commit 726b90b5c29bbda72cda8bcbd19cf9115ab42b1c
parent ba03c8e56c18cdceac81ce132d38e80a4193e7eb
Author: Christian Grothoff <christian@grothoff.org>
Date: Fri, 31 Jul 2026 14:15:27 +0200
preps for v0.8.0
Diffstat:
| M | ChangeLog | | | 6 | ++++++ |
| M | NEWS | | | 53 | +++++++---------------------------------------------- |
2 files changed, 13 insertions(+), 46 deletions(-)
diff --git a/ChangeLog b/ChangeLog
@@ -1,3 +1,9 @@
+Fri Jul 31 02:14:29 PM CEST 2026
+ Updates for GNU Taler 1.6.0.
+ Breaking KDF change to reconcile differences
+ between C and TypeScript code.
+ Releasing Anastasis v0.8.0. -CG
+
Fri Dec 13 11:07:49 PM CET 2024
Updates for GNU Taler 0.14.0.
Various minor code fixes and cleanups.
diff --git a/NEWS b/NEWS
@@ -1,61 +1,26 @@
-Noteworthy changes in the next release
-======================================
+Noteworthy changes 0.8.0
+========================
* INCOMPATIBLE CHANGE, backups made by earlier C clients cannot be
- recovered.
-
- derive_key() used to pass the key derivation context to GNUnet's KDF as a
- *pointer*, so only the first byte of each context string was mixed in.
- Every key derived by anastasis_encrypt()/anastasis_decrypt() was therefore
- computed from the wrong input: recovery documents ("erd"), key shares
- ("eks"), truths ("ect"), per-policy master keys ("emk"), core secrets
- ("cse") and metadata ("rmd") -- and, for the secure-question method, only
- the first character of the answer took part in the derivation.
-
- The full context string is now used, which is what
- doc/sphinx/cryptography.rst always specified and what the TypeScript
- implementation has always done, so this makes the C code agree with the
- deployed protocol rather than changing it. The two are not compatible:
- data written by an earlier C client cannot be read by this one, and no
- fallback read path is provided.
+ recovered; the cause is some incongruence between the C and
+ TypeScript implementation where the C code had the KDF wrong which
+ was now resolved.
Recovery of such a backup fails with "failed to decrypt policy document
with the given identity attributes". There is no way for the client to
tell that case apart from genuinely mistyped identity attributes, since
the ciphertext looks the same either way -- the message names both
- possibilities for that reason.
-
- The protocol version was bumped for this, so a client and a provider that
- disagree about it refuse each other rather than failing later during
- recovery. Providers must be upgraded together with the clients that use
- them, and the TypeScript client must be on a version speaking the same
- protocol.
+ possibilities for that reason. Using an older client should still allow
+ recovery of the older backup.
* The provider REST API is now at protocol version 2:0:1. Clients that
advertise protocol version 0 (i.e. anything predating the key derivation
change above) are refused.
-* libanastasisutil has a new soname (libanastasisutil.so.1).
- ANASTASIS_CRYPTO_recovery_document_decrypt(), _keyshare_decrypt(),
- _truth_decrypt() and _core_secret_recover() changed from returning void to
- returning enum GNUNET_GenericReturnValue: they used to ignore decryption
- failures and then abort() on the result, so a malicious provider could
- crash a recovering client. Out-of-tree users of these functions --
- notably anastasis-gtk -- must be updated and rebuilt.
-
* Providers upgrading an existing database must run anastasis-dbinit to pick
up the stasis-0002 migration; it replaces the challenge-code index with
one garbage collection can actually use.
-* Garbage collection now runs as a single stored procedure and actually
- reclaims data: expired accounts with their recovery documents and
- payments, expired truths with their challenge codes and payments,
- challenge payments whose truth is gone, and stale IBAN authentication
- transfers. Previously it aborted with a foreign key violation for any
- account that had ever uploaded a recovery document, i.e. in the normal
- case, and reclaimed nothing. How long expired data is kept is now
- configurable via GC_BACKUP_GRACE and GC_PAYMENT_RETENTION.
-
* The build is hardened by default (PIE, RELRO/BIND_NOW, _FORTIFY_SOURCE,
stack protector); use ./configure --disable-hardening for profiling or
debugging.
@@ -65,7 +30,3 @@ Noteworthy changes in the next release
It now only writes inside the directory configured as
"[authorization-file] DIRECTORY".
-* Albania: identity numbers were rejected outright, because the validation
- regular expression was missing the day field and so could only match an
- 8-character number where a real one has 10. There is still no check-digit
- validation for Albania.
