Skip to content

v4.2.1

Latest
Latest

Choose a tag to compare

View all tags
@paolostivanin paolostivanin released this 01 Jul 08:56
v4.2.1
3a7fa1a
This commit was signed with the committer’s verified signature.
paolostivanin Paolo Stivanin
GPG key ID: 3C9BE9B64EC1EA64
Verified
Learn about vigilant mode.

Highlights

  • YAOTP (Yandex.Key) OTP support
  • MbedTLS 4.x compatibility

Note: this is the first release since v4.1.0, so the unreleased 4.2.0 work is folded in here.

New features

YAOTP (Yandex.Key)

Full implementation per KeeYaOtp: CRC-13-verified Yandex secret, SHA-256(pin || key) with the leading-zero quirk, HMAC-SHA-256 with 64-bit truncation, and 8-character base-26 output.

  • New API: get_yaotp(), get_yaotp_at(), cotp_yaotp_secret_pin_length()
  • Context wrappers: cotp_ctx_yaotp(), cotp_ctx_yaotp_at()
  • otpauth://yaotp/ URI parser and builder: cotp_yaotp_uri_parse(), cotp_yaotp_uri_build(), cotp_yaotp_uri_free()
  • New error codes (appended, ABI-safe): INVALID_YAOTP_SECRET_LENGTH, INVALID_YAOTP_SECRET_CRC, INVALID_YAOTP_PIN

Internals

  • One-shot whash_sha256 wrapper dispatched by the selected backend (gcrypt/openssl/mbedtls)
  • Shared percent-encode/decode codec (utils/pct) used by both the otpauth and yaotp URI parsers

Compatibility and fixes

  • MbedTLS 4.x: the classic mbedtls_md_hmac_* API was demoted to private identifiers in 4.x, which broke the mbedtls HMAC backend. It is now a version-guarded dual implementation: PSA Crypto (psa_mac_sign_setup/update/finish) for MBEDTLS_VERSION_MAJOR >= 4, with the unchanged legacy path for 2.x/3.x. FindMbedTLS.cmake also links libtfpsacrypto when present (TF-PSA-Crypto split).
  • Ubuntu 24.04: whash_mbedtls now uses mbedtls/md.h to fix the build.
  • CMake: GCC-only flags guarded behind NOT MSVC (#78).
  • YAOTP: return INVALID_YAOTP_PIN for an out-of-range embedded pin-length nibble, and remove a dead length re-check.

Tests

KeeYaOtp known-answer vectors, secret normalization (lowercase and spaces), URI round-trip, end-to-end URI to code, and error paths. Verified on all three backends (gcrypt, openssl, mbedtls 4.1.0): full ctest suite passing, ASan and UBSan clean.

ABI

No ABI break: new error codes are appended to cotp_error_t, and no existing symbols changed.

Verification

SHA256: 5f0cc41049e9fa296c1edf09c6fb0bb6dae588b149d5049adbc41d21aefc1bb1

gpg --verify v4.2.1.tar.gz.asc v4.2.1.tar.gz
echo "5f0cc41049e9fa296c1edf09c6fb0bb6dae588b149d5049adbc41d21aefc1bb1  v4.2.1.tar.gz" | sha256sum -c

Full changelog: v4.1.0...v4.2.1

Assets 3
Loading