0.1.10 - upgrade deps()

[0.1.10] - 2026-04-18

Changed

Dependency Upgrades (All Client Implementations)

• Upgraded Go, Rust, Python 3, and Java client dependencies to their latest compatible versions
• All four test suites continue to pass after the upgrade (Go, Rust 16/16, Java 4/4, Python 3 4/4)

Rust Manifest Correction

• Fixed invalid edition = "2025" in clients/rust/Cargo.toml (not a released Rust edition) to edition = "2024"; Cargo rejected the previous manifest outright
• Refreshed Cargo.lock to the latest semver-compatible patch versions for all crates

Dependencies

Go (clients/golang/)

Dependency	From	To
go toolchain	1.25.5	1.25.8
github.com/cloudflare/circl	1.6.1	1.6.3
golang.org/x/crypto	0.46.0	0.50.0
golang.org/x/sys	0.39.0	0.43.0

Python 3 (clients/python3/)

Dependency	From	To
kyber-py	>=0.2.0	>=1.2.0
dilithium-py	>=0.1.0	>=1.4.0
cryptography	>=41.0.0	>=46.0.0
pycryptodome	>=3.20.0	>=3.23.0
typing-extensions	>=4.0.0	>=4.15.0
pytest (dev)	>=7.0.0	>=9.0.0

• Added the missing cryptography dependency to pyproject.toml (previously only declared in requirements.txt)

Java (clients/java/)

Dependency	From	To
com.google.code.gson:gson	2.10.1	2.13.2
maven-compiler-plugin	3.11.0	3.14.0
maven-jar-plugin	3.3.0	3.4.2
maven-surefire-plugin	3.2.2	3.5.2
exec-maven-plugin	3.1.0	3.5.0
org.junit.jupiter:junit-jupiter	5.10.1	6.0.3
org.bouncycastle:bcprov-jdk18on / bcpkix-jdk18on	1.78	1.78.1 (pinned)

Security

Bouncy Castle Pinned to 1.78.1 (Java Client)

• Last release containing org.bouncycastle.pqc.crypto.crystals.kyber: BC 1.79+ replaced Crystals-Kyber with ML-KEM (FIPS 203), which is wire-incompatible with the draft Kyber still used by the Go, Rust, and Python client implementations
• Upgrade path: Moving the Java client beyond BC 1.78.x requires a coordinated protocol migration (Kyber → ML-KEM) across all four client implementations; tracked as a future breaking change
• Inline rationale: pom.xml carries an explanatory comment next to the <bouncycastle.version> property so future maintainers don't re-attempt a silent upgrade

Miscellaneous

• Added CLAUDE.md and .claude/ to .gitignore

0.1.9 - hybridKEM(kyber + X25519)

[0.1.9] - 2025-12-27

Added

Hybrid KEM (Kyber + X25519)

• Defense-in-depth cryptography: Shared secret remains secure if at least one of Kyber or X25519 remains secure
• Robust combiner: SS_hybrid = HKDF(SS_pq || SS_ecdh, "Dice52-Hybrid-SS")
• Updated RFC specification: Section 3.1 now specifies hybrid KEM construction

New X25519 Functions (All Languages)

Language	Key Generation	Shared Secret
Go	GenerateX25519Keypair()	X25519SharedSecret()
Rust	generate_x25519_keypair()	x25519_shared_secret()
Python	generate_x25519_keypair()	x25519_shared_secret()
Java	Handshake.generateX25519Keypair()	Handshake.x25519SharedSecret()

Hybrid Encapsulation API (All Languages)

Language	Initiator	Responder
Go	InitiatorHybridEncapsulate()	ResponderHybridDecapsulate()
Rust	initiator_hybrid_encapsulate()	responder_hybrid_decapsulate()
Python	initiator_hybrid_encapsulate()	responder_hybrid_decapsulate()
Java	Handshake.initiatorHybridEncapsulate()	Handshake.responderHybridDecapsulate()

