fix: hardening

CHANGELOG.md

@@ -1,7 +1,16 @@
 # Changelog
 
 ## 0.0.3
+
+### Added 
+
 - Added test image generation to GH0STB1T imagestego
+- Added MCP Server integration, with 10 tools (audio_encode, audio_decode, audio_capacity, audio_analyze, generate_audio_carrier, image_encode, image_decode, image_capacity, image_analyze, generate_image_carrier)
+
+### Fixed 
+- Random seeding for LSBStego
+- Constant time for audio and image steganography
+
 
 ## 0.0.2 - 2026-02-05
 

pyproject.toml

@@ -54,7 +54,7 @@ license = "Apache-2.0"
 license-files = ["LICENSE"]
 
 dependencies = [
-    "pycryptodomex>=3.21.0",
+    "pycryptodome>=3.15.0",
     "pydub>=0.25.1",
     "audioop-lts>=0.2.2",
     "soundfile>=0.12.1",
@@ -106,7 +106,7 @@ mcp = [
 # ]
 
 all = [
-    "pycryptodomex>=3.21.0",
+    "pycryptodome>=3.15.0",
     "pydub>=0.25.1",
     "audioop-lts>=0.2.2",
     "soundfile>=0.12.1",

src/ghostbit/audiostego/core/audio_steganography.py

@@ -1,5 +1,6 @@
 #!/usr/bin/env python3
 import os
+import hmac
 import struct
 import hashlib
 import logging
@@ -655,7 +656,8 @@ def set_key_argon(self, password: str) -> None:
         verification_plaintext = b"STEGO_VERIFY_2025"
         nonce = os.urandom(12)
         aesgcm = AESGCM(bytes(self.aes_key))
-        verification_ciphertext = aesgcm.encrypt(nonce, verification_plaintext, None)
+        key_commitment = hashlib.sha256(bytes(self.aes_key)).digest()
+        verification_ciphertext = aesgcm.encrypt(nonce, verification_plaintext, key_commitment)
         self.key_verif_block = bytearray(nonce + verification_ciphertext)
 
         logger.debug(f"Secure Argon2id key set (kdf_version={self.kdf_version})")
@@ -1043,7 +1045,7 @@ def analyze_stream(self, stream: BinaryIO, dsc_head26_version: str) -> bool:
 
             if (
                 not self.key_verif_block
-                or bytes(self.key_verif_block) != stored_key_verif
+                or not hmac.compare_digest(bytes(self.key_verif_block), stored_key_verif)
             ):
                 logger.info(
                     f"Password required for encrypted content (KDF v{self.kdf_version})"
@@ -1079,10 +1081,11 @@ def analyze_stream(self, stream: BinaryIO, dsc_head26_version: str) -> bool:
                 nonce = raw[:12]
                 ciphertext = raw[12:]
                 aesgcm = AESGCM(bytes(self.aes_key))
+                key_commitment = hashlib.sha256(bytes(self.aes_key)).digest()
 
                 try:
-                    plaintext = aesgcm.decrypt(nonce, ciphertext, None)
-                    if plaintext != b"STEGO_VERIFY_2025":
+                    plaintext = aesgcm.decrypt(nonce, ciphertext, key_commitment)
+                    if not hmac.compare_digest(plaintext, b"STEGO_VERIFY_2025"):
                         raise AudioSteganographyException("Invalid password")
                 except Exception:
                     logger.error("Password verification failed")