Releases: zama-ai/kms
Releases · zama-ai/kms
Release list
v0.14.1-0
What's Changed
- fix: ensure new epoch id used in resharing (#752) by @jot2re in #762
- chore: fix meta store on boot v0.14.x by @kc1212 in #768
- fix: bcast fix port by @titouantanguy in #774
Full Changelog: v0.14.0-1...v0.14.1-0
v0.13.22
What's Changed
- chore!: backward compatible PRSS hotfix by @titouantanguy in #712
Full Changelog: v0.13.21...v0.13.22
v0.14.0-1
v0.14.0-0
What's Changed
- Rework the generate-test-material tool by @dvdplm in #543
- chore: only rebuild golden image on changes by @dd23 in #556
- chore: clippy fixes from the future by @dvdplm in #565
- CI reform, part 3 by @dvdplm in #555
- Faster testing material generation by @dvdplm in #550
- feat: make sure keygen generates homPRF key by @kc1212 in #560
- chore: test of migration with prf key by @kc1212 in #572
- ci: fix docker build for enclave by @fegmorte in #575
- chore: remove all 10P tests by @dvdplm in #569
- chore: update yq as the older version had security vuls by @kc1212 in #580
- chore: update backward compatibility to 0.13.20 by @kc1212 in #579
- chart: add custodian backup config for secret sharing by @fegmorte in #581
- chore: unify uncompressed flag by @kc1212 in #577
- refactor: rewriting storage helpers by @jot2re in #562
- chore: attempt to fix CI by pinning the revision of our dylint fetch by @dvdplm in #586
- chore: fix central pr-preview by @kc1212 in #582
- chore: remove algebra crate feature by @titouantanguy in #578
- fix(ci): Migrate to runson and remove slab by @fegmorte in #542
- chore!: remove testing feature from kms-gen-keys by @kc1212 in #574
- docs: minor updates to claude by @jot2re in #588
- ci: remove HOME setup for runs-on runner by @fegmorte in #592
- chore: fix rust version in ai-docs by @kc1212 in #593
- Audit slow/fast tests by @dvdplm in #589
- chore: update CONTRIBUTING to remove external PR by @aquint-zama in #573
- chore: minor NIST params change by @titouantanguy in #599
- fix: non enclave threshold prev by @titouantanguy in #595
- docs: review updates by @jot2re in #603
- ci(common): update protoc setup by @fegmorte in #602
- chore: setup new backwards compatibility tests by @jot2re in #594
- fix(ci): workaround CVE-2026-31431 by @chilcano in #566
- chore: ensure there are no missing backward compatibility tests by @kc1212 in #587
- chore: demote some logs from INFO to more appropriate TRACE/DEBUG/WARN by @dvdplm in #533
- ci(common): remove schedule from kind-testing by @fegmorte in #605
- chore: bump python to v3.14-slim-bookworm in check-docs wf by @dd23 in #607
- chore: Remove the CoW-reflinks verification step by @dvdplm in #604
- Don't use the
insecurefeature in tests by @dvdplm in #608 - chore: handle backup security findings by @jot2re in #590
- Refactor the CRS testing tooling a bit: no more macro, retry each task indipendently by @dvdplm in #534
- chore: All tests use builders by @dvdplm in #600
- chore: deterministic backward compatibility tests by @kc1212 in #591
- chore: changes moby/stairway by @titouantanguy in #564
- chore: add tfhe dylint by @kc1212 in #601
- Optimize Bivariate poly math by @dvdplm in #576
- fix: correctly check whether rerand ksk reuses pksk by @titouantanguy in #611
- fix: fix the max number of prss sets allowed by @titouantanguy in #616
- chore: matmul cleanup by @dvdplm in #585
- fix(security): replace unsafe zeroize impls with ZeroizeOnDrop by @maksymsur in #614
- chore: breaking change detection by @kc1212 in #610
- chore: explicit
num_partiesin core-client config by @dd23 in #619 - chore: better wasm tests by @kc1212 in #618
- ci: add safe-chain in ci by @fegmorte in #596
