fcrypt 0.3.5

Cross-platform CLI for password-based file encryption and decryption
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174

# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

## [0.3.5] - 2026-09-20

### Added

- Added tag-triggered crates.io publishing in dependency order for
  `fcrypt-oqs-sys`, `fcrypt-oqs`, and `fcrypt`.
- Added a step-by-step release tutorial covering GitHub Releases, npm, and
  crates.io.

### Security

- Shipped dedicated `fcrypt-oqs` bindings that pin the vendored liboqs C
  implementation to commit
  `282809f06dccf6893980035cb11f319684d10d52` and verify the revision of fresh
  and cached source trees, including worktree cleanliness, before compilation.
  A movable upstream tag or a pre-populated build cache can no longer silently
  select different C code.

## [0.3.4] - 2026-09-19

### Security

- Verify and decrypt a private ciphertext snapshot so concurrent in-place
  changes to the input cannot bypass detached-signature verification.
- Publish automatically generated identities, ciphertext, and signatures in
  one transaction. Failed encryption or signing no longer leaves generated
  keys behind or replaces an existing identity before the operation succeeds.
- Retain recovery backups when rollback fails and report every backup path
  instead of deleting the remaining copies of previous files.
- Bound opaque payload decryption to a 64 MiB ciphertext buffer, allocate only
  the current chunk's actual length, and decrypt in place. Empty and short
  payloads no longer allocate the chunk size declared by the manifest.
- Zeroize manifest, slot, and plaintext chunk buffers through RAII on success
  and error paths, redact the manifest file secret from debug output, and make
  identity metadata inspection skip private-key values instead of allocating
  them.

## [0.3.3] - 2026-07-23

### Security

- Updated the liboqs bindings to `tectonic-oqs` 0.11.2 and its patched liboqs
  0.15.x source, which includes the HQC compiler-optimization fix for
  CVE-2025-52473 while retaining opaque v1 key and ciphertext compatibility.
- Made signed asymmetric encryption publish the ciphertext and detached
  signature as one transaction, preserving existing outputs if either publish
  step fails.
- Made generated recipient and signing public/secret key pairs transactional.
- Reused one validated signing public-key bundle throughout verification,
  removing the verification-key path replacement window.
- Added a backward-compatible authenticated signer requirement to signed PQC
  slots and made decryption fail closed when the detached signature is ignored
  or removed. Existing signed opaque v1 containers remain readable.
- Limited asymmetric key JSON and detached signature inputs to 64 KiB before
  parsing.

## [0.3.2] - 2026-07-22

### Added
- Added Base64 output (`-b64`/`--base64`) and a conservative `--compatible` alphabet to random password generation.

### Changed
- Renamed the Cargo package and Rust crate from `filecrypt` to `fcrypt` so the package name matches the installed binary.
- Updated npm package metadata and all platform package dependencies to `0.3.2`.

## [0.3.1] - 2026-07-10

### Added
- Added unified `encrypt` and `decrypt` commands that select password or recipient-key mode from the supplied credentials.
- Added top-level `identity`, `sign`, `verify`, `password`, and `phrase` commands.
- Added non-interactive password input through `--password-file`, plus `--json`, `--quiet`, and `--no-progress` output controls.
- Added integration coverage for the unified CLI, password files, identity inspection, JSON redaction, and keyset rollback.

### Changed
- Updated the CLI help and README for the new command layout while retaining legacy asymmetric command aliases.
- Updated npm metadata and all platform package dependencies to `0.3.1`.

### Fixed
- Prevented mandatory detached-signature verification from being bypassed by replacing the ciphertext path between verification and decryption.
- Prevented key generation from changing permissions on an existing user directory.
- Allowed expired recipient secret keys to decrypt historical files and expired signing public keys to verify historical signatures; expired public/secret keys remain blocked for new encryption/signing respectively.
- Made named keyset generation preflight all paths and restore previously published files if a forced commit fails.
- Preserved non-UTF-8 file names when deriving decrypt output paths.
- Made automatic recipient-key discovery skip malformed secret-key files when valid identities remain.
- Rejected empty passwords at the password-encryption API boundary.

### Security
- Redacted secret-key debug output and zeroized decoded secret-key material and intermediate shared secrets where supported.

