Skip to content

v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Aug 01:04
· 241 commits to master since this release
v0.2.0
a5b602e

Highlights

DSTU 4145 (digital signatures)

  • New uacrypt commands: sign-keygen, sign-pubkey, sign, verify (T-124).
  • Correctness fix: scalar_multiply returned a wrong result for scalars at/near the curve's
    own group order — reachable in-contract at exactly one boundary value (k == n-1). No forgery
    risk (confirmed via independent Bouncy Castle cross-check), but a genuine correctness bug in
    code every sign/verify call goes through. See docs/DECISIONS.md D-110.
  • Performance: sign ~2.6x faster, verify ~4.4x faster (cumulative), via bit-interleave
    GF(2^163) squaring and an Itoh-Tsujii addition-chain field inversion, plus a projective/Shamir's-
    trick fast path for verify's public-scalar combine step. Narrows the gap to OpenSSL's
    nistb163 from ~21-23x to ~5-8x slower. See docs/DECISIONS.md D-108/D-109, docs/PERFORMANCE.md.
  • Official Strumok-256/512 supplementary test vectors added (two additional state-sourced sources,
    beyond the existing UAPKI-attributed set).

Kalyna performance

  • Const-generic round functions close most of the block-cipher gap with the UAPKI reference
    (T-128).
  • GCM/GMAC field-multiply bottleneck closed via a 4-bit comb multiply (T-125).
  • CMAC/GMAC/KW gain a cached-schedule API surface, XTS gains a faster GF(2^m) doubling (T-126/T-127).
  • Kupyna gains a const-generic compression function (T-134); Strumok's keystream generation is
    batched/fixed-index (T-135).

no_std / embedded

  • New getrandom Cargo feature: a no_std-compatible RNG path via getrandom 0.3's link-time
    custom backend, for targets without std (T-123).

Assurance

  • Kani bounded-model-check proofs added for gf2m163::reduce's two previously hand-argued claims,
    checked exhaustively over all 2^384 possible inputs (T-145).
  • CodeQL advanced-setup migration, explicit least-privilege CI permissions (T-143).
  • SonarCloud static analysis wired into CI (T-140).

Breaking changes

None in the public crypto_*/hazmat API surface. uacrypt's on-disk encrypt/decrypt wire
format was already changed pre-1.0 in a prior release (chunked crypto_secretstream format) — not
part of this release.

Notes

  • No crates.io publish in this release (GitHub Release only, matching v0.1.0's scope) — crates.io
    publication remains a separate, explicitly-gated decision (T-17).
  • Still pre-1.0, not audited, and not a claim of side-channel resistance — see docs/SECURITY.md.
Assets 6
Loading