Redoubt 2.2.1

Redoubt 2.2.1

Security

• Hardened the update check request: update_check.py now validates the URL scheme before calling urllib.request.urlopen(), rejecting anything other than http/https (e.g. file: or custom schemes). This addresses Bandit B310 while preserving TLS certificate verification. The endpoint remains a hardcoded HTTPS GitHub URL.

Improvements

• Added CONTRIBUTING.md with development setup and contribution guidelines.
• Added RELEASE_WORKFLOW.md documenting versioning, the release procedure, artifact building (Linux AppImage / Windows ZIP), testing requirements, and release quality criteria.
• Documented the migration.py module in the README module overview.
• Updated the README roadmap: Tor/onion networking moved to v2.3.0; post-quantum cryptography remains a v3.0.0 goal.

Compatibility & migration

• Fully backward compatible with 2.X.X versions.
• No storage or migration format changes since 2.2.0; existing vaults continue to work without manual steps.

Release 2.2.0

Redoubt 2.2.0

Security

• Fixed critical key reuse vulnerability: The master vault key (derived from the passphrase via Argon2id) is no longer used directly for encryption. Instead, two independent subkeys are derived via HKDF-SHA256 with distinct info labels:
  • Identity subkey (VAULT_KEY_IDENTITY_LABEL) → encrypts identity.enc using AES-256-GCM
  • Database subkey (VAULT_KEY_DATABASE_LABEL) → passed to SQLCipher as PRAGMA key for redoubt.db
  • Previously, the same master key protected both files; a weakness in either encryption scheme exposed the other. Now the encryption keys are cryptographically separated.
• Strengthened Argon2id KDF: Increased time_cost from 3 to 4 iterations (memory cost remains 256 MiB, parallelism 4), further slowing brute-force attacks against the vault passphrase.
• Constant-time fingerprint comparison: Added hmac.compare_digest() for fingerprint verification during contact validation, eliminating timing side-channels.
• Automatic transparent migration with backups: On first unlock after upgrading, existing identity.enc and redoubt.db are automatically migrated to the new key-separated format. Before any modification, timestamped backups are created in ~/.redoubt/backups/ (including WAL/SHM files for the database). Migration requires user confirmation in interactive mode.

Updates

• Added dedicated migration.py module handling all legacy format detection and migration logic (pre-v2.1.1 single-key format, v2.1.1 legacy time_cost=3 format, and partial migrations).
• Migration is atomic: both identity.enc and redoubt.db are migrated together on first successful unlock with the correct passphrase.
• Updated ARCHITECTURE.md to document the new vault key separation architecture and added a "Post-Quantum Readiness (Store-Now-Decrypt-Later)" section acknowledging the current lack of PQC and planning migration for v3.0.0.
• Updated README.md roadmap to reflect post-quantum cryptography as a v3.0.0 goal.

Compatibility & migration

• Fully backward compatible: Existing installations migrate transparently on first run after upgrade (asks for y/N confirmation). No manual steps required.
• Migration handles all known legacy formats:
  1. Pre-v2.1.1 (single master key for both files, time_cost=3 or 4)
  2. v2.1.1 with legacy Argon2id time_cost=3 but already separated keys
  3. v2.1.1 with current time_cost=4 but single key (partial migration)
• Backups are created in ~/.redoubt/backups/ with timestamps (e.g., identity.enc.20261106_185731.bak, redoubt.db.20261106_185731.bak plus -wal/-shm).
• If migration is cancelled or fails, original files remain untouched and backups are available for manual recovery.
• Non-interactive environments (tests, CI, piped input) auto-confirm migration.
• After migration, subsequent launches use the fast path (no re-migration overhead).

v2.1.1

Redoubt 2.1.1

Improvements

• Renamed "☰ Settings" to "☰ Menu".
• Added a dedicated Settings submenu to accommodate future application settings.
• Added an opt-in update check at launch, which connects to the GitHub API (api.github.com) to check for new releases. This requires an internet connection and exposes the user's public IP address to GitHub.