- chore: fix rust version to v1.94, bump aws dependencies and set dependency opt-level=1 by @dd23 in #620
- ci: update codeql action by @fegmorte in #627
- chore: update tfhe-rs 1.6.2 by @kc1212 in #629
- chore!: remove multiparty support for kms-gen-keys by @kc1212 in #621
- ci: add runs-on action for artifact api compatibility by @fegmorte in #628
- ci(common): improve caching mechanism with Swatinem action by @fegmorte in #606
- ci: fix docker-check-build workflow by @fegmorte in #633
- chore: misc documentation and clippy updates by @dd23 in #634
- chore: fix local docker compose by @kc1212 in #639
- fix: network bug where a message could be dropped by @titouantanguy in #624
- feat: insecure keygen from existing shares by @kc1212 in #626
- perf(storage): avoid full-size copies of FHE keys on the keygen store… by @maksymsur in #631
- Move
safe_serialize_hash_element_versionedtothreshold-hashingand rename tohash_versionedby @dvdplm in #640 - feat: adding bandwidth test by @titouantanguy in #583
- perf: batch reconstruction with hints + more par iter by @titouantanguy in #638
- chore: insecure preprocessing for threshold mpc by @kc1212 in #635
- chore: Retire the kms-custodian build step by @dvdplm in #622
- chore: use SystemTime for custodian backup data structures rather than u64 by @dvdplm in #632
- chore: refactor polling to use a unified function by @kc1212 in #645
- chore: bump chart version to v1.7.0 by @dd23 in #649
- fix: handle security finding 9.2 by @jot2re in #646
- ci: overwrite comment for test reporter by @fegmorte in #647
- fix(security): bound unvalidated gRPC inputs to prevent handler panics and DoS by @maksymsur in #644
- chore: refactor DKGParams by @titouantanguy in #642
- chore: do not pass on server/sns key when not needed by @kc1212 in #653
- chore: replace
escargotcrate with handrolled build commands by @dvdplm in #654 - fix: perf non enclave + core-client bench by @titouantanguy in #625
- chore: improve verification on core-client by @kc1212 in #648
- feat(observability): label kind-test metrics and fix histogram buckets by @maksymsur in #630
- chore: bump dependencies by @dd23 in #651
- feat: dedicated cpk rerand by @titouantanguy in #655
- chore: update quinn-proto to v0.11.15 by @dd23 in #657
- [chore] Retire
threshold_testsby @dvdplm in #643 - fix: fix network deadlock by @titouantanguy in #658
- Deserialize safely and efficiently by @dvdplm in #636
- chore: Destroy context also destroys associated epochs by @dvdplm in #656
- perf: Less cloning during keygen by @dvdplm in #650
- ci: fix test reporter comment by @fegmorte in #652
- Micro optimizations in
mult_listby @dvdplm in #660 - fix: use non-overlapping counters in batched PRSS-Mask by @dd23 in #662
- chore: refactor meta store management by @jot2re in #598
- test: perf workflow update by @titouantanguy in #666
- chore!: identify mpc node by address by @eudelins-zama in #670
- fix: when measuring throughput, do not count user-side reconstruction&validation by @dvdplm in #671
- chore: make public decrypt measure through put the same way as user decrypt by @dvdplm in #672
- chore: retire data_as_raw_vec everywhere by @dvdplm in #668
- chore: revert back to waiting for decryptions by @jot2re in https://github.com/zama...
v0.13.21
v0.13.11
v0.13.20
New Features in v0.13.20
- Context-aware responses on all endpoints (decryption and public material) and corresponding EIP-712 signatures
- Core implementation of KMS context, epochs and resharing
tfhe-rsv1.6.1 support- Full support for compressed keygen and key migration of existing keys to GPU-compatible keys
- Many internal fixes and improvements
The v0.13.20 release is the successor of the last stable version, KMS v0.13.10 and compatible with the fhevm v0.13 stack.
