CIRCL v1.6.5

What's Changed

• ascon: don't output plaintext if authentication fails by @bwesterb in #631
• Dilithium: don't accept signatures with trailing data by @bwesterb in #632
• Fix HPKE/KEM exact-length key unmarshaling by @drmikecrypto in #627
• Bump x/crypto and golangci-lint by @bwesterb in #637
• ecc/bls12381: reject trailing data in G1/G2 SetBytes by @bwesterb in #636
• eddilithium: fail verification if signature is wrong length by @bwesterb in #633
• tss/rsa: fix length check to prevent runtime out-of-bounds panic by @bwesterb in #640
• dleq: verify: return false instead of panic()ing on nil parameters by @bwesterb in #641
• ed448: document verification behaviour by @bwesterb in #642
• ed448: reject non-canonical point encodings by @bwesterb in #635
• slhdsa: ensure full reads when rand source is provided by @bwesterb in #634
• ed{25519,448}: don't accept trailing data for keys by @bwesterb in #643
• frodo: pack: fix accidental zero buffer assumption by @bwesterb in #645
• secretsharing: check that share ID is not zero. by @bwesterb in #644
• kyber: document pk isn't checked like ML-KEM by @bwesterb in #648
• zk/dleq: Don't accept trailing data on proof by @bwesterb in #649
• slhdsa: don't panic if prehash-hash is out of range by @bwesterb in #647
• goldilocks: don't panic when unmarshalling invalid point by @bwesterb in #646
• hpke: don't panic when unmarshalling opener/sealer from empty buffer by @bwesterb in #656
• ot/simot: don't panic on mismatched ciphertext lengths by @bwesterb in #655
• fourq: document point decoding is lenient by @bwesterb in #654
• oprf: add note on multiple Point encodings by @bwesterb in #653
• tss/rsa: don't panic when combining empty list of shares by @bwesterb in #652
• ecc/p384: document that package is not fully constant time by @bwesterb in #651
• ristretto: reject non-canonical scalars by @bwesterb in #650
• Add more explicit constant time warnings by @bwesterb in #638
• mlsbset: make Encode() constant time by @bwesterb in #639
• mlsbset: fix stray index in Encode comment by @lukevalenta in #658
• removeLen32Prefixed: check for possible data overflow by @mdosch in #629
• expander: panic if requested output length overflows DST. by @cjpatton in #664
• zk/dleq: add base point a to challenge derivation. by @cjpatton in #663
• dh/sidh: document Import() side-effect for kem/sike. by @cjpatton in #662
• ecc/fourq: improve constant-timeness of fpSgn, fqSqrt. by @cjpatton in #666
• blinsign/blindrsa/partiallyblindrsa: reject malformed moduli. by @cjpatton in #665
• blindsign/blindrsa: align PSSZERO behavior with RFC 9474. by @cjpatton in #660
• ecc/fourq: fix fqSqr arithmetic error on amd64 by @cjpatton in #659
• README: warn that not all packages are constant time by @frangelbarrera in #668
• internal/test: unify ACVP test vector parsing by @ihopenre-eng in #667
• blindrsa: fix interface documentation by @bwesterb in #672
• ecc/fourq: fix legacy (non-BMI2) GF(p^2) multiplication on amd64 by @bwesterb in #669
• p384: document assumed reductions by @bwesterb in #670
• ed25519: document another divergence with crypto/ed25519 by @bwesterb in #671
• prio3/histogram: don't panic on measurement equal to the bucket count by @bwesterb in #673
• zk/qndleq: document Qn membership precondition by @bwesterb in #675
• vdaf/prio3: require all prep shares by @bwesterb in #676
• vdaf/prio3: document prep sequencing requirement by @bwesterb in #677
• zk/dl: reject identity proof inputs by @bwesterb in #678
• tss/rsa: document trusted modulus requirement by @bwesterb in #680
• dh/csidh: harden key imports by @bwesterb in #689
• zk/dleq: validate batch shape by @bwesterb in #684
• ot/simot: make sender sessions one-shot by @bwesterb in #679
• vdaf/prio3/sum: reject unsafe measurement bounds by @bwesterb in #682
• tss/rsa: validate sign share protocol parameters by @bwesterb in #674
• vdaf/prio3/sum: reject aggregate field overflow by @bwesterb in #681
• vdaf/prio3: validate preparation inputs by @bwesterb in #683
• oprf: reject invalid deterministic blinds by @bwesterb in #688
• vdaf/prio3: reject degenerate parameters by @bwesterb in #685
• oprf: validate finalize state by @bwesterb in #687

New Contributors

• @drmikecrypto made their first contribution in #627
• @lukevalenta made their first contribution in #658
• @mdosch made their first contribution in #629
• @frangelbarrera made their first contribution in #668
• @ihopenre-eng made their first contribution in #667

