v0.3.8

Full Changelog: v0.3.7...v0.3.8

v0.3.7

Full Changelog: v0.3.6...v0.3.7

v0.3.6

Full Changelog: v0.3.5...v0.3.6

v0.3.5

Full Changelog: v0.3.4...v0.3.5

v0.3.4

Full Changelog: v0.3.3...v0.3.4

v0.3.3

Full Changelog: v0.3.2...v0.3.3

v0.3.2

Full Changelog: v0.3.1...v0.3.2

v0.3.1

Full Changelog: v0.3.0...v0.3.1

v0.3.0

Full Changelog: v0.2.0...v0.3.0

v0.2.0

Highlights

DSTU 4145 (digital signatures)

• New uacrypt commands: sign-keygen, sign-pubkey, sign, verify (T-124).
• Correctness fix: scalar_multiply returned a wrong result for scalars at/near the curve's
  own group order — reachable in-contract at exactly one boundary value (k == n-1). No forgery
  risk (confirmed via independent Bouncy Castle cross-check), but a genuine correctness bug in
  code every sign/verify call goes through. See docs/DECISIONS.md D-110.
• Performance: sign ~2.6x faster, verify ~4.4x faster (cumulative), via bit-interleave
  GF(2^163) squaring and an Itoh-Tsujii addition-chain field inversion, plus a projective/Shamir's-
  trick fast path for verify's public-scalar combine step. Narrows the gap to OpenSSL's
  nistb163 from ~21-23x to ~5-8x slower. See docs/DECISIONS.md D-108/D-109, docs/PERFORMANCE.md.
• Official Strumok-256/512 supplementary test vectors added (two additional state-sourced sources,
  beyond the existing UAPKI-attributed set).

Kalyna performance

• Const-generic round functions close most of the block-cipher gap with the UAPKI reference
  (T-128).
• GCM/GMAC field-multiply bottleneck closed via a 4-bit comb multiply (T-125).
• CMAC/GMAC/KW gain a cached-schedule API surface, XTS gains a faster GF(2^m) doubling (T-126/T-127).
• Kupyna gains a const-generic compression function (T-134); Strumok's keystream generation is
  batched/fixed-index (T-135).

no_std / embedded

• New getrandom Cargo feature: a no_std-compatible RNG path via getrandom 0.3's link-time
  custom backend, for targets without std (T-123).

Assurance

• Kani bounded-model-check proofs added for gf2m163::reduce's two previously hand-argued claims,
  checked exhaustively over all 2^384 possible inputs (T-145).
• CodeQL advanced-setup migration, explicit least-privilege CI permissions (T-143).
• SonarCloud static analysis wired into CI (T-140).

Breaking changes

None in the public crypto_*/hazmat API surface. uacrypt's on-disk encrypt/decrypt wire
format was already changed pre-1.0 in a prior release (chunked crypto_secretstream format) — not
part of this release.

Notes

• No crates.io publish in this release (GitHub Release only, matching v0.1.0's scope) — crates.io
  publication remains a separate, explicitly-gated decision (T-17).
• Still pre-1.0, not audited, and not a claim of side-channel resistance — see docs/SECURITY.md.