NEWS (3751B)
1 Noteworthy changes in the next release 2 ====================================== 3 4 * INCOMPATIBLE CHANGE, backups made by earlier C clients cannot be 5 recovered. 6 7 derive_key() used to pass the key derivation context to GNUnet's KDF as a 8 *pointer*, so only the first byte of each context string was mixed in. 9 Every key derived by anastasis_encrypt()/anastasis_decrypt() was therefore 10 computed from the wrong input: recovery documents ("erd"), key shares 11 ("eks"), truths ("ect"), per-policy master keys ("emk"), core secrets 12 ("cse") and metadata ("rmd") -- and, for the secure-question method, only 13 the first character of the answer took part in the derivation. 14 15 The full context string is now used, which is what 16 doc/sphinx/cryptography.rst always specified and what the TypeScript 17 implementation has always done, so this makes the C code agree with the 18 deployed protocol rather than changing it. The two are not compatible: 19 data written by an earlier C client cannot be read by this one, and no 20 fallback read path is provided. 21 22 Recovery of such a backup fails with "failed to decrypt policy document 23 with the given identity attributes". There is no way for the client to 24 tell that case apart from genuinely mistyped identity attributes, since 25 the ciphertext looks the same either way -- the message names both 26 possibilities for that reason. 27 28 The protocol version was bumped for this, so a client and a provider that 29 disagree about it refuse each other rather than failing later during 30 recovery. Providers must be upgraded together with the clients that use 31 them, and the TypeScript client must be on a version speaking the same 32 protocol. 33 34 * The provider REST API is now at protocol version 2:0:1. Clients that 35 advertise protocol version 0 (i.e. anything predating the key derivation 36 change above) are refused. 37 38 * libanastasisutil has a new soname (libanastasisutil.so.1). 39 ANASTASIS_CRYPTO_recovery_document_decrypt(), _keyshare_decrypt(), 40 _truth_decrypt() and _core_secret_recover() changed from returning void to 41 returning enum GNUNET_GenericReturnValue: they used to ignore decryption 42 failures and then abort() on the result, so a malicious provider could 43 crash a recovering client. Out-of-tree users of these functions -- 44 notably anastasis-gtk -- must be updated and rebuilt. 45 46 * Providers upgrading an existing database must run anastasis-dbinit to pick 47 up the stasis-0002 migration; it replaces the challenge-code index with 48 one garbage collection can actually use. 49 50 * Garbage collection now runs as a single stored procedure and actually 51 reclaims data: expired accounts with their recovery documents and 52 payments, expired truths with their challenge codes and payments, 53 challenge payments whose truth is gone, and stale IBAN authentication 54 transfers. Previously it aborted with a foreign key violation for any 55 account that had ever uploaded a recovery document, i.e. in the normal 56 case, and reclaimed nothing. How long expired data is kept is now 57 configurable via GC_BACKUP_GRACE and GC_PAYMENT_RETENTION. 58 59 * The build is hardened by default (PIE, RELRO/BIND_NOW, _FORTIFY_SOURCE, 60 stack protector); use ./configure --disable-hardening for profiling or 61 debugging. 62 63 * The "file" authorization method, which is meant for testing, used the 64 client-supplied truth directly as the path it wrote the challenge code to. 65 It now only writes inside the directory configured as 66 "[authorization-file] DIRECTORY". 67 68 * Albania: identity numbers were rejected outright, because the validation 69 regular expression was missing the day field and so could only match an 70 8-character number where a real one has 10. There is still no check-digit 71 validation for Albania.