cristiancmoises/zupt
Watch
1
0
Fork
You've already forked zupt
 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions 3

v4.2.0: full (pure) post-quantum mode + critical dedup nonce fix

Browse source 
Add a native full post-quantum encryption mode and fix a critical
keystream-reuse bug in deduplicated encrypted archives.

Full post-quantum mode (--pq-only)
- New envelope type 0x06 (ZUPT_ENC_PQ_ONLY): ML-KEM-768 (FIPS 203) as
  the sole key-establishment mechanism, with no classical X25519
  component. Archive key = SHA3-512(ml_ss || ml_ct || "ZUPT-PQ-ONLY-v1").
- For compliance postures that require a single NIST-standardised PQ
  primitive with no classical KEM in the envelope (CNSA 2.0-style
  "PQ-only"). Hybrid --pq stays the recommended default; --pq-only has
  no classical fallback, so a break of ML-KEM-768 alone breaks it.
- keygen --pq-only / keygen --pub --pq-only (ZPQK magic, 1200B pub /
  3600B priv; not interchangeable with hybrid --pq keys). Wrong or
  tampered ciphertext is rejected via ML-KEM FO implicit rejection plus
  the HMAC-SHA256 Encrypt-then-MAC envelope. In-tree, default build.

Security (critical): AES-256-CTR keystream reuse under --dedup
- Dedup assigns block sequence 0 to every data block (the sentinel that
  keeps cross-file dedup references authenticating consistently). The
  per-block nonce was base_nonce XOR block_seq, so under --dedup every
  block collapsed to the same nonce, reusing the CTR keystream across
  distinct plaintexts (a many-time-pad). Each block now uses a fresh
  random 128-bit nonce stored in the block prefix and bound into the
  block MAC; block_seq is still bound as MAC AAD. Regression test:
  tests/test_dedup_nonce.sh. Re-encrypt any --dedup encrypted archives
  written by <= 4.1.0.

Other
- keygen --sdk / --box on a source-only build now fails with a clear
  message pointing to native --pq / --pq-only (or a WITH_SDK=1 build).
- Documentation: README, SECURITY, THREAT_MODEL, man page, CHANGELOG,
  and all packaging recipes updated for the new mode and the security
  fix; version bumped to 4.2.0. Wire format v1.6 unchanged (0x06 is
  additive).

Validation: make check 16/16, quick suite 11/11 (incl. PQ-only),
dedup-nonce regression (all block nonces distinct), cppcheck clean.
This commit is contained in:
Cristian Cezar Moisés 2026-07-09 21:15:14 -03:00
commit 124958aea9
24 changed files with 811 additions and 123 deletions
Download patch file Download diff file Expand all files Collapse all files

2
packaging/aur/PKGBUILD
View file

@ -11,7 +11,7 @@
# zupt-VERSION.tar.gz alongside the PKGBUILD.
pkgname=vaptvupt
pkgver=4.1.0
pkgver=4.2.0
pkgrel=1
provides=('zupt')
replaces=('zupt')

24
packaging/debian/changelog
View file

@ -1,3 +1,27 @@
vaptvupt (4.2.0-1) UNRELEASED; urgency=high
* New native full (pure) post-quantum mode --pq-only: ML-KEM-768 (FIPS
203) as the sole key-establishment mechanism, no classical X25519
component (envelope type 0x06; archive key SHA3-512(ml_ss || ml_ct ||
"ZUPT-PQ-ONLY-v1")). For compliance postures that require a single
NIST-standardised PQ primitive with no classical KEM in the envelope
(CNSA 2.0-style "PQ-only"). Keys via keygen --pq-only (ZPQK magic;
not interchangeable with hybrid --pq keys). Hybrid --pq remains the
recommended default; --pq-only has no classical fallback, so a break
of ML-KEM-768 alone breaks the archive. In-tree, default build.
* Security (critical): AES-256-CTR keystream reuse under --dedup. Dedup
blocks all use sequence 0, so the previous nonce (base_nonce XOR seq)
collapsed to a single value across blocks, reusing the CTR keystream
(a many-time-pad). Each block now uses a fresh random 128-bit nonce
stored in the block prefix and bound into the block MAC; block_seq is
still bound as MAC AAD. Regression test tests/test_dedup_nonce.sh.
Re-encrypt any --dedup encrypted archives written by <= 4.1.0.
* keygen --sdk / --box on a source-only build now fails with a clear
message pointing to native --pq / --pq-only (or a WITH_SDK=1 build).
* Wire format v1.6 unchanged; the 0x06 envelope is additive.
-- Cristian Cezar Moisés <sac@securityops.co> Wed, 09 Jul 2026 12:00:00 +0000
vaptvupt (4.1.0-1) UNRELEASED; urgency=high
* Source-only build: the prebuilt vendored libraries libzuptsdk.so and