Breaking Changes in v0.13.20
- Compressed keys are now generated by default during keygen and uncompressed keys need to be explicitly selected via parameter (#518)
- Key generation, CRS generation and preprocessing endpoints now process the
extra_datafield and include it in their signatures.extra_datawas ignored and thus treated as empty before for those endpoints. tfhe-rsversion has been bumped to v1.6.1
What's Changed
- ci: upgrade sync-secrets version by @fegmorte in #475
- chore: Extract algebra into its own crate by @dvdplm in #434
- fix: fix kubeUtils image tag by @fegmorte in #479
- ci: fix harbor login by @fegmorte in #482
- fix: use default epoch_ID if not set by @dd23 in #483
- chore: Extract execution to own crate by @dvdplm in #440
- chore: add eip-712 validation in public decryption tests by @kc1212 in #478
- chore: allow concurrent port allocation by @kc1212 in #484
- chore: do not drop receiver when peer has completed by @dd23 in #477
- chore: Dedup dependencies: tonic by @dvdplm in #451
- fix: fix migration keys v0.13.10 by @fegmorte in #490
- chore: bump kms version to v0.13.20-0 and chart to v1.6.0-0 by @dd23 in #488
- chore: use get_listeners_random_free_ports in core/threshold by @kc1212 in #487
- feat: add support for anonymous S3 read tests by @maksymsur in #495
- chore: ci logging management by @maksymsur in #476
- chore: improve backup tests by @kc1212 in #493
- chore: strongly typed boundary for validation functions by @kc1212 in #489
- ci: Add rolling update kind testing by @fegmorte in #480
- fix: add admin rbac for pr-preview namespace by @fegmorte in #492
- chore: use raw prometheus for metrics collection by @eudelins-zama in #494
- chore: remove
non-wasmfeature fromthreshold-networkingby @dvdplm in #500 - Upgrade to Rust's 2024 edition by @dvdplm in #498
- fix: stuck integration test and CI artifact saving by @maksymsur in #503
- refactor: config generation in integration tests by @maksymsur in #501
- chore: remove redundant Option type by @kc1212 in #502
- chore: test anon s3 using minio by @kc1212 in #504
- Two test fixes by @dvdplm in #506
- ci: update slab-github-runner action to v1.6.0 by @soonum in #497
- Fix NIST scripts by @dvdplm in #499
- Avoid double allocating while hashing&serializing by @dvdplm in #496
- Add a slow_tests feature to threshold-experimental and move heavy tests by @dvdplm in #512
- chore: Create testing keys explicitly by @dvdplm in #450
- chore: avoid re-serialization of public key in verification by @kc1212 in #513
- Fix flaky tests by @dvdplm in #511
- chore: lazy static to lazy lock by @eudelins-zama in #515
- chore: optional threshold argument in user dec response validation by @kc1212 in #505
- chore: remove ml-kem 1024 support by @kc1212 in #517
- ci: Fix node 20 warning by bumping actions by @fegmorte in #520
- chore: remove high-cardinality metric tags by @dd23 in #523
- chore: upgrade
rasnandrasn-cmsto v0.28.11 (latest). by @dvdplm in #526 - chore: ignore RUSTSEC-2026-0099 and RUSTSEC-2026-0098 temporarily by @dd23 in #529
- refactor(tests): phase out captured-log assertions (logs_contain / logs_assert) in favor of explicit outcomes by @maksymsur in #508
- chore: zkp benches and kats by @titouantanguy in #516
- feat: hom prf keygen protocol by @kc1212 in #527
- fix: cherry picks from closed PR on multiple signing keys - MPC context in custodian backup by @jot2re in #509
- chore: Ensure resharing happens after custodian backup restore by @jot2re in #521
- Fix CI change-detection by @dvdplm in #525
- fix: test_keygen_backup_presence_central by @jot2re in #537
- chore: improve and clean up storage logs and documentation by @dd23 in #539
- ci: Fix missing checkout by @fegmorte in #535
- fix: Run tests for all crates in CI by @dvdplm in #536
- Unbreak PRs by @dvdplm in #548
- CI reform, round 2 by @dvdplm in #541
- feat: added agents settings by @jot2re in #538
- feat: add abort end points for key gen and crs gen by @jot2re in #528
- feat!: Switch to compressed keys by @dvdplm in #518
- chore: clean cut experiments by @titouantanguy in #524
- chore: upgrade tfhe-rs to 1.6 by @kc1212 in #546
- Remove deprecated tests by @dvdplm in #547
- fix(ci): use correct pod name in performance-testing log collection by @dd23 in #552
- chore: allow docker build from Github UI by @dd23 in #549
- chore: bump rust version to v1.95 by @dd23 in #551
- feat: store compact pk with xofkeyset by @kc1212 in #532
- chore: Lagrange polynomial cache refactor by @eudelins-zama in #522
- fix: performance testing workflow fixes and improvements by @dd23 in #553
- fix: default docker build to true, when wf is invoked from another one by @dd23 in #554
- chore!: initial enabling of extra data by @jot2re in #544
- chore: downgrade rustc back to 1.94.0 by @dvdplm in #557
- feat: copy migrated key from new key ID to the old one by @kc1212 in #530
- fix: add missing checkout to signing wf by @dd23 in #561
New Contributors
Full Changelog: v0.13.10...v0.13.20
v0.13.20-0
New Features in v0.13.20
- Context-aware responses on all endpoints (decryption and public material) and corresponding EIP-712 signatures
- Core implementation of KMS context, epochs and resharing
tfhe-rsv1.6.1 support- Full support for compressed keygen and key migration of existing keys to GPU-compatible keys
- Many internal fixes and improvements
The v0.13.20-0 release is the successor of the last stable version, KMS v0.13.10 and compatible with the fhevm v0.13 stack.
