2. Changelog

Any important changes to the project specification or wiki content will be documented here.

2.1. Version 2023.1 (12 April 2023)

Fixed a typo in the specification for crypto.PasswordKDF which said that the password argument was of type bytes, but the password argument is really of type str.

Fixed a typo in the specification for crypto.PasswordKDF which said that the password argument was of type bytes, but the password argument is really of type str.

In the specification for crypto.HMACEqual, changed the text in the Note to read “…vulnerable to timing attacks that allow the adversary to forge valid HMACs even without knowledge of the private key”. The Note previously read “…vulnerable to timing attacks that allow the adversary to extract the underlying HMAC key”, which is slightly inaccurate—attacks that extract the key are mainly related to the length extension attacks discussed in the Warning of crypto.Hash.

In Sharing Methods, the following text was added: “Additionally, calls to revoke_file by the root user where old_recipient isn’t a direct descendant of the root user in the sharing tree result in undefined behavior and will not be tested for any particular behavior.”
In Sharing Methods, the following text was added: “While the behavior of the client is unspecified for the aforementioned “undefined” cases (and thus your client may handle such cases in any way it wants), you must make sure to preserve Confidentiality and Integrity even in undefined behavior cases, as the adversary may attempt such actions (or create their own malicious client that attempts similar actions).”

In the specification for revoke_file, the following error case was removed: “If the calling user is not the root user in the sharing tree defined over the file named filename.”, as Sharing Methods states that this case results in undefined behavior.
In the specification for revoke_file, the following error case was removed: “If old_recipient is not a direct child of the calling user on filename’s sharing tree.”, as Sharing Methods states that this case results in undefined behavior.

The list of adversary capabilities in Threat Model has been changed to a numbered list to make it easier to refer to.
Capability 3 of Threat Model has been updated. Specifically, the text “…and tamper with…” has been removed, and the text “(The adversary cannot tamper with or inject network traffic.)” has been added.

Instructions on obtaining the Stencil Code were added to the wiki.
Code usage examples (in particular, a serialization example specific to public-private keys) were added to Section 6.2.1 and Section 6.2.2 of Serialization API.
Section 5.1.3 and Section 5.2.3 (in Asymmetric Encryption and Digital Signatures) were added to document the from_bytes class methods on AsymmetricEncryptKey, AsymmetricDecryptKey, SignatureVerifyKey, and SignatureSignKey, which are used to serialize the Python representation of those keys to bytes format. This allows the keys to be stored on the Dataserver.
A Warning was added to the documentation for the Memloc API.
The output length of the functions in Hash Functions and HMACs was added to the API documentation.

Initial project release.