pq_crypto-seal 0.1.3 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f595c15cfe06676ee508888c302a9bb5bab8083ffdef97540d6b6d19d877e270
-  data.tar.gz: 7e8107699dbdead218debc3c870d5ad98ba0f279a23f2c2698c3918bc0060d45
+  metadata.gz: ba33e05dfec6b3dc0b81bddd6a2b715f954c94ed73ea854024f2376244f8e785
+  data.tar.gz: 6c86441cbed8a97ae0014f824a194496c581578b3e894ce1731bc8ba20aa3e7c
 SHA512:
-  metadata.gz: 9cc59508eea68e697e16ceee595718319b1f10c9ee4aceea186565ba3f9d1133e9b6717aa198de1a33f1e4782812caa6a2c32e6bce7ba557a9ba9c7d923e20fc
-  data.tar.gz: e2fcec77d71028fa2615a62af722441277dfda52b24e05c4e2d3ffa50621b3435c28ab14b742788237ef18c3ad4f3d0c12770e0de0488de858f7243d57dbb2f4
+  metadata.gz: 91f80804510c93a6a381cbf1c10f0584c2f1efe96c2a898a42c2db6f7700eaa821adedc20de95b41e42aee822ad33d8b35d25d356380f117e3b171b8cd46c270
+  data.tar.gz: 4f077ede4fa61486e9ba2925efeb626aac1dcc4a80067f5c50628c5579a94dce2683cffaaa9838a35b5399a11fb399b824d39a4b39ff0f6ad3e9b42c9582671c

data/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## 0.1.4
+
+Wire format v1, the public API and the error classes are unchanged. The frozen
+golden envelope (`test/frozen_envelope_test.rb`) is byte-identical.
+
+### Security
+
+- **Native arguments converted before use.** `require_length` converted a
+  `#to_str` argument into a local copy only, so the caller then read
+  `RSTRING_PTR` of the original, non-String object (segfault under ASan/UBSan).
+  All arguments are now converted with `StringValue` first, then validated.
+- **No length check before a later `#to_str` callback.** The key length was
+  validated before the nonce was converted; a nonce `#to_str` could shrink the
+  key and the following 32-byte copy read out of bounds. Validation now happens
+  only after every conversion.
+- **Authentication error class pinned for GC compaction.** The cached
+  `AuthenticationError` VALUE was not registered with the GC; after
+  `GC.compact` raising it could crash. It is now a registered root.
+- **AEGIS operations without the GVL use private C buffers** for the inputs and
+  output. The extension creates the Ruby result with the GVL after the operation,
+  then wipes and frees the C buffers.
+- **Interrupts after a GVL-free section are handled.** Work runs under
+  `rb_protect`; key copies and snapshots are wiped and outputs cleared before a
+  pending `Thread#raise`/`kill` is re-raised. An interrupted or failed
+  incremental update finalizes the AEGIS state, so it can no longer emit or
+  accept a tag over data the caller never received.
+- **AEGIS state locking uses `atomic_bool`** with acquire/release ordering, as in
+  `pq_crypto` 0.6.8. `Encryptor`/`Decryptor` cannot be `dup`ed or `clone`d.
+- **Effective zeroization.** `Secrets.wipe!` used `String#replace`, which frees
+  the old buffer without clearing it. Wiping now goes through `Native.wipe`
+  (in-place `OPENSSL_cleanse` after `rb_str_modify`). Parsers copy fields with
+  `unpack1` instead of `byteslice`, so decrypted plaintext is not kept alive in
+  hidden copy-on-write roots, and the private-metadata copy owns its buffer.
+- File recipient rebuilds keep rejecting trailing bytes after the envelope.
+- Stream encryption keeps caller-owned input buffers intact. Stream decryption
+  uses the normalized chunk size after authentication.
+- Extension built with `-fstack-protector-strong` and, when the toolchain does
+  not already define it, `-D_FORTIFY_SOURCE=2`.
+
+### Changed
+
+- C extension split into `pqs_core.{c,h}` and Ruby bindings. HKDF-SHA256 uses
+  OpenSSL 3 `EVP_MAC`.
+- Vendored sources and their checksum match the pinned upstream
+  `libaegis` 0.10.3 archive.
+- Ruby library refactored into small objects (header/section/inner codecs with a
+  declarative header layout, encryption plans, stanza sealing/opening, streaming
+  writers and readers). The public String and IO APIs retain their Ruby
+  keyword signatures.
+- `PQC_SEAL_SANITIZE` accepts a sanitizer list (`1` still means
+  `address,undefined`).
+- `extconf.rb` restructured into `PQCSealBuild` modules; OpenSSL selection is
+  unchanged.
+- Development dependencies moved from the gemspec to the Gemfile.
+- Internal helpers changed shape: `Format.split_slot(slot)` no longer takes the
+  slot size, `Format.validate_capacity!` no longer checks the recipient count
+  (`Format.validate_recipient_count!` does), `Format.parse_verified_inner` and
+  the `Binary.read_*` helpers were removed, and implementation classes that were
+  accidentally public (`OneShotEncryptor`, `OneShotOpener`, `RecipientRebuilder`,
+  `DekRotator`) are now private constants. `IOAPI::DEFAULT_CHUNK_SIZE` remains.
+
+### Testing
+
+- Ruby regression tests cover native arguments, GC, concurrent updates and the
+  IO cases above. CI also runs the Ruby-independent C tests under ASan and UBSan.
+
 ## 0.1.3
 
 - Runtime dependency relaxed from `pq_crypto = 0.6.4` to `pq_crypto ~> 0.6`

data/README.md

@@ -12,7 +12,7 @@ random DEK → AEGIS-256 → document
 `libaegis` 0.10.3 is vendored and compiled into the extension. The existing
 `pq_crypto` gem supplies the hybrid KEM and OpenSSL-backed primitives.
 