Breaking Changes in v0.13.20
- Compressed keys are now generated by default during keygen and uncompressed keys need to be explicitly selected via parameter (#518)
- Key generation, CRS generation and preprocessing endpoints now process the
extra_datafield and include it in their signatures.extra_datawas ignored and thus treated as empty before for those endpoints. tfhe-rsversion has been bumped to v1.6.1
What's Changed
- ci: upgrade sync-secrets version by @fegmorte in #475
- chore: Extract algebra into its own crate by @dvdplm in #434
- fix: fix kubeUtils image tag by @fegmorte in #479
- ci: fix harbor login by @fegmorte in #482
- fix: use default epoch_ID if not set by @dd23 in #483
- chore: Extract execution to own crate by @dvdplm in #440
- chore: add eip-712 validation in public decryption tests by @kc1212 in #478
- chore: allow concurrent port allocation by @kc1212 in #484
- chore: do not drop receiver when peer has completed by @dd23 in #477
- chore: Dedup dependencies: tonic by @dvdplm in #451
- fix: fix migration keys v0.13.10 by @fegmorte in #490
- chore: bump kms version to v0.13.20-0 and chart to v1.6.0-0 by @dd23 in #488
- chore: use get_listeners_random_free_ports in core/threshold by @kc1212 in #487
- feat: add support for anonymous S3 read tests by @maksymsur in #495
- chore: ci logging management by @maksymsur in #476
- chore: improve backup tests by @kc1212 in #493
- chore: strongly typed boundary for validation functions by @kc1212 in #489
- ci: Add rolling update kind testing by @fegmorte in #480
- fix: add admin rbac for pr-preview namespace by @fegmorte in #492
- chore: use raw prometheus for metrics collection by @eudelins-zama in #494
- chore: remove
non-wasmfeature fromthreshold-networkingby @dvdplm in #500 - Upgrade to Rust's 2024 edition by @dvdplm in #498
- fix: stuck integration test and CI artifact saving by @maksymsur in #503
- refactor: config generation in integration tests by @maksymsur in #501
- chore: remove redundant Option type by @kc1212 in #502
- chore: test anon s3 using minio by @kc1212 in #504
- Two test fixes by @dvdplm in #506
- ci: update slab-github-runner action to v1.6.0 by @soonum in #497
- Fix NIST scripts by @dvdplm in #499
- Avoid double allocating while hashing&serializing by @dvdplm in #496
- Add a slow_tests feature to threshold-experimental and move heavy tests by @dvdplm in #512
- chore: Create testing keys explicitly by @dvdplm in #450
- chore: avoid re-serialization of public key in verification by @kc1212 in #513
- Fix flaky tests by @dvdplm in #511
- chore: lazy static to lazy lock by @eudelins-zama in #515
- chore: optional threshold argument in user dec response validation by @kc1212 in #505
- chore: remove ml-kem 1024 support by @kc1212 in #517
- ci: Fix node 20 warning by bumping actions by @fegmorte in #520
- chore: remove high-cardinality metric tags by @dd23 in #523
- chore: upgrade
rasnandrasn-cmsto v0.28.11 (latest). by @dvdplm in #526 - chore: ignore RUSTSEC-2026-0099 and RUSTSEC-2026-0098 temporarily by @dd23 in #529
- refactor(tests): phase out captured-log assertions (logs_contain / logs_assert) in favor of explicit outcomes by @maksymsur in #508
- chore: zkp benches and kats by @titouantanguy in #516
- feat: hom prf keygen protocol by @kc1212 in #527
- fix: cherry picks from closed PR on multiple signing keys - MPC context in custodian backup by @jot2re in #509
- chore: Ensure resharing happens after custodian backup restore by @jot2re in #521
- Fix CI change-detection by @dvdplm in #525
- fix: test_keygen_backup_presence_central by @jot2re in #537
- chore: improve and clean up storage logs and documentation by @dd23 in #539
- ci: Fix missing checkout by @fegmorte in #535
