cachekit-core 0.6.0

LZ4 compression, xxHash3 integrity, AES-256-GCM encryption for byte payloads
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116

# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [0.6.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.5.0...cachekit-core-v0.6.0) (2026-08-08)


### Features

* cache keyring per-tenant derivation at construction via TenantKeyring (LAB-1638) ([#71](https://github.com/cachekit-io/cachekit-core/issues/71)) ([d3f0eb0](https://github.com/cachekit-io/cachekit-core/commit/d3f0eb05f6861c4c10a3f44e920f0f34c1aa1508))
* expose winning-key index via decrypt_indexed for rotation drain observability (LAB-1645) ([#73](https://github.com/cachekit-io/cachekit-core/issues/73)) ([d834f74](https://github.com/cachekit-io/cachekit-core/commit/d834f74ede16bfc9ca812f6881f341caabe6e3c4))

## [0.5.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.4.0...cachekit-core-v0.5.0) (2026-08-07)


### ⚠ BREAKING CHANGES

* public items EncryptionHeader, KeyRotationState, RotationAwareHeader, and ZeroKnowledgeEncryptor::rotate_key() are removed (EncryptionError::NotImplemented variant included). Use Keyring for master-key rotation.

### Features

* replace dead key-rotation machinery with keyring decrypt helper (LAB-683) ([#67](https://github.com/cachekit-io/cachekit-core/issues/67)) ([327f993](https://github.com/cachekit-io/cachekit-core/commit/327f993877a3c409ba86dc0f76431ba4bb64d575))

## [0.4.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.3.0...cachekit-core-v0.4.0) (2026-07-27)


### Features

* emit StorageEnvelope compressed_data as msgpack bin (protocol 1.1) (LAB-866) ([#59](https://github.com/cachekit-io/cachekit-core/issues/59)) ([c691087](https://github.com/cachekit-io/cachekit-core/commit/c69108763dea380f9768b23b885dca2e73bae51d))

## [0.3.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.2.1...cachekit-core-v0.3.0) (2026-07-15)


### Features

* standalone checksum-only integrity API ([#13](https://github.com/cachekit-io/cachekit-core/issues/13)) ([#50](https://github.com/cachekit-io/cachekit-core/issues/50)) ([afced1a](https://github.com/cachekit-io/cachekit-core/commit/afced1a7e777103b95b4110c7e89e809a1d4d8de))


### Performance Improvements

* borrow input in ByteStorage write path instead of copying it ([#48](https://github.com/cachekit-io/cachekit-core/issues/48)) ([7f5ebc1](https://github.com/cachekit-io/cachekit-core/commit/7f5ebc1410ee0d16b5c31b4d19097d3d9e1d5582))

## [0.2.1](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.2.0...cachekit-core-v0.2.1) (2026-05-31)


### Bug Fixes

* use local> preset ref for private renovate-config repo ([#29](https://github.com/cachekit-io/cachekit-core/issues/29)) ([80355a4](https://github.com/cachekit-io/cachekit-core/commit/80355a49806b36a2b759be9fdfd9e0536cd43476))


### Security

* seed nonce instance counter with 8 random bytes, raising cross-process collision resistance from 2^32 to 2^64 (HIGH-2/HIGH-3) ([#36](https://github.com/cachekit-io/cachekit-core/issues/36)) ([af3d5fe](https://github.com/cachekit-io/cachekit-core/commit/af3d5fec0d66a95fb2b8994bbdb761ec01cede9d))

## [0.2.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.1.1...cachekit-core-v0.2.0) (2026-03-16)


### Features

* add wasm32-unknown-unknown platform support ([#22](https://github.com/cachekit-io/cachekit-core/issues/22)) ([911dbce](https://github.com/cachekit-io/cachekit-core/commit/911dbce82f14ee7e32926ece3a79d001300e1252))

## [0.1.1](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.1.0...cachekit-core-v0.1.1) (2025-12-18)


### Bug Fixes

* downgrade to edition 2021 and MSRV 1.80 for stable Rust compatibility ([#16](https://github.com/cachekit-io/cachekit-core/issues/16)) ([da5ced5](https://github.com/cachekit-io/cachekit-core/commit/da5ced5712cc88fe4f6ab966fbc39b79fcdfa089))

## [0.1.0](https://github.com/cachekit-io/cachekit-core/compare/cachekit-core-v0.0.1...cachekit-core-v0.1.0) (2025-12-05)


### Features

* initial release ([6dbe9b1](https://github.com/cachekit-io/cachekit-core/commit/6dbe9b1e30173395fdf51bfab457898be8515291))

## [Unreleased]

### Added

- **ByteStorage**: LZ4 compression with xxHash3-64 checksums
  - Automatic compression/decompression
  - Integrity verification on retrieval
  - Decompression bomb protection (512MB limit, 1000x ratio limit)

- **ZeroKnowledgeEncryptor**: AES-256-GCM encryption
  - Counter-based nonce generation (prevents reuse)
  - Hardware acceleration detection (AES-NI, ARM Crypto)
  - Operation metrics for observability

- **Key Derivation**: HKDF-SHA256 (RFC 5869)
  - Domain separation for multi-use keys
  - Tenant isolation via salt
  - Key fingerprinting for rotation support

- **C FFI Layer**: Multi-language support
  - Opaque handle management
  - Panic-safe error handling
  - Auto-generated `cachekit.h` header

- **Security Infrastructure**
  - 16 fuzz targets covering all attack surfaces
  - Kani formal verification proofs
  - Property-based testing with proptest
  - `cargo-deny` supply chain security

### Security

- All key material zeroized on drop
- Constant-time operations for encryption via `ring`
- No panics in library code (Result-based error handling)
- FFI boundary hardened with `catch_unwind`

[Unreleased]: https://github.com/cachekit-io/cachekit-core/compare/main...HEAD