diff --git a/Cargo.lock b/Cargo.lock index 228a993..4be533d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2224,7 +2224,7 @@ checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a" [[package]] name = "vitaminc" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "vitaminc", "vitaminc-aead", @@ -2239,7 +2239,7 @@ dependencies = [ [[package]] name = "vitaminc-aead" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "bytes", "quickcheck", @@ -2252,7 +2252,7 @@ dependencies = [ [[package]] name = "vitaminc-async-traits" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "vitaminc-protected", "vitaminc-traits", @@ -2260,7 +2260,7 @@ dependencies = [ [[package]] name = "vitaminc-encrypt" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "aes-gcm", "aws-lc-rs", @@ -2275,7 +2275,7 @@ dependencies = [ [[package]] name = "vitaminc-kms" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "aws-config", "aws-sdk-kms", @@ -2289,7 +2289,7 @@ dependencies = [ [[package]] name = "vitaminc-password" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "vitaminc-protected", "vitaminc-random", @@ -2297,7 +2297,7 @@ dependencies = [ [[package]] name = "vitaminc-permutation" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "bitvec", "paste", @@ -2311,7 +2311,7 @@ dependencies = [ [[package]] name = "vitaminc-protected" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "bitvec", "digest 0.11.2", @@ -2328,7 +2328,7 @@ dependencies = [ [[package]] name = "vitaminc-protected-derive" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "proc-macro2", "quote", @@ -2337,7 +2337,7 @@ dependencies = [ [[package]] name = "vitaminc-random" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "getrandom 0.4.3", "rand", @@ -2349,7 +2349,7 @@ dependencies = [ [[package]] name = "vitaminc-random-derives" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "proc-macro2", "quote", @@ -2358,7 +2358,7 @@ dependencies = [ [[package]] name = "vitaminc-traits" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" dependencies = [ "anyhow", "bytes", diff --git a/Cargo.toml b/Cargo.toml index 2fa161b..40b2da7 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -17,7 +17,7 @@ members = [ [workspace.package] documentation = "https://docs.rs/vitaminc" -version = "0.2.0-pre.1" +version = "0.2.0-pre.2" repository = "https://github.com/cipherstash/vitaminc" authors = [ "Dan Draper ", diff --git a/packages/aead/CHANGELOG.md b/packages/aead/CHANGELOG.md index c7214ac..7c12c8a 100644 --- a/packages/aead/CHANGELOG.md +++ b/packages/aead/CHANGELOG.md @@ -7,6 +7,31 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +### Documentation + +- docs(aead),refactor(encrypt): address decrypt-path review findings +- docs(aead),test(encrypt): document ContextTag limits; add negative-AAD tests + +### Features + +- re-introduce ContextTag on the revised Cipher/Decipher traits +- add ContextTag::context + decrypt/decrypt_with_aad helper +- implement Encrypt/Decrypt for the Equatable controlled type + +### Refactoring + +- thread AAD through the decrypt path to mirror encrypt +- align ContextTag::aad_with arg order with encrypt_with_aad +- address ContextTag decrypt-helper review + +### Testing + +- close Tier-1 cargo-mutants gaps (ConstantTimeEq, PAE invariant) +- close remaining Tier-1 cargo-mutants gaps (ts_ne, zeroize, read_nonce, hlist CI) +- address code-review findings on the Tier-1 mutation fixes +- test(aead),test(encrypt): close ContextTag coverage gaps from review + + ### Documentation - rewrite READMEs for revised Cipher/Decipher traits diff --git a/packages/aead/Cargo.toml b/packages/aead/Cargo.toml index 671b49f..7e10bef 100644 --- a/packages/aead/Cargo.toml +++ b/packages/aead/Cargo.toml @@ -12,8 +12,8 @@ keywords.workspace = true categories.workspace = true [dependencies] -vitaminc-protected = { version = "0.2.0-pre.1", path = "../protected" } -vitaminc-random = { version = "0.2.0-pre.1", path = "../random" } +vitaminc-protected = { version = "0.2.0-pre.2", path = "../protected" } +vitaminc-random = { version = "0.2.0-pre.2", path = "../random" } bytes = { version = "^1", features = ["serde"] } serde = { workspace = true } diff --git a/packages/async-traits/CHANGELOG.md b/packages/async-traits/CHANGELOG.md index 177c5c4..96474f5 100644 --- a/packages/async-traits/CHANGELOG.md +++ b/packages/async-traits/CHANGELOG.md @@ -1,5 +1,10 @@ +### Documentation + +- fix fabricated APIs, wrong metadata, and stale claims; add SECURITY.md + + diff --git a/packages/async-traits/Cargo.toml b/packages/async-traits/Cargo.toml index cebb3ca..3c1e0fa 100644 --- a/packages/async-traits/Cargo.toml +++ b/packages/async-traits/Cargo.toml @@ -13,5 +13,5 @@ categories.workspace = true rust-version.workspace = true [dependencies] -vitaminc-protected = { version = "0.2.0-pre.1", path = "../protected" } -vitaminc-traits = { version = "0.2.0-pre.1", path = "../traits" } +vitaminc-protected = { version = "0.2.0-pre.2", path = "../protected" } +vitaminc-traits = { version = "0.2.0-pre.2", path = "../traits" } diff --git a/packages/encrypt/CHANGELOG.md b/packages/encrypt/CHANGELOG.md index 5e6def6..391e927 100644 --- a/packages/encrypt/CHANGELOG.md +++ b/packages/encrypt/CHANGELOG.md @@ -1,5 +1,41 @@ +### Documentation + +- correct stale #181 zeroize note on Aes256Cipher::open +- docs(aead),refactor(encrypt): address decrypt-path review findings +- docs(aead),test(encrypt): document ContextTag limits; add negative-AAD tests +- fix fabricated APIs, wrong metadata, and stale claims; add SECURITY.md + +### Features + +- expose Aes256Cipher::decipher to construct a Decipher +- re-introduce ContextTag on the revised Cipher/Decipher traits +- add ContextTag::context + decrypt/decrypt_with_aad helper + +### Miscellaneous + +- rustfmt context_tag test to satisfy CI + +### Performance + +- borrow AAD per seq/map element instead of cloning + +### Refactoring + +- thread AAD through the decrypt path to mirror encrypt +- tidy decrypt AAD path per code review +- align ContextTag::aad_with arg order with encrypt_with_aad +- address ContextTag decrypt-helper review + +### Testing + +- split test-module cfg so cargo-mutants skips it +- add positive AAD roundtrip for the sequence path +- test(aead),test(encrypt): close ContextTag coverage gaps from review +- cover Equatable AEAD round-trip and tamper axes + + ### Documentation - rewrite READMEs for revised Cipher/Decipher traits diff --git a/packages/encrypt/Cargo.toml b/packages/encrypt/Cargo.toml index 103a9a9..13e6378 100644 --- a/packages/encrypt/Cargo.toml +++ b/packages/encrypt/Cargo.toml @@ -12,9 +12,9 @@ keywords.workspace = true categories.workspace = true [dependencies] -vitaminc-aead = { version = "0.2.0-pre.1", path = "../aead" } -vitaminc-protected = { version = "0.2.0-pre.1", path = "../protected" } -vitaminc-random = { version = "0.2.0-pre.1", path = "../random" } +vitaminc-aead = { version = "0.2.0-pre.2", path = "../aead" } +vitaminc-protected = { version = "0.2.0-pre.2", path = "../protected" } +vitaminc-random = { version = "0.2.0-pre.2", path = "../random" } zeroize = { workspace = true } @@ -46,7 +46,7 @@ _test-rust-crypto-backend = ["dep:aes-gcm"] hlist = ["vitaminc-aead/hlist"] [dev-dependencies] -vitaminc-protected = { path = "../protected", version = "0.2.0-pre.1", features = ["arbitrary"] } +vitaminc-protected = { path = "../protected", version = "0.2.0-pre.2", features = ["arbitrary"] } quickcheck = "1.1.0" quickcheck_macros = "1.2.0" diff --git a/packages/kms/CHANGELOG.md b/packages/kms/CHANGELOG.md index 94dca97..df7fc40 100644 --- a/packages/kms/CHANGELOG.md +++ b/packages/kms/CHANGELOG.md @@ -1,5 +1,15 @@ +### Documentation + +- fix fabricated APIs, wrong metadata, and stale claims; add SECURITY.md + +### Miscellaneous + +- bump aws-sdk-kms from 1.107.0 to 1.109.0 +- bump aws-config from 1.8.17 to 1.8.18 + + ### Miscellaneous - bump aws-sdk-kms from 1.106.0 to 1.107.0 diff --git a/packages/kms/Cargo.toml b/packages/kms/Cargo.toml index a75dc12..e9dbca5 100644 --- a/packages/kms/Cargo.toml +++ b/packages/kms/Cargo.toml @@ -12,9 +12,9 @@ keywords.workspace = true categories.workspace = true [dependencies] -vitaminc-async-traits = { version = "0.2.0-pre.1", path = "../async-traits" } -vitaminc-traits = { version = "0.2.0-pre.1", path = "../traits" } -vitaminc-protected = { version = "0.2.0-pre.1", path = "../protected" } +vitaminc-async-traits = { version = "0.2.0-pre.2", path = "../async-traits" } +vitaminc-traits = { version = "0.2.0-pre.2", path = "../traits" } +vitaminc-protected = { version = "0.2.0-pre.2", path = "../protected" } aws-sdk-kms = "1.109.0" aws-config = "1.8.18" diff --git a/packages/password/CHANGELOG.md b/packages/password/CHANGELOG.md index f86588c..b692a69 100644 --- a/packages/password/CHANGELOG.md +++ b/packages/password/CHANGELOG.md @@ -1,5 +1,10 @@ +### Documentation + +- fix fabricated APIs, wrong metadata, and stale claims; add SECURITY.md + + diff --git a/packages/password/Cargo.toml b/packages/password/Cargo.toml index a0b0d56..603b7dc 100644 --- a/packages/password/Cargo.toml +++ b/packages/password/Cargo.toml @@ -13,5 +13,5 @@ categories.workspace = true # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html [dependencies] -vitaminc-random = { version = "0.2.0-pre.1", path = "../random" } -vitaminc-protected = { version = "0.2.0-pre.1", path = "../protected" } +vitaminc-random = { version = "0.2.0-pre.2", path = "../random" } +vitaminc-protected = { version = "0.2.0-pre.2", path = "../protected" } diff --git a/packages/permutation/CHANGELOG.md b/packages/permutation/CHANGELOG.md index 16454f2..d509707 100644 --- a/packages/permutation/CHANGELOG.md +++ b/packages/permutation/CHANGELOG.md @@ -1,5 +1,15 @@ +### Fixes + +- thread T: Zeroize bound and drop Copy for #181 + +### Refactoring + +- borrow in invert() instead of cloning the key +- single-source into_inner_unchecked; document drop-glue guarantees + + ### Fixes diff --git a/packages/permutation/Cargo.toml b/packages/permutation/Cargo.toml index 5bb4608..421a5c9 100644 --- a/packages/permutation/Cargo.toml +++ b/packages/permutation/Cargo.toml @@ -12,8 +12,8 @@ keywords.workspace = true categories.workspace = true [dependencies] -vitaminc-protected = { version = "0.2.0-pre.1", path = "../protected", features = ["bitvec"] } -vitaminc-random = { version = "0.2.0-pre.1", path = "../random" } +vitaminc-protected = { version = "0.2.0-pre.2", path = "../protected", features = ["bitvec"] } +vitaminc-random = { version = "0.2.0-pre.2", path = "../random" } bitvec = { workspace = true } rand = { workspace = true } diff --git a/packages/protected-derive/CHANGELOG.md b/packages/protected-derive/CHANGELOG.md index 7eb24ca..85e6a9d 100644 --- a/packages/protected-derive/CHANGELOG.md +++ b/packages/protected-derive/CHANGELOG.md @@ -2,6 +2,7 @@ + ### Fixes - remove circular dev-dependency between vitaminc-protected and vitaminc diff --git a/packages/protected/CHANGELOG.md b/packages/protected/CHANGELOG.md index ce9c698..2b5a5a1 100644 --- a/packages/protected/CHANGELOG.md +++ b/packages/protected/CHANGELOG.md @@ -1,5 +1,20 @@ +### Documentation + +- fix fabricated APIs, wrong metadata, and stale claims; add SECURITY.md + +### Fixes + +- zeroize controlled types on drop ([#181](https://github.com/cipherstash/vitaminc/pull/181)) + +### Refactoring + +- move instead of copy in flatten_array +- single-source into_inner_unchecked; document drop-glue guarantees +- make move_inner_out a safe fn via an unsafe trait + + ### Miscellaneous diff --git a/packages/protected/Cargo.toml b/packages/protected/Cargo.toml index 914f3b8..9de07eb 100644 --- a/packages/protected/Cargo.toml +++ b/packages/protected/Cargo.toml @@ -22,7 +22,7 @@ digest = "0.11.2" subtle = "2.6.1" quickcheck = { version = "1.1.0", optional = true } -vitaminc-protected-derive = { path = "../protected-derive", version = "0.2.0-pre.1" } +vitaminc-protected-derive = { path = "../protected-derive", version = "0.2.0-pre.2" } [dev-dependencies] rmp-serde = "1.3.1" diff --git a/packages/random-derives/CHANGELOG.md b/packages/random-derives/CHANGELOG.md index f6c6753..e7b825d 100644 --- a/packages/random-derives/CHANGELOG.md +++ b/packages/random-derives/CHANGELOG.md @@ -3,6 +3,7 @@ + ### Miscellaneous - release v0.1.0-pre4.1 diff --git a/packages/random/CHANGELOG.md b/packages/random/CHANGELOG.md index f0173c8..b01a543 100644 --- a/packages/random/CHANGELOG.md +++ b/packages/random/CHANGELOG.md @@ -7,6 +7,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). ## [Unreleased] +### Fixes + +- thread T: Zeroize bound and drop Copy for #181 + + ### Features diff --git a/packages/random/Cargo.toml b/packages/random/Cargo.toml index 1565e20..2003da4 100644 --- a/packages/random/Cargo.toml +++ b/packages/random/Cargo.toml @@ -18,8 +18,8 @@ rand = { workspace = true } thiserror = { workspace = true } zeroize = { workspace = true } -vitaminc-random-derives = { version = "0.2.0-pre.1", path = "../random-derives" } -vitaminc-protected = { version = "0.2.0-pre.1", path = "../protected" } +vitaminc-random-derives = { version = "0.2.0-pre.2", path = "../random-derives" } +vitaminc-protected = { version = "0.2.0-pre.2", path = "../protected" } # Wasm32: route `getrandom` to the browser/Deno crypto API. Pulled in # transitively via `rand` -> `getrandom 0.4`. Must be paired with the diff --git a/packages/traits/CHANGELOG.md b/packages/traits/CHANGELOG.md index 9bc2e41..5794f54 100644 --- a/packages/traits/CHANGELOG.md +++ b/packages/traits/CHANGELOG.md @@ -3,6 +3,7 @@ + ### Miscellaneous - set workspace-wide MSRV to 1.75.0 diff --git a/packages/traits/Cargo.toml b/packages/traits/Cargo.toml index 8a2c91f..81c18fb 100644 --- a/packages/traits/Cargo.toml +++ b/packages/traits/Cargo.toml @@ -14,8 +14,8 @@ rust-version.workspace = true [dependencies] rmp-serde = "1.3.1" -vitaminc-protected = { version = "0.2.0-pre.1", path = "../protected" } -vitaminc-random = { version = "0.2.0-pre.1", path = "../random" } +vitaminc-protected = { version = "0.2.0-pre.2", path = "../protected" } +vitaminc-random = { version = "0.2.0-pre.2", path = "../random" } serde = { workspace = true } thiserror = { workspace = true } diff --git a/packages/vitaminc/CHANGELOG.md b/packages/vitaminc/CHANGELOG.md index e6802b5..d21c39e 100644 --- a/packages/vitaminc/CHANGELOG.md +++ b/packages/vitaminc/CHANGELOG.md @@ -1,5 +1,10 @@ +### Documentation + +- fix fabricated APIs, wrong metadata, and stale claims; add SECURITY.md + + ### Refactoring diff --git a/packages/vitaminc/Cargo.toml b/packages/vitaminc/Cargo.toml index bf9bbe3..91f8de2 100644 --- a/packages/vitaminc/Cargo.toml +++ b/packages/vitaminc/Cargo.toml @@ -15,14 +15,14 @@ categories.workspace = true all-features = true [dependencies] -vitaminc-kms = { path = "../kms", version = "0.2.0-pre.1", optional = true } -vitaminc-permutation = { path = "../permutation", version = "0.2.0-pre.1", optional = true } -vitaminc-protected = { path = "../protected", version = "0.2.0-pre.1", optional = true } -vitaminc-random = { path = "../random", version = "0.2.0-pre.1", optional = true } -vitaminc-traits = { path = "../traits", version = "0.2.0-pre.1", optional = true } -vitaminc-async-traits = { path = "../async-traits", version = "0.2.0-pre.1", optional = true } -vitaminc-encrypt = { path = "../encrypt", version = "0.2.0-pre.1", optional = true } -vitaminc-aead = { path = "../aead", version = "0.2.0-pre.1", optional = true } +vitaminc-kms = { path = "../kms", version = "0.2.0-pre.2", optional = true } +vitaminc-permutation = { path = "../permutation", version = "0.2.0-pre.2", optional = true } +vitaminc-protected = { path = "../protected", version = "0.2.0-pre.2", optional = true } +vitaminc-random = { path = "../random", version = "0.2.0-pre.2", optional = true } +vitaminc-traits = { path = "../traits", version = "0.2.0-pre.2", optional = true } +vitaminc-async-traits = { path = "../async-traits", version = "0.2.0-pre.2", optional = true } +vitaminc-encrypt = { path = "../encrypt", version = "0.2.0-pre.2", optional = true } +vitaminc-aead = { path = "../aead", version = "0.2.0-pre.2", optional = true } [features] protected = ["dep:vitaminc-protected"]