Session X25519 Fields

• Go: ECDHPub, ECDHPriv, PeerECDHPub fields in Session struct
• Rust: new_with_ecdh() constructor for explicit X25519 keys
• Python: ecdh_pub, ecdh_priv, peer_ecdh_pub optional constructor parameters
• Java: New constructor overload accepting X25519PublicKeyParameters and X25519PrivateKeyParameters

Changed

Hybrid Handshake (Section 6)

• Initiator now generates ephemeral X25519 key pair alongside Kyber encapsulation
• Signature covers both Kyber ciphertext and X25519 public key: Sign(SigContext || KyberCT || ECDHPub)
• HandshakeMessage includes ECDHPub field

Hybrid Ratchet (Section 12)

• Ratchet initiator generates both Kyber and X25519 key pairs
• RatchetMessage includes ECDHPub field for X25519 public key
• Signature covers both Kyber public key and X25519 public key
• Chain key assignment now correctly swaps for initiator vs responder

Documentation

• Updated README with hybrid KEM examples for Go and Rust
• Updated all demo files to demonstrate hybrid encapsulation flow
• RFC Section 3.1 updated to specify hybrid KEM algorithm
• RFC Section 15 updated with hybrid KEM security properties

Dependencies

Language	New Dependency	Purpose
Go	github.com/cloudflare/circl/dh/x25519	X25519 ECDH
Rust	x25519-dalek = "2.0"	X25519 ECDH
Python	cryptography	X25519 via pyca/cryptography
Java	(Bouncy Castle already includes)	X25519 via BC

0.1.8 - moreClients() - java & python3

[0.1.8] - 2025-12-26

Added

Python 3 Implementation (clients/python3/)

• Full protocol implementation: Complete Dice52-PQ protocol in Python 3
• Post-quantum cryptography: Uses kyber-py and dilithium-py (pure Python implementations)
• Symmetric cryptography: Uses pycryptodome for ChaCha20-Poly1305 and HKDF-SHA-256
• Package structure: Proper Python package with pyproject.toml for pip installation
• Module files:
  • dice52/__init__.py - Package exports
  • dice52/types.py - Protocol constants and data types
  • dice52/error.py - Exception classes
  • dice52/crypto.py - ChaCha20-Poly1305 encryption/decryption
  • dice52/kdf.py - HKDF-SHA256 key derivation functions
  • dice52/handshake.py - Kyber768/Dilithium3 handshake
  • dice52/session.py - Session management with ratcheting and Ko enhancement
  • dice52/demo.py - Demo application
• Testing: Unit tests in tests/test_session.py
• Build targets: Local Makefile with install, test, demo, clean targets

Java Implementation (clients/java/)

• Full protocol implementation: Complete Dice52-PQ protocol in Java 17
• Post-quantum cryptography: Uses Bouncy Castle 1.78 for ML-KEM-768 (Kyber) and ML-DSA-65 (Dilithium)
• Symmetric cryptography: Bouncy Castle for ChaCha20-Poly1305 and HKDF-SHA-256
• Maven project: Standard Maven structure with pom.xml
• Source files:
  • io.dice52.Constants - Protocol constants
  • io.dice52.Types - Data types and message structures
  • io.dice52.Dice52Exception - Exception hierarchy
  • io.dice52.Crypto - ChaCha20-Poly1305 encryption/decryption
  • io.dice52.Kdf - HKDF-SHA256 key derivation functions
  • io.dice52.Handshake - Kyber768/Dilithium3 handshake
  • io.dice52.Session - Session management with ratcheting and Ko enhancement
  • io.dice52.Demo - Demo application
• Testing: JUnit 5 tests in SessionTest.java
• Build targets: Local Makefile with build, test, demo, clean targets

Features (Both Implementations)

• Authenticated handshake with ML-KEM-768 and ML-DSA-65 signatures
• Ko enhancement protocol (commit-reveal) for defense-in-depth
• PQ ratcheting with signature verification
• Paranoid mode support with configurable parameters
• Message encryption/decryption with ChaCha20-Poly1305
• HKDF key derivation per RFC specification
• Thread-safe session management

