@xmbl/state-machine 0.1.14 → 0.1.16

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # @xmbl/state-machine
 
+## 0.1.16
+
+### Patch Changes
+
+- **SECURITY — 0.1.15 still leaked the AIR trace, by a second route.** The mask added in 0.1.13
+  closed the linear attack; it did not close this one, and the published 0.1.15 bytes return the
+  exact secret.
+
+  Base-field Merkle leaves were `H('l:' + value)` and the field is 31 bits. Every opening hands the
+  verifier its authentication path, whose FIRST element is the level-0 SIBLING's leaf hash —
+  inverting it is a sweep of 2^31 SHA-256, measured at **450 seconds** for the whole field, once,
+  reusable against every proof ever made. So each of the `2*nc` trace openings donated one more
+  evaluation of `col'` for nothing: **80 opened + 80 swept = 160** points against a polynomial of
+  degree `T + blindDeg = 104` that needs **105**. Interpolate, evaluate at `g^0`, read row 0.
+  Measured against published 0.1.15: `RECOVERED 570682118` / `ACTUAL 570682118`. The blind cannot
+  see this — `blindDeg = 2*nc + 8` is sized against what is opened DIRECTLY.
+
+  **Fix**: `@xmbl/zero-knowledge` exports `merkleSalted`, `mverifySalted` and `randomSalts`; a
+  base-field leaf is now `H('ls:' + value + ':' + salt)` with a fresh 128-bit salt per leaf, carried
+  in the opening as `sCur`/`sNxt`. A missing or short salt is refused, so a salt-stripped proof does
+  not verify. Extension-field leaves are ~124 bits and stay unsalted.
+
+  **BREAKING for AIR proofs**: the statement tag is versioned `zk3` and the opening shape gained the
+  salts, so **no proof made by 0.1.13–0.1.15 verifies on 0.1.16**. Re-prove. `airSetup`/`airProve`/
+  `airVerify`/`AIR_STATEMENTS` signatures are unchanged.
+
+  `xzk` (the cube-curve statement) is unaffected and deliberately not salted: its FRI layer 0 IS the
+  curve codeword in the clear, `Pt` is public by construction, and its hiding is the witness family
+  (`Pt = P + Z_R*B`, a 2-parameter family per proof) rather than leaf secrecy.
+
+  The standing regression check is no longer a guess at the next attack. It is a COUNT: the points
+  an adversary can hold must stay strictly below `T + blindDeg + 1`. At the shipped parameters that
+  is `80 + 0 < 105`; un-salting the leaves makes it `160 < 105` and fails.
+
+## 0.1.15
+
+### Patch Changes
+
+- **The Linux and Windows desktop builds still failed at v0.1.14; both are fixed.** v0.1.14 attached
+  the macOS dmg (x64 + arm64), both web bundles and the extension zip — the first downloadable
+  builds this repo has ever produced — but two targets were still missing:
+
+  - **Linux** — the default deb/AppImage artifact name is `${name}_${version}_${arch}`, and `name`
+    is the SCOPED package name `@xmbl/desktop-app`, so fpm tried to write into `dist/@xmbl/` and
+    died with "Parent directory does not exist". Artifacts are now named explicitly.
+  - **Windows** — electron-builder rebuilt every native dependency in the hoisted workspace tree
+    for the electron ABI, and `classic-level`'s node-gyp build fails on Windows, so the `.exe` was
+    never produced. Nothing in the desktop app loads a native module (`main.js` and
+    `src/core/xmbl-core.js` require only `electron` and `path`), so the rebuild is skipped.
+
+  No change to any published package's code in this release.
+
 ## 0.1.14
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xmbl/state-machine",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "type": "module",
   "main": "index.js",
   "exports": {