Release 2.1.0

Redoubt 2.1.0

Improvements

• Settings menu: New top-left ☰ Settings menu (also F2) with About, Show card, Contact list and Add contact.
• Contact management in the UI: Add contacts through a validated form, browse saved contacts with name, IP, public key and fingerprint, and revoke them from the contact list.
• Revocation with confirmation: Revoking a contact deletes its messages and outbox, closes any live session, wipes the Double Ratchet state, drops pending ACKs/presence, and prevents in-flight handshakes from installing a new session.
• Shared contact validation: contact_validation.py centralizes name/IP/public-key/fingerprint checks for both the UI form and the CLI.
• Legacy CLI retained: --add-contact, --list-contacts and --remove-contact are still available and documented.
• About screen: Shows author, version and license.
• Test coverage: Added tests for the settings menu, theme cycling, settings persistence and revoked-contact session handling.

Security

• Revocation is enforced at runtime: _install_session refuses sessions for contacts no longer present in storage, and drop_contact() removes live session/ratchet state and pending retransmissions.
• Contact validation (fingerprint must match the public key, own identity rejected, duplicate contacts rejected) is now shared between CLI and UI, avoiding divergent checks.
• Wire protocol and message cryptography are unchanged.

Fixes

• Restored the missing packaging/redoubt.desktop, so AppImage builds ship a valid desktop entry again (v2.0.0 packaging regression).
• Corrected the desktop entry Version field (it is the Desktop Entry specification version 1.0, not the Redoubt version).
• Documentation updates: settings menu, legacy CLI contact commands, module table, revocation behavior and AppImage output path.

Compatibility

• Version 2.1.0 clients ARE compatible with version 2.0.0 clients (but not 1.x.x): the wire protocol and message cryptography are unchanged.
• Existing identity keys, contacts and locally stored history remain valid.
• The legacy CLI contact commands remain available.

Release 2.0.0

Redoubt 2.0.0

Improvements

• Double Ratchet Protocol: Implemented a Double Ratchet mechanism combining symmetric-key ratcheting and Diffie-Hellman key exchanges to provide Forward Secrecy and Post-Compromise Security within individual sessions (NOT X3DH as previously suggested by the README.md's roadmap, but still enough for the use case).
• Ephemeral Key Exchange: Session root keys are now derived from ephemeral Diffie-Hellman secrets rather than static identity keys, preventing identity key compromise from exposing previously established session traffic.
• Message Key Isolation: Each message uses an independently derived encryption key. Compromise of an individual message key does not expose previous or subsequent messages.
• Automatic Recovery: The ratchet periodically introduces fresh DH material, allowing sessions to recover confidentiality after a temporary state compromise.
• Protocol Authentication: New DH ratchet metadata is authenticated as part of the message's Additional Authenticated Data (AAD), protecting protocol state against tampering.
• Secure Message Processing: Introduced a two-phase message reception process (prepare_receive → commit) to prevent invalid or forged packets from advancing ratchet state.
• Session Synchronization: Improved handling of out-of-order messages through bounded skipped message keys.

Security

• Replaced the previous static-key-based session root derivation with an ephemeral key exchange combining DH-EE, DH-SE and DH-ES.
• Introduced bounded skipped-key storage to limit memory consumption and exposure.
• Improved ratchet state management, including one-time commits and protection against stale state transitions.
• Invalid ratchet operations and malformed key exchange metadata are rejected without advancing cryptographic state.

Compatibility

• Breaking protocol change: Message packet structure has changed to accommodate Double Ratchet metadata (dh, pn).
• Version 2.0.0 clients are not wire-compatible with version 1.0.1 clients.
• Existing identity keys and locally stored message history are not inherently invalidated by the protocol upgrade.

Redoubt 1.0.1

Redoubt 1.0.1

Improvements

• Added sha256sums of AppImages in appimages/
• Added --version argument to the executable

v1.0.0

Full Changelog: https://github.com/FreyFlyy/Redoubt/commits/v1.0.0