- fix: Run tests for all crates in CI by @dvdplm in #536
- Unbreak PRs by @dvdplm in #548
- CI reform, round 2 by @dvdplm in #541
- feat: added agents settings by @jot2re in #538
- feat: add abort end points for key gen and crs gen by @jot2re in #528
- feat!: Switch to compressed keys by @dvdplm in #518
- chore: clean cut experiments by @titouantanguy in #524
- chore: upgrade tfhe-rs to 1.6 by @kc1212 in #546
- Remove deprecated tests by @dvdplm in #547
- fix(ci): use correct pod name in performance-testing log collection by @dd23 in #552
- chore: allow docker build from Github UI by @dd23 in #549
- chore: bump rust version to v1.95 by @dd23 in #551
- feat: store compact pk with xofkeyset by @kc1212 in #532
- chore: Lagrange polynomial cache refactor by @eudelins-zama in #522
- fix: performance testing workflow fixes and improvements by @dd23 in #553
- fix: default docker build to true, when wf is invoked from another one by @dd23 in #554
- chore!: initial enabling of extra data by @jot2re in #544
- chore: downgrade rustc back to 1.94.0 by @dvdplm in #557
- feat: copy migrated key from new key ID to the old one by @kc1212 in #530
- fix: add missing checkout to signing wf by @dd23 in #561
New Contributors
Full Changelog: v0.13.10...v0.13.20-0
v0.13.10
New Features in v0.13.10
- Context-aware decryption responses and corresponding EIP-712 signatures
- Core implementation of KMS context, epochs and resharing
tfhe-rsv1.5.4 support- Full support for compressed keygen and key migration of existing keys to GPU-compatible keys
- Many internal fixes and improvements
The v0.13.10 release is the successor of the last stable version, KMS v0.13.3 and compatible with the fhevm v0.12 stack.
This release is functionally identical to v0.13.10-rc.3.
Breaking Changes in v0.13.10
- The endpoints for Prss-Init (
rpc Init(kms.v1.InitRequest)) and same-set resharing (rpc InitiateResharing(kms.v1.InitiateResharingRequest)) have been removed and were replaced by endpoints for Epoch and Context management. (#337) - core-service config change: the field
rate_limiter_conf.resharewas renamed torate_limiter_conf.new_epoch(#337) StandardKeySetConfig, a parameter for the keygen grpc interface has changed to incorporate the new compressed key format (#424)- Decryption results now process the
extra_datafield and include it in their signatures.extra_datawas ignored and thus treated as empty before. - rust version has been bumped to v1.94
- tfhe-rs version has been bumped to v1.5.4
What's Changed
- fix: refactor deploy scripts by @fegmorte in #370
- fix: fix CI by @titouantanguy in #393
- chore: update bytes by @kc1212 in #395
- fix: fix small instance for slab by @fegmorte in #392
- chore: bump dependencies (aws security issue fix) by @dd23 in #397
- chore: NIST bench and KATs by @titouantanguy in #316
- feat: standard compressed keygen by @kc1212 in #375
- fix: cargo audit time crate by @maksymsur in #400
- feat!: reshare service -- epoch manager by @titouantanguy in #337
- fix: stability issues on KMS when getting out of sync by @jot2re in #388
- feat: compressed keygen centralized by @kc1212 in #396
- chore: bump ml-kem to v0.2.2 and kms to v0.13.0-rc.3 by @dd23 in #401
- chore: bump slab runner to v1.5.1 by @dd23 in #404
- chore: allow empty client_sk in insecure_process_user_decryption_resp by @kc1212 in #403
- fix: fix chart testing by @fegmorte in #409
- fix: fix chart testing by @fegmorte in #410
- fix: custom create EIF file by @maksymsur in #413
- chore: insecure keygen and integration test for compressed keys by @kc1212 in #402
- build: removed dead dependencies by @jot2re in #411
- chore!: updates to software version and backwards compatibility by @jot2re in #407
