Skip to content

v0.4.0: Security Hardening and Post-Quantum Cryptography

Choose a tag to compare

View all tags
@derekg derekg released this 22 Jun 17:43
· 13 commits to main since this release
v0.4.0
56c7c25
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

ts-ssh v0.4.0 - Security Hardening and Post-Quantum Cryptography

This release focuses on security enhancements, post-quantum cryptography preparation, and code quality improvements.

🔒 Security Enhancements

Enterprise-Grade Security Hardening

  • Modern SSH Key Discovery: Ed25519 prioritized over legacy RSA keys
  • TTY Security: Multi-layer validation preventing hijacking attacks
  • Process Protection: Credential masking in process lists and environment
  • Atomic File Operations: Race condition prevention in file handling
  • Host Key Verification: Enhanced verification against ~/.ssh/known_hosts
  • Cross-Platform Security: Platform-specific implementations for Windows/macOS/Linux

Critical Vulnerability Fixes

  • CVE-TS-SSH-001: Host key verification bypass protections added
  • CVE-TS-SSH-002: Credential exposure in process lists eliminated
  • CVE-TS-SSH-003: File permission race conditions resolved
  • CVE-TS-SSH-004: Unsafe TTY access vulnerabilities fixed

🔮 Post-Quantum Cryptography Preparation

Quantum-Resistant Infrastructure

  • Algorithm Support: Foundation for sntrup761x25519-sha512@openssh.com and other PQC algorithms
  • Algorithm Agility: Framework for seamless cryptographic transitions
  • Monitoring System: PQC usage tracking and reporting capabilities
  • Command-Line Flags: --pqc, --pqc-level, --pqc-report for quantum cryptography control

🌍 Internationalization

Multi-Language Support

  • Spanish Language: Complete CLI translation (--lang es)
  • Language Detection: Automatic detection from environment variables (LANG, TS_SSH_LANG)
  • Extensible Framework: Ready for additional language support

🛠️ Technical Improvements

Code Quality and Architecture

  • Modular Refactoring: Clean separation with internal/ package structure
  • Security Package: Dedicated internal/security/ for security operations
  • PQC Package: New internal/crypto/pqc/ for quantum cryptography
  • Comprehensive Testing: Enhanced test coverage with security-focused scenarios
  • Cross-Platform Compatibility: Improved Windows/macOS/Linux support

Documentation Updates

  • Realistic Claims: Removed inconsistent numerical scores from documentation
  • Security Architecture: Comprehensive security documentation
  • Project Guidelines: Added guidance for quality assessment practices

📊 Technical Metrics

  • 80+ Tests: Comprehensive test suite including security scenarios
  • 5 Internal Packages: Modular architecture for maintainability
  • Cross-Platform: Full Windows/macOS/Linux compatibility
  • Security Events: Comprehensive audit logging and monitoring

🚨 Breaking Changes

None - this release maintains full backwards compatibility with existing ts-ssh usage.

📝 Installation

# Using go install (recommended)
go install github.com/derekg/ts-ssh@v0.4.0

# Build from source
git clone https://github.com/derekg/ts-ssh.git
cd ts-ssh
git checkout v0.4.0
go build -o ts-ssh .

🆕 New Usage Examples

Multi-Language Support

# Use Spanish interface
ts-ssh --lang es --list

# Set permanent language preference
export TS_SSH_LANG=es
ts-ssh --help

Post-Quantum Cryptography (Preparation)

# Enable PQC monitoring (when available)
ts-ssh --pqc-report

# Future: PQC algorithm selection
ts-ssh --pqc-level 2 your-server  # (when PQC is fully implemented)

📋 Full Changelog

Security:

  • Comprehensive security hardening with CVE fixes
  • Modern SSH key discovery (Ed25519 priority)
  • TTY security and process protection enhancements
  • Atomic file operations and race condition prevention

Features:

  • Spanish language support and i18n framework
  • Post-quantum cryptography infrastructure
  • Enhanced cross-platform compatibility

Quality:

  • Major code quality improvements and refactoring
  • Comprehensive test coverage expansion
  • Modular internal package architecture

Documentation:

  • Removed inconsistent quality scores
  • Enhanced security architecture documentation
  • Realistic security implementation claims

This release positions ts-ssh as a secure, future-ready SSH client with enterprise-grade security features and quantum-cryptography readiness.

Assets 9
Loading