124958aea9
Add a native full post-quantum encryption mode and fix a critical keystream-reuse bug in deduplicated encrypted archives. Full post-quantum mode (--pq-only) - New envelope type 0x06 (ZUPT_ENC_PQ_ONLY): ML-KEM-768 (FIPS 203) as the sole key-establishment mechanism, with no classical X25519 component. Archive key = SHA3-512(ml_ss || ml_ct || "ZUPT-PQ-ONLY-v1"). - For compliance postures that require a single NIST-standardised PQ primitive with no classical KEM in the envelope (CNSA 2.0-style "PQ-only"). Hybrid --pq stays the recommended default; --pq-only has no classical fallback, so a break of ML-KEM-768 alone breaks it. - keygen --pq-only / keygen --pub --pq-only (ZPQK magic, 1200B pub / 3600B priv; not interchangeable with hybrid --pq keys). Wrong or tampered ciphertext is rejected via ML-KEM FO implicit rejection plus the HMAC-SHA256 Encrypt-then-MAC envelope. In-tree, default build. Security (critical): AES-256-CTR keystream reuse under --dedup - Dedup assigns block sequence 0 to every data block (the sentinel that keeps cross-file dedup references authenticating consistently). The per-block nonce was base_nonce XOR block_seq, so under --dedup every block collapsed to the same nonce, reusing the CTR keystream across distinct plaintexts (a many-time-pad). Each block now uses a fresh random 128-bit nonce stored in the block prefix and bound into the block MAC; block_seq is still bound as MAC AAD. Regression test: tests/test_dedup_nonce.sh. Re-encrypt any --dedup encrypted archives written by <= 4.1.0. Other - keygen --sdk / --box on a source-only build now fails with a clear message pointing to native --pq / --pq-only (or a WITH_SDK=1 build). - Documentation: README, SECURITY, THREAT_MODEL, man page, CHANGELOG, and all packaging recipes updated for the new mode and the security fix; version bumped to 4.2.0. Wire format v1.6 unchanged (0x06 is additive). Validation: make check 16/16, quick suite 11/11 (incl. PQ-only), dedup-nonce regression (all block nonces distinct), cppcheck clean.
120 lines
3.9 KiB
Nix
120 lines
3.9 KiB
Nix
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
#
|
|
# Nix flake for zupt.
|
|
#
|
|
# Usage (with flakes enabled):
|
|
# nix build .#zupt # build the package
|
|
# nix run .#zupt -- version # run zupt directly
|
|
# nix develop # drop into a dev shell
|
|
# nix flake check # lint the flake
|
|
#
|
|
# To consume from another flake:
|
|
# inputs.zupt.url = "git+https://git.securityops.co/cristiancmoises/zupt?ref=v2.4.4";
|
|
# ...packages.x86_64-linux.default = inputs.zupt.packages.x86_64-linux.zupt;
|
|
#
|
|
# Reproducibility:
|
|
# * Nix already pins the source tree by hash.
|
|
# * `make dist` is also reproducible (tests/test_dist_reproducible.sh).
|
|
# * Together, two independent Nix evaluations of the same flake.lock
|
|
# produce byte-identical /nix/store outputs.
|
|
|
|
{
|
|
description = "Zupt — post-quantum backup compression utility (C11)";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, flake-utils }:
|
|
flake-utils.lib.eachSystem [ "x86_64-linux" "aarch64-linux" ] (system:
|
|
let
|
|
pkgs = import nixpkgs { inherit system; };
|
|
|
|
zupt = pkgs.stdenv.mkDerivation {
|
|
pname = "vaptvupt";
|
|
version = "4.2.0";
|
|
|
|
# When publishing, replace this with `fetchurl` against the
|
|
# release tarball. For local development the flake assumes it
|
|
# lives in the same directory as the source.
|
|
src = ./.;
|
|
|
|
nativeBuildInputs = with pkgs; [
|
|
gcc
|
|
gnumake
|
|
];
|
|
|
|
# python3 is only used by the regression-test harness.
|
|
checkInputs = [ pkgs.python3 ];
|
|
|
|
# Build with the project's preferred warning set on top of Nix's
|
|
# hardening flags. Don't override -O2 from stdenv.
|
|
NIX_CFLAGS_COMPILE = "-Wall -Wextra -Wpedantic -std=c11";
|
|
|
|
# `make` builds the binary using vendored libzuptsdk via rpath.
|
|
buildPhase = ''
|
|
runHook preBuild
|
|
make -j$NIX_BUILD_CORES
|
|
runHook postBuild
|
|
'';
|
|
|
|
# Run the full upstream regression suite. Disable per-package by
|
|
# setting doCheck = false; on by default.
|
|
doCheck = true;
|
|
checkPhase = ''
|
|
runHook preCheck
|
|
make test
|
|
runHook postCheck
|
|
'';
|
|
|
|
installPhase = ''
|
|
runHook preInstall
|
|
make DESTDIR=$out PREFIX= install
|
|
|
|
# Move libzuptsdk into $out/lib/zupt/. The binary's rpath is
|
|
# $ORIGIN/../lib/zupt after autopatchelf rewrites it during
|
|
# the fixup phase.
|
|
mkdir -p $out/lib/zupt
|
|
install -m 0755 vendor/zuptsdk/libzuptsdk.so.2.0.0 \
|
|
$out/lib/zupt/libzuptsdk.so.2.0.0
|
|
ln -sf libzuptsdk.so.2.0.0 $out/lib/zupt/libzuptsdk.so.2
|
|
ln -sf libzuptsdk.so.2.0.0 $out/lib/zupt/libzuptsdk.so
|
|
|
|
# Docs
|
|
mkdir -p $out/share/doc/zupt
|
|
cp README.md SECURITY.md CHANGELOG.md AUDIT.md $out/share/doc/zupt/
|
|
runHook postInstall
|
|
'';
|
|
|
|
meta = with pkgs.lib; {
|
|
description = "Post-quantum backup compression utility (ML-KEM-768 + AES-256-CTR + HMAC-SHA256 + Argon2id)";
|
|
homepage = "https://git.securityops.co/cristiancmoises/zupt";
|
|
license = with licenses; [ agpl3Plus gpl3Plus ];
|
|
maintainers = [ ];
|
|
platforms = [ "x86_64-linux" "aarch64-linux" ];
|
|
mainProgram = "zupt";
|
|
};
|
|
};
|
|
in {
|
|
packages = {
|
|
zupt = zupt;
|
|
default = zupt;
|
|
};
|
|
|
|
apps.default = {
|
|
type = "app";
|
|
program = "${zupt}/bin/zupt";
|
|
};
|
|
|
|
devShells.default = pkgs.mkShell {
|
|
buildInputs = with pkgs; [
|
|
gcc
|
|
gnumake
|
|
python3
|
|
valgrind
|
|
gdb
|
|
];
|
|
};
|
|
});
|
|
}
|