Be "at least as secure" as Tor (as a client)
This is a fairly open-ended ticket; it is a requirement for %Arti 1.0.0: Ready for production use, but we need to decide what exactly it comprises.
Some likely candidates to include are:
- SafeLogging (#189 (closed))
- Zeroizing keys (#254)
- Circuit isolation code (#150 (closed))
- File permission checking (#315 (closed))
- Setting per-process flags and dropping permissions as in C tor's
winprocess_sys.c,restrict.c,setuid.h(#364) - Netflow padding (#62)
Some things not necessarily to include (now) are:
- seccomp2 sandboxing (huge kludge, less necessary in Rust)
- memory-DoS resistance (waits for %Arti 1.2.0: Onion service support )
- hardened PRNG (current prng is "good enough")