# Security Audit — VaptVupt v4.0.0 **Date:** 2026-05-20 **Author:** Cristian Cezar Moisés **Audit type:** Self-audit with formal verification (Jasmin CT proofs, ACSL contracts) and NIST/RFC test vectors **Status:** No independent third-party audit performed History: - v2.0.0 — 2026-03-29 — initial audit baseline. - v2.2.4 — 2026-05-19 — five findings (F-01..F-05) closed. - v2.2.5 — 2026-05-19 — F-06 (high) and F-07 closed. - v2.3.0 — 2026-05-20 — F-08 closed via AIT (format v1.4 → v1.5). - v2.3.1 — 2026-05-20 — F-09 closed via preface-AAD MAC (format v1.5 → v1.6). Exhaustive byte sweep on PQ-SDK archive: **0/1827 undetected**. - v2.4.0 — 2026-05-20 — Methodology release. §3.5 byte-sweep mandate added. - v2.4.1 — 2026-05-20 — F-10: KDF default flipped to Argon2id. - v2.4.2 — 2026-05-20 — F-11 closed: verbal probe-oracle eliminated. - v2.4.3 — 2026-05-20 — F-12: encrypted archive comments. Byte sweep on 1878-byte PQ-SDK+comment archive: **0/1878 undetected**. - v2.4.4 — 2026-05-20 — Distribution packaging + reproducible `make dist`. - v2.4.5 — 2026-05-20 — Packaging completion: RPM, Nix flake, DISTRIBUTION.md. - v2.4.6 — 2026-05-20 — CI rewrite + THREAT_MODEL.md. - v2.4.7 — 2026-05-20 — Manpage refresh and shell completions (bash, zsh, fish). Also corrected three stale banner strings that claimed PBKDF2 was the default KDF despite the v2.4.1 flip to Argon2id (user-visible text only; no behavioural change). No source changes that affect security posture; audit posture unchanged from v2.4.3. - v2.4.8 — 2026-05-24 — Distro-friendly release. New `make check` target (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v3.0.0 — 2026-05-25 — MAJOR: Zupt → VaptVupt INPI Brasil trademark rename. Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v3.0.1 — 2026-05-26 — GUI license cleanup (removed MIT credit line; gui/LICENSE-GUI rewritten AGPL-3.0-or-later with historical correction note). GUI version-string parsing bug fix (the v3.0.0 `replace("zupt ", "")` parser matched the wrong substring inside the new rename parenthetical, causing garbled window titles; fixed with anchored `_VERSION_RE`). New regression test tests/test_gui_branding.sh (11 assertions) wired into make check and make test. No source crypto changes; audit posture unchanged from v3.0.0 (which itself preserved the v2.3.1 baseline). Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v3.0.2 — 2026-05-26 — F-13 closed: usage() string literal in src/zupt_main.c exceeded C99's 4095-char ISO limit (was 4121). Refactored to 5 fprintf sections; -Woverlength-strings added to default CFLAGS so future regressions fail the build. Help text drift cleanup (stale "zupt" examples → "vaptvupt", stale "LZ77 + Huffman" → "VaptVupt LZ + ANS 2.48.5", license attribution). New regression test tests/test_help_consistency.sh (10 assertions including the F-13 byte-level guard). No source crypto changes; audit posture unchanged from v3.0.1. gui/LICENSE-GUI rewritten AGPL-3.0-or-later with historical correction note). GUI version-string parsing bug fix (the v3.0.0 `replace("zupt ", "")` parser matched the wrong substring inside the new rename parenthetical, causing garbled window titles; fixed with anchored `_VERSION_RE`). New regression test tests/test_gui_branding.sh (11 assertions) wired into make check and make test. No source crypto changes; audit posture unchanged from v3.0.0 (which itself preserved the v2.3.1 baseline). Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v3.0.3 — 2026-05-26 — Static-analysis cleanup. cppcheck knownConditionTrueFalse findings closed in varint decoders (dead `&& (x&0x80)` AND-branch after preceding terminator-byte early-return). -Wconversion / -Wsign-conversion findings closed with explicit casts at two sites. Our 9-file non-vendored C now compiles clean under the union of strict GCC warnings including -Wconversion -Wsign-conversion -Werror. New regression test tests/test_static_analysis.sh (7 assertions) wired into make check and make test. Behaviour byte-identical; F-09 byte sweep still 0/1827 silent accepts. No source crypto changes. src/zupt_main.c exceeded C99's 4095-char ISO limit (was 4121). Refactored to 5 fprintf sections; -Woverlength-strings added to default CFLAGS so future regressions fail the build. Help text drift cleanup (stale "zupt" examples → "vaptvupt", stale "LZ77 + Huffman" → "VaptVupt LZ + ANS 2.48.5", license attribution). New regression test tests/test_help_consistency.sh (10 assertions including the F-13 byte-level guard). No source crypto changes; audit posture unchanged from v3.0.1. gui/LICENSE-GUI rewritten AGPL-3.0-or-later with historical correction note). GUI version-string parsing bug fix (the v3.0.0 `replace("zupt ", "")` parser matched the wrong substring inside the new rename parenthetical, causing garbled window titles; fixed with anchored `_VERSION_RE`). New regression test tests/test_gui_branding.sh (11 assertions) wired into make check and make test. No source crypto changes; audit posture unchanged from v3.0.0 (which itself preserved the v2.3.1 baseline). Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v3.1.0 — 2026-05-31 — VaptVupt codec 2.48.5 -> 2.53.3 (API byte-identical; 3 .c files changed). Inherits 6 upstream corrupt-input decoder memory-safety fixes (v2.52.4 + v2.53.2). F-14 closed: ASAN found a heap-buffer-overflow WRITE of size 32 in OUR decode wrapper — decode buffers were malloc(uncompressed _size) with no slack, but the codec AVX2 over-copy needs >=32 B slack (documented contract in vaptvupt.h). Old codec never reached it; new wider AVX2 hot path does. Fixed with shared ZUPT_VV_DECODE_SLACK (64 B) guard on both single-threaded (zupt_format.c) and parallel (zupt_parallel.c) decode paths. Verified: ASAN 24/24 single-threaded + 15/15 multi-threaded; bit-flip fuzz 300 trials 0 crashes / 300 clean rejects. F-09 byte sweep still 0/1827. vv_decoder.c scalar build made -Werror clean for aarch64/Termux. New test tests/test_vv_decode _slack.sh. Wire format unchanged (v1.6); 3.0.3 archives extract byte-exact. knownConditionTrueFalse findings closed in varint decoders (dead `&& (x&0x80)` AND-branch after preceding terminator-byte early-return). -Wconversion / -Wsign-conversion findings closed with explicit casts at two sites. Our 9-file non-vendored C now compiles clean under the union of strict GCC warnings including -Wconversion -Wsign-conversion -Werror. New regression test tests/test_static_analysis.sh (7 assertions) wired into make check and make test. Behaviour byte-identical; F-09 byte sweep still 0/1827 silent accepts. No source crypto changes. src/zupt_main.c exceeded C99's 4095-char ISO limit (was 4121). Refactored to 5 fprintf sections; -Woverlength-strings added to default CFLAGS so future regressions fail the build. Help text drift cleanup (stale "zupt" examples → "vaptvupt", stale "LZ77 + Huffman" → "VaptVupt LZ + ANS 2.48.5", license attribution). New regression test tests/test_help_consistency.sh (10 assertions including the F-13 byte-level guard). No source crypto changes; audit posture unchanged from v3.0.1. gui/LICENSE-GUI rewritten AGPL-3.0-or-later with historical correction note). GUI version-string parsing bug fix (the v3.0.0 `replace("zupt ", "")` parser matched the wrong substring inside the new rename parenthetical, causing garbled window titles; fixed with anchored `_VERSION_RE`). New regression test tests/test_gui_branding.sh (11 assertions) wired into make check and make test. No source crypto changes; audit posture unchanged from v3.0.0 (which itself preserved the v2.3.1 baseline). Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v3.2.0 — 2026-06-01 — SHA-256 hardware acceleration (Intel SHA-NI). New SHA256RNDS2/MSG1/MSG2 compression path with CPUID runtime dispatch (has_shani, CPUID.07H:EBX[29]). Accelerates the Encrypt-then-MAC second pass (HMAC-SHA256) and PBKDF2. Security-relevant property: SHA-NI is constant-time by construction (no data-dependent memory access or branches), strengthening the side-channel posture of HMAC verification over attacker-influenced ciphertext vs the scalar software path. No cryptographic-correctness change: same SHA-256, same HMAC, same Encrypt-then-MAC, same wire bytes (format v1.6 unchanged). NIST FIPS 180-4 vectors pass on both paths; the 64 SHA-NI round constants are verified bit-identical to the scalar K[] table. Speedup ([ESTIMATED] 3-8x) NOT measured in this release — the build host lacks SHA-NI; figure to be confirmed on SHA-NI hardware. Scalar fallback unchanged and remains the path on non-SHA-NI CPUs (incl. aarch64). F-09 byte sweep still 0/1827. byte-identical; 3 .c files changed). Inherits 6 upstream corrupt-input decoder memory-safety fixes (v2.52.4 + v2.53.2). F-14 closed: ASAN found a heap-buffer-overflow WRITE of size 32 in OUR decode wrapper — decode buffers were malloc(uncompressed _size) with no slack, but the codec AVX2 over-copy needs >=32 B slack (documented contract in vaptvupt.h). Old codec never reached it; new wider AVX2 hot path does. Fixed with shared ZUPT_VV_DECODE_SLACK (64 B) guard on both single-threaded (zupt_format.c) and parallel (zupt_parallel.c) decode paths. Verified: ASAN 24/24 single-threaded + 15/15 multi-threaded; bit-flip fuzz 300 trials 0 crashes / 300 clean rejects. F-09 byte sweep still 0/1827. vv_decoder.c scalar build made -Werror clean for aarch64/Termux. New test tests/test_vv_decode _slack.sh. Wire format unchanged (v1.6); 3.0.3 archives extract byte-exact. knownConditionTrueFalse findings closed in varint decoders (dead `&& (x&0x80)` AND-branch after preceding terminator-byte early-return). -Wconversion / -Wsign-conversion findings closed with explicit casts at two sites. Our 9-file non-vendored C now compiles clean under the union of strict GCC warnings including -Wconversion -Wsign-conversion -Werror. New regression test tests/test_static_analysis.sh (7 assertions) wired into make check and make test. Behaviour byte-identical; F-09 byte sweep still 0/1827 silent accepts. No source crypto changes. src/zupt_main.c exceeded C99's 4095-char ISO limit (was 4121). Refactored to 5 fprintf sections; -Woverlength-strings added to default CFLAGS so future regressions fail the build. Help text drift cleanup (stale "zupt" examples → "vaptvupt", stale "LZ77 + Huffman" → "VaptVupt LZ + ANS 2.48.5", license attribution). New regression test tests/test_help_consistency.sh (10 assertions including the F-13 byte-level guard). No source crypto changes; audit posture unchanged from v3.0.1. gui/LICENSE-GUI rewritten AGPL-3.0-or-later with historical correction note). GUI version-string parsing bug fix (the v3.0.0 `replace("zupt ", "")` parser matched the wrong substring inside the new rename parenthetical, causing garbled window titles; fixed with anchored `_VERSION_RE`). New regression test tests/test_gui_branding.sh (11 assertions) wired into make check and make test. No source crypto changes; audit posture unchanged from v3.0.0 (which itself preserved the v2.3.1 baseline). Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v3.3.0 — 2026-06-01 — Incremental HMAC-SHA256 for the per-block Encrypt-then-MAC hot path. ipad/opad key prefix folded once per keyring; MAC streamed (aad || nonce || ciphertext || seq) instead of concatenated into a malloc'd buffer. SECURITY-RELEVANT: identical authentication semantics — the MAC is byte-for-byte the same (RFC 2104 + SHA-256 Merkle-Damgard associativity), proven by RFC 4231 vectors, a new equivalence test, and byte-exact decryption of 3.2.x archives. Constant-time tag compares unchanged (byte-OR accumulator / Jasmin zupt_mac_verify_ct). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. Reduces secret-data heap footprint: the old path copied the full ciphertext into a second malloc'd buffer per block — now removed. No cryptographic- correctness change, no wire-format change (v1.6). ASan clean on both KDF paths. SHA-NI). New SHA256RNDS2/MSG1/MSG2 compression path with CPUID runtime dispatch (has_shani, CPUID.07H:EBX[29]). Accelerates the Encrypt-then-MAC second pass (HMAC-SHA256) and PBKDF2. Security-relevant property: SHA-NI is constant-time by construction (no data-dependent memory access or branches), strengthening the side-channel posture of HMAC verification over attacker-influenced ciphertext vs the scalar software path. No cryptographic-correctness change: same SHA-256, same HMAC, same Encrypt-then-MAC, same wire bytes (format v1.6 unchanged). NIST FIPS 180-4 vectors pass on both paths; the 64 SHA-NI round constants are verified bit-identical to the scalar K[] table. Speedup ([ESTIMATED] 3-8x) NOT measured in this release — the build host lacks SHA-NI; figure to be confirmed on SHA-NI hardware. Scalar fallback unchanged and remains the path on non-SHA-NI CPUs (incl. aarch64). F-09 byte sweep still 0/1827. byte-identical; 3 .c files changed). Inherits 6 upstream corrupt-input decoder memory-safety fixes (v2.52.4 + v2.53.2). F-14 closed: ASAN found a heap-buffer-overflow WRITE of size 32 in OUR decode wrapper — decode buffers were malloc(uncompressed _size) with no slack, but the codec AVX2 over-copy needs >=32 B slack (documented contract in vaptvupt.h). Old codec never reached it; new wider AVX2 hot path does. Fixed with shared ZUPT_VV_DECODE_SLACK (64 B) guard on both single-threaded (zupt_format.c) and parallel (zupt_parallel.c) decode paths. Verified: ASAN 24/24 single-threaded + 15/15 multi-threaded; bit-flip fuzz 300 trials 0 crashes / 300 clean rejects. F-09 byte sweep still 0/1827. vv_decoder.c scalar build made -Werror clean for aarch64/Termux. New test tests/test_vv_decode _slack.sh. Wire format unchanged (v1.6); 3.0.3 archives extract byte-exact. knownConditionTrueFalse findings closed in varint decoders (dead `&& (x&0x80)` AND-branch after preceding terminator-byte early-return). -Wconversion / -Wsign-conversion findings closed with explicit casts at two sites. Our 9-file non-vendored C now compiles clean under the union of strict GCC warnings including -Wconversion -Wsign-conversion -Werror. New regression test tests/test_static_analysis.sh (7 assertions) wired into make check and make test. Behaviour byte-identical; F-09 byte sweep still 0/1827 silent accepts. No source crypto changes. src/zupt_main.c exceeded C99's 4095-char ISO limit (was 4121). Refactored to 5 fprintf sections; -Woverlength-strings added to default CFLAGS so future regressions fail the build. Help text drift cleanup (stale "zupt" examples → "vaptvupt", stale "LZ77 + Huffman" → "VaptVupt LZ + ANS 2.48.5", license attribution). New regression test tests/test_help_consistency.sh (10 assertions including the F-13 byte-level guard). No source crypto changes; audit posture unchanged from v3.0.1. gui/LICENSE-GUI rewritten AGPL-3.0-or-later with historical correction note). GUI version-string parsing bug fix (the v3.0.0 `replace("zupt ", "")` parser matched the wrong substring inside the new rename parenthetical, causing garbled window titles; fixed with anchored `_VERSION_RE`). New regression test tests/test_gui_branding.sh (11 assertions) wired into make check and make test. No source crypto changes; audit posture unchanged from v3.0.0 (which itself preserved the v2.3.1 baseline). Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v3.4.0 — 2026-06-01 — F-15: Argon2id KDF parameter transparency. The 0x04 Argon2id enc-header recorded only [type|salt|nonce] and nothing about the KDF cost (the PBKDF2 header records its iteration count). New archives append a one-byte KDF profile descriptor at offset 33 (ZUPT_ARGON2_PROFILE_MODERATE), making the header self- describing so a reader always knows which Argon2id cost produced the archive — eliminating a silent-undecryptability risk if the preset ever changes. The descriptor is covered by the F-08 archive- integrity trailer (tamper-evident; a flipped byte fails decryption, verified). Additive + back-compatible: legacy 33-byte archives decrypt byte-exact; 33B and 34B headers derive identical keys; unknown profiles are refused fail-closed (no wrong-key guessing). Build-time SDK-drift guard: the F-15 test asserts the KDF is deterministic and meets a coarse memory-hard cost floor (>=20 ms), failing the build if libzuptsdk is swapped for a weak/stub Argon2id. No cryptographic-correctness change, no wire-format change (v1.6). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. Note: the explicit RFC 9106 zsdk_argon2id() is header-declared but NOT exported by the vendored libzuptsdk.so, so the cost is recorded in- band rather than re-parameterised; revisit if the SDK exports it. Encrypt-then-MAC hot path. ipad/opad key prefix folded once per keyring; MAC streamed (aad || nonce || ciphertext || seq) instead of concatenated into a malloc'd buffer. SECURITY-RELEVANT: identical authentication semantics — the MAC is byte-for-byte the same (RFC 2104 + SHA-256 Merkle-Damgard associativity), proven by RFC 4231 vectors, a new equivalence test, and byte-exact decryption of 3.2.x archives. Constant-time tag compares unchanged (byte-OR accumulator / Jasmin zupt_mac_verify_ct). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. Reduces secret-data heap footprint: the old path copied the full ciphertext into a second malloc'd buffer per block — now removed. No cryptographic- correctness change, no wire-format change (v1.6). ASan clean on both KDF paths. SHA-NI). New SHA256RNDS2/MSG1/MSG2 compression path with CPUID runtime dispatch (has_shani, CPUID.07H:EBX[29]). Accelerates the Encrypt-then-MAC second pass (HMAC-SHA256) and PBKDF2. Security-relevant property: SHA-NI is constant-time by construction (no data-dependent memory access or branches), strengthening the side-channel posture of HMAC verification over attacker-influenced ciphertext vs the scalar software path. No cryptographic-correctness change: same SHA-256, same HMAC, same Encrypt-then-MAC, same wire bytes (format v1.6 unchanged). NIST FIPS 180-4 vectors pass on both paths; the 64 SHA-NI round constants are verified bit-identical to the scalar K[] table. Speedup ([ESTIMATED] 3-8x) NOT measured in this release — the build host lacks SHA-NI; figure to be confirmed on SHA-NI hardware. Scalar fallback unchanged and remains the path on non-SHA-NI CPUs (incl. aarch64). F-09 byte sweep still 0/1827. byte-identical; 3 .c files changed). Inherits 6 upstream corrupt-input decoder memory-safety fixes (v2.52.4 + v2.53.2). F-14 closed: ASAN found a heap-buffer-overflow WRITE of size 32 in OUR decode wrapper — decode buffers were malloc(uncompressed _size) with no slack, but the codec AVX2 over-copy needs >=32 B slack (documented contract in vaptvupt.h). Old codec never reached it; new wider AVX2 hot path does. Fixed with shared ZUPT_VV_DECODE_SLACK (64 B) guard on both single-threaded (zupt_format.c) and parallel (zupt_parallel.c) decode paths. Verified: ASAN 24/24 single-threaded + 15/15 multi-threaded; bit-flip fuzz 300 trials 0 crashes / 300 clean rejects. F-09 byte sweep still 0/1827. vv_decoder.c scalar build made -Werror clean for aarch64/Termux. New test tests/test_vv_decode _slack.sh. Wire format unchanged (v1.6); 3.0.3 archives extract byte-exact. knownConditionTrueFalse findings closed in varint decoders (dead `&& (x&0x80)` AND-branch after preceding terminator-byte early-return). -Wconversion / -Wsign-conversion findings closed with explicit casts at two sites. Our 9-file non-vendored C now compiles clean under the union of strict GCC warnings including -Wconversion -Wsign-conversion -Werror. New regression test tests/test_static_analysis.sh (7 assertions) wired into make check and make test. Behaviour byte-identical; F-09 byte sweep still 0/1827 silent accepts. No source crypto changes. src/zupt_main.c exceeded C99's 4095-char ISO limit (was 4121). Refactored to 5 fprintf sections; -Woverlength-strings added to default CFLAGS so future regressions fail the build. Help text drift cleanup (stale "zupt" examples → "vaptvupt", stale "LZ77 + Huffman" → "VaptVupt LZ + ANS 2.48.5", license attribution). New regression test tests/test_help_consistency.sh (10 assertions including the F-13 byte-level guard). No source crypto changes; audit posture unchanged from v3.0.1. gui/LICENSE-GUI rewritten AGPL-3.0-or-later with historical correction note). GUI version-string parsing bug fix (the v3.0.0 `replace("zupt ", "")` parser matched the wrong substring inside the new rename parenthetical, causing garbled window titles; fixed with anchored `_VERSION_RE`). New regression test tests/test_gui_branding.sh (11 assertions) wired into make check and make test. No source crypto changes; audit posture unchanged from v3.0.0 (which itself preserved the v2.3.1 baseline). Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v3.5.0 — 2026-06-01 — Measured constant-time MAC comparison (dudect-style). The MAC tag compare — the most timing-sensitive operation, where a leak is a forgery oracle — was carried as three duplicated inline byte-OR loops marked CT-REQUIRED but never measured. Consolidated into one audited primitive zupt_ct_memeq (volatile OR-accumulate, no early exit, branch-free fold), used by the v1.6 strict decrypt path and the F-08 archive-integrity-trailer check. New dudect-style timing test (tests/test_ct_timing.c): Welch t-test over fixed-equal vs random-differing tag classes, built at -O2 so it exercises the shipped code (incl. that the volatile sink survives the optimiser). Verdict is environment- relative: a leaky-memcmp positive control must show a clear leak in the same environment, and zupt_ct_memeq must show <=20% of that signal (measured ~1%; median of 5 runs; INCONCLUSIVE rather than vacuous-pass if the host is too coarse). A reintroduced early- return/branch pushes the ratio toward 1.0 and fails. This turns an asserted CT property into a measured one + CI regression guard. The formally-verified Jasmin zupt_mac_verify_ct path (v1.4/v1.5 legacy compare) and the F-06 two-candidate fold are unchanged. No cryptographic-correctness change, no wire-format change (v1.6). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. The 0x04 Argon2id enc-header recorded only [type|salt|nonce] and nothing about the KDF cost (the PBKDF2 header records its iteration count). New archives append a one-byte KDF profile descriptor at offset 33 (ZUPT_ARGON2_PROFILE_MODERATE), making the header self- describing so a reader always knows which Argon2id cost produced the archive — eliminating a silent-undecryptability risk if the preset ever changes. The descriptor is covered by the F-08 archive- integrity trailer (tamper-evident; a flipped byte fails decryption, verified). Additive + back-compatible: legacy 33-byte archives decrypt byte-exact; 33B and 34B headers derive identical keys; unknown profiles are refused fail-closed (no wrong-key guessing). Build-time SDK-drift guard: the F-15 test asserts the KDF is deterministic and meets a coarse memory-hard cost floor (>=20 ms), failing the build if libzuptsdk is swapped for a weak/stub Argon2id. No cryptographic-correctness change, no wire-format change (v1.6). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. Note: the explicit RFC 9106 zsdk_argon2id() is header-declared but NOT exported by the vendored libzuptsdk.so, so the cost is recorded in- band rather than re-parameterised; revisit if the SDK exports it. Encrypt-then-MAC hot path. ipad/opad key prefix folded once per keyring; MAC streamed (aad || nonce || ciphertext || seq) instead of concatenated into a malloc'd buffer. SECURITY-RELEVANT: identical authentication semantics — the MAC is byte-for-byte the same (RFC 2104 + SHA-256 Merkle-Damgard associativity), proven by RFC 4231 vectors, a new equivalence test, and byte-exact decryption of 3.2.x archives. Constant-time tag compares unchanged (byte-OR accumulator / Jasmin zupt_mac_verify_ct). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. Reduces secret-data heap footprint: the old path copied the full ciphertext into a second malloc'd buffer per block — now removed. No cryptographic- correctness change, no wire-format change (v1.6). ASan clean on both KDF paths. SHA-NI). New SHA256RNDS2/MSG1/MSG2 compression path with CPUID runtime dispatch (has_shani, CPUID.07H:EBX[29]). Accelerates the Encrypt-then-MAC second pass (HMAC-SHA256) and PBKDF2. Security-relevant property: SHA-NI is constant-time by construction (no data-dependent memory access or branches), strengthening the side-channel posture of HMAC verification over attacker-influenced ciphertext vs the scalar software path. No cryptographic-correctness change: same SHA-256, same HMAC, same Encrypt-then-MAC, same wire bytes (format v1.6 unchanged). NIST FIPS 180-4 vectors pass on both paths; the 64 SHA-NI round constants are verified bit-identical to the scalar K[] table. Speedup ([ESTIMATED] 3-8x) NOT measured in this release — the build host lacks SHA-NI; figure to be confirmed on SHA-NI hardware. Scalar fallback unchanged and remains the path on non-SHA-NI CPUs (incl. aarch64). F-09 byte sweep still 0/1827. byte-identical; 3 .c files changed). Inherits 6 upstream corrupt-input decoder memory-safety fixes (v2.52.4 + v2.53.2). F-14 closed: ASAN found a heap-buffer-overflow WRITE of size 32 in OUR decode wrapper — decode buffers were malloc(uncompressed _size) with no slack, but the codec AVX2 over-copy needs >=32 B slack (documented contract in vaptvupt.h). Old codec never reached it; new wider AVX2 hot path does. Fixed with shared ZUPT_VV_DECODE_SLACK (64 B) guard on both single-threaded (zupt_format.c) and parallel (zupt_parallel.c) decode paths. Verified: ASAN 24/24 single-threaded + 15/15 multi-threaded; bit-flip fuzz 300 trials 0 crashes / 300 clean rejects. F-09 byte sweep still 0/1827. vv_decoder.c scalar build made -Werror clean for aarch64/Termux. New test tests/test_vv_decode _slack.sh. Wire format unchanged (v1.6); 3.0.3 archives extract byte-exact. knownConditionTrueFalse findings closed in varint decoders (dead `&& (x&0x80)` AND-branch after preceding terminator-byte early-return). -Wconversion / -Wsign-conversion findings closed with explicit casts at two sites. Our 9-file non-vendored C now compiles clean under the union of strict GCC warnings including -Wconversion -Wsign-conversion -Werror. New regression test tests/test_static_analysis.sh (7 assertions) wired into make check and make test. Behaviour byte-identical; F-09 byte sweep still 0/1827 silent accepts. No source crypto changes. src/zupt_main.c exceeded C99's 4095-char ISO limit (was 4121). Refactored to 5 fprintf sections; -Woverlength-strings added to default CFLAGS so future regressions fail the build. Help text drift cleanup (stale "zupt" examples → "vaptvupt", stale "LZ77 + Huffman" → "VaptVupt LZ + ANS 2.48.5", license attribution). New regression test tests/test_help_consistency.sh (10 assertions including the F-13 byte-level guard). No source crypto changes; audit posture unchanged from v3.0.1. gui/LICENSE-GUI rewritten AGPL-3.0-or-later with historical correction note). GUI version-string parsing bug fix (the v3.0.0 `replace("zupt ", "")` parser matched the wrong substring inside the new rename parenthetical, causing garbled window titles; fixed with anchored `_VERSION_RE`). New regression test tests/test_gui_branding.sh (11 assertions) wired into make check and make test. No source crypto changes; audit posture unchanged from v3.0.0 (which itself preserved the v2.3.1 baseline). Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v3.6.0 — 2026-06-01 — NIST SP 800-38A AES-256-CTR known-answer vectors + ML-KEM self-test fixes. AES-256-CTR — the bulk cipher — previously had only indirect roundtrip coverage; added the canonical SP 800-38A F.5.5 (encrypt) and F.5.6 (decrypt) vectors, validating zupt_aes256_ctr against the standard on both the Jasmin AES-NI path (zupt_aes256_ctr4 + zupt_aes256_blk) and the C T-table fallback. Both match exactly, confirming the Jasmin single-block AES is correct vs the standard (retires the stale stack-offset concern for zupt_aes256_blk). Also fixed two ML-KEM-768 self-test bugs: (1) an inverted result check in test_vectors that printed OK when the self-test returned failure — it had been passing vacuously; (2) the NTT roundtrip self-test asserted a false ntt∘inv_ntt == identity (this pqcrystals/Kyber Montgomery convention recovers each coefficient scaled by R^-1 mod q = 169), now rewritten to assert the true consistent-linear-scaling invariant, which still catches genuine NTT bugs and no longer emits a misleading stderr "NTT roundtrip FAILED". ML-KEM correctness end-to-end was never affected — the K-PKE, KEM, and FIPS 203 roundtrip vectors and implicit-rejection all pass. No source-crypto behaviour change, no wire-format change (v1.6). test_vectors now 16 passed / 0 failed (was 14, one vacuous). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. (dudect-style). The MAC tag compare — the most timing-sensitive operation, where a leak is a forgery oracle — was carried as three duplicated inline byte-OR loops marked CT-REQUIRED but never measured. Consolidated into one audited primitive zupt_ct_memeq (volatile OR-accumulate, no early exit, branch-free fold), used by the v1.6 strict decrypt path and the F-08 archive-integrity-trailer check. New dudect-style timing test (tests/test_ct_timing.c): Welch t-test over fixed-equal vs random-differing tag classes, built at -O2 so it exercises the shipped code (incl. that the volatile sink survives the optimiser). Verdict is environment- relative: a leaky-memcmp positive control must show a clear leak in the same environment, and zupt_ct_memeq must show <=20% of that signal (measured ~1%; median of 5 runs; INCONCLUSIVE rather than vacuous-pass if the host is too coarse). A reintroduced early- return/branch pushes the ratio toward 1.0 and fails. This turns an asserted CT property into a measured one + CI regression guard. The formally-verified Jasmin zupt_mac_verify_ct path (v1.4/v1.5 legacy compare) and the F-06 two-candidate fold are unchanged. No cryptographic-correctness change, no wire-format change (v1.6). