v1.1.0

This release consolidates recent robustness, concurrency, and documentation improvements.

Summary

This release improves the security and robustness of cryptio by:

• Strengthening input validation and error handling around encryption/decryption.
• Reducing sensitive material exposure by zeroing derived keys and passphrases.
• Making Client safe for concurrent use and adding a thread-safe Client.Wipe() method.
• Adding edge tests (truncated/tampered ciphertext, empty plaintext, concurrency).
• Making exhaustive benchmarks optional and adding CI-friendly guidance.

Notable Changes

Added

• Client.Wipe() — a thread-safe method that clears the client's passphrase from memory. After calling Wipe(), the client MUST NOT be used again.

Changed

• DecryptRaw input validation:
  • Validate header length (salt + nonce) before processing.
  • Ensure params.NonceSize matches gcm.NonceSize().
  • Verify ciphertext length is at least gcm.Overhead().
  • Improve error messages with context (use fmt.Errorf("...: %w", err)).
• Key handling and zeroization:
  • deriveKey now operates on a snapshot copy of the passphrase under a read-lock and returns the derived key.
  • Derived keys are zeroed (overwritten with zeros) after use in both EncryptRaw and DecryptRaw.
• Concurrency safety:
  • Client now embeds a sync.RWMutex to protect the passphrase during derive operations and wipe.
  • deriveKey copies the passphrase under a read-lock to avoid races.

Security Notes

• Key zeroization is best-effort: Go's runtime may copy slices in ways that zeroization cannot fully eliminate. However, explicit zeroing of derived key slices and passphrases reduces exposure windows and is a useful defense-in-depth step.
• Client.Wipe() clears the passphrase slice and sets it to nil. Callers must ensure no other goroutines are using the client after wipe.

Migration & Compatibility

• No breaking changes to existing public APIs except:
  • Client.Wipe() has been added — this is a non-breaking addition.
  • Behavior changes: DecryptRaw now performs stricter validation and returns more explicit errors for malformed inputs; callers should handle these errors (they are returned as wrapped errors).

v1.0.0

cryptio v1.0.0

We are excited to announce the first official release of cryptio!

🚀 Features

• Modern cