# Changelog

## [1.0.0] — 2026-03-21

### Stable Release
- **Archive format frozen at v1.4.** `FORMAT_STABLE` flag (bit 4) set in all v1.0+ archives. Future format changes require v2.0 with new magic bytes.
- **FORMAT.md:** Complete field-level specification of every byte in the archive format.
- **AUDIT.md:** Security audit checklist with findings and mitigations.
- **FUZZING.md:** AFL++ setup, corpus generation, expected coverage targets.
- **License changed:** GPL-3.0 → MIT. All source file headers updated.

## [0.7.0] — 2026-03-21

### Added — Post-Quantum Hybrid Encryption
- **ML-KEM-768 (FIPS 203)** pure C11 implementation in `src/zupt_mlkem.c` (~600 lines). Constant-time NTT, Barrett/Montgomery reduction, CBD sampling, Fujisaki-Okamoto CCA transform with implicit rejection.
- **X25519 (RFC 7748)** pure C11 implementation in `src/zupt_x25519.c` (~270 lines). Montgomery ladder, constant-time `fe_cswap`, 5×51-bit field arithmetic.
- **Keccak-f[1600]** with SHA3-256, SHA3-512, SHAKE-128, SHAKE-256 in `src/zupt_keccak.c` (~215 lines). Required by ML-KEM for hashing and sampling.
- **Hybrid KEM:** ML-KEM-768 + X25519 combined key encapsulation. Shared secret derived via `SHA3-512(ml_kem_ss XOR x25519_ss ‖ ct ‖ ephemeral_pk ‖ "ZUPT-HYBRID-v1")`. Secure if EITHER ML-KEM or X25519 is secure.
- **`zupt keygen`** subcommand generates ML-KEM-768 + X25519 keypair (`.zupt-key` format). `--pub` exports public key only.
- **`--pq <keyfile>`** flag for compress/extract/list/test. Encrypts with recipient's public key (no password needed).
- **Key file format:** `ZKEY` magic, version byte, flags, ML-KEM pk (1184B) + X25519 pk (32B) + optional sk (2400B + 32B), XXH64 checksum.
- **10-test PQ test suite** (`tests/test_pq.sh`): keygen, pubkey export, key sizes, PQ compress, round-trip, integrity, wrong-key rejection, password backward compat, PQ+MT, large file.

### Fixed — ML-KEM Bugs (Critical)
- **basemul array out-of-bounds:** Loop accessed `zetas[64+i]` past the 128-entry array. Fixed to 64 iterations with ±zeta per FIPS 203.
- **Missing `poly_tomont` in keygen:** Public key was computed without Montgomery domain normalization. K-PKE encrypt/decrypt produced different results.
- **Inverted cmov in FO decaps:** Constant-time conditional always selected the rejection key, even on valid ciphertext. Root cause: C integer promotion in `(diff-1) >> 8` expression.
- **`inv_ntt` used wrong zetas table:** Separate `zetas_inv[]` with incorrect values. Fixed to reuse `zetas[]` with k counting 127→0.
- **PQ nonce mismatch:** Encrypt and decrypt independently generated random `base_nonce`. Fixed: nonce stored in encryption header, decrypt reads it back.

### Changed
- Archive format: v1.3 → v1.4.
- Encryption header extended: `enc_type` prefix byte (0x01=PBKDF2, 0x02=PQ-Hybrid).
- Legacy v0.5 archives (no enc_type) still read correctly via fallback detection.
- `ZUPT_FLAG_PQ_HYBRID` (bit 3) added to global_flags.

### Security — No Regressions
- HMAC verified before decryption in every worker (unchanged).
- Constant-time MAC comparison (unchanged).
- Password mode (-p) fully backward compatible.
- All intermediate ML-KEM/X25519 key material wiped with `zupt_secure_wipe()`.

## [0.6.0] — 2026-03-21

### Added
- Multi-threaded compression (`-t <N>`). Batch-parallel pipeline. 14-test MT suite.

## [0.5.1] — 2026-03-21

### Fixed
- 16 bugs: Huffman over-subscription, heap-buffer-overflows, CSPRNG fallback removed, constant-time MAC, LE serialization, write error tracking.

## [0.4.0] — 2026-03-01

### Added
- Byte prediction preprocessor (Zupt-LZHP). Solid mode.

## [0.3.0] — 2026-02-15

### Added
- Zupt-LZH codec: LZ77 + Huffman, 1MB window, near-optimal parsing.

## [0.2.0] — 2026-01-20

### Added
- AES-256-CTR + HMAC-SHA256 encryption. PBKDF2. Directory recursion.

## [0.1.0] — 2026-01-01

### Added
- Initial release. Zupt-LZ codec, `.zupt` format, XXH64 checksums, CLI.