124958aea9
Add a native full post-quantum encryption mode and fix a critical keystream-reuse bug in deduplicated encrypted archives. Full post-quantum mode (--pq-only) - New envelope type 0x06 (ZUPT_ENC_PQ_ONLY): ML-KEM-768 (FIPS 203) as the sole key-establishment mechanism, with no classical X25519 component. Archive key = SHA3-512(ml_ss || ml_ct || "ZUPT-PQ-ONLY-v1"). - For compliance postures that require a single NIST-standardised PQ primitive with no classical KEM in the envelope (CNSA 2.0-style "PQ-only"). Hybrid --pq stays the recommended default; --pq-only has no classical fallback, so a break of ML-KEM-768 alone breaks it. - keygen --pq-only / keygen --pub --pq-only (ZPQK magic, 1200B pub / 3600B priv; not interchangeable with hybrid --pq keys). Wrong or tampered ciphertext is rejected via ML-KEM FO implicit rejection plus the HMAC-SHA256 Encrypt-then-MAC envelope. In-tree, default build. Security (critical): AES-256-CTR keystream reuse under --dedup - Dedup assigns block sequence 0 to every data block (the sentinel that keeps cross-file dedup references authenticating consistently). The per-block nonce was base_nonce XOR block_seq, so under --dedup every block collapsed to the same nonce, reusing the CTR keystream across distinct plaintexts (a many-time-pad). Each block now uses a fresh random 128-bit nonce stored in the block prefix and bound into the block MAC; block_seq is still bound as MAC AAD. Regression test: tests/test_dedup_nonce.sh. Re-encrypt any --dedup encrypted archives written by <= 4.1.0. Other - keygen --sdk / --box on a source-only build now fails with a clear message pointing to native --pq / --pq-only (or a WITH_SDK=1 build). - Documentation: README, SECURITY, THREAT_MODEL, man page, CHANGELOG, and all packaging recipes updated for the new mode and the security fix; version bumped to 4.2.0. Wire format v1.6 unchanged (0x06 is additive). Validation: make check 16/16, quick suite 11/11 (incl. PQ-only), dedup-nonce regression (all block nonces distinct), cppcheck clean.
71 lines
2.8 KiB
Ruby
71 lines
2.8 KiB
Ruby
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
#
|
|
# Homebrew formula for zupt.
|
|
#
|
|
# To publish:
|
|
# 1. Run `make dist` upstream to produce zupt-VERSION.tar.gz (reproducible).
|
|
# 2. Upload to a stable release URL.
|
|
# 3. Update `url`, `version`, and `sha256` below.
|
|
# 4. Submit to homebrew-core via PR OR host in your own tap
|
|
# (e.g. cristiancmoises/homebrew-tap).
|
|
#
|
|
# Local test:
|
|
# brew install --build-from-source ./zupt.rb
|
|
# brew test zupt
|
|
# brew audit --strict --online zupt
|
|
#
|
|
# Notes for macOS:
|
|
# * Jasmin assembly is disabled at build time on Darwin (no jasminc dep);
|
|
# the C fallback for AES-256-CTR / HMAC compare paths is shipped.
|
|
# * libzuptsdk is vendored and installed alongside the binary; the binary
|
|
# uses @loader_path rpath so users don't have to set DYLD paths.
|
|
|
|
class Vaptvupt < Formula
|
|
desc "Post-quantum backup compression utility (ML-KEM-768 + AES-256-CTR + HMAC-SHA256)"
|
|
homepage "https://git.securityops.co/cristiancmoises/zupt"
|
|
url "https://git.securityops.co/cristiancmoises/zupt/releases/download/v4.2.0/vaptvupt-4.2.0.tar.gz"
|
|
version "4.2.0"
|
|
sha256 "REPLACE_WITH_SHA256_OF_RELEASE_TARBALL"
|
|
license "AGPL-3.0-or-later"
|
|
|
|
depends_on "python@3.12" => :test # only for test-suite tamper harness
|
|
|
|
def install
|
|
# macOS build: no Jasmin, C-fallback crypto paths are used.
|
|
# The Makefile auto-detects Jasmin availability and falls back cleanly.
|
|
ENV["CFLAGS"] = "#{ENV.cflags} -O2 -std=c11 -Wall -Wextra"
|
|
|
|
system "make", "-j#{ENV.make_jobs}"
|
|
system "make", "DESTDIR=#{prefix}", "PREFIX=", "install"
|
|
|
|
# Vendored libzuptsdk goes into lib/zupt/ with @loader_path rpath.
|
|
# Note: Linux ships .so.2.0.0; macOS .dylib equivalent must be built
|
|
# separately by the vendored makefile. For the initial Homebrew
|
|
# submission this assumes the upstream tarball includes a .dylib build;
|
|
# if not, build it here.
|
|
lib_zupt = lib/"zupt"
|
|
lib_zupt.mkpath
|
|
if File.exist?("vendor/zuptsdk/libzuptsdk.dylib")
|
|
cp "vendor/zuptsdk/libzuptsdk.dylib", lib_zupt
|
|
elsif File.exist?("vendor/zuptsdk/libzuptsdk.so.2.0.0")
|
|
# Fallback: link Linux-style .so on macOS (works for direct loads but
|
|
# not for dlopen-on-Darwin scenarios). Upstream is tracking this.
|
|
cp "vendor/zuptsdk/libzuptsdk.so.2.0.0", lib_zupt
|
|
end
|
|
|
|
# Docs
|
|
doc.install "README.md", "SECURITY.md", "CHANGELOG.md", "AUDIT.md"
|
|
end
|
|
|
|
test do
|
|
# End-to-end sanity check: build a real archive, extract it, byte-compare.
|
|
(testpath/"input.txt").write("homebrew formula test payload\n")
|
|
system bin/"zupt", "c", "-p", "test", "out.zupt", "input.txt"
|
|
system bin/"zupt", "info", "out.zupt"
|
|
mkdir "extracted"
|
|
cd "extracted" do
|
|
system bin/"zupt", "x", "-p", "test", "../out.zupt"
|
|
end
|
|
system "diff", "-q", "input.txt", "extracted/input.txt"
|
|
end
|
|
end
|