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. The 0x04 Argon2id enc-header recorded only [type|salt|nonce] and nothing about the KDF cost (the PBKDF2 header records its iteration count). New archives append a one-byte KDF profile descriptor at offset 33 (ZUPT_ARGON2_PROFILE_MODERATE), making the header self- describing so a reader always knows which Argon2id cost produced the archive — eliminating a silent-undecryptability risk if the preset ever changes. The descriptor is covered by the F-08 archive- integrity trailer (tamper-evident; a flipped byte fails decryption, verified). Additive + back-compatible: legacy 33-byte archives decrypt byte-exact; 33B and 34B headers derive identical keys; unknown profiles are refused fail-closed (no wrong-key guessing). Build-time SDK-drift guard: the F-15 test asserts the KDF is deterministic and meets a coarse memory-hard cost floor (>=20 ms), failing the build if libzuptsdk is swapped for a weak/stub Argon2id. No cryptographic-correctness change, no wire-format change (v1.6). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. Note: the explicit RFC 9106 zsdk_argon2id() is header-declared but NOT exported by the vendored libzuptsdk.so, so the cost is recorded in- band rather than re-parameterised; revisit if the SDK exports it. Encrypt-then-MAC hot path. ipad/opad key prefix folded once per keyring; MAC streamed (aad || nonce || ciphertext || seq) instead of concatenated into a malloc'd buffer. SECURITY-RELEVANT: identical authentication semantics — the MAC is byte-for-byte the same (RFC 2104 + SHA-256 Merkle-Damgard associativity), proven by RFC 4231 vectors, a new equivalence test, and byte-exact decryption of 3.2.x archives. Constant-time tag compares unchanged (byte-OR accumulator / Jasmin zupt_mac_verify_ct). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. Reduces secret-data heap footprint: the old path copied the full ciphertext into a second malloc'd buffer per block — now removed. No cryptographic- correctness change, no wire-format change (v1.6). ASan clean on both KDF paths. SHA-NI). New SHA256RNDS2/MSG1/MSG2 compression path with CPUID runtime dispatch (has_shani, CPUID.07H:EBX[29]). Accelerates the Encrypt-then-MAC second pass (HMAC-SHA256) and PBKDF2. Security-relevant property: SHA-NI is constant-time by construction (no data-dependent memory access or branches), strengthening the side-channel posture of HMAC verification over attacker-influenced ciphertext vs the scalar software path. No cryptographic-correctness change: same SHA-256, same HMAC, same Encrypt-then-MAC, same wire bytes (format v1.6 unchanged). NIST FIPS 180-4 vectors pass on both paths; the 64 SHA-NI round constants are verified bit-identical to the scalar K[] table. Speedup ([ESTIMATED] 3-8x) NOT measured in this release — the build host lacks SHA-NI; figure to be confirmed on SHA-NI hardware. Scalar fallback unchanged and remains the path on non-SHA-NI CPUs (incl. aarch64). F-09 byte sweep still 0/1827. byte-identical; 3 .c files changed). Inherits 6 upstream corrupt-input decoder memory-safety fixes (v2.52.4 + v2.53.2). F-14 closed: ASAN found a heap-buffer-overflow WRITE of size 32 in OUR decode wrapper — decode buffers were malloc(uncompressed _size) with no slack, but the codec AVX2 over-copy needs >=32 B slack (documented contract in vaptvupt.h). Old codec never reached it; new wider AVX2 hot path does. Fixed with shared ZUPT_VV_DECODE_SLACK (64 B) guard on both single-threaded (zupt_format.c) and parallel (zupt_parallel.c) decode paths. Verified: ASAN 24/24 single-threaded + 15/15 multi-threaded; bit-flip fuzz 300 trials 0 crashes / 300 clean rejects. F-09 byte sweep still 0/1827. vv_decoder.c scalar build made -Werror clean for aarch64/Termux. New test tests/test_vv_decode _slack.sh. Wire format unchanged (v1.6); 3.0.3 archives extract byte-exact. knownConditionTrueFalse findings closed in varint decoders (dead `&& (x&0x80)` AND-branch after preceding terminator-byte early-return). -Wconversion / -Wsign-conversion findings closed with explicit casts at two sites. Our 9-file non-vendored C now compiles clean under the union of strict GCC warnings including -Wconversion -Wsign-conversion -Werror. New regression test tests/test_static_analysis.sh (7 assertions) wired into make check and make test. Behaviour byte-identical; F-09 byte sweep still 0/1827 silent accepts. No source crypto changes. src/zupt_main.c exceeded C99's 4095-char ISO limit (was 4121). Refactored to 5 fprintf sections; -Woverlength-strings added to default CFLAGS so future regressions fail the build. Help text drift cleanup (stale "zupt" examples → "vaptvupt", stale "LZ77 + Huffman" → "VaptVupt LZ + ANS 2.48.5", license attribution). New regression test tests/test_help_consistency.sh (10 assertions including the F-13 byte-level guard). No source crypto changes; audit posture unchanged from v3.0.1. gui/LICENSE-GUI rewritten AGPL-3.0-or-later with historical correction note). GUI version-string parsing bug fix (the v3.0.0 `replace("zupt ", "")` parser matched the wrong substring inside the new rename parenthetical, causing garbled window titles; fixed with anchored `_VERSION_RE`). New regression test tests/test_gui_branding.sh (11 assertions) wired into make check and make test. No source crypto changes; audit posture unchanged from v3.0.0 (which itself preserved the v2.3.1 baseline). Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v3.7.0 — 2026-06-01 — ML-KEM-768 decapsulation comparison routed through the audited constant-time primitive. The implicit- rejection check (received ct vs re-encrypted ct', 1088 bytes) was an inline byte-OR loop marked CT-REQUIRED but never measured and not sharing the zupt_ct_memeq primitive introduced in 3.5.0. A timing leak there is a KEM decapsulation oracle (valid vs invalid ciphertext) that breaks IND-CCA2. It now calls zupt_ct_memeq(ct, ct_prime, 1088); the fail bit is (1 - equal) so ML-KEM output is byte-identical (FIPS 203 roundtrip, implicit- rejection vector, PQ-hybrid roundtrip, wrong-key rejection all pass). This was the LAST security-critical comparison using a bespoke inline loop — MAC tag, F-08 trailer, and ML-KEM decaps now all route through one audited, length-independent primitive. tests/test_ct_timing extended to 1088 bytes with a source-routing guard. HONEST SCOPING: the 1088-byte dudect numbers are reported informational, not pass/fail — at that size on a shared vCPU the signal is memory-dominated and memcmp is not a cleanly-leaking control, so the 32-byte environment-relative ratio does not transfer. Constant-timeness of the 1088-byte compare instead follows from (a) the 32-byte pass proving zupt_ct_memeq is CT, (b) zupt_ct_memeq being length-independent by construction (OR-accumulate, no early exit, no data-dependent branch), and (c) the source-routing guard confirming decaps uses it. No cryptographic-correctness change, no wire-format change (v1.6). test_vectors 16/0; F-09 byte sweep 0/1827; F-06 0/2000. vectors + ML-KEM self-test fixes. AES-256-CTR — the bulk cipher — previously had only indirect roundtrip coverage; added the canonical SP 800-38A F.5.5 (encrypt) and F.5.6 (decrypt) vectors, validating zupt_aes256_ctr against the standard on both the Jasmin AES-NI path (zupt_aes256_ctr4 + zupt_aes256_blk) and the C T-table fallback. Both match exactly, confirming the Jasmin single-block AES is correct vs the standard (retires the stale stack-offset concern for zupt_aes256_blk). Also fixed two ML-KEM-768 self-test bugs: (1) an inverted result check in test_vectors that printed OK when the self-test returned failure — it had been passing vacuously; (2) the NTT roundtrip self-test asserted a false ntt∘inv_ntt == identity (this pqcrystals/Kyber Montgomery convention recovers each coefficient scaled by R^-1 mod q = 169), now rewritten to assert the true consistent-linear-scaling invariant, which still catches genuine NTT bugs and no longer emits a misleading stderr "NTT roundtrip FAILED". ML-KEM correctness end-to-end was never affected — the K-PKE, KEM, and FIPS 203 roundtrip vectors and implicit-rejection all pass. No source-crypto behaviour change, no wire-format change (v1.6). test_vectors now 16 passed / 0 failed (was 14, one vacuous). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. (dudect-style). The MAC tag compare — the most timing-sensitive operation, where a leak is a forgery oracle — was carried as three duplicated inline byte-OR loops marked CT-REQUIRED but never measured. Consolidated into one audited primitive zupt_ct_memeq (volatile OR-accumulate, no early exit, branch-free fold), used by the v1.6 strict decrypt path and the F-08 archive-integrity-trailer check. New dudect-style timing test (tests/test_ct_timing.c): Welch t-test over fixed-equal vs random-differing tag classes, built at -O2 so it exercises the shipped code (incl. that the volatile sink survives the optimiser). Verdict is environment- relative: a leaky-memcmp positive control must show a clear leak in the same environment, and zupt_ct_memeq must show <=20% of that signal (measured ~1%; median of 5 runs; INCONCLUSIVE rather than vacuous-pass if the host is too coarse). A reintroduced early- return/branch pushes the ratio toward 1.0 and fails. This turns an asserted CT property into a measured one + CI regression guard. The formally-verified Jasmin zupt_mac_verify_ct path (v1.4/v1.5 legacy compare) and the F-06 two-candidate fold are unchanged. No cryptographic-correctness change, no wire-format change (v1.6). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. The 0x04 Argon2id enc-header recorded only [type|salt|nonce] and nothing about the KDF cost (the PBKDF2 header records its iteration count). New archives append a one-byte KDF profile descriptor at offset 33 (ZUPT_ARGON2_PROFILE_MODERATE), making the header self- describing so a reader always knows which Argon2id cost produced the archive — eliminating a silent-undecryptability risk if the preset ever changes. The descriptor is covered by the F-08 archive- integrity trailer (tamper-evident; a flipped byte fails decryption, verified). Additive + back-compatible: legacy 33-byte archives decrypt byte-exact; 33B and 34B headers derive identical keys; unknown profiles are refused fail-closed (no wrong-key guessing). Build-time SDK-drift guard: the F-15 test asserts the KDF is deterministic and meets a coarse memory-hard cost floor (>=20 ms), failing the build if libzuptsdk is swapped for a weak/stub Argon2id. No cryptographic-correctness change, no wire-format change (v1.6). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. Note: the explicit RFC 9106 zsdk_argon2id() is header-declared but NOT exported by the vendored libzuptsdk.so, so the cost is recorded in- band rather than re-parameterised; revisit if the SDK exports it. Encrypt-then-MAC hot path. ipad/opad key prefix folded once per keyring; MAC streamed (aad || nonce || ciphertext || seq) instead of concatenated into a malloc'd buffer. SECURITY-RELEVANT: identical authentication semantics — the MAC is byte-for-byte the same (RFC 2104 + SHA-256 Merkle-Damgard associativity), proven by RFC 4231 vectors, a new equivalence test, and byte-exact decryption of 3.2.x archives. Constant-time tag compares unchanged (byte-OR accumulator / Jasmin zupt_mac_verify_ct). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. Reduces secret-data heap footprint: the old path copied the full ciphertext into a second malloc'd buffer per block — now removed. No cryptographic- correctness change, no wire-format change (v1.6). ASan clean on both KDF paths. SHA-NI). New SHA256RNDS2/MSG1/MSG2 compression path with CPUID runtime dispatch (has_shani, CPUID.07H:EBX[29]). Accelerates the Encrypt-then-MAC second pass (HMAC-SHA256) and PBKDF2. Security-relevant property: SHA-NI is constant-time by construction (no data-dependent memory access or branches), strengthening the side-channel posture of HMAC verification over attacker-influenced ciphertext vs the scalar software path. No cryptographic-correctness change: same SHA-256, same HMAC, same Encrypt-then-MAC, same wire bytes (format v1.6 unchanged). NIST FIPS 180-4 vectors pass on both paths; the 64 SHA-NI round constants are verified bit-identical to the scalar K[] table. Speedup ([ESTIMATED] 3-8x) NOT measured in this release — the build host lacks SHA-NI; figure to be confirmed on SHA-NI hardware. Scalar fallback unchanged and remains the path on non-SHA-NI CPUs (incl. aarch64). F-09 byte sweep still 0/1827. byte-identical; 3 .c files changed). Inherits 6 upstream corrupt-input decoder memory-safety fixes (v2.52.4 + v2.53.2). F-14 closed: ASAN found a heap-buffer-overflow WRITE of size 32 in OUR decode wrapper — decode buffers were malloc(uncompressed _size) with no slack, but the codec AVX2 over-copy needs >=32 B slack (documented contract in vaptvupt.h). Old codec never reached it; new wider AVX2 hot path does. Fixed with shared ZUPT_VV_DECODE_SLACK (64 B) guard on both single-threaded (zupt_format.c) and parallel (zupt_parallel.c) decode paths. Verified: ASAN 24/24 single-threaded + 15/15 multi-threaded; bit-flip fuzz 300 trials 0 crashes / 300 clean rejects. F-09 byte sweep still 0/1827. vv_decoder.c scalar build made -Werror clean for aarch64/Termux. New test tests/test_vv_decode _slack.sh. Wire format unchanged (v1.6); 3.0.3 archives extract byte-exact. knownConditionTrueFalse findings closed in varint decoders (dead `&& (x&0x80)` AND-branch after preceding terminator-byte early-return). -Wconversion / -Wsign-conversion findings closed with explicit casts at two sites. Our 9-file non-vendored C now compiles clean under the union of strict GCC warnings including -Wconversion -Wsign-conversion -Werror. New regression test tests/test_static_analysis.sh (7 assertions) wired into make check and make test. Behaviour byte-identical; F-09 byte sweep still 0/1827 silent accepts. No source crypto changes. src/zupt_main.c exceeded C99's 4095-char ISO limit (was 4121). Refactored to 5 fprintf sections; -Woverlength-strings added to default CFLAGS so future regressions fail the build. Help text drift cleanup (stale "zupt" examples → "vaptvupt", stale "LZ77 + Huffman" → "VaptVupt LZ + ANS 2.48.5", license attribution). New regression test tests/test_help_consistency.sh (10 assertions including the F-13 byte-level guard). No source crypto changes; audit posture unchanged from v3.0.1. gui/LICENSE-GUI rewritten AGPL-3.0-or-later with historical correction note). GUI version-string parsing bug fix (the v3.0.0 `replace("zupt ", "")` parser matched the wrong substring inside the new rename parenthetical, causing garbled window titles; fixed with anchored `_VERSION_RE`). New regression test tests/test_gui_branding.sh (11 assertions) wired into make check and make test. No source crypto changes; audit posture unchanged from v3.0.0 (which itself preserved the v2.3.1 baseline). Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. - v4.0.0 — 2026-06-10 — Stack integration: codec → canonical 2.60.4 (security release; OOB heap write in AVX2 exact-size decode fixed; CBMC-verified BCJ). F-16 found, disclosed, fixed (see Findings). New --pq-box mode via vendored libpqvaptvupt 0.6.0 (HKDF-SHA256 domain-separated combiner; 13/13 adversarial checks; ASan/UBSan clean). New exact-content_size decode regression (80 cases, ASan). SHA-NI measured 5.8× same-box; v3.2.0 estimate retired. Clang strict build restored (as(1) for Jasmin .s). 8-mode back-compat byte-exact. - v4.0.0 — 2026-06-10 — F-16: data loss in ≤3.8.0 BCJ encoding (pre-existing; found by the 4.0.0 back-compat matrix; fixed by the codec move to canonical 2.60.4). The ≤3.8.0 tree vendored a divergent pre-release BCJ (upstream 2.53.3 has no BCJ; it landed in 2.53.4). On BCJ-detected executable content at L8/L9 the old encoder emitted streams that no decoder accepts — including 3.8.0 itself (verified: the 3.8.0 binary fails on the archive it just wrote; defect is at write time, deterministic on the binary fixture). L≤7 and non-BCJ content unaffected: the 8-mode matrix (plain L1/L5/L9, store, Argon2id, PBKDF2, --pq, --pq-sdk) decodes byte-exact under 4.0.0. Remediation: re-create affected archives with ≥4.0.0 and verify extraction before deleting sources. Regression guard: tests/test_codec_exact_size.sh includes tool-level BCJ roundtrips (L5/L9, real ELF fixture) plus 80 exact-size codec decodes under ASan covering the upstream OOB fix class. Forward-compat note: ≤3.8.0 cannot read 4.0.0 archives where the auto-filter fired (L3+ on ELF/PE/Mach-O); upgrade readers first in mixed fleets. - v3.8.0 — 2026-06-01 — Documentation-only release: consolidated measured benchmarks (BENCHMARKS.md). No source, cryptographic, or wire-format change — the binary is identical in behaviour to 3.7.0 (format v1.6). Publishes a complete reproducible benchmark set (compression ratio/throughput, encode-speed-vs-level, the KDF-vs-per-block crypto overhead split, and a head-to-head ratio comparison against zstd that shows where VaptVupt loses) with the test machine and method stated per table. The SHA-NI speedup is explicitly marked [ESTIMATED] as the test box has no SHA-NI. No new findings; all prior guarantees unchanged: test_vectors 16/0, F-09 byte sweep 0/1827, F-06 1-bit HMAC fuzz 0/2000, every security-critical comparison through the audited constant-time primitive. through the audited constant-time primitive. The implicit- rejection check (received ct vs re-encrypted ct', 1088 bytes) was an inline byte-OR loop marked CT-REQUIRED but never measured and not sharing the zupt_ct_memeq primitive introduced in 3.5.0. A timing leak there is a KEM decapsulation oracle (valid vs invalid ciphertext) that breaks IND-CCA2. It now calls zupt_ct_memeq(ct, ct_prime, 1088); the fail bit is (1 - equal) so ML-KEM output is byte-identical (FIPS 203 roundtrip, implicit- rejection vector, PQ-hybrid roundtrip, wrong-key rejection all pass). This was the LAST security-critical comparison using a bespoke inline loop — MAC tag, F-08 trailer, and ML-KEM decaps now all route through one audited, length-independent primitive. tests/test_ct_timing extended to 1088 bytes with a source-routing guard. HONEST SCOPING: the 1088-byte dudect numbers are reported informational, not pass/fail — at that size on a shared vCPU the signal is memory-dominated and memcmp is not a cleanly-leaking control, so the 32-byte environment-relative ratio does not transfer. Constant-timeness of the 1088-byte compare instead follows from (a) the 32-byte pass proving zupt_ct_memeq is CT, (b) zupt_ct_memeq being length-independent by construction (OR-accumulate, no early exit, no data-dependent branch), and (c) the source-routing guard confirming decaps uses it. No cryptographic-correctness change, no wire-format change (v1.6). test_vectors 16/0; F-09 byte sweep 0/1827; F-06 0/2000. vectors + ML-KEM self-test fixes. AES-256-CTR — the bulk cipher — previously had only indirect roundtrip coverage; added the canonical SP 800-38A F.5.5 (encrypt) and F.5.6 (decrypt) vectors, validating zupt_aes256_ctr against the standard on both the Jasmin AES-NI path (zupt_aes256_ctr4 + zupt_aes256_blk) and the C T-table fallback. Both match exactly, confirming the Jasmin single-block AES is correct vs the standard (retires the stale stack-offset concern for zupt_aes256_blk). Also fixed two ML-KEM-768 self-test bugs: (1) an inverted result check in test_vectors that printed OK when the self-test returned failure — it had been passing vacuously; (2) the NTT roundtrip self-test asserted a false ntt∘inv_ntt == identity (this pqcrystals/Kyber Montgomery convention recovers each coefficient scaled by R^-1 mod q = 169), now rewritten to assert the true consistent-linear-scaling invariant, which still catches genuine NTT bugs and no longer emits a misleading stderr "NTT roundtrip FAILED". ML-KEM correctness end-to-end was never affected — the K-PKE, KEM, and FIPS 203 roundtrip vectors and implicit-rejection all pass. No source-crypto behaviour change, no wire-format change (v1.6). test_vectors now 16 passed / 0 failed (was 14, one vacuous). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. (dudect-style). The MAC tag compare — the most timing-sensitive operation, where a leak is a forgery oracle — was carried as three duplicated inline byte-OR loops marked CT-REQUIRED but never measured. Consolidated into one audited primitive zupt_ct_memeq (volatile OR-accumulate, no early exit, branch-free fold), used by the v1.6 strict decrypt path and the F-08 archive-integrity-trailer check. New dudect-style timing test (tests/test_ct_timing.c): Welch t-test over fixed-equal vs random-differing tag classes, built at -O2 so it exercises the shipped code (incl. that the volatile sink survives the optimiser). Verdict is environment- relative: a leaky-memcmp positive control must show a clear leak in the same environment, and zupt_ct_memeq must show <=20% of that signal (measured ~1%; median of 5 runs; INCONCLUSIVE rather than vacuous-pass if the host is too coarse). A reintroduced early- return/branch pushes the ratio toward 1.0 and fails. This turns an asserted CT property into a measured one + CI regression guard. The formally-verified Jasmin zupt_mac_verify_ct path (v1.4/v1.5 legacy compare) and the F-06 two-candidate fold are unchanged. No cryptographic-correctness change, no wire-format change (v1.6). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. The 0x04 Argon2id enc-header recorded only [type|salt|nonce] and nothing about the KDF cost (the PBKDF2 header records its iteration count). New archives append a one-byte KDF profile descriptor at offset 33 (ZUPT_ARGON2_PROFILE_MODERATE), making the header self- describing so a reader always knows which Argon2id cost produced the archive — eliminating a silent-undecryptability risk if the preset ever changes. The descriptor is covered by the F-08 archive- integrity trailer (tamper-evident; a flipped byte fails decryption, verified). Additive + back-compatible: legacy 33-byte archives decrypt byte-exact; 33B and 34B headers derive identical keys; unknown profiles are refused fail-closed (no wrong-key guessing). Build-time SDK-drift guard: the F-15 test asserts the KDF is deterministic and meets a coarse memory-hard cost floor (>=20 ms), failing the build if libzuptsdk is swapped for a weak/stub Argon2id. No cryptographic-correctness change, no wire-format change (v1.6). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. Note: the explicit RFC 9106 zsdk_argon2id() is header-declared but NOT exported by the vendored libzuptsdk.so, so the cost is recorded in- band rather than re-parameterised; revisit if the SDK exports it. Encrypt-then-MAC hot path. ipad/opad key prefix folded once per keyring; MAC streamed (aad || nonce || ciphertext || seq) instead of concatenated into a malloc'd buffer. SECURITY-RELEVANT: identical authentication semantics — the MAC is byte-for-byte the same (RFC 2104 + SHA-256 Merkle-Damgard associativity), proven by RFC 4231 vectors, a new equivalence test, and byte-exact decryption of 3.2.x archives. Constant-time tag compares unchanged (byte-OR accumulator / Jasmin zupt_mac_verify_ct). F-09 byte sweep 0/1827; F-06 1-bit HMAC fuzz 0/2000. Reduces secret-data heap footprint: the old path copied the full ciphertext into a second malloc'd buffer per block — now removed. No cryptographic- correctness change, no wire-format change (v1.6). ASan clean on both KDF paths. SHA-NI). New SHA256RNDS2/MSG1/MSG2 compression path with CPUID runtime dispatch (has_shani, CPUID.07H:EBX[29]). Accelerates the Encrypt-then-MAC second pass (HMAC-SHA256) and PBKDF2. Security-relevant property: SHA-NI is constant-time by construction (no data-dependent memory access or branches), strengthening the side-channel posture of HMAC verification over attacker-influenced ciphertext vs the scalar software path. No cryptographic-correctness change: same SHA-256, same HMAC, same Encrypt-then-MAC, same wire bytes (format v1.6 unchanged). NIST FIPS 180-4 vectors pass on both paths; the 64 SHA-NI round constants are verified bit-identical to the scalar K[] table. Speedup ([ESTIMATED] 3-8x) NOT measured in this release — the build host lacks SHA-NI; figure to be confirmed on SHA-NI hardware. Scalar fallback unchanged and remains the path on non-SHA-NI CPUs (incl. aarch64). F-09 byte sweep still 0/1827. byte-identical; 3 .c files changed). Inherits 6 upstream corrupt-input decoder memory-safety fixes (v2.52.4 + v2.53.2). F-14 closed: ASAN found a heap-buffer-overflow WRITE of size 32 in OUR decode wrapper — decode buffers were malloc(uncompressed _size) with no slack, but the codec AVX2 over-copy needs >=32 B slack (documented contract in vaptvupt.h). Old codec never reached it; new wider AVX2 hot path does. Fixed with shared ZUPT_VV_DECODE_SLACK (64 B) guard on both single-threaded (zupt_format.c) and parallel (zupt_parallel.c) decode paths. Verified: ASAN 24/24 single-threaded + 15/15 multi-threaded; bit-flip fuzz 300 trials 0 crashes / 300 clean rejects. F-09 byte sweep still 0/1827. vv_decoder.c scalar build made -Werror clean for aarch64/Termux. New test tests/test_vv_decode _slack.sh. Wire format unchanged (v1.6); 3.0.3 archives extract byte-exact. knownConditionTrueFalse findings closed in varint decoders (dead `&& (x&0x80)` AND-branch after preceding terminator-byte early-return). -Wconversion / -Wsign-conversion findings closed with explicit casts at two sites. Our 9-file non-vendored C now compiles clean under the union of strict GCC warnings including -Wconversion -Wsign-conversion -Werror. New regression test tests/test_static_analysis.sh (7 assertions) wired into make check and make test. Behaviour byte-identical; F-09 byte sweep still 0/1827 silent accepts. No source crypto changes. src/zupt_main.c exceeded C99's 4095-char ISO limit (was 4121). Refactored to 5 fprintf sections; -Woverlength-strings added to default CFLAGS so future regressions fail the build. Help text drift cleanup (stale "zupt" examples → "vaptvupt", stale "LZ77 + Huffman" → "VaptVupt LZ + ANS 2.48.5", license attribution). New regression test tests/test_help_consistency.sh (10 assertions including the F-13 byte-level guard). No source crypto changes; audit posture unchanged from v3.0.1. gui/LICENSE-GUI rewritten AGPL-3.0-or-later with historical correction note). GUI version-string parsing bug fix (the v3.0.0 `replace("zupt ", "")` parser matched the wrong substring inside the new rename parenthetical, causing garbled window titles; fixed with anchored `_VERSION_RE`). New regression test tests/test_gui_branding.sh (11 assertions) wired into make check and make test. No source crypto changes; audit posture unchanged from v3.0.0 (which itself preserved the v2.3.1 baseline). Codec upgrade to VaptVupt LZ + ANS 2.48.5 (two libFuzzer-found fixes: csz==0 OOB-READ in vv_dstream_decompress_chunk; UBSan-safe pointer arithmetic in vv_copy_match). GUI binary-discovery bug fixed with liveness-checking _find_vaptvupt + discovery log. Enhanced manpage (597 lines). Wire format unchanged at v1.6. Bidirectional v2.x ↔ v3.0.0 archive compatibility verified. F-09 byte sweep still 0/1827 silent accepts; F-06 HMAC fuzz still 0/2000. No new findings, no findings reopened. Security posture unchanged. (curated 10-suite, 91-assertion subset) for OBS / Debian / RPM `%check` sections. openSUSE OBS files rewritten for cabelo (`home:cabelo:innovators/zupt`): license corrected MIT → AGPL-3.0-or-later, version bumped 1.5.5 → 2.4.8, changelog history preserved. No source changes; audit posture unchanged from v2.3.1. --- ## 1. Cryptographic Test Vector Verification All primitives tested against published reference vectors: | Primitive | Standard | Vectors | Status | |-----------|----------|---------|--------| | SHA-256 | FIPS 180-4 | 3 (empty, "abc", 448-bit) | **PASS** | | HMAC-SHA256 | RFC 4231 | 2 (TC2: "Jefe", TC3: 20×0xAA) | **PASS** | | AES-256-CTR | NIST SP 800-38A | 2 (F.5.5 encrypt, F.5.6 decrypt; 4 blocks) | **PASS** | | SHA3-256 | FIPS 202 | 2 (empty, "abc") | **PASS** | | SHAKE-128 | FIPS 202 | 1 (empty, 128-bit output) | **PASS** | | X25519 | RFC 7748 §5.2 | 2 (both test vectors) | **PASS** | | ML-KEM-768 | FIPS 203 | 2 (5-trial roundtrip + implicit rejection) | **PASS** | | XXH64 | xxHash spec | 1 (empty string, seed=0) | **PASS** | | ML-KEM-768 self-test | internal | 1 (NTT consistent-scaling + CBD bounds) | **PASS** | | **Total** | | **16** | **16/16 PASS** | ## 2. Jasmin Constant-Time Verification | Function | Purpose | Status | |----------|---------|--------| | `zupt_mac_verify_ct` | HMAC comparison | **✅ Linked, CT-proven** | | `zupt_ct_select_32` | ML-KEM FO select | **✅ Linked, CT-proven** | | `zupt_fe_cswap` | X25519 conditional swap | **✅ Linked, CT-proven** | | `zupt_aes256_blk` | AES-256 single-block (AES-NI) | **✅ Linked, CT by hardware** | | `zupt_aes256_ctr4` | AES-256 4-block pipeline | **✅ Linked, CT by hardware** | ## 3. ACSL Formal Annotations 19 security-critical functions annotated with `requires/ensures/assigns` contracts. Target: `frama-c -wp -wp-rte -wp-model Typed+Cast` ## 4. Security Hardening | Feature | Status | |---------|--------| | mlock() key protection | **✅ Active** | | Buffer canaries (keyring) | **✅ Active** | | Always-decrypt timing mitigation | **✅ Active** | | AFL++ fuzz harnesses | **✅ Available** (`make fuzz-build`) | ## 5. VaptVupt Codec Tests | Test | Status | |------|--------| | Roundtrip all 3 modes (UF/BAL/EXT) | **PASS** | | Roundtrip + AES-256 encryption | **PASS** | | Roundtrip + PQ hybrid encryption | **PASS** | | Roundtrip + multi-threaded | **PASS** | | Roundtrip + solid mode | **PASS** | | Incompressible fallback to store | **PASS** | | Empty/small input | **PASS** | | Multi-block (2 MB) | **PASS** | | **Total** | **11/11 PASS** | | Suite | Tests | Result | What It Covers | |-------|-------|--------|----------------| | Regression | 16 | **16/16 PASS** | All codecs, modes, encryption, edge cases, corruption detection | | Multi-threaded | 14 | **14/14 PASS** | N=1/2/4/8 threads, large files, 1000 files, MT+encryption | | Post-quantum | 10 | **10/10 PASS** | Keygen, PQ encrypt/decrypt, wrong key, password compat, PQ+MT, 2MB | | Quick smoke | 9 | **9/9 PASS** | Normal, solid, encrypted, wrong pw, MT, fast, store, PQ, integrity | | NIST vectors | 14 | **14/14 PASS** | See table above | | **Total** | **62** | **62/62 PASS** | | Reproduction: `make