-> **Status:** 0.1.3 is experimental cryptographic software; format v1; not
+> **Status:** 0.1.4 is experimental cryptographic software; format v1; not
 > independently audited. Read `SECURITY.md` before using it for irreplaceable data.
 >
 > `wrap_suite_id = 1` is pinned to `:ml_kem_768_x25519_xwing` and `pq_crypto ~> 0.6`
@@ -22,7 +22,7 @@ random DEK → AEGIS-256 → document
 
 ```ruby
 gem "pq_crypto", "~> 0.6"
-gem "pq_crypto-seal", "~> 0.1.3"
+gem "pq_crypto-seal", "~> 0.1.4"
 ```
 
 Ruby `>= 2.7.1` and OpenSSL `>= 3.0` development files are required for a
@@ -217,10 +217,11 @@ bundle install
 bundle exec rake
 ```
 
-Set `PQC_SEAL_SANITIZE=1` when compiling under ASan/UBSan. The suite covers
+Set `PQC_SEAL_SANITIZE=1` (address + undefined) or an explicit sanitizer list
+such as `PQC_SEAL_SANITIZE=thread` when compiling the extension. The suite covers
 AEGIS one-shot/incremental equivalence, tampering, multi-recipient opening,
-full-envelope padding, recipient rebuilds, staged file publication, and parser
-limits.
+full-envelope padding, recipient rebuilds, staged file publication, parser
+limits, concurrent use of one AEGIS state, and argument conversion edge cases.
 
 
 ## Padding enforcement on decrypt

data/RELEASING.md

@@ -22,15 +22,14 @@ gem; that would break the provenance guarantee. Never update the snapshot
 without rerunning official KATs, cross-backend equivalence checks, envelope
 golden vectors, and fuzz tests.
 
-The golden vectors fix every value this gem controls (recipient keys, DEK,
-nonces, section id, padding bytes, metadata, plaintext) and assert the derived
-header bytes, associated data, and one-shot/incremental equivalence. A fully
-frozen "plaintext to exact bytes" vector is intentionally not asserted for the
-KEM ciphertext region, because X-Wing encapsulation randomness originates inside
-`pq_crypto` and is not injectable here; the wire-contract check pins its exact
-sizes and round-trip instead.
+The frozen envelope test supplies a published X-Wing encapsulation result and
+deterministic randomness for Seal. It checks the digest of the complete envelope
+for both one-shot and streaming encryption. Other golden tests cover header
+bytes, associated data and recipient behaviour.
 
 The ASan job sets `detect_leaks=0` because ASan is preloaded into an otherwise
 unsanitized Ruby interpreter; host-process allocator noise would otherwise fail
-the job. Memory-safety errors still abort via `halt_on_error`.
+the job. Memory-safety errors still abort via `halt_on_error`. It also sets
+`use_sigaltstack=0`: Ruby installs its own per-thread alternate signal stack and
+ASan would otherwise try to unmap that buffer when a thread exits.
 

data/SECURITY.md

@@ -1,7 +1,7 @@
 # Security
 
 This project has not received an independent cryptographic or implementation
-audit. Do not treat version 0.1.3 as a substitute for a reviewed storage design.
+audit. Do not treat version 0.1.4 as a substitute for a reviewed storage design.
 
 Experimental cryptographic software; format v1; not independently audited.
 
@@ -68,6 +68,13 @@ callers that need residual-data hygiene must clear their own buffers.
 `Opened#data` / `Opened#metadata` returned from `open` are the caller's
 responsibility after use.
 
+Buffers the library owns (DEK, KEK, X-Wing shared secrets, the decrypted inner
+frame, the private-metadata copy, staged plaintext chunks) are zeroized in place
+by the C extension. Parsed fields are copied out instead of sliced, so no hidden
+copy-on-write root keeps decrypted bytes alive. Zeroization is still best effort:
+Ruby may have copied a string before it reached the library, and the garbage
+collector does not clear freed memory.
+
 
 ## payload_id stability
 

data/ext/pq_crypto_seal/aegis_unused_stubs.c

@@ -1,8 +1,9 @@
-/*
- * pq_crypto-seal exposes only AEGIS-256. libaegis common.c initializes all
- * optional families, so source-only builds provide no-op selectors for the
- * families deliberately not linked into this extension.
- */
+int aegis128l_pick_best_implementation(void);
+int aegis128x2_pick_best_implementation(void);
+int aegis128x4_pick_best_implementation(void);
+int aegis256x2_pick_best_implementation(void);
+int aegis256x4_pick_best_implementation(void);
+
 int aegis128l_pick_best_implementation(void) {
     return 0;
 }