS ${_XKCP_LOW_OBJS} $<TARGET_OBJECTS:xkcp_low_keccakp_1600_plain64>
                                       $<TARGET_OBJECTS:xkcp_low_keccakp_1600times4_serial>)
endif()

# We currently do not have a SHA3 AVX2 implementation that works on Windows
if(BUILD_AVX2 AND CMAKE_SYSTEM_NAME MATCHES "Linux|Darwin")
  add_library(xkcp_low_keccakp_1600_avx2 OBJECT KeccakP-1600/avx2/KeccakP-1600-AVX2.S)

  add_library(xkcp_low_keccakp_1600times4_avx2 OBJECT KeccakP-1600times4/avx2/KeccakP-1600-times4-SIMD256.c)
  target_include_directories(xkcp_low_keccakp_1600times4_avx2 PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/KeccakP-1600/avx2)
  target_compile_options(xkcp_low_keccakp_1600times4_avx2 PRIVATE -mavx2)

  if(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
    target_compile_definitions(xkcp_low_keccakp_1600_avx2 PRIVATE old_gas_syntax no_plt)
  endif()

  if(OQS_DIST_X86_64_BUILD)
    target_compile_definitions(xkcp_low_keccakp_1600_avx2 PRIVATE ADD_SYMBOL_SUFFIX)
    target_compile_definitions(xkcp_low_keccakp_1600times4_avx2 PRIVATE ADD_SYMBOL_SUFFIX)
  endif()

  set(_XKCP_LOW_OBJS ${_XKCP_LOW_OBJS} $<TARGET_OBJECTS:xkcp_low_keccakp_1600_avx2>
                                       $<TARGET_OBJECTS:xkcp_low_keccakp_1600times4_avx2>)
endif()

set(XKCP_LOW_OBJS ${_XKCP_LOW_OBJS} PARENT_SCOPE)
Open Quantum Safe Library Documentation: CMakeLists

# SPDX-License-Identifier: MIT

set(_LMS_OBJS "")

set(SRCS
         external/endian.c
         external/hash.c
         external/hss.c
         external/hss_alloc.c
         external/hss_aux.c
         external/hss_common.c
         external/hss_compute.c
         external/hss_derive.c
         external/hss_generate.c
         external/hss_keygen.c
         external/hss_param.c
         external/hss_reserve.c
         external/hss_sign.c
         external/hss_sign_inc.c
         external/hss_thread_single.c
         external/hss_verify.c
         external/hss_verify_inc.c
         external/hss_zeroize.c
         external/lm_common.c
         external/lm_ots_common.c
         external/lm_ots_sign.c
         external/lm_ots_verify.c
         external/lm_verify.c
         sig_stfl_lms.c
         sig_stfl_lms_functions.c
   )
    
#if (OQS_ENABLE_SIG_STFL_lms)
#    add_compile_definitions(OQS_ENABLE_SIG_STFL_lms)
#    set (SRCS ${SRCS} sig_stfl_lms.c sig_stfl_lms_functions.c)
#endif()


add_library(lms OBJECT ${SRCS})
target_include_directories(lms PRIVATE ${LIBOQS_ROOT_DIR}/include)
set(_LMS_OBJS ${_LMS_OBJS} $<TARGET_OBJECTS:lms>)
set(LMS_OBJS ${_LMS_OBJS} PARENT_SCOPE)
Open Quantum Safe Library Documentation: license

******************************************************************************
Copyright (c) 2017 Cisco Systems, Inc.  All rights reserved.
 
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
Redistributions of source code must retain the above copyright
  notice, this list of conditions and the following disclaimer.
Redistributions in binary form must reproduce the above
  copyright notice, this list of conditions and the following
  disclaimer in the documentation and/or other materials provided
  with the distribution.
Neither the name of the Cisco Systems, Inc. nor the names of its
  contributors may be used to endorse or promote products derived
  from this software without specific prior written permission.
 
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
OF THE POSSIBILITY OF SUCH DAMAGE.
******************************************************************************
Open Quantum Safe Library Documentation: CMakeLists

# Copyright (c) 2025 Intel Corporation
#
# SPDX-License-Identifier: MIT

set(_SHA3_AVX512VL_LOW_OBJS "")

if(OQS_USE_SHA3_AVX512VL)
  add_library(sha3_avx512vl_low OBJECT
    KeccakP-1600-AVX512VL.S SHA3-AVX512VL.S KeccakP-1600-times4-AVX512VL.S SHA3-times4-AVX512VL.S)
  set(_SHA3_AVX512VL_LOW_OBJS ${_SHA3_AVX512VL_LOW_OBJS} $<TARGET_OBJECTS:sha3_avx512vl_low>)
endif()

set(SHA3_AVX512VL_LOW_OBJS ${_SHA3_AVX512VL_LOW_OBJS} PARENT_SCOPE)
Open Quantum Safe Library Documentation: README

[//]: # (SPDX-License-Identifier: CC-BY-4.0)

# AArch64 backend (little endian)

This directory contains a native backend for little endian AArch64 systems. It is derived from [^NeonNTT] [^SLOTHY_Paper].

