Skip to content

Version 0.2.0

Pre-release
Pre-release
Compare
Choose a tag to compare
@paragonie-scott paragonie-scott released this 04 Jan 08:30
· 546 commits to master since this release
v0.2.0
This tag was signed with the committer’s verified signature.
paragonie-security P.I.E. Security Team
GPG key ID: 6B97A1C2826404DA
Learn about vigilant mode.
4c15b7b

PAST now has a basic reference implementation and a first draft for the specification.

Notable change to the cryptography since v0.1.0: We now feed data into MACs and signature algorithms in such a way to minimize the risk of canonicalization attacks. Although no practical exploits are known for HMAC-SHA384 or Poly1305, simply concatenating different values together as one giant string seems like a needlessly cavalier design decision. Our new serialization format should effectively mitigate any risks.

We're going to take some time to accept feedback from the community, polish up the documentation, and request review from professional cryptographers.

Unless a game-over protocol flaw is discovered, the current implementation should be assumed stable enough to serve as a reference point for developing implementations in other programming languages. However, don't deploy this in production until v1.0.0 has been tagged and released.

Assets 2
Loading