Full Changelog: v1.6.4...v1.6.5

CIRCL v1.6.4

What's Changed

• Fix typo: it's to its by @04cb in #588
• ci: Bump Go version to 1.26 by @armfazh in #591
• tss/rsa: polynomial evaluation using Horner's method by @armfazh in #590
• zk/qndleq: Ensure large security parameter by @armfazh in #592
• sign/bls: rejects aggregated signatures built with duplicated messages. by @armfazh in #595
• Bump golang.org/x/crypto from 0.30.0 to 0.45.0 by @dependabot[bot] in #585
• tss/rsa: avoiding overflow in lambda calculation with big.Int by @armfazh in #598
• deps: Update CIRCL version in code generators. by @armfazh in #599
• ci: add Semgrep OSS scanning workflow by @hrushikeshdeshpande in #601
• zk/qndleq: Fixes challenge calculation by @armfazh in #596
• sign/bls: Check that signature cannot be the identity point by @armfazh in #603
• ml-dsa: Don't use tr pointer by @bwesterb in #606
• ecc/bls12381: affinize must handle identity elements. by @armfazh in #604
• pki: check pem.Decode returned nil block. by @z9z in #607
• abe/cpabe/tkn20: fix AND-gate secret sharing. by @cjpatton in #610
• hpke: fix verifyPSKInputs() to match spec. by @cjpatton in #612
• hpke: Warn about nonce misuse during marshaling by @cjpatton in #613
• hpke: don't panic when parsing on hybrid keys/ciphertexts. by @cjpatton in #614
• blindsign/blindrsa: reject non-canonical signatures. by @cjpatton in #615
• blindsign/blindrsa: reject message unless co-prime with modulus by @cjpatton in #616
• oprf: reject identity element as public key. by @cjpatton in #619
• Add AGENTS.md and REVIEW.md for contributor and AI agent guidance by @dotjs in #620
• ecc/bls12381: check input length for infinity encoding in SetBytes. by @bwesterb in #618
• abe/cpabe/tkn20: bound recursion depth when parsing policies. by @cjpatton in #622
• abe/cpabe/tkn20: reject ciphertexts with trailing data. by @cjpatton in #621
• abe/cpabe/tkn20: handle short ciphertexts as errors. by @cjpatton in #611
• abe/cpabe/tkn20: enforce wire count matches policy. by @cjpatton in #624
• abe/cpabe/tkn20: handle malformed ciphertext header. by @cjpatton in #623
• abe/cpabe/tkn20: reject circuits with invalid topologies. by @cjpatton in #625
• Release CIRCL v1.6.4 by @cjpatton in #626

New Contributors

• @04cb made their first contribution in #588
• @z9z made their first contribution in #607
• @dotjs made their first contribution in #620

Full Changelog: v1.6.3...v1.6.4

CIRCL v1.6.3

CIRCL v1.6.3

Fix a bug on ecc/p384 scalar multiplication.

What's Changed

• sign/mldsa: Check opts for nil value by @armfazh in #582
• ecc/p384: Point addition must handle point doubling case. by @armfazh in #583
• Release CIRCL v1.6.3 by @armfazh in #584

Full Changelog: v1.6.2...v1.6.3

CIRCL v1.6.2

CIRCL v1.6.2

• New SLH-DSA, improvements in ML-DSA for arm64.
• Tested compilation on WASM.

What's Changed

• Optimize pairing product computation by moving exponentiations to G1. by @dfaranha in #547
• sign: Adding SLH-DSA signature by @armfazh in #512
• Update code generators to CIRCL v1.6.1. by @armfazh in #548
• ML-DSA: Add preliminary Wycheproof test vectors by @bwesterb in #552
• go fmt by @bwesterb in #554
• gz-compressing test vectors, use of HexBytes and ReadGzip functions. by @armfazh in #555
• group: Removes use of elliptic Marshal and Unmarshal functions. by @armfazh in #556
• Support encoding/decoding ML-DSA private keys (as long as they contain seeds) by @bwesterb in #559
• Update to golangci-lint v2 by @bwesterb in #560
• Preparation for ARM64 Implementation of poly operations for dilithium package. by @elementrics in #562
• prepare power2Round for custom implementations in assembly by @elementrics in #564
• ARM64 implementation for poly.PackLe16 by @elementrics in #563
• add arm64 version of polyMulBy2toD by @elementrics in #565
• add arm64 version of polySub by @elementrics in #566
• group: add byteLen method for short groups and RandomScalar uses rand.Int by @armfazh in #568
• add arm64 version of poly.Add/Sub by @elementrics in #572
• group: Adding cryptobyte marshaling to scalars by @armfazh in #569
• Bumping up to Go1.25 by @armfazh in #574
• ci: Including WASM compilation. by @armfazh in #577
• Revert to using package-declared HPKE errors for shortkem instead of standard library errors by @harshiniwho in #578
• Release v1.6.2 by @armfazh in #579

New Contributors

• @dfaranha made their first contribution in #547
• @elementrics made their first contribution in #562
• @harshiniwho made their first contribution in #578

Full Changelog: v1.6.1...v1.6.2

CIRCL v1.6.1

CIRCL v1.6.1

• Fixes some point checks on the FourQ curve.
• Hybrid KEM fails on low-order points.

