v4.1.0: source-only build, multithreaded-encryption fix, security hardening
Build from source with no vendored binaries: - Remove prebuilt libzuptsdk.so / libpqvaptvupt.so (and a stray .pyc). The default build needs only a C compiler + make; it links no external library and installs no .so. The libzuptsdk-backed modes (Argon2id KDF, --pq-sdk, --pq-box) are gated behind an opt-in `make WITH_SDK=1`. The default password KDF is PBKDF2-SHA256 and --pq (native ML-KEM-768 + X25519) is the built-in PQ mode. openSUSE/RPM/deb/AUR/Homebrew/Nix recipes bumped to 4.1.0; the openSUSE spec now builds source-only (%files ships no .so, %build/%install WITH_SDK=0). Fix: multithreaded encrypted archives were unextractable on the native AEAD path. The parallel compress/decompress workers skipped the F-09 frame-preface AAD that the serial path and the archive's AAD_PREFACE flag bind into every block MAC, so each multithreaded block failed authentication. The workers now bind the preface via a shared serializer; output is byte-identical across thread counts and interoperates with single-threaded archives (also fixes `--kdf pbkdf2 -t N` in any build). Security hardening (crafted-archive memory safety + crypto): - LZH raw code-length stack overflow + huff_lut OOB write - overflow-safe bounds in parse_index and solid-mode extract (heap OOB read) - SEQ decoder safe-zone heap overflow (litlen+matchlen reserve) - require the per-block ENCRYPTED flag on encrypted archives (plaintext forgery) - cap archive-supplied PBKDF2 iteration count (KDF-amplification DoS) - non-elidable secret wipe in the SDK path; restored disk images created 0600 Docs: remove AUDIT.md / BENCHMARKS.md / ROADMAP.md; trim marketing/AI-styled text and correct KDF/PQ facts across README, SECURITY, INSTALL, DISTRIBUTION, THREAT_MODEL, THIRD-PARTY-NOTICES, the man page, and packaging READMEs. Wire format v1.6 unchanged.
This commit is contained in:
Cristian Cezar Moisés
parent
136a96ed20
commit
4874010d0e
39 changed files with 1097 additions and 2770 deletions
|
|
@ -1,36 +1,25 @@
|
|||
THIRD-PARTY NOTICES
|
||||
===================
|
||||
|
||||
**VaptVupt contains no third-party source code.** Every line of source in
|
||||
this repository is the work of Cristian Cezar Moisés. This document
|
||||
exists for transparency about runtime dependencies and build-time
|
||||
tools.
|
||||
|
||||
If you redistribute VaptVupt, you must preserve this attribution document
|
||||
along with the LICENSE file.
|
||||
This document records VaptVupt's runtime dependencies and build-time
|
||||
tools. If you redistribute VaptVupt, you must preserve this attribution
|
||||
document along with the LICENSE file.
|
||||
|
||||
-------------------------------------------------------------------------
|
||||
Components shipped in this repository (all original work)
|
||||
Licensing
|
||||
-------------------------------------------------------------------------
|
||||
|
||||
| Component | Location | License | Author |
|
||||
|---|---|---|---|
|
||||
| vaptvupt CLI | src/, include/ | AGPL-3.0-or-later | Cristian Cezar Moisés |
|
||||
| libzuptsdk | sdk/, vendor/zuptsdk/include/ | AGPL-3.0-or-later | Cristian Cezar Moisés |
|
||||
| VaptVupt LZ codec | src/vv_*.c, src/vaptvupt_api.c, include/vaptvupt*.h | **GPL-3.0-or-later** | Cristian Cezar Moisés |
|
||||
| Jasmin constant-time crypto | jasmin/*.jazz, jasmin/*.s | AGPL-3.0-or-later | Cristian Cezar Moisés |
|
||||
| VaptVupt GUI (Python) | gui/ | AGPL-3.0-or-later | Cristian Cezar Moisés |
|
||||
**Note on VaptVupt LZ codec licensing**: the VaptVupt LZ codec
|
||||
(src/vv_*.c, src/vaptvupt_api.c, include/vaptvupt*.h) is licensed
|
||||
GPL-3.0-or-later (not AGPL like the rest of the project) so that, with
|
||||
sufficient maturity, it can be considered for upstreaming into the Linux
|
||||
or BSD kernels, which require GPL-compatible licenses. The author retains
|
||||
the right to dual-license the codec under other terms for commercial use;
|
||||
contact sac@securityops.co for inquiries.