The code in this directory is auto-generated from the 'clean' assembly in [dev/aarch64_clean](../../../../dev/aarch64_clean)
in a two-step fashion: First, it is superoptimized using the [SLOTHY](https://github.com/slothy-optimizer/slothy) superoptimizer,
giving the assembly in [dev/aarch64_opt](../../../../dev/aarch64_opt). Then, it is stripped of remaining register aliases, macros
and most preprocessor directives by [`scripts/simpasm`](../../../../scripts/simpasm).

If you want to understand how the assembly works, and/or make changes to it, consult [dev/](../../../../dev).

<!--- bibliography --->
[^NeonNTT]: Becker, Hwang, Kannwischer, Yang, Yang: Neon NTT: Faster Dilithium, Kyber, and Saber on Cortex-A72 and Apple M1, [https://eprint.iacr.org/2021/986](https://eprint.iacr.org/2021/986)
[^SLOTHY_Paper]: Abdulrahman, Becker, Kannwischer, Klein: Fast and Clean: Auditable high-performance assembly via constraint solving, [https://eprint.iacr.org/2022/1303](https://eprint.iacr.org/2022/1303)
Open Quantum Safe Library Documentation: README

[//]: # (SPDX-License-Identifier: CC-BY-4.0)

This directory contains the native x86_64 arithmetic backend for ML-KEM provided by the official [AVX2
implementation](https://github.com/pq-crystals/kyber/tree/main/avx2) of the Kyber team.
Open Quantum Safe Library Documentation: CMakeLists

# SPDX-License-Identifier: MIT

# This file was generated by
# scripts/copy_from_upstream/copy_from_upstream.py

set(_HQC_OBJS "")

if(OQS_ENABLE_KEM_hqc_128)
    add_library(hqc_128_clean OBJECT kem_hqc_128.c pqclean_hqc-128_clean/code.c pqclean_hqc-128_clean/fft.c pqclean_hqc-128_clean/gf.c pqclean_hqc-128_clean/gf2x.c pqclean_hqc-128_clean/hqc.c pqclean_hqc-128_clean/kem.c pqclean_hqc-128_clean/parsing.c pqclean_hqc-128_clean/reed_muller.c pqclean_hqc-128_clean/reed_solomon.c pqclean_hqc-128_clean/shake_ds.c pqclean_hqc-128_clean/shake_prng.c pqclean_hqc-128_clean/vector.c)
    target_include_directories(hqc_128_clean PRIVATE ${CMAKE_CURRENT_LIST_DIR}/pqclean_hqc-128_clean)
    target_include_directories(hqc_128_clean PRIVATE ${PROJECT_SOURCE_DIR}/src/common/pqclean_shims)
    target_compile_options(hqc_128_clean PRIVATE -O0)
    if (CMAKE_SYSTEM_NAME STREQUAL "Darwin")
        target_compile_definitions(hqc_128_clean PRIVATE old_gas_syntax)
    endif()
    set(_HQC_OBJS ${_HQC_OBJS} $<TARGET_OBJECTS:hqc_128_clean>)
endif()

if(OQS_ENABLE_KEM_hqc_192)
    add_library(hqc_192_clean OBJECT kem_hqc_192.c pqclean_hqc-192_clean/code.c pqclean_hqc-192_clean/fft.c pqclean_hqc-192_clean/gf.c pqclean_hqc-192_clean/gf2x.c pqclean_hqc-192_clean/hqc.c pqclean_hqc-192_clean/kem.c pqclean_hqc-192_clean/parsing.c pqclean_hqc-192_clean/reed_muller.c pqclean_hqc-192_clean/reed_solomon.c pqclean_hqc-192_clean/shake_ds.c pqclean_hqc-192_clean/shake_prng.c pqclean_hqc-192_clean/vector.c)
    target_include_directories(hqc_192_clean PRIVATE ${CMAKE_CURRENT_LIST_DIR}/pqclean_hqc-192_clean)
    target_include_directories(hqc_192_clean PRIVATE ${PROJECT_SOURCE_DIR}/src/common/pqclean_shims)
    target_compile_options(hqc_192_clean PRIVATE -O0)
    if (CMAKE_SYSTEM_NAME STREQUAL "Darwin")
        target_compile_definitions(hqc_192_clean PRIVATE old_gas_syntax)
    endif()
    set(_HQC_OBJS ${_HQC_OBJS} $<TARGET_OBJECTS:hqc_192_clean>)
endif()