## [0.3.0] - 2026-07-07

### Added
- Added the opaque encrypted file container for password and asymmetric modes.
- Added post-quantum opaque recipient slots using ML-KEM-1024 and HQC-256.
- Added detached ML-DSA-87 signatures for opaque ciphertext files.
- Added `fcrypt keygen pair <name> [lifetime_days]` to generate recipient and signing keypairs together.
- Added fixed opaque v1 password KDF parameters: Argon2id, 128 MiB memory, time cost 3, parallelism 1.
- Added `docs/OPAQUE_FORMAT.md`.

### Changed
- Changed default encrypted output extension to `.bin`.
- Changed password decrypt to read chunk parameters from the encrypted manifest instead of runtime configuration.
- Changed password-slot encryption and decryption to use the same fixed opaque v1 Argon2id profile.
- Changed asymmetric signing to detached signatures for opaque ciphertext files.
- Bumped package metadata to `0.3.0`.

### Removed
- Removed the old cleartext-header encrypted file formats from the current decrypt path.
- Removed the `--paranoic` / `--paranoid` symmetric cascade mode.
- Removed embedded signatures for new opaque files.

### Security
- Opaque files no longer expose cleartext magic bytes, format version, algorithm identifiers, or recipient key identifiers.
- Payload chunk indexes now use `u64` nonces.
- Recipient key auto-discovery is bounded to avoid unbounded PQC decrypt attempts.
- Generated passphrases are returned in zeroizing storage.

### Compatibility
- `fcrypt` `0.3.0` cannot read files encrypted by `fcrypt` `0.2.0` or earlier. Use `fcrypt` `0.2.0` to read those old files.

## [0.2.0] - 2026-07-07

### Added
- Added GitHub Actions automation for signed `.deb` and `.rpm` packages, APT/RPM repository publication through GitHub Pages, and Sigstore bundle generation for package artifacts.
- Added npm package manifests, a Node.js launcher, and GitHub Actions automation for publishing prebuilt `fcrypt` binaries for Linux, macOS, and Windows on x64 and arm64.

## [0.1.2] - 2026-05-17

### Security
- Updated `indicatif` to `0.18.4` to remove the unmaintained transitive `number_prefix` dependency reported by `cargo audit`.

## [0.1.1] - 2026-05-17

### Fixed
- Authenticate newly encrypted empty files with an AES-GCM tag while preserving legacy empty-file compatibility.
- Avoid non-forced output clobbering races by finalizing temp files with no-clobber persistence.
- Replace forced outputs without deleting the destination before the final persist step.

### Security
- Updated `rand` to `0.8.6`.

## [0.1.0] - 2026-03-15

### Added
- Initial `fcrypt` CLI release.
- Password-based file encryption and decryption with AES-256-GCM.
- Argon2id key derivation with random per-file salt.
- Streaming chunked processing for large files with bounded memory usage.
- Hidden interactive password prompt and encryption confirmation prompt.
- Overwrite confirmation logic with `--force` override.
- Progress bar reporting bytes processed.
- Safe temp-file output workflow (finalize only after successful operation).
- Integration tests for roundtrip, edge cases, corruption/truncation, and naming logic.

[Unreleased]: https://github.com/ThoisoiThree/fcrypt/compare/v0.3.5...HEAD
[0.3.5]: https://github.com/ThoisoiThree/fcrypt/compare/v0.3.4...v0.3.5
[0.3.4]: https://github.com/ThoisoiThree/fcrypt/compare/v0.3.3...v0.3.4
[0.3.3]: https://github.com/ThoisoiThree/fcrypt/compare/v0.3.2...v0.3.3
[0.3.2]: https://github.com/ThoisoiThree/fcrypt/compare/v0.3.1...v0.3.2
[0.3.1]: https://github.com/ThoisoiThree/fcrypt/compare/v0.3.0...v0.3.1
[0.3.0]: https://github.com/ThoisoiThree/fcrypt/compare/v0.2.0...v0.3.0
[0.2.0]: https://github.com/ThoisoiThree/fcrypt/compare/v0.1.2...v0.2.0
[0.1.2]: https://github.com/ThoisoiThree/fcrypt/compare/v0.1.1...v0.1.2
[0.1.1]: https://github.com/ThoisoiThree/fcrypt/compare/v0.1...v0.1.1
[0.1.0]: https://github.com/ThoisoiThree/fcrypt/releases/tag/v0.1