0.1.7 - clients()

[0.1.7] - 2025-12-26

Changed

Repository Restructuring

• New clients/ directory: Moved language implementations into dedicated subfolders
• Go implementation: Now located at clients/golang/ (includes cmd/, pkg/, go.mod, go.sum)
• Rust implementation: Now located at clients/rust/ (includes src/, benches/, Cargo.toml, Cargo.lock)
• Updated Makefile: All build targets now use cd clients/<lang> to execute in correct directories
• Updated README.md: Import paths, build commands, and project structure documentation reflect new layout

Documentation

• Updated Go import path to github.com/dryoc/dice52/clients/golang/pkg/dice52
• Updated Rust git dependency to include subdirectory = "clients/rust"
• Revised project structure section in README to show new folder hierarchy

0.1.6 - Zeroize()

[0.1.6] - 2025-12-21

Security

Memory Zeroing

• Go: Added ZeroBytes() and ZeroKey32() utility functions for secure memory erasure
• Go: Added KoEnhancementState.Zero() method to securely clear sensitive enhancement state
• Go: Message keys are now zeroed immediately after encryption/decryption
• Go: Nonces are zeroed after use in encryption/decryption
• Go: Ko enhancement state (TK, entropy, commits) is zeroed when cleared
• Go: lastSharedSecret is zeroed when paranoid mode re-enhancement completes
• Rust: Added zeroize crate dependency with derive support
• Rust: KoEnhancementState now derives Zeroize and ZeroizeOnDrop for automatic cleanup
• Rust: Added KoEnhancementState.zeroize_all() method for explicit zeroing including Option fields
• Rust: Added zero_bytes() utility function exported from crypto module
• Rust: Message keys are now zeroed immediately after encryption/decryption
• Rust: Nonces are zeroed after use in encryption/decryption
• Rust: Ko enhancement state is explicitly zeroed in ko_finalize() and ko_finalize_reenhancement()
• Rust: last_shared_secret is zeroed when paranoid mode re-enhancement completes

Changed

• Sensitive cryptographic material (message keys, nonces, entropy, commits) is now actively zeroed after use to prevent data remanence attacks

0.1.5 - paranoid()

[0.1.5] - 2024-12-21

Added

Paranoid Mode (Section 7.2)

• Configurable Security Levels: New ParanoidConfig type for fine-tuning security parameters
• Periodic Ko Re-enhancement: Commit-reveal protocol can now run every N epochs for additional entropy injection
• Configurable Epoch Limits: MaxMessagesPerEpoch can be reduced from 33 to increase ratchet frequency
• Defense Against Weak RNG: Independent entropy from both parties protects against compromised random number generators

New Configuration Options

Parameter	Description	Default
Enabled	Activate paranoid mode	true
KoReenhanceInterval	Epochs between Ko re-enhancement (0 = never)	10
MaxMessagesPerEpoch	Messages before mandatory ratchet (1-33)	16

Go API Additions

• ParanoidConfig struct with Validate() and DefaultParanoidConfig()
• Session.SetParanoidMode(config) - Enable paranoid mode
• Session.GetParanoidConfig() - Get current configuration
• Session.IsParanoidMode() - Check if paranoid mode is active
• Session.NeedsKoReenhancement() - Check if Ko re-enhancement is pending
• Session.KoStartReenhancement() - Start Ko re-enhancement after ratchet
• Session.KoProcessReenhanceCommit() - Process peer's re-enhancement commit
• Session.KoFinalizeReenhancement() - Finalize Ko re-enhancement

Rust API Additions

• ParanoidConfig struct with new(), default(), and validate()
• Session::set_paranoid_mode(config) - Enable paranoid mode
• Session::get_paranoid_config() - Get current configuration
• Session::is_paranoid_mode() - Check if paranoid mode is active
• Session::needs_ko_reenhancement() - Check if Ko re-enhancement is pending
• Session::ko_start_reenhancement() - Start Ko re-enhancement
• Session::ko_process_reenhance_commit() - Process peer's commit
• Session::ko_finalize_reenhancement() - Finalize re-enhancement
• Dice52Error::ConfigError - New error variant for configuration errors