|
||||
|
||||
**Note on VaptVupt licensing**: VaptVupt is licensed GPL-3.0-or-later
|
||||
(not AGPL like the rest of VaptVupt) so that, with sufficient maturity, it
|
||||
can be considered for upstreaming into the Linux or BSD kernels, which
|
||||
require GPL-compatible licenses. The author retains the right to dual-
|
||||
license VaptVupt under other terms for commercial use; contact
|
||||
sac@securityops.co for inquiries.
|
||||
|
||||
The rest of the project (vaptvupt CLI, libzuptsdk, Jasmin source, GUI) is
|
||||
licensed AGPL-3.0-or-later. Commercial licenses (relief from AGPL
|
||||
network-use clause) are available; contact sac@securityops.co.
|
||||
The rest of the project (vaptvupt CLI, Jasmin source, GUI) is licensed
|
||||
AGPL-3.0-or-later. Commercial licenses (relief from the AGPL network-use
|
||||
clause) are available; contact sac@securityops.co.
|
||||
|
||||
-------------------------------------------------------------------------
|
||||
Build-time tool (not redistributed)
|
||||
|
|
@ -59,12 +48,15 @@ at runtime and are NOT redistributed as part of VaptVupt.
|
|||
|
||||
**libargon2** — Argon2id password hashing function (RFC 9106)
|
||||
|
||||
Required only for: the optional `make WITH_SDK=1` build. The default
|
||||
build uses native PBKDF2-SHA256 and does not link
|
||||
libargon2.
|
||||
Linked at runtime: libargon2.so.1
|
||||
Version expected: 1.0+ (Debian/Ubuntu: libargon2-1)
|
||||
Upstream: https://github.com/P-H-C/phc-winner-argon2
|
||||
License: Apache-2.0 OR CC0-1.0 (dual)
|
||||
Copyright: (c) 2015 The Argon2 Authors
|
||||
Used by: Password-derived encryption mode
|
||||
Used by: Argon2id password-derived encryption mode
|
||||
|
||||
**OpenSSL libcrypto** — AES, SHA-256, AES-NI hardware backends
|
||||
|
||||
|
|
@ -79,9 +71,11 @@ at runtime and are NOT redistributed as part of VaptVupt.
|
|||
Compatibility with public standards
|
||||
-------------------------------------------------------------------------
|
||||
|
||||
Where VaptVupt implements public standards, it does so independently
|
||||
from any reference implementation. No code has been copied from
|
||||
external projects. Standards followed:
|
||||
Where VaptVupt implements public standards, it does so independently from
|
||||
any reference implementation. Other projects in the post-quantum hybrid
|
||||
encryption space (libsodium, age, Tink, rustls, etc.) were referenced as
|
||||
prior art during design, but no code was copied from any external
|
||||
project. Standards followed:
|
||||
|
||||
- FIPS 197 (AES)
|
||||
- FIPS 202 (Keccak / SHA-3)
|
||||
|
|
@ -94,11 +88,6 @@ external projects. Standards followed:
|
|||
- RFC 9106 (Argon2)
|
||||
- RFC 9180 (HPKE)
|
||||
|
||||
The VaptVupt project was designed independently. Other projects in the
|
||||
post-quantum hybrid encryption space (libsodium, age, Tink, rustls,
|
||||
etc.) were referenced as prior art during design but no code was
|
||||
copied. VaptVupt does not include any code from these projects.
|
||||
|
||||
-------------------------------------------------------------------------
|
||||
Reporting attribution issues
|
||||
-------------------------------------------------------------------------
|
||||
|
|
@ -114,8 +103,8 @@ with the subject "[third-party]" and details of the issue.
|
|||
License summary
|
||||
-------------------------------------------------------------------------
|
||||
|
||||
VaptVupt CLI, libzuptsdk, Jasmin source, GUI: AGPL-3.0-or-later
|
||||
VaptVupt LZ codec: GPL-3.0-or-later
|
||||
Commercial license (any component): contact sac@securityops.co
|
||||
VaptVupt CLI, Jasmin source, GUI: AGPL-3.0-or-later
|
||||
VaptVupt LZ codec: GPL-3.0-or-later
|
||||
Commercial license (any component): contact sac@securityops.co
|
||||
|
||||
Project home: https://git.securityops.co/cristiancmoises/vaptvupt
|
||||
|
|
|
|||
Loading…
Reference in a new issue