What's Changed

• kem/hybrid: ensure X25519 hybrids fails with low order points by @Lekensteyn in #541
• .github: Use native ARM64 builders instead of QEMU by @Lekensteyn in #542
• Fixes several errors on twisted Edwards curves. by @armfazh in #545
• Release v1.6.1 by @armfazh in #546

Full Changelog: v1.6.0...v1.6.1

CIRCL v1.6.0

CIRCL v1.6.0

New!

• Prio3 Verifiable Distributed Aggregation Function (draft-irtf-cfrg-vdaf).
• X-Wing: general-purpose hybrid post-quantum KEM (draft-connolly-cfrg-xwing-kem)

What's Changed

• Add OIDs to ML-DSA by @bwesterb in #519
• Adds Prio3 a set of verifiable distributed aggregation functions. by @armfazh in #522
• Run semgrep cronjob only in upstream repository. by @armfazh in #526
• X-Wing PQ/T hybrid by @bwesterb in #471
• ckem: move crypto/elliptic to crypto/ecdh by @MingLLuo in #529
• hpke: Update HPKE code to use ecdh stdlib package. by @armfazh in #530
• prio3: Adds polynomial multiplication using NTT by @armfazh in #532
• Add Prio3 in readme. by @armfazh in #527

New Contributors

• @MingLLuo made their first contribution in #529

Full Changelog: v1.5.0...v1.6.0

CIRCL v1.5.0

CIRCL v1.5.0

New: ML-DSA, Module-Lattice-based Digital Signature Algorithm.

What's Changed

• kem: add X25519MLKEM768 TLS hybrid KEM by @bwesterb in #510
• Create semgrep.yml by @hrushikeshdeshpande in #514
• repo: Some fixes reported by CodeQL by @armfazh in #515
• Add ML-DSA (FIPS204) by @bwesterb in #480
• sign/mldsa: Add test for ML-DSA signature verification. by @armfazh in #517
• Release v1.5.0 by @armfazh in #518

New Contributors

• @hrushikeshdeshpande made their first contribution in #514

Full Changelog: v1.4.0...v1.5.0

CIRCL v1.4.0

CIRCL v1.4.0

Changes

New: ML-KEM compatible with FIPS-203.

Commit History

• eddilithium3: fix typos by @bwesterb in #503
• Add ML-KEM (FIPS 203). by @bwesterb in #470
• Add ML-KEM decapsulation key check. by @bwesterb in #507
• Preparing for release v1.4.0 by @armfazh in #508

Full Changelog: v1.3.9...v1.4.0

CIRCL v1.3.9

CIRCL v1.3.9

Changes:

• Fix bug on BLS12381 decoding elements.

Commit History

• dilithium: fix typo by @bwesterb in #498
• bls12381: Detects invalid prefix in G1 and G2 serialized elements by @armfazh in #500
• Preparing CIRCL release v1.3.9 by @armfazh in #501

Full Changelog: v1.3.8...v1.3.9

CIRCL v1.3.8

CIRCL v1.3.8

New

• BLS Signatures on top of BLS12-381.
• Adopt faster squaring in pairings.
• BlindRSA compliant with RFC9474.
• (Verifiable) Secret Sharing compatible with the Group interface (elliptic curves).

Notice

• Update on cpabe/tkn20 ciphertexts, read more at https://github.com/cloudflare/circl/wiki/tkn20-Ciphertext-Format-(v1.3.8)

What's Changed

• Implement Granger-Scott faster squaring in the cyclotomic subgroup. by @armfazh in #449
• Updates avo and CIRCL's own dependency. by @armfazh in #474
• Updating documentation for OPRF package. by @armfazh in #475
• group: removes order method from group interface by @armfazh in #356
• zk/dleq: Adding DLEQ proofs for Qn, the subgroup of squares in (Z/nZ)* by @armfazh in #451
• Reduce x/crypto and x/sys versions to match Go 1.21 by @Lekensteyn in #476
• Bump GitHub Actions versions and use Go 1.22 and 1.21 by @Lekensteyn in #477
• Adding rule for constant values by @armfazh in #478
• Add BLS signatures over BLS12-381 by @armfazh in #446
• group: Implements Shamir and Feldman secret sharing. by @armfazh in #348
• blindrsa: add support for all variants of RFC9474 by @armfazh in #479
• Explicitly installs Go with version before CodeQL analysis. by @armfazh in #481
• Bumps golangci-lint action by @armfazh in #485
• ecc/bls12381: Ensures pairing operations don't overwrite their input by @armfazh in #494
• Align to the purego build tag, removing noasm build tag by @mattyclarkson in #492
• cpabe: Serializing ciphertext with 32-bit prefixes. by @armfazh in #490

New Contributors

• @mattyclarkson made their first contribution in #492

Full Changelog: v1.3.7...v1.3.8