Skip to content

CHANGELOG.md

Latest commit

 

History

History
116 lines (64 loc) · 5.38 KB

CHANGELOG.md

File metadata and controls

116 lines (64 loc) · 5.38 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

0.6.0 (2026-08-08)

Features

  • cache keyring per-tenant derivation at construction via TenantKeyring (LAB-1638) (#71) (d3f0eb0)
  • expose winning-key index via decrypt_indexed for rotation drain observability (LAB-1645) (#73) (d834f74)

0.5.0 (2026-08-07)

⚠ BREAKING CHANGES

  • public items EncryptionHeader, KeyRotationState, RotationAwareHeader, and ZeroKnowledgeEncryptor::rotate_key() are removed (EncryptionError::NotImplemented variant included). Use Keyring for master-key rotation.

Features

  • replace dead key-rotation machinery with keyring decrypt helper (LAB-683) (#67) (327f993)

0.4.0 (2026-07-27)

Features

  • emit StorageEnvelope compressed_data as msgpack bin (protocol 1.1) (LAB-866) (#59) (c691087)

0.3.0 (2026-07-15)

Features

Performance Improvements

  • borrow input in ByteStorage write path instead of copying it (#48) (7f5ebc1)

0.2.1 (2026-05-31)

Bug Fixes

  • use local> preset ref for private renovate-config repo (#29) (80355a4)

Security

  • seed nonce instance counter with 8 random bytes, raising cross-process collision resistance from 2^32 to 2^64 (HIGH-2/HIGH-3) (#36) (af3d5fe)

0.2.0 (2026-03-16)

Features

  • add wasm32-unknown-unknown platform support (#22) (911dbce)

0.1.1 (2025-12-18)

Bug Fixes

  • downgrade to edition 2021 and MSRV 1.80 for stable Rust compatibility (#16) (da5ced5)

0.1.0 (2025-12-05)

Features

Unreleased

Added

  • ByteStorage: LZ4 compression with xxHash3-64 checksums

    • Automatic compression/decompression
    • Integrity verification on retrieval
    • Decompression bomb protection (512MB limit, 1000x ratio limit)

  • ZeroKnowledgeEncryptor: AES-256-GCM encryption

    • Counter-based nonce generation (prevents reuse)
    • Hardware acceleration detection (AES-NI, ARM Crypto)
    • Operation metrics for observability

  • Key Derivation: HKDF-SHA256 (RFC 5869)

    • Domain separation for multi-use keys
    • Tenant isolation via salt
    • Key fingerprinting for rotation support

  • C FFI Layer: Multi-language support

    • Opaque handle management
    • Panic-safe error handling
    • Auto-generated cachekit.h header

  • Security Infrastructure

    • 16 fuzz targets covering all attack surfaces
    • Kani formal verification proofs
    • Property-based testing with proptest
    • cargo-deny supply chain security

Security

  • All key material zeroized on drop
  • Constant-time operations for encryption via ring
  • No panics in library code (Result-based error handling)
  • FFI boundary hardened with catch_unwind