Skip to content

v0.2.0

Choose a tag to compare

View all tags
@cedricbonhomme cedricbonhomme released this 24 Apr 22:00
· 20 commits to main since this release
v0.2.0
This tag was signed with the committer’s verified signature.
cedricbonhomme Cédric Bonhomme
GPG key ID: A1CB94DE57B7A70D
Verified
Learn about vigilant mode.
d2521ca
This commit was signed with the committer’s verified signature.
cedricbonhomme Cédric Bonhomme
GPG key ID: A1CB94DE57B7A70D
Verified
Learn about vigilant mode.

Changed

  • Source-fragment encryption switched from AES-256-GCM to AES-SIV
    (RFC 5297), invoked deterministically with no nonce and no associated
    data. The same Telegram message now always produces the same
    Telegram/<ciphertext> source string, so Vulnerability-Lookup can
    deduplicate on the ciphertext without having to decrypt it. Plaintext
    is still recoverable with the key. source_encryption_key accepts
    32-, 48-, or 64-byte keys (AES-128/192/256-SIV); 64 bytes is
    recommended for new deployments.

    Migration note: source strings pushed by 0.1.x (AES-GCM with a
    per-record random nonce) will not dedupe against strings produced by
    0.2.0 for the same underlying message.

  • Telegram-tag precedence inverted: tag_wildusage (→ exploited) now
    wins over tag_poc (→ proof_of_concept) when both are set.

Dependencies

  • Bumped cryptography from 45.0.7 to 46.0.7.

Full Changelog: v0.1.1...v0.2.0

Assets 2
Loading