Changed

• MaxMessagesPerEpoch constant renamed to DefaultMaxMessagesPerEpoch (old name kept for compatibility)
• Session now tracks lastKoEnhancedEpoch for paranoid mode timing
• Ratchet function now checks for pending Ko re-enhancement

Documentation

• RFC updated with Section 7.2 covering paranoid mode specification
• README updated with paranoid mode examples for both Go and Rust
• New configuration tables in documentation

Security

• Ko re-enhancement uses separate AAD strings (ko-reenhance-commit, ko-reenhance-reveal) to distinguish from initial enhancement
• Shared secret from ratchet is stored only when paranoid mode requires it
• State is properly cleared after re-enhancement completes

0.1.0 - init rand()

[0.1.0] - 2024-12-21

Added

Core Protocol

• Dice52-PQ Protocol: Post-quantum authenticated ratcheting secure messaging protocol
• RFC Specification: Complete protocol specification in RFC-style document (rfc-dice52-pq-protocol.md)

Cryptographic Primitives

• ML-KEM-768 (Kyber): Post-quantum key encapsulation mechanism
• ML-DSA-65 (Dilithium mode3): Post-quantum digital signatures for authentication
• HKDF-SHA-256: Key derivation function for all key material
• ChaCha20-Poly1305: Authenticated encryption for message confidentiality

Key Features

• Forward Secrecy: Via KEM-based ratcheting mechanism
• Post-Compromise Security: Session recovery through ratchet updates
• Quantum Resistance: Protection against "harvest now, decrypt later" attacks
• Per-Message Fresh Keys: Unique encryption key for every message
• Deterministic Key Ordering (Ko): Hidden ordering key influencing all derivations

Ko Enhancement Protocol

• Commit-Reveal Phase: Two-phase protocol for Ko enhancement
• Independent Entropy: Both parties contribute randomness to final Ko
• Defense-in-Depth: Protection against single-point-of-failure KEM compromise
• Contribution Fairness: Neither party can unilaterally bias the ordering key

Session Management

• Authenticated Handshake: Signed KEM encapsulation for session establishment
• Chain Key Management: Separate sending (CKs) and receiving (CKr) chains
• Epoch-Based Rekeying: 33-message limit per epoch with mandatory ratchet
• Replay Protection: Monotonic message counters and epoch verification

Go Implementation (pkg/dice52/)

• types.go: Constants and type definitions
• kdf.go: Key derivation functions (HKDF-based)
• handshake.go: Authenticated handshake protocol
• crypto.go: ChaCha20-Poly1305 encryption/decryption
• session.go: Session state management and Ko enhancement
• ko_enhancement_test.go: Test suite for Ko enhancement

Rust Implementation (src/)

• lib.rs: Library entry point and public API
• types.rs: Constants, types, and message structures
• kdf.rs: Key derivation functions
• handshake.rs: Handshake protocol implementation
• crypto.rs: AEAD encryption utilities
• session.rs: Session management with Ko enhancement
• error.rs: Error types and handling

Developer Tools

• Go Demo: cmd/dice52/main.go - Example usage
• Rust Demo: src/bin/dice52.rs - Example usage
• Makefile: Build targets for both Go and Rust
• Benchmarks: Rust benchmarks in benches/benchmarks.rs

Dependencies

Go:

• github.com/cloudflare/circl - Post-quantum cryptography (Kyber, Dilithium)
• golang.org/x/crypto - Cryptographic utilities

Rust:

• pqcrypto-kyber - ML-KEM implementation
• pqcrypto-dilithium - ML-DSA implementation
• chacha20poly1305 - AEAD encryption
• hkdf / sha2 - Key derivation
• rand - Secure random number generation

Security

• All cryptographic operations use constant-time implementations where available
• Secret key material is designed for prompt erasure after use
• Commit verification uses constant-time comparison
• Sessions abort on any verification failure