SECURITY RELEASE v0.2.4 - HMAC Implementation

[ProtocoloAEE]

🔐 CRITICAL SECURITY FIXES:

• ✅ HMAC-SHA256 implementation for secure watermarking
• ✅ Fixes vulnerability in v0.2.3 (user_id as only seed)
• ✅ Cryptographic key management (secret key separate from user_id)
• ✅ Secure engine (engine_secure.py) with proper key handling
• ✅ Secure client (client_secure.py) for production use
• ✅ Environment variable support (AEE_SECRET_KEY)
• ✅ Backward compatibility maintained (engine.py, client.py)
• ✅ Key rotation support

🚨 SECURITY NOTICE:

If you're using v0.2.3, upgrade immediately. v0.2.3 uses user_id as the only seed, which is cryptographically insecure. v0.2.4 fixes this with HMAC and proper key management.

🎯 FEATURES:

• Vector embedding traceability with legal certification
• 20% noise survival (empirically validated)
• Pinecone/Weaviate integration ready
• Scientific watermarking with configurable FPR (0.1% to 5%)
• Full validation suite (5000+ trials)

🚀 QUICK START:

pip install aeeprotocol==0.2.4
python
# RECOMMENDED (Secure - NEW):
from aeeprotocol.core.engine_secure import AEEMathEngineSecure
from aeeprotocol.sdk.client_secure import AEEClientSecure

# Initialize with environment variable
import os
os.environ['AEE_SECRET_KEY'] = 'your-base64-key-here'  # From .env

client = AEEClientSecure(user_id=123456)
🔧 MIGRATION FROM v0.2.3:
python
# OLD (v0.2.3 - INSECURE):
from aeeprotocol.sdk.client import AEEClient
client = AEEClient(user_id=123456)

# NEW (v0.2.4 - SECURE):
from aeeprotocol.sdk.client_secure import AEEClientSecure
client = AEEClientSecure(user_id=123456)
# OR keep using AEEClient (backward compatible)
📝 SECURITY BEST PRACTICES:
Store keys securely: export AEE_SECRET_KEY='base64-key'

Use .env file (add to .gitignore)

Rotate keys every 90 days

Never commit keys to version control

Use .env.example as template

📊 VALIDATION RESULTS:
Configuration	Target FPR	Observed FPR	Security Level
Standard	2.0%	1.88%	🔐 Balanced
Strict	1.0%	0.93%	🔐🔐 High
Maximum	0.1%	0.04%	🔐🔐🔐 Maximum
📁 FILE STRUCTURE:
text
aeeprotocol/
├── core/
│   ├── engine_secure.py    # ✅ SECURE (recommended)
│   └── engine.py           # ← Backward compatibility
├── sdk/
│   ├── client_secure.py    # ✅ SECURE (recommended)
│   └── client.py           # ← Backward compatibility
├── __init__.py             # v0.2.4
├── .env.example            # Template
└── auditor_test_v8.3.py    # Security tests
🐛 KNOWN ISSUES IN v0.2.3 (FIXED IN v0.2.4):
❌ CVE-SIMULATED: user_id used as cryptographic seed

❌ No HMAC protection

❌ Key not separated from user identifier

✅ ALL FIXED in v0.2.4

Release Information

Version: 0.2.4 (Secure)

Release Date: $(date +%Y-%m-%d)

Security Level: HMAC-SHA256

Compatibility: Python 3.8+

License: MIT

Author: Franco Carricondo

Security Audit: v8.3 Complete

Upgrade Command: pip install --upgrade aeeprotocol==0.2.4

Documentation: README.md
Security Guide: .env.example
Validation: VALIDATION.md

<hr /><em>This discussion was created from the release <a href='https://github.com/ProtocoloAEE/aee-protocol/releases/tag/v0.2.4'>SECURITY RELEASE v0.2.4 - HMAC Implementation</a>.</em>