pq_crypto-seal 0.1.2 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0e2f25bfc50a4e95892fb3c9e25992ff359bd16cc65535dacf3863d943c34e52
-  data.tar.gz: 40462d41fa188924ba4abbd5d76b4ad22c48377964d70a4544bae919ec4f5140
+  metadata.gz: ba33e05dfec6b3dc0b81bddd6a2b715f954c94ed73ea854024f2376244f8e785
+  data.tar.gz: 6c86441cbed8a97ae0014f824a194496c581578b3e894ce1731bc8ba20aa3e7c
 SHA512:
-  metadata.gz: 8a3f087d4c922637fcbf5af86cae6a9e118b688215f9a218c6572e524555643e2d444f7452416575c2904f08a8c34742adc0e2cb4bfab6e33a0267015f03d177
-  data.tar.gz: e1746e895c1be25bd755fc358c4eac0291b21c6c638b7d87fb1603e08229783e942adcecbdc4c095e4ae1fde9ca00d49a7f472a89cc1ef183339a94f9546e025
+  metadata.gz: 91f80804510c93a6a381cbf1c10f0584c2f1efe96c2a898a42c2db6f7700eaa821adedc20de95b41e42aee822ad33d8b35d25d356380f117e3b171b8cd46c270
+  data.tar.gz: 4f077ede4fa61486e9ba2925efeb626aac1dcc4a80067f5c50628c5579a94dce2683cffaaa9838a35b5399a11fb399b824d39a4b39ff0f6ad3e9b42c9582671c

data/CHANGELOG.md

@@ -1,5 +1,79 @@
 # Changelog
 
+## 0.1.4
+
+Wire format v1, the public API and the error classes are unchanged. The frozen
+golden envelope (`test/frozen_envelope_test.rb`) is byte-identical.
+
+### Security
+
+- **Native arguments converted before use.** `require_length` converted a
+  `#to_str` argument into a local copy only, so the caller then read
+  `RSTRING_PTR` of the original, non-String object (segfault under ASan/UBSan).
+  All arguments are now converted with `StringValue` first, then validated.
+- **No length check before a later `#to_str` callback.** The key length was
+  validated before the nonce was converted; a nonce `#to_str` could shrink the
+  key and the following 32-byte copy read out of bounds. Validation now happens
+  only after every conversion.
+- **Authentication error class pinned for GC compaction.** The cached
+  `AuthenticationError` VALUE was not registered with the GC; after
+  `GC.compact` raising it could crash. It is now a registered root.
+- **AEGIS operations without the GVL use private C buffers** for the inputs and
+  output. The extension creates the Ruby result with the GVL after the operation,
+  then wipes and frees the C buffers.
+- **Interrupts after a GVL-free section are handled.** Work runs under
+  `rb_protect`; key copies and snapshots are wiped and outputs cleared before a
+  pending `Thread#raise`/`kill` is re-raised. An interrupted or failed
+  incremental update finalizes the AEGIS state, so it can no longer emit or
+  accept a tag over data the caller never received.
+- **AEGIS state locking uses `atomic_bool`** with acquire/release ordering, as in
+  `pq_crypto` 0.6.8. `Encryptor`/`Decryptor` cannot be `dup`ed or `clone`d.
+- **Effective zeroization.** `Secrets.wipe!` used `String#replace`, which frees
+  the old buffer without clearing it. Wiping now goes through `Native.wipe`
+  (in-place `OPENSSL_cleanse` after `rb_str_modify`). Parsers copy fields with
+  `unpack1` instead of `byteslice`, so decrypted plaintext is not kept alive in
+  hidden copy-on-write roots, and the private-metadata copy owns its buffer.
+- File recipient rebuilds keep rejecting trailing bytes after the envelope.
+- Stream encryption keeps caller-owned input buffers intact. Stream decryption
+  uses the normalized chunk size after authentication.
+- Extension built with `-fstack-protector-strong` and, when the toolchain does
+  not already define it, `-D_FORTIFY_SOURCE=2`.
+
+### Changed
+
+- C extension split into `pqs_core.{c,h}` and Ruby bindings. HKDF-SHA256 uses
+  OpenSSL 3 `EVP_MAC`.
+- Vendored sources and their checksum match the pinned upstream
+  `libaegis` 0.10.3 archive.
+- Ruby library refactored into small objects (header/section/inner codecs with a
+  declarative header layout, encryption plans, stanza sealing/opening, streaming
+  writers and readers). The public String and IO APIs retain their Ruby
+  keyword signatures.
+- `PQC_SEAL_SANITIZE` accepts a sanitizer list (`1` still means
+  `address,undefined`).
+- `extconf.rb` restructured into `PQCSealBuild` modules; OpenSSL selection is
+  unchanged.
+- Development dependencies moved from the gemspec to the Gemfile.
+- Internal helpers changed shape: `Format.split_slot(slot)` no longer takes the
+  slot size, `Format.validate_capacity!` no longer checks the recipient count
+  (`Format.validate_recipient_count!` does), `Format.parse_verified_inner` and
+  the `Binary.read_*` helpers were removed, and implementation classes that were
+  accidentally public (`OneShotEncryptor`, `OneShotOpener`, `RecipientRebuilder`,
+  `DekRotator`) are now private constants. `IOAPI::DEFAULT_CHUNK_SIZE` remains.
+
+### Testing
+
+- Ruby regression tests cover native arguments, GC, concurrent updates and the
+  IO cases above. CI also runs the Ruby-independent C tests under ASan and UBSan.
+
+## 0.1.3
+
+- Runtime dependency relaxed from `pq_crypto = 0.6.4` to `pq_crypto ~> 0.6`
+  so patch/minor releases on the 0.6 line (including 0.6.7) resolve without a
+  Seal bump. Wire suite 1 remains pinned by algorithm id and exact
+  key/ciphertext/shared-secret sizes inside Seal; do not treat this as carte
+  blanche for a future `1.x` / breaking KEM wire change.
+
 ## 0.1.2
 
