vendor/monocypher/CHANGELOG.md

14.0.3

2-----

32026/06/15

5- Fixed timing leak vulnerability in EdDSA/Ed25519 signatures.

6- Various minor documentation fixes.

7- Various minor build system fixes.

8- Various minor compiler warning fixes.

114.0.2

12-----

132023/08/24

15- Fixed multiple-lanes Argon2.

16- Improved Poly1305 performance.

17- Improved Argon2 performance.

18- Makefiles no longer override standard environment variables.

214.0.1

22-----

232023/03/06

25- Fixed Ed25519 secret key size in function prototype.

26- Fixed soname (should have been changed in 4.0.0)

27- Added convenience sub-targets to makefile.

28- Briefly specified wire format of Elligator and incremental AEAD.

314.0.0

32-----

332023/02/20

35- Fixed unsafe signature API.

36- Simpler, more flexible low-level signature API.

37- Fully specified, consensus-friendly signatures.

38- Added Argon2d and Argon2id, support multiple lanes.

39- Added safe and fast streaming AEAD.

40- Added HKDF-SHA-512 and documented BLAKE2b KDF.

41- More consistent and memorable function names.

42- POSIX makefile.

453.1.3

46-----

472022/04/25

49- Fixed many typos in the documentation.

50- Fixed buffer overflow in speed benchmarks.

51- Fixed some MSVC warnings.

52- Fixed a minor violation of the Elligator2 reverse map specs.

53- Added `change-prefix.sh` to help changing the `crypto_` prefix.

54- Added the `MONOCYPHER_CPP_NAMESPACE` preprocessor definition to

55 support namespaces for C++.

56- Deprecated `crypto_key_exchange()`

57- Use GitHub actions to automate the regular test suite.

603.1.2

61-----

622020/12/27

64- Addressed issues from Cure53's audit:

65 - MON-01-001: Clarified which CSPRNG to use on Darwin.

66 - MON-01-002: Won't fix (nonce handling is a core design decision).

67 - MON-01-004: Compared with Kleshni's implementation.

68 - MON-01-005: Split a dedicated "advanced" folder in the manual.

69- Quality assurance for 2^255-19 arithmetic (elliptic curves):

70 - Documented carry propagation.

71 - Enforced slightly safer invariants.

72- Improved the speed of EdDSA signature generation.

73- Made the vectors.h header more compact and easier to modify.

74- TIS-CI integration.

75- Added speed benchmark for ed25519-donna.

76- Documented lengths limits of `crypto_ietf_chacha20()`

793.1.1

80-----

812020/06/15

83- Various documentation fixes.

84- Fixed various compiler warnings.

85- Fixed some integer overflows (16-bit platforms only).

883.1.0

89-----

902020/04/03

92- Added Elligator 2 mappings (hash to curve, curve to hash).

93- Added OPRF support (with scalar inversion).

94- Added Edwards25519 -> Curve25519 conversions.

973.0.0

98-----

992020/01/19

100

101- Deprecated the incremental AEAD interface.

102- Deprecated the incremental Chacha20, added a direct interface.

103- Added IETF Chacha20 (96-bit nonce), as described in RFC 8439.

104- Moved deprecated interfaces to a separate `src/deprecated` folder.

105- Removed the `ED25519_SHA512` preprocessor flag.

106- `crypto_x25519()` and `crypto_key_exchange()` now return `void`.

107- Added a custom hash interface to EdDSA. Several instances of EdDSA

108 can share the same binary.

109- Added optional support for HMAC SHA-512.

110- Moved SHA-512 operations to `src/optional/monocypher-ed25519.(h|c)`.

111- Optional support for Ed25519 no longer requires a preprocessor flag.

112 Add `src/optional/monocypher-ed25519.(h|c)` to your project instead.

113

114

1152.0.6

116-----

1172019/10/21

118

119- Added the `BLAKE2_NO_UNROLLING` preprocessor definition. Activating

120 it makes the binary about 5KB smaller and speeds up processing times

121 on many embedded processors.

122- Reduced the stack usage of signature verification by about

123 40%. Signature verification now fits in smaller machines.

124- Fixed many implicit casts warnings.

125- Fixed the manual here and there.

126- Lots of small nitpicks.

127

128

1292.0.5

130-----

1312018/08/23

132

133- Faster EdDSA signatures and verification. Like, 4 times as fast.

134

135

1362.0.4

137-----

1382018/06/24

139

140- Corrected a critical vulnerability found by Mike Pechkin in EdDSA,

141 where crypto_check() was accepting invalid signatures. The current

142 fix removes a buggy optimisation, effectively halving the performance

143 of EdDSA.

144- The test suite no longer tries to allocate zero bytes (some platforms

145 fail such an allocation).

146

1472.0.3

148-----

1492018/06/16

150

151- Corrected undefined behaviour in BLAKE2b.

152- Improved the test suite (faster, better coverage).

153

1542.0.2

155-----

1562018/04/23

157

158- Corrected a couple failures to wipe secret buffers.

159- Corrected a bug that prevented compilation in Ed25519 mode.

160- Adjusted the number of test vectors in the test suite.

