Add Everest to threat model
Signed-off-by: Janos Follath <janos.follath@arm.com>
diff --git a/SECURITY.md b/SECURITY.md
index 61e3936..7ed72de 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -135,3 +135,12 @@
- Use cryptographic mechanisms that are not based on block ciphers. In
particular, for authenticated encryption, use ChaCha20/Poly1305 instead of
block cipher modes. For random generation, use HMAC\_DRBG instead of CTR\_DRBG.
+
+#### Everest
+
+The HACL* implementation of X25519 taken from the Everest project only protects
+against remote timing attacks. (See their [Security
+Policy](https://github.com/hacl-star/hacl-star/blob/main/SECURITY.md).)
+
+The Everest variant is only used when `MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED`
+configuration option is defined. This option is off by default.