version bumps, MAX_RECV_SEEN patch, FIPS interop, doc updates

soliton/src/primitives/hkdf.rs

@@ -16,10 +16,19 @@ use sha3::Sha3_256;
 /// # Security
 ///
 /// The caller is responsible for zeroizing the `out` buffer when the derived
-/// key material is no longer needed. The `hkdf` crate's internal PRK is
-/// **not** zeroized on drop (`hkdf 0.13.0-rc.5` has no `zeroize` feature).
-/// Mitigation: `Hkdf` is a short-lived local — PRK lifetime is bounded to
-/// this function scope, and `panic = "abort"` prevents unwinding.
+/// key material is no longer needed.
+///
+/// What the dependencies zeroize, verified against the pinned sources
+/// (`hkdf 0.13.0-rc.5`, `hmac 0.13.0-rc.5`, `sha3 0.11.0-rc.7`,
+/// `digest 0.11.0-rc.11`, `block-buffer 0.11.0`, all with their `zeroize`
+/// features resolved on): dropping the `Hkdf` zeroizes the PRK-keyed HMAC
+/// state — both SHA3 cores through `sha3`'s `Drop` and the wrapper's block
+/// buffer through `block-buffer`'s. `hkdf` itself has no `zeroize` feature
+/// and leaves three plain stack copies behind: the raw 32-byte PRK that
+/// `Hkdf::new` extracts and discards, the `key ^ OPAD` block that
+/// `HmacCore::new_from_slice` builds in a local, and the last output block
+/// that `expand` keeps in a local. All three are bounded to this function's
+/// frame, and `panic = "abort"` prevents unwinding past it.
 pub fn hkdf_sha3_256(salt: &[u8], ikm: &[u8], info: &[u8], out: &mut [u8]) -> Result<()> {
     if out.is_empty() {
         return Err(Error::InvalidLength {