if(OQS_ENABLE_KEM_hqc_256)
    add_library(hqc_256_clean OBJECT kem_hqc_256.c pqclean_hqc-256_clean/code.c pqclean_hqc-256_clean/fft.c pqclean_hqc-256_clean/gf.c pqclean_hqc-256_clean/gf2x.c pqclean_hqc-256_clean/hqc.c pqclean_hqc-256_clean/kem.c pqclean_hqc-256_clean/parsing.c pqclean_hqc-256_clean/reed_muller.c pqclean_hqc-256_clean/reed_solomon.c pqclean_hqc-256_clean/shake_ds.c pqclean_hqc-256_clean/shake_prng.c pqclean_hqc-256_clean/vector.c)
    target_include_directories(hqc_256_clean PRIVATE ${CMAKE_CURRENT_LIST_DIR}/pqclean_hqc-256_clean)
    target_include_directories(hqc_256_clean PRIVATE ${PROJECT_SOURCE_DIR}/src/common/pqclean_shims)
    target_compile_options(hqc_256_clean PRIVATE -O0)
    if (CMAKE_SYSTEM_NAME STREQUAL "Darwin")
        target_compile_definitions(hqc_256_clean PRIVATE old_gas_syntax)
    endif()
    set(_HQC_OBJS ${_HQC_OBJS} $<TARGET_OBJECTS:hqc_256_clean>)
endif()

set(HQC_OBJS ${_HQC_OBJS} PARENT_SCOPE)
Open Quantum Safe Library Documentation: CMakeLists

# SPDX-License-Identifier: MIT

# This file was generated by
# scripts/copy_from_upstream/copy_from_upstream.py

set(_NTRUPRIME_OBJS "")

if(OQS_ENABLE_KEM_ntruprime_sntrup761)
    add_library(ntruprime_sntrup761_openssh OBJECT kem_ntruprime_sntrup761.c sntrup761_openssh/sntrup761.c)
    target_include_directories(ntruprime_sntrup761_openssh PRIVATE ${CMAKE_CURRENT_LIST_DIR}/sntrup761_openssh)
    set(_NTRUPRIME_OBJS ${_NTRUPRIME_OBJS} $<TARGET_OBJECTS:ntruprime_sntrup761_openssh>)
endif()

set(NTRUPRIME_OBJS ${_NTRUPRIME_OBJS} PARENT_SCOPE)
Open Quantum Safe Library Documentation: FUZZING

# Fuzzing

Fuzz testing is an automated software testing method that injects invalid, 
malformed, or unexpected inputs to reveal defects and vulnerabilities. A fuzzing 
tool monitors the system for exceptions like crashes, information leakage, or 
errors, helping developers identify and fix bugs and security loopholes.

## Current state of fuzzing in liboqs
- [ ] kem 
  - [ ] bike
  - [ ] classic_mceliece
  - [ ] frodokem
  - [ ] hqc
  - [ ] kyber
  - [ ] ml_kem
  - [ ] ntruprime
- [ ] sig
  - [x] falcon
  - [x] mayo
  - [x] ml_dsa
- [ ] sig_stfl
  - [ ] lms
  - [ ] sig_stfl
  - [ ] xmss

## Building and running fuzz tests

Building fuzz tests is very similar to building normally with some optional
steps to target different types of bugs. The most basic ways to build the
fuzz tests is as follows;

```bash
mkdir build && cd build
cmake -GNinja -DOQS_BUILD_FUZZ_TESTS=ON ..
ninja
```

`OQS_BUILD_FUZZ_TESTS` will build two test binaries: `tests/fuzz_test_sig` and `tests/fuzz_test_kem`.

The fuzzer will run indefinitely or;
- until it finds a bug and crashes,
- you manually stop the fuzzer i.e. CTRL-C
- you set a timeout using the command line.

For more details on the available command line args please consult the [libfuzzer docs](https://llvm.org/docs/LibFuzzer.html).