test-all` --- ## 3. Memory Safety | Tool | Command | Result | |------|---------|--------| | AddressSanitizer | `make test-asan` | **Zero errors** | | UndefinedBehaviorSanitizer | Built with `-fsanitize=address,undefined` | **Zero errors** | | All code paths tested | Normal + solid + encrypted + PQ + MT | **Clean** | Reproduction: ```bash make test-asan ./zupt_asan compress /tmp/t.zupt /path/to/data/ ./zupt_asan extract -o /tmp/out/ /tmp/t.zupt ./zupt_asan keygen -o /tmp/k.key ./zupt_asan compress --pq /tmp/pub.key /tmp/pq.zupt /path/to/data/ ./zupt_asan extract --pq /tmp/k.key -o /tmp/pqout/ /tmp/pq.zupt ``` --- ## 4. Compiler Warning Audit | Compiler | Flags | Warnings | |----------|-------|----------| | GCC 13.x | `-Wall -Wextra -Wpedantic -O2 -std=c11` | **Zero** | | Clang 18.x | `-Wall -Wextra -Wpedantic -O2 -std=c11` | **Zero** | --- ## 5. Constant-Time Analysis | Function | Location | CT Method | Jasmin Verified? | Risk Level | |----------|----------|-----------|-----------------|------------| | HMAC comparison | `zupt_crypto.c:252` | 4×u64 XOR accumulation | **Yes** — `zupt_mac_verify_ct` linked | **None** (Jasmin proven) | | ML-KEM FO select | `zupt_mlkem.c:593` | 4×u64 masked select | **Yes** — `zupt_ct_select_32` linked | **None** (Jasmin proven) | | ML-KEM NTT butterfly | `zupt_mlkem.c` | Montgomery reduction (branchless) | No | Low | | ML-KEM CBD sampling | `zupt_mlkem.c` | Bitwise operations only | No | Low | | X25519 fe_cswap | `zupt_x25519.c:95` | Masked XOR swap | No (limb mismatch) | Low (C is branchless) | | X25519 Montgomery ladder | `zupt_x25519.c:243` | Fixed 255 iterations | No | Low | | AES-256 encrypt | `zupt_aes256.c:59` | **Table-based S-box** | **No** | **HIGH on shared HW** | | SHA-256 | `zupt_sha256.c` | Table-based constants | No | Low (not secret-indexed) | | Keccak-f[1600] | `zupt_keccak.c` | Bitwise XOR/ROT only | No | None | | Key wipe | `zupt_crypto.c` | `explicit_bzero` / volatile | No | Low | ### Jasmin Assembly Verification Two functions confirmed active in binary via `nm`: ``` 0000000000014ae0 T zupt_mac_verify_ct ← Jasmin assembly, CT proven 0000000000014b20 T zupt_ct_select_32 ← Jasmin assembly, CT proven ``` Assembly generated by `jasminc 2026.03.0`. Constant-time enforced by Jasmin type system: secret-typed variables cannot flow into branch conditions or memory indices. ### Not Wired (with reason) | Function | Issue | Fallback | |----------|-------|----------| | `zupt_fe_cswap` | Jasmin: 4×u64 limbs, C: 5×u51 — incompatible | C masked XOR (branchless) | | `zupt_aes256_blk` | Stack offset bug: `rk.[1]` → `[rsp+1]` not `[rsp+16]` | C table-based AES | --- ## 6. Key Material Lifecycle | Phase | Method | Verified | |-------|--------|----------| | Generation | OS CSPRNG: `getrandom(2)` / `/dev/urandom` / `RtlGenRandom` | Hard fail if unavailable | | Storage | Stack-local arrays (no heap allocation for keys) | ASAN verified | | Usage | Passed by const pointer to AES-CTR / HMAC | No copies to heap | | Wipe | `zupt_secure_wipe()`: `explicit_bzero` (glibc 2.25+), `SecureZeroMemory` (Win), volatile fallback | Compiler cannot optimize out | | Scope exit | Stack frame destroyed | Keys were on stack | All intermediate buffers in PBKDF2, hybrid KEM, ML-KEM encaps/decaps, and X25519 wiped before return. --- ## 7. Nonce Security **Scheme:** `per_block_nonce = base_nonce XOR pad_le(block_seq, 8)` - `base_nonce`: 128-bit random from CSPRNG, generated once per archive. - `block_seq`: monotonically increasing 0, 1, 2, ... per archive. - **Uniqueness within archive:** Guaranteed (distinct seq → distinct nonce). - **Uniqueness across archives:** 2^-128 collision probability per pair (birthday bound on random base). --- ## 8. Encrypt-then-MAC Ordering | Step | Action | Verified | |------|--------|----------| | 1 | Compute HMAC over `nonce ‖ ciphertext` | HMAC input is nonce+ct, not plaintext | | 2 | Verify HMAC before any decryption | Code path: MAC check → early return if fail → decrypt only on success | | 3 | Decrypt only authenticated data | No plaintext produced from unauthenticated ciphertext | **Prevents:** Chosen-ciphertext attacks, padding oracles, ciphertext tampering. --- ## 9. Bugs Found and Fixed (v0.5.1 → v1.5.0) | Bug | Severity | Version Fixed | Impact | |-----|----------|---------------|--------| | Huffman Kraft-inequality violation | Critical | v0.5.1 | Data corruption on specific inputs | | Heap-buffer-overflow in LZ match finder | Critical | v0.5.1 | Potential code execution | | `rand()` CSPRNG fallback | Critical | v0.5.1 | Predictable encryption keys | | ML-KEM `poly_basemul` OOB | Critical | v1.0.0 | Buffer overread in NTT | | ML-KEM missing `poly_tomont` | Critical | v1.0.0 | Public key in wrong domain | | ML-KEM inverted FO `cmov` | Critical | v1.0.0 | Always selected rejection key | | ML-KEM `inv_ntt` wrong table | High | v1.0.0 | NTT roundtrip failure | | PQ nonce mismatch | High | v1.0.0 | Encrypt/decrypt used different nonces | | X25519 `AA + a24*E` formula | High | v1.1.0 | Wrong curve, not interoperable | | Dead `match_cost()` | Low | v1.1.0 | Clang warning | | `const polyvec` qualifier | Low | v1.1.0 | Pedantic warnings | | `__int128` pedantic | Low | v1.1.0 | Pedantic warning | --- ## 10. Known Limitations | Limitation | Impact | Mitigation | Status | |------------|--------|------------|--------| | Table-based AES (C fallback) | Cache-timing on shared hardware | Jasmin AES-NI path exists but has offset bug | **Open** — fix `.jazz` source | | Table-based SHA-256 | Theoretical cache-timing | Not used on secret-indexed data | **Accepted** | | PBKDF2 not quantum-safe | Quantum password brute-force | Use `--pq` mode | **Documented** | | No `mlock()` | Keys swappable to disk | Short key lifetime + `zupt_secure_wipe` | **Planned** | | No fuzzing performed | Undiscovered bugs | AFL++ setup in FUZZING.md | **Planned** | | No independent audit | Self-assessed only | Open source + Jasmin proofs | **Planned** | | X25519 Jasmin not linked | C fallback for fe_cswap | C is branchless but compiler-dependent | **Open** — limb mismatch | --- © 2026 Cristian Cezar Moisés — AGPL-3.0-or-later --- ## v2.2.1 audit pass — 2026-04-27 This pass focused on the production-readiness of the libzuptsdk integration introduced in v2.2.0 and on adversarial review of the existing code paths not previously audited. ### Methodology Two-pass adversarial review: - **Pass A (read-and-reason):** read each source file, identify invariants, ask "what does an attacker control?", "what happens at boundaries?". - **Pass B (test-driven):** write a failing test that exercises the suspected bug, fix it, write a regression test that fails before the fix and passes after. When A and B disagreed, the discrepancy was investigated rather than papered over. ### Findings (all fixed in v2.2.1) | # | File:line | Severity | Description | |---|---|---|---| | 1 | `zupt_format.c:146` | low | varint reader truncated at 9 bytes | | 2 | `zupt_format.c:1529..1699` (×6) | medium | unchecked `fwrite` in extract path → silent corruption | | 3 | `zupt_crypto_sdk.c:90..` | low (defense-in-depth) | `mac_key` aliased to `enc_key` in SDK paths | | 4 | `zupt_lz.c:33` | high | `size_t` overflow in LZ length decoder | | 5 | `zupt_format.c:1610,1681` | high | dedup-ref recursion + OOB seek (DoS) | | 6 | `zupt_format.c:446,883` | low | encrypt failure left partial archive | The only finding rated as high severity (#4 and #5) are exploitable from a malicious archive: an attacker who can convince the user to extract their archive could trigger a process crash. None of the findings allow code execution or key recovery; the AEAD layer's authentication tag still prevents arbitrary writes. ### Test coverage after fixes | Suite | Count | Status | |---|---|---| | Native (run_quick.sh) | 9 | ✓ | | SDK roundtrip (test_sdk.sh) | 11 | ✓ | | Audit double-validated (test_audit.sh) | 10 | ✓ NEW | | Inherited from libzuptsdk 2.1.5 | 169 | ✓ | | Inherited fuzz iterations (ASAN-clean) | 750,000 | ✓ | | **Total verified test points** | **199 + 750k fuzz** | **✓** | ### Notes for users If you are using zupt in production: - v2.2.1 is a recommended upgrade. - Archives written with v2.2.0 or earlier remain readable; no migration needed. - The high-severity findings (#4, #5) only affect the *extract* path. If you only ever extract archives you created yourself, you are not affected by them. If you accept third-party archives, upgrade. - The `--pq-sdk` mode introduced in v2.2.0 was not affected by any of these findings; it was introduced clean and remained clean. --- ## 2026-04-27 — v2.2.1 audit pass Internal code review against an internal audit checklist (AUDIT_PROMPT — superseded by FORMAL_AUDIT_PROMPT.md). Six bugs identified and fixed in the same release. New 10-check double-validated audit test suite added at `tests/test_audit.sh`. ### Bugs found and fixed | # | File:line | Severity | Description | |---|---|---|---| | 1 | `src/zupt_format.c:146` | low | uint64 varint truncated to 63 bits | | 2 | `src/zupt_format.c` (×6) | medium | unchecked `fwrite` returns in extract path | | 3 | `src/zupt_crypto_sdk.c` | low | `mac_key` was copy of `enc_key`, now KDF-split | | 4 | `src/zupt_lz.c:33` | high | `lz_read_extra` size_t overflow → OOB copy | | 5 | `src/zupt_format.c` (×2) | medium | dedup-ref forward offset + recursion accepted | | 6 | `src/zupt_format.c` (×2) | low | partial archive not removed on encrypt-init fail | ### Test methodology - **Path A**: code review identifies invariant; a failing test is constructed. - **Path B**: an independent property-based check exercises the same invariant from a different angle. - A test passes only when A and B agree. Disagreement is treated as a finding. 