 ### Security

data/FORMAT.md

@@ -55,7 +55,7 @@ Every complete recipient-section rebuild creates a new random section ID and
 recreates all real and dummy slots. Mixed wrapping suites are forbidden.
 
 Wrap suite `1` fixes MLKEM768-X25519/X-Wing **draft-10**-compatible encapsulation
-(`pq_crypto = 0.6.4` algorithm `:ml_kem_768_x25519_xwing`), HKDF-SHA256, AEGIS-256
+(`pq_crypto ~> 0.6` algorithm `:ml_kem_768_x25519_xwing`), HKDF-SHA256, AEGIS-256
 DEK wrapping, and 32-byte wrap nonces/tags. The suite id freezes that behaviour
 for at-rest data even if a later RFC text diverges. Exact sizes:
 

data/README.md

@@ -12,17 +12,17 @@ random DEK → AEGIS-256 → document
 `libaegis` 0.10.3 is vendored and compiled into the extension. The existing
 `pq_crypto` gem supplies the hybrid KEM and OpenSSL-backed primitives.
 
-> **Status:** 0.1.2 is experimental cryptographic software; format v1; not
+> **Status:** 0.1.4 is experimental cryptographic software; format v1; not
 > independently audited. Read `SECURITY.md` before using it for irreplaceable data.
 >
-> `wrap_suite_id = 1` is pinned to `:ml_kem_768_x25519_xwing` and `pq_crypto = 0.6.4`
+> `wrap_suite_id = 1` is pinned to `:ml_kem_768_x25519_xwing` and `pq_crypto ~> 0.6`
 > (X-Wing draft-10 wire sizes). Content suite 1 is AEGIS-256 via libaegis 0.10.3.
 
 ## Installation
 
 ```ruby
-gem "pq_crypto", "~> 0.6.4"
-gem "pq_crypto-seal", "~> 0.1.2"
+gem "pq_crypto", "~> 0.6"
+gem "pq_crypto-seal", "~> 0.1.4"
 ```
 