161- Improved tests for incremental interfaces.

162- Replaced the GNU all permissive licence by a public domain dedication

163 (Creative Commons CC-0). The BSD licence remains as a fallback.

164

1652.0.1

166-----

1672018/03/07

168

169- Followed a systematic pattern for the loading code of symmetric

170 crypto. It is now easier to review.

171- Tweaked Poly1305 code to make it easier to prove correct.

172

1732.0.0

174-----

1752018/02/14

176

177- Changed the authenticated encryption format. It now conforms to

178 RFC 7539, with one exception: it uses XChacha20 initialisation instead

179 of the IETF version of Chacha20. This new format conforms to

180 libsodium's `crypto_aead_xchacha20poly1305_ietf_encrypt`.

181- Removed `crypto_lock_encrypt()` and `crypto_lock_auth()`.

182- Renamed `crypto_lock_aead_auth()` to `crypto_lock_auth_ad()`.

183- Renamed `crypto_unlock_aead_auth()` to `crypto_unlock_auth_ad()`.

184- Added `crypto_lock_auth_message()` and `crypto_unlock_auth_message()`.

185- Renamed `crypto_aead_lock` to `crypto_lock_aead`.

186- Renamed `crypto_aead_unlock` to `crypto_unlock_aead`.

187

188The format change facilitates optimisation by aligning data to block

189boundaries. The API changes increase consistency.

190

1911.1.0

192-----

1932018/02/06

194

195- Rewrote the manual into proper man pages.

196- Added incremental interfaces for authenticated encryption and

197 signatures.

198- Replaced `crypto_memcmp()` by 3 fixed size buffer comparisons (16, 32,

199 and 64 bytes), to make sure the generated code remains constant time.

200- A couple breaking API changes, easily fixed by renaming the affected

201 functions.

202

2031.0.1

204-----

2052017/07/23

206

207- Optimised the loading and unloading code of the symmetric crypto

208 (BLAKE2b, SHA-512, Chacha20, and Poly1305).

209- Fused self-contained tests together for easier analysis with Frama-C

210 and the TIS interpreter.

211

2121.0

213---

2142017/07/18

215

216- Renamed `crypto_chacha20_Xinit` to `crypto_chacha20_x_init`, for

217 consistency reasons (snake case everywhere).

218- Fixed signed integer overflow detected by UBSan.

219- Doubled the speed of EdDSA by performing the scalar product in

220 Montgomery space.

221

2220.8

223---

2242017/07/06

225

226- Added about a hundred lines of code to improve performance of public

227 key cryptography. Diffie-Hellman is now 20% faster than before.

228 The effects are less pronounced for EdDSA.

229- Added random self-consistency tests.

230- Added a speed benchmark against libsodium.

231

2320.7

233---

2342017/06/07

235

236- Slightly changed the authenticated encryption API. Functions are

237 now all in "detached" mode. The reason is better support for

238 authenticated encryption _without_ additional data.

239- Rewrote BLAKE2b from spec so it can use the same licence as

240 everything else.

241- Added random tests that compare Monocypher with libsodium and

242 ed25519-donna.

243- Added explicit support for Frama-C analysis (this doesn't affect the

244 source code).

245

2460.6

247---

2482017/03/17

249

250- Fixed incorrect Poly1305 output on empty messages. (Found by Mike

251 Pechkin.)

252

2530.5

254---

2552017/03/10

256

257- Fixed many undefined behaviours in Curve25519 that occur whenever

258 we perform a left shift on a signed negative integer. It doesn't

259 affect the generated code, but you never know. (Found with Frama-C

260 by André Maroneze.)

261

262Fun fact: TweetNaCl and ref10 have the same bug. Libsodium has

263corrected the issue, though.

264

265For those who don't comprehend the magnitude of this madness, the

266expression `-1 << 3` is undefined in C. This is explained in

267section 6.5.7(§4) of the C11 standard.

268

2690.4

270---

2712017/03/09

272

273- Fixed critical bug causing Argon2i to fail whenever it uses more

274 than 512 blocks. It was reading uninitialised memory and the

275 results were incorrect. (Found by Mike Pechkin.)

276- Fixed an undefined behaviour in Curve25519 (`fe_tobytes()`). It was

277 accessing uninitialised memory before throwing it away. It didn't

278 affect the compiled code nor the results, but you never know.

279 (Found with [Frama-C](http://frama-c.com) by André Maroneze.)

280

2810.3

282---

2832017/02/27

284

285- Got the invariants of Poly1305 right and put them in the comments.

286 There was no bug, but that was lucky (turned out the IETF test

287 vectors were designed to trigger the bugs I was afraid of).

288- Simplified Poly1305 finalisation (replaced conditional subtraction

289 by a carry propagation).

290- Made a few cosmetic changes here and there.

291

2920.2

293---

294????/??/??

295

296- Public interface significantly reworked. Removed redundant, hard to

297 mess up constructions.

298- Added AEAD.

299- Sped up Curve25519 by a factor of more than 6 (switched to ref10

300 arithmetic).

301- Added various test vectors and completed the consistency tests.

302

3030.1

304---

3052016/??/??