10 audit checks across four categories (authenticated archives, format security, format compatibility, robustness). All passing. ### Cumulative test surface (2.2.1) | Suite | Tests | Status | |---|---|---| | `make test` (run_quick) | 9 | ✓ | | `tests/test_sdk.sh` | 11 | ✓ | | `tests/test_audit.sh` | 10 | ✓ | | **zupt total** | **30** | **✓** | | Inherited libzuptsdk audit | 42 | ✓ | | Inherited libzuptsdk RFC + roundtrip | 84 | ✓ | | Inherited libzuptsdk binding contracts | 57 | ✓ | | Inherited libzuptsdk Wycheproof | 5 | ✓ | | **Combined zupt + SDK** | **218** | **✓** | | Mutation-fuzz iters (ASAN/UBSAN) | 750,000 | ✓ | ### Open items (not blockers) - No external audit yet. - `make test-asan` not wired into the zupt Makefile (only the SDK Makefile has it). - The deduplication path is structurally complex and would benefit from property-based testing (currently covered by 30 tests, none property-based). --- ## 2026-04-27 — v2.2.2 audit pass Second internal review against the same audit checklist, focused on format parser robustness and dedup path correctness. ### Bugs found and fixed (4) | # | File:line | Severity | Description | |---|---|---|---| | 7 | `zupt_format.c:166` | medium | realloc-pair atomicity: UB on partial failure | | 8 | `zupt_format.c:138` | low | in-memory varint decoder had same 9-byte truncation as file variant | | 9 | `zupt_format.c:1267` | medium | `encryption_header_off` not bounds-checked before seek | | 10 | `zupt_format.c:1402` | medium | `index_offset` not bounds-checked before seek | ### New test surface - 12 dedup property-based checks (`test_dedup_props.sh`) — covers byte-exact roundtrip, dedup space savings, 100%-duplicate sets, and dedup + PQ encryption interaction. - 1000 ASAN/UBSAN fuzz iterations (`fuzz_format`) — zero crashes, zero memory errors. ### Cumulative test surface (2.2.2) | Suite | Tests | Status | |---|---|---| | run_quick.sh | 9 | ✓ | | test_sdk.sh | 11 | ✓ | | test_audit.sh | 10 | ✓ | | test_dedup_props.sh | 12 | ✓ NEW | | **zupt total** | **42** | **✓** | | Format mutation fuzz (ASAN/UBSAN) | 1,000 iters | ✓ NEW | | Inherited libzuptsdk audit | 42 | ✓ | | Inherited libzuptsdk RFC + roundtrip | 84 | ✓ | | Inherited libzuptsdk binding contracts | 57 | ✓ | | Inherited libzuptsdk Wycheproof | 5 | ✓ | | Inherited libzuptsdk fuzz | 750,000 iters | ✓ | | **Combined zupt + SDK** | **260 tests + 751k fuzz** | **✓** | ### CI GitHub Actions workflow added at `.github/workflows/ci.yml`: build-and-test, asan-build, fuzz-format, package-deb. Each run exercises the full test surface plus fuzz under sanitizers and verifies the .deb installs cleanly. ### Open items - External audit still pending (cost-bound, not engineering-bound). - AppImage build via real `appimagetool` not yet automated in CI. - The fuzz harness uses a single fixed seed archive; corpus diversification (different file types, multi-file archives, encrypted seeds) would strengthen coverage further. --- ## 2026-04-27 — v2.2.2 formal audit (no version bump) Formal cryptographic audit pass conducted using methodology in `FORMAL_AUDIT_PROMPT.md`. Auditor profile: senior cryptographic engineering (15+ years production crypto). Threat model: government archives with 30+ year retention, financial institutions under Brazilian Central Bank Resolução 4.658/2018, healthcare (LGPD-Saúde), defense (CNSA 2.0 alignment). ### Methodology - **Path A**: line-by-line manual review with documented preconditions, postconditions, invariants, trust boundaries, failure modes. - **Path B**: independent adversarial test exercising the same invariant. - Bug confirmed only when both paths agreed. ### Bugs found and fixed (4) | # | File | Severity | Description | |---|---|---|---| | 11 | `zupt_format.c` (×2) | **HIGH** | Zip Slip path traversal in extract — `e->path` to `fopen` without validation | | 12 | `zupt_format.c` (×2) | **MEDIUM** | symlink-follow on extract output (`fopen "wb"` follows symlinks) | | 13 | `zupt_format.c:1593` | LOW | `size_t` overflow on solid-extract size cap (32-bit) | | 14 | `zupt_format.c:parse_index` | LOW | `count * sizeof(entry)` overflow before calloc (32-bit) | ### Cryptographic primitive review (no findings) Reviewed every public crypto path against: - FIPS 197 (AES) — key/IV size, counter init, nonce reuse - FIPS 202 (Keccak/SHA-3) — rate/capacity, no domain confusion - FIPS 203 (ML-KEM) — parameter set correctness, key sanitization, decap fault resistance - RFC 5297 (AES-SIV) — nonce-misuse resistance, AD coverage - RFC 5869 (HKDF) — salt-vs-IKM separation, info domain separation - RFC 7748 (X25519) — scalar clamping, all-zero output rejection - RFC 8439 (ChaCha20-Poly1305) — 192-bit XChaCha nonce, AD coverage - RFC 9106 (Argon2) — m≥64 MiB, t≥3, p≥1, salt≥16B - RFC 9180 (HPKE) — suite ID, mode binding, encap context Findings: **none**. All primitives correctly implemented. ### New regression test suite `tests/test_path_traversal.sh` — 5 property checks covering: 1. Patched archive with `../` entry does not escape parent dir 2. Patched archive with absolute path does not write to `/tmp/owned` 3. Symlink at extract target is not followed (sentinel preserved) 4. Legitimate paths still extract correctly 5. Deep nested safe paths still work ### Cumulative test surface (2.2.2 final) | Suite | Tests | Status | |---|---|---| | run_quick.sh | 9 | ✓ | | test_sdk.sh | 11 | ✓ | | test_audit.sh | 10 | ✓ | | test_dedup_props.sh | 12 | ✓ | | test_path_traversal.sh | 5 | ✓ NEW | | **zupt total** | **47** | **✓** | | Format mutation fuzz (ASAN/UBSAN) | 1,000 iters | ✓ | | Inherited libzuptsdk audit | 42 | ✓ | | Inherited libzuptsdk RFC + roundtrip | 84 | ✓ | | Inherited libzuptsdk binding contracts | 57 | ✓ | | Inherited libzuptsdk Wycheproof | 5 | ✓ | | Inherited libzuptsdk fuzz | 750,000 iters | ✓ | | **Combined zupt + SDK** | **265 tests + 751k fuzz** | **✓** | ### Portability re-verification Static portability scan: clean. - No unaligned pointer casts - No raw `/` separators (uses `ZUPT_PATH_SEP`) - No `htonl`/`ntohl`/struct casts (LE helpers throughout) - No POSIX-only headers without `#ifdef _WIN32` guards GCC + `-Wpedantic` build: clean. Win32 paths verified via `-D_WIN32 -E` synthetic preprocessing. ### Cumulative bug count across audit sprints | Sprint | Bugs found | Severity range | |---|---|---| | v2.2.1 (first audit) | 6 | low to high | | v2.2.2 (second audit) | 4 | low to medium | | v2.2.2 formal | 4 | low to **high** (Zip Slip path traversal) | | v2.2.2 sprint 4 | 1 | **critical** (silent extract via arg parser) | | v2.2.2 god-tier audit | 1 | **critical** (block-swap AEAD) | | **Total** | **16** | **all fixed and regression-tested** | ### Open items - External independent audit still pending (cost, not engineering) - Side-channel timing leak testing not performed - Cross-OS CI (macOS / Windows / FreeBSD runners) not yet wired - Formal verification beyond Jasmin constant-time primitives (F*, ProVerif) not pursued ## 2026-05-01 — v2.2.3 release audit (VaptVupt 2.48.2 integration) Two independent test passes performed: one on the working tree, a second on a clean build from the produced source tarball (`zupt-2.2.3-source.tar.gz`). Both passes identical and clean. ### Surfaces verified | Surface | Test target | Pass 1 | Pass 2 | Notes | |---|---|---|---|---| | Quick suite | `make test` | 9 + 11 + 10 + 12 + 5 + 8 + 6 = 61 OK | 61 OK | All `tests/*.sh` | | Regression | `tests/regression.sh` | 22/22 | 22/22 | T17 fixed (see CHANGELOG) | | Threaded | `tests/test_threaded.sh` | 14/14 | 14/14 | MT compress/decompress | | Post-quantum | `tests/test_pq.sh` | 10/10 | 10/10 | `--pq-sdk` and legacy `--pq` | | VaptVupt unit | `make test-vv` | 11/11 | 11/11 | All modes + format_v2 | | NIST vectors | `make test-vectors` | 14/14 | 14/14 | XXH64, SHA-256, ML-KEM (incl. internal self-test), X25519, AES, HMAC | | ASAN/UBSan | `make test-asan` | clean | clean | plain + password + `--pq-sdk`; levels 1, 5, 9 | | Format mutation fuzz | `make fuzz-format-run` | 1000 iters, 0 crashes | 1000 iters, 0 crashes | ASAN-instrumented binary as victim | | License audit | `make audit-licenses` | clean | clean | All SPDX correct (AGPL for Zupt, GPL for VaptVupt) | | GCC strict warnings | `-Wall -Wextra -Wpedantic` | 0 | 0 | C11 strict | | Disk backup | `zupt disk backup`/`restore` | byte-exact sha256 | — | 5 MB image, all PATTERN markers preserved | Cumulative cases passing: **112 across 12 suites**, both passes. ### Defect found and fixed in this release cycle VaptVupt 2.48.2 + `format_v2 = 1` + `VV_MODE_ULTRA_FAST` produces output the decoder rejects with `VV_ERR_OVERFLOW`. The combination is **not in VaptVupt's upstream test matrix** (`vaptvupt-2.48.2/tests/test_zupt_integration.c` exercises `format_v2` only with `BALANCED` and `EXTREME`). Caught by Zupt's own `tests/regression.sh` T17 (VaptVupt all levels) before release. Workaround in `src/vaptvupt_api.c`: set `opts.format_v2 = 0` for levels 1–2 (`VV_MODE_ULTRA_FAST`); leave `format_v2 = 1` for levels 3–9. To be reported upstream; once VaptVupt validates the combination the guard can be lifted. ### Defect found and fixed in this release cycle (build system) The `STALE_OBJS` arch-safety guard in `Makefile` was comparing the canonical strings `x86-64` (from `file(1)`) against `x86_64` (from `$(CC) -dumpmachine`) and treating them as different architectures, causing every `make` invocation to wipe and rebuild every `.o` file even on a consistent host. Both sides are now normalised through `tr -d '_-' | tr [:upper:] [:lower:]` so the comparison succeeds on a same-arch tree and only fires when the tarball really did include cross-arch objects. ### Packages produced and verified All built from the same source tree, then exercised end-to-end (encrypted compress + extract + sha256 byte-compare) outside the build host's normal library search path: | Package | File | Size | Roundtrip | |---|---|---|---| | Debian/Ubuntu | `zupt_2.2.3_amd64.deb` | 365 KB | encrypted OK | | RPM | `zupt-2.2.3-1.x86_64.rpm` | 468 KB | encrypted OK | | AppImage | `zupt-2.2.3-x86_64.AppImage` | 569 KB | encrypted OK (extracted) | | AppDir tarball | `zupt-2.2.3-x86_64.AppDir.tar.gz` | 377 KB | encrypted OK | | Generic Linux | `zupt-2.2.3-linux-x86_64.tar.gz` | 430 KB | encrypted OK | | Source | `zupt-2.2.3-source.tar.gz` | 736 KB | rebuilt + full suite OK | All six produce byte-identical output on the test corpus (records.csv + 256 KB random binary + hello.txt).