Harden key handling and crypto backend edge cases

[bifurcation]

Summary

• tighten key lifecycle and header parsing behavior, including epoch purging, counter exhaustion, key-direction checks, and clearer replay semantics
• harden crypto backend edge cases across OpenSSL and BoringSSL, including empty HKDF salt handling, checked size conversions, CTR input bounds, and cleaner error reporting
• clean up supporting infrastructure with safer wrapper types, fixed-capacity initialization, release hardening flags, and targeted API comments

Testing

• make test

[bifurcation]

This expression overflows on platforms where size_t is 32 bits. Since you're only checking for > (1 << 32), it would be simpler and safer to test size >> 32 == 0, right? Unless size >> 32 would be UB or something on 32-bit platforms.

[bifurcation]

This function should not be repeated across the various crypto implementation files. Likewise for any others that are repeated.

[bifurcation]

Suggested change

	if ((CMAKE_CXX_COMPILER_ID MATCHES "Clang" OR CMAKE_CXX_COMPILER_ID MATCHES "GNU") AND NOT WIN32)
	set(SFRAME_RELEASE_COMPILE_FLAGS "-fstack-protector-strong -D_FORTIFY_SOURCE=2")
	if (CMAKE_CXX_COMPILER_ID MATCHES "Clang")
	set(SFRAME_RELEASE_COMPILE_FLAGS
	"${SFRAME_RELEASE_COMPILE_FLAGS} -ftrivial-auto-var-init=zero")
	endif()
	foreach(config RELEASE RELWITHDEBINFO MINSIZEREL)
	set(CMAKE_C_FLAGS_${config} "${CMAKE_C_FLAGS_${config}} ${SFRAME_RELEASE_COMPILE_FLAGS}")
	set(CMAKE_CXX_FLAGS_${config} "${CMAKE_CXX_FLAGS_${config}} ${SFRAME_RELEASE_COMPILE_FLAGS}")
	endforeach()
	if(APPLE)
	foreach(config RELEASE RELWITHDEBINFO MINSIZEREL)
	set(CMAKE_EXE_LINKER_FLAGS_${config} "${CMAKE_EXE_LINKER_FLAGS_${config}} -pie")
	endforeach()
	elseif(UNIX)
	foreach(config RELEASE RELWITHDEBINFO MINSIZEREL)
	set(CMAKE_EXE_LINKER_FLAGS_${config}
	"${CMAKE_EXE_LINKER_FLAGS_${config}} -pie -Wl,-z,relro,-z,now")
	endforeach()
	endif()
	endif()

[k-wasniowski]

Is it used actually outside of crypto files ? If not, wouldnt it be sufficient to call it directly?

Also ive noticed its also called in boringssl, and there it gets less clear. If method is used outside, maybe we could change the name ?