chapulin 0.2.0

chapulin 0.2.0 moves a host build's speed choices from build flags to the caller. On arm64 and x86-64, a web PKI client and both server roles now build one object that holds every fast path beside the portable code, and each session picks among them from ch_cfg.cpu, the caller's description of its CPU. A device build runs the portable code and has no such field.

• Breaking, ch_cfg.cpu: in a host build every init call and ch_srv_check return CH_EINVAL unless cpu holds CH_CPU_PROBED, and for a bit the object's architecture does not define. chapulin still probes nothing: the caller probes the CPU and owns PSTATE.DIT and DOITM.
• The bits: CH_CPU_CONSTANT_TIME_AES runs AES-GCM and QUIC's Initial packets on the AES and carry-less multiply instructions; without it a session offers ChaCha20 alone. CH_CPU_CONSTANT_TIME_MULTIPLY runs the native multiply, the vector Poly1305 and the 51-bit X25519 field. On x86-64, CH_CPU_AVX2 runs the AVX2 ChaCha20, and CH_CPU_VAES beside the AES bit runs the VAES AES-GCM.
• Removed: AES=hw, AES=runtime, ch_cfg.aes_instructions, CH_NATIVE_AES, WIDEMUL=runtime, ch_cfg.widemul, and the X25519 and CHACHA variables. A host build takes no AES or WIDEMUL value. A device build keeps AES=soft or extern and WIDEMUL=decomposed or native.
• To upgrade a host caller: drop those variables from the build and set cfg.cpu = CH_CPU_PROBED plus the bits your probe found. In Zig, set .cpu = .{ .constant_time_aes = ..., .constant_time_multiply = ... } on Client and Server. CH_CPU_AVX2 also states that the operating system saves the 256-bit registers, which a probe reads from CPUID and XGETBV.
• Speed: the server side of a handshake with x25519 and an ECDSA P-256 certificate takes 7.06 M instructions on arm64 with the multiply bit, against 42.30 M without it. On an x86-64 CI runner the VAES kernels seal a 16 KiB AES-128-GCM record in 3.3 to 3.6 µs, against about 6 µs on AES-NI. A forged 16 KiB AES-GCM record is refused in 2.5 µs, down from 8.3. docs/performance.md has the tables.
• Fixes: on x86-64 under Apple clang the vector Poly1305 left powers of its one-time key in stack slots the compiler picked; it now reads them from the one struct it wipes. The emulated Cortex-M3 test builds again, and CI fails where it used to skip that test.
• Stability: in 0.x the API and the build variables may change between minor versions. Breaking commits carry ! in the log.

chapulin 0.1.0

chapulin 0.1.0, the first tagged release. A TLS 1.3 library in C11 for devices with a few kB of SRAM: a client, a server (ROLE=server), and the TLS layer under a QUIC stack. No heap, libc only.

• Transports: TRANSPORT=tcp-blocking, tcp-nonblocking and quic-nonblocking, with QUIC versions 1 and 2 (RFC 9001, RFC 9369).
• Suites: TLS_CHACHA20_POLY1305_SHA256 in every build. TLS_AES_128_GCM_SHA256 and TLS_AES_256_GCM_SHA384 under SUITE=aesgcm with AES=hw, runtime or extern, and the builder's constant-time statement.
• Key exchange: x25519 or X25519MLKEM768 for device clients. The webpki client and the server hold X25519MLKEM768, x25519 and secp256r1.
• Trust: a pinned RSA-PSS or ECDSA P-256 key, a pinned CA key, or a public chain against caller-supplied anchors with SPKI pins and RFC 7250 raw public keys.
• Protocol: PSK resumption, HelloRetryRequest, KeyUpdate and record_size_limit. A Zig module and a header-only C++ wrapper.
• Speed: a 16 KiB record on an M1 Pro takes 2.5 µs for an AES-128-GCM seal (OpenSSL 2.1) and 11.8 µs for ChaCha20-Poly1305 with CHACHA=vector WIDEMUL=native (OpenSSL 9.4). docs/performance.md has every table.
• Verification: CBMC harnesses for every module, Lean specs with a differential driver, RFC and Wycheproof vectors, and mutation tests. docs/verification.md states what is proved and what is only tested.
• Stability: in 0.x the API and the build variables may change between minor versions. Breaking commits carry ! in the log.