4
packaging/homebrew/vaptvupt.rb
View file

@ -23,8 +23,8 @@
class Vaptvupt < Formula
desc "Post-quantum backup compression utility (ML-KEM-768 + AES-256-CTR + HMAC-SHA256)"
homepage "https://git.securityops.co/cristiancmoises/zupt"
url "https://git.securityops.co/cristiancmoises/zupt/releases/download/v4.1.0/vaptvupt-4.1.0.tar.gz"
version "4.1.0"
url "https://git.securityops.co/cristiancmoises/zupt/releases/download/v4.2.0/vaptvupt-4.2.0.tar.gz"
version "4.2.0"
sha256 "REPLACE_WITH_SHA256_OF_RELEASE_TARBALL"
license "AGPL-3.0-or-later"

2
packaging/nix/flake.nix
View file

@ -33,7 +33,7 @@
zupt = pkgs.stdenv.mkDerivation {
pname = "vaptvupt";
version = "4.1.0";
version = "4.2.0";
# When publishing, replace this with `fetchurl` against the
# release tarball. For local development the flake assumes it

16
packaging/opensuse/README.md
View file

@ -1,12 +1,12 @@
# openSUSE Build Service update for `home:cabelo:innovators/vaptvupt`
This directory contains the three files needed to build vaptvupt `4.1.0`
This directory contains the three files needed to build vaptvupt `4.2.0`
in OBS:
| File | Purpose |
|---------------|-------------------------------------------------------------------------|
| `_service` | `revision` pinned to `v4.1.0`. Format unchanged (still `tar_scm`). |
| `vaptvupt.spec` | `Version: 4.1.0`. `License: AGPL-3.0-or-later`. `%check` calls `make check`. |
| `_service` | `revision` pinned to `v4.2.0`. Format unchanged (still `tar_scm`). |
| `vaptvupt.spec` | `Version: 4.2.0`. `License: AGPL-3.0-or-later`. `%check` calls `make check`. |
| `vaptvupt.changes`| Changelog for the 4.x series. Older history preserved verbatim. |
## Spec notes
@ -58,22 +58,22 @@ cp /path/to/vaptvupt-source/packaging/opensuse/_service .
cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.spec .
cp /path/to/vaptvupt-source/packaging/opensuse/vaptvupt.changes .
# 3. Trigger the service locally to fetch v4.1.0 from GitHub
# 3. Trigger the service locally to fetch v4.2.0 from GitHub
osc service runall
# Produces vaptvupt-4.1.0.tar.gz in the current directory.
# Produces vaptvupt-4.2.0.tar.gz in the current directory.
# 4. (Optional) Local build to verify before committing
osc build openSUSE_Tumbleweed x86_64
# 5. Commit upstream
osc status # confirm vaptvupt-4.1.0.tar.gz is staged alongside the
osc status # confirm vaptvupt-4.2.0.tar.gz is staged alongside the
# three text files
osc commit -m "Update to 4.1.0"
osc commit -m "Update to 4.2.0"
```
## Notes for future updates
* The `_service` `revision` is pinned to `v4.1.0`. To track a new
* The `_service` `revision` is pinned to `v4.2.0`. To track a new
release, edit that one line and re-run `osc service runall`.
* The spec's `Version:` field is hard-coded — when you bump `_service`
`revision`, also bump `Version:` to match.

2
packaging/opensuse/_service
View file

@ -2,7 +2,7 @@
<service name="tar_scm" mode="manual">
<param name="url">https://github.com/cristiancmoises/zupt</param>