## Sanitizers
It is a common pattern to combine fuzzing with various sanitizers to catch different bugs.
One of the simpler sanitizers is the fuzzing sanitizer, which will instrument the code
for coverage driven fuzzing. To enable this simply add this to your environment variables
before configuring cmake;

```
export CFLAGS=-fsanitize=fuzzer-no-link
```

It is common to combine the fuzzer sanitizer with either the [address](https://clang.llvm.org/docs/AddressSanitizer.html)
or the [undefined behaviour sanitizer](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html). To
add these simply add the relevant flags to BOTH the CFLAGS and LDFLAGS e.g.

```
export CFLAGS=-fsanitize=fuzzer-no-link,address
export LDFLAGS=-fsanitize=address
```

Then rerun cmake as normal i.e.
```bash
mkdir build && cd build
cmake -GNinja ..  -DOQS_BUILD_FUZZ_TESTS=ON
ninja -j$(nproc)
```
Open Quantum Safe Library Documentation: sig stfl


# **Stateful Hash Based Signatures**

The security of hash based signatures (HBS) is based on the underlying hash functions on which they are built.
NIST recommendation is that they are suitable for near term use to mitigate against attacks mounted by quantum computers.
While not a general purpose solution, they are useful means to authenticate boot or firmware images.

<ins>**General**</ins>

This package provides full support for a variety of variants for XMSS and LMS. 
Key generation, signature generation, and signature verification. 
Security of HBS also depends on the management of the state of the secret key. Secret keys can only used once to generate a signature.
Multiple signing with same key can reveal that key to an attacker.
Because of this, NIST recommends that key and signature generation be done in hardware security modules.
Having said that, this library is fully functional for research purposes. Secret keys are incremented after each sign operation.
However, secure storage and lifecycle management of the secret keys are left to applications using this feature.
Secret key storage is easily done by supplying a callback function to the library. This callback is invoked to store the secret key.


<ins>**Key State Management**</ins>

Application writers have to supply callback functions to store and update secret keys.
After a sign operation the secret key index is advanced and stored. This ensures one-time use of the key.
Signing operations will fail without this callback set because the private key cannot be advanced (to prevent reuse).

Stateful keys can generate a finite number of signatures. A counter tracks the limit when the key is created and is decremented after each signature is generated.
When the counter is down to 0, signature generation fails. Applications can query the remaining count via an API.
Open Quantum Safe Library Documentation: ntruprime

# NTRU-Prime

- **Algorithm type**: Key encapsulation mechanism.
- **Main cryptographic assumption**: NTRU.
- **Principal submitters**: Daniel J. Bernstein, Billy Bob Brumley, Ming-Shing Chen, Chitchanok Chuengsatiansup, Tanja Lange, Adrian Marotzke, Bo-Yuan Peng, Nicola Tuveri, Christine van Vredendaal, Bo-Yin Yang.
- **Authors' website**: https://ntruprime.cr.yp.to
- **Specification version**: supercop-20200826.
- **Primary Source**<a name="primary-source"></a>:
  - **Source**: https://github.com/openssh/openssh-portable/blob/1cc936b2fabffeac7fff14ca1070d7d7a317ab7b/sntrup761.c
  - **Implementation license (SPDX-Identifier)**: Public domain
- **Ancestors of primary source**:
  - https://github.com/jedisct1/supercop/releases/tag/20240808, which takes it from:
  - supercop-20240808

## Parameter set summary

|  Parameter set  | Parameter set alias   | Security model   |   Claimed NIST Level |   Public key size (bytes) |   Secret key size (bytes) |   Ciphertext size (bytes) |   Shared secret size (bytes) | Keypair seed size (bytes)   | Encapsulation seed size (bytes)   |
|:---------------:|:----------------------|:-----------------|---------------------:|--------------------------:|--------------------------:|--------------------------:|-----------------------------:|:----------------------------|:----------------------------------|
|    sntrup761    | NA                    | IND-CCA2         |                    2 |                      1158 |                      1763 |                      1039 |                           32 | NA                          | NA                                |

## sntrup761 implementation characteristics

|       Implementation source       | Identifier in upstream   | Supported architecture(s)   | Supported operating system(s)   | CPU extension(s) used   | No branching-on-secrets claimed?   | No branching-on-secrets checked by valgrind?   | Large stack usage?‡   |
|:---------------------------------:|:-------------------------|:----------------------------|:--------------------------------|:------------------------|:-----------------------------------|:-----------------------------------------------|:----------------------|
| [Primary Source](#primary-source) | master                   | All                         | All                             | None                    | True                               | True                                           | False                 |

Are implementations chosen based on runtime CPU feature detection? **No**.

 ‡For an explanation of what this denotes, consult the [Explanation of Terms](#explanation-of-terms) section at the end of this file.

## Explanation of Terms

- **Large Stack Usage**: Implementations identified as having such may cause failures when running in threads or in constrained environments.