 Ruby `>= 2.7.1` and OpenSSL `>= 3.0` development files are required for a
@@ -217,10 +217,11 @@ bundle install
 bundle exec rake
 ```
 
-Set `PQC_SEAL_SANITIZE=1` when compiling under ASan/UBSan. The suite covers
+Set `PQC_SEAL_SANITIZE=1` (address + undefined) or an explicit sanitizer list
+such as `PQC_SEAL_SANITIZE=thread` when compiling the extension. The suite covers
 AEGIS one-shot/incremental equivalence, tampering, multi-recipient opening,
-full-envelope padding, recipient rebuilds, staged file publication, and parser
-limits.
+full-envelope padding, recipient rebuilds, staged file publication, parser
+limits, concurrent use of one AEGIS state, and argument conversion edge cases.
 
 
 ## Padding enforcement on decrypt

data/RELEASING.md

@@ -1,7 +1,7 @@
 # Releasing
 
 1. Run `bundle exec ruby script/vendor_libs.rb --check`.
-2. Confirm `pq_crypto` dependency remains `= 0.6.4` and `WRAP_KEM_ALGORITHM`
+2. Confirm `pq_crypto` dependency remains `~> 0.6` and `WRAP_KEM_ALGORITHM`
    is still `:ml_kem_768_x25519_xwing` with the documented sizes.
 3. Run `bundle exec ruby script/release_contract_check.rb` (also enforced in CI).
 4. Run the full CI matrix: test, sanitize, fuzz, release_contract, gem-smoke.
@@ -22,15 +22,14 @@ gem; that would break the provenance guarantee. Never update the snapshot
 without rerunning official KATs, cross-backend equivalence checks, envelope
 golden vectors, and fuzz tests.
 
-The golden vectors fix every value this gem controls (recipient keys, DEK,
-nonces, section id, padding bytes, metadata, plaintext) and assert the derived
-header bytes, associated data, and one-shot/incremental equivalence. A fully
-frozen "plaintext to exact bytes" vector is intentionally not asserted for the
-KEM ciphertext region, because X-Wing encapsulation randomness originates inside
-`pq_crypto` and is not injectable here; the wire-contract check pins its exact
-sizes and round-trip instead.
+The frozen envelope test supplies a published X-Wing encapsulation result and
+deterministic randomness for Seal. It checks the digest of the complete envelope
+for both one-shot and streaming encryption. Other golden tests cover header
+bytes, associated data and recipient behaviour.
 
 The ASan job sets `detect_leaks=0` because ASan is preloaded into an otherwise
 unsanitized Ruby interpreter; host-process allocator noise would otherwise fail
-the job. Memory-safety errors still abort via `halt_on_error`.
+the job. Memory-safety errors still abort via `halt_on_error`. It also sets
+`use_sigaltstack=0`: Ruby installs its own per-thread alternate signal stack and
+ASan would otherwise try to unmap that buffer when a thread exits.
 

data/SECURITY.md

@@ -1,7 +1,7 @@
 # Security
 
 This project has not received an independent cryptographic or implementation
-audit. Do not treat version 0.1.2 as a substitute for a reviewed storage design.
+audit. Do not treat version 0.1.4 as a substitute for a reviewed storage design.
 
 Experimental cryptographic software; format v1; not independently audited.
 
@@ -68,6 +68,13 @@ callers that need residual-data hygiene must clear their own buffers.
 `Opened#data` / `Opened#metadata` returned from `open` are the caller's
 responsibility after use.
 
+Buffers the library owns (DEK, KEK, X-Wing shared secrets, the decrypted inner
+frame, the private-metadata copy, staged plaintext chunks) are zeroized in place
+by the C extension. Parsed fields are copied out instead of sliced, so no hidden
+copy-on-write root keeps decrypted bytes alive. Zeroization is still best effort:
+Ruby may have copied a string before it reached the library, and the garbage
+collector does not clear freed memory.
+
 
 ## payload_id stability
 
@@ -128,7 +135,7 @@ independent of future RFC text:
 
 | Component | Pin |
 |---|---|
-| `wrap_suite_id = 1` | MLKEM768-X25519 / X-Wing **draft-10** compatible via `pq_crypto = 0.6.4` algorithm `:ml_kem_768_x25519_xwing` (PK 1216, CT 1120, SS 32) |
+| `wrap_suite_id = 1` | MLKEM768-X25519 / X-Wing **draft-10** compatible via `pq_crypto ~> 0.6` algorithm `:ml_kem_768_x25519_xwing` (PK 1216, CT 1120, SS 32) |
 | `content_suite_id = 1` | AEGIS-256, 32-byte nonce/tag, inner-frame-v1, via vendored **libaegis 0.10.3** |
 | AEGIS KATs | CFRG AEGIS draft-18 positive/negative vectors in `test/aegis_vectors_test.rb` |
 | X-Wing KATs | draft-10 decapsulation vectors in `test/fixtures/xwing-draft-10-vector-*.json` (see `test/xwing_kat_test.rb`) |

data/VENDORING.md

@@ -13,7 +13,7 @@ libaegis 0.10.3.
   this snapshot, not to a future RFC that may diverge.
 
 X-Wing / MLKEM768-X25519 wrap suite 1 is supplied by runtime dependency
-`pq_crypto = 0.6.4` (not vendored here). External draft-10 decapsulation KATs
+`pq_crypto ~> 0.6` (not vendored here). External draft-10 decapsulation KATs
 live in `test/fixtures/xwing-draft-10-vector-*.json`.
 
 The complete source snapshot is retained, while the Ruby extension compiles only the AEGIS-256 and common implementation files it exposes. No system libaegis is

data/ext/pq_crypto_seal/aegis_unused_stubs.c

@@ -1,8 +1,9 @@
-/*
- * pq_crypto-seal exposes only AEGIS-256. libaegis common.c initializes all
- * optional families, so source-only builds provide no-op selectors for the
- * families deliberately not linked into this extension.
- */
+int aegis128l_pick_best_implementation(void);
+int aegis128x2_pick_best_implementation(void);
+int aegis128x4_pick_best_implementation(void);
+int aegis256x2_pick_best_implementation(void);
+int aegis256x4_pick_best_implementation(void);
+
 int aegis128l_pick_best_implementation(void) {
     return 0;
 }