- chore: fix keyset type error in core-client by @kc1212 in #414
- feat: delete epoch from epoch manager by @kc1212 in #366
- chore: update redis server version by @eudelins-zama in #416
- chore: even more additional metrics by @jot2re in #394
- chore: resharing with compressed keys by @kc1212 in #406
- fix: do not add context twice from verifier by @kc1212 in #420
- feat(core-client/tests): k8s integration tests by @maksymsur in #391
- fix(zizmor): update trivy-action to v0.34.0 by @maksymsur in #427
- chore(core-client): robustness against failing cores and documentation by @dd23 in #408
- fix: backward compatibility of NetworkValue by @kc1212 in #421
- feat: bit lift protocol by @titouantanguy in #399
- fix: don't fetch key policies if key policy attestation is disabled by @mkmks in #431
- bug: Ensure all private elements get backed up #2892 by @jot2re in #418
- feat!: compressed keygen from existing secret by @kc1212 in #424
- fix: ensure custodian backup tests purge data so they can be re-ran without issue by @dvdplm in #417
- feat!: addition of configuration end point by @jot2re in #425
- feat: adding BGV mult by @titouantanguy in #423
- chore: bump version to v0.13.10-rc.0 by @dd23 in #433
- ci: Cleanup image after kind testing by @fegmorte in #430
- chore: refine testing infrastructure and tests exec time comparison by @maksymsur in #426
- fix!: handled issue with skip_serializing by @jot2re in #442
- chore: integration tests for compressed keygen from existing secret by @kc1212 in #438
- chore: removed non compressed keygen from core/threshold by @kc1212 in #439
- chore: public storage material validation by @eudelins-zama in #443
- chore: misc core-client improvements and centralized docker telemetry by @dd23 in #445
- chore: crs public storage validation by @eudelins-zama in #447
- feat: propagate tag during keygen from existing shares by @kc1212 in #444
- chore: streamlined migration by @jot2re in #429
- fix: change default context epoch by @jot2re in #446
- fix: spawn network tasks detached by @eudelins-zama in #454
- chore: bump rust, yq, grpc-health-check, tfhe-rs and trivy by @dd23 in #455
- chore: update quinn-proto by @eudelins-zama in #456
- fix: do not delete images from PRs with label
dockerby @dd23 in #458 - fix: expand the use of extra_data in EIP712 signature payloads by @mkmks in #453
- chore: reshare multiple keys in new epoch by @titouantanguy in #441
- chore: bump tfhe-rs to v1.5.4 by @dd23 in #461
- fix: issues with nightly tests by @jot2re in #460
- fix: check extra_data in wasm user decrypt responses by @mkmks in #465
- docs: changes checklist by @jot2re in #466
- ci: fix labeled pr by @fegmorte in #464
- Remove
StorageCacheby @dvdplm in #467 - feat: allow starting without signing key in recovery mode by @dd23 in #468
- chore: crs in epoch by @titouantanguy in #452
- chore: use rcgen and rustls-webpki k256-enabled forks from Zama org by @mkmks in #437
- chore: make core-client methods consistent by @kc1212 in #469
- chore: fix broken centralized backup test by @kc1212 in #473
- chore: depend on protected branches of rcgen, rustls-webpki, rustls by @mkmks in #474
- chore!: add eip712 for new epoch by @eudelins-zama in #471
- feat: add
extra_datato core_client decryption by @dd23 in #470 - fix: use default epoch_ID if not set and bump to v0.13.10-rc.2 by @dd23 in #481
- chore: add eip-712 validation in public decryption tests (#478) by @kc1212 in #485
- chore: do not drop receiver when peer has completed (#477) by @dd23 in #486
- chore: fix migration keys v0.13.10 (#490) and v0.13.10-rc.3 by @dd23 in #491
- chore: bump version to v0.13.10 stable by @dd23 in #510
Full Changelog: v0.13.3...v0.13.10