<param name="scm">git</param>
<param name="revision">v4.1.0</param>
<param name="revision">v4.2.0</param>
<param name="versionformat">@PARENT_TAG@</param>
<param name="versionrewrite-pattern">v(.*)</param>
<param name="submodules">enable</param>

23
packaging/opensuse/vaptvupt.changes
View file

@ -1,3 +1,26 @@
-------------------------------------------------------------------
Wed Jul 9 12:00:00 UTC 2026 - Alessandro de Oliveira Faria <cabelo@opensuse.org>
- Update to 4.2.0:
* New native full (pure) post-quantum mode --pq-only: ML-KEM-768
(FIPS 203) as the sole key-establishment mechanism, with no
classical X25519 component (envelope type 0x06; archive key
SHA3-512(ml_ss || ml_ct || "ZUPT-PQ-ONLY-v1")). For compliance
postures that mandate a single NIST-standardised PQ primitive with
no classical KEM in the envelope (CNSA 2.0-style "PQ-only"). Keys
via keygen --pq-only. In-tree crypto, built in the default
source-only package. Hybrid --pq remains the recommended default;
--pq-only has no classical fallback.
* Security (critical): fixed AES-256-CTR keystream reuse under
--dedup. Dedup blocks all use sequence 0, so the previous nonce
(base_nonce XOR seq) collapsed to a single value across blocks,
reusing the CTR keystream. Each block now uses a fresh random
128-bit nonce. Re-encrypt any --dedup encrypted archives written
by <= 4.1.0.
* keygen --sdk / --box now gives clear guidance toward native --pq /
--pq-only on a source-only build.
* Wire format v1.6 unchanged; the 0x06 envelope is additive.
-------------------------------------------------------------------
Tue Jul 7 12:00:00 UTC 2026 - Alessandro de Oliveira Faria <cabelo@opensuse.org>

2
packaging/opensuse/vaptvupt.spec
View file

@ -19,7 +19,7 @@
Name: vaptvupt
Version: 4.1.0
Version: 4.2.0
Release: 0
Summary: Post-quantum backup compression with AES-256 + ML-KEM-768 hybrid encryption
License: AGPL-3.0-or-later

12
packaging/rpm/vaptvupt.spec
View file

@ -20,7 +20,7 @@
# in the base.
Name: vaptvupt
Version: 4.1.0
Version: 4.2.0
Release: 1%{?dist}
Summary: Post-quantum backup compression utility (AES-256 + ML-KEM-768 + Argon2id, formerly Zupt)
@ -112,6 +112,16 @@ ln -sf libpqvaptvupt.so.0.6.0 %{buildroot}%{_libdir}/%{name}/libpqvaptvupt.so
%endif
%changelog
* Wed Jul 09 2026 Cristian Cezar Moisés <sac@securityops.co> - 4.2.0-1
- New native full (pure) post-quantum mode --pq-only: ML-KEM-768 as the
sole KEM, no classical X25519 (envelope 0x06). For "PQ-only" compliance
postures; hybrid --pq remains the recommended default. In-tree crypto.
- Security (critical): fixed AES-256-CTR keystream reuse under --dedup
(every block now uses a fresh random 128-bit nonce). Re-encrypt any
--dedup encrypted archives written by <= 4.1.0.
- Clearer keygen --sdk/--box guidance on source-only builds.
- Wire format v1.6 unchanged.
* Tue May 20 2025 Cristian Cezar Moisés <sac@securityops.co> - 2.4.4-1
- Initial Fedora/EPEL RPM package.
- Tracks upstream v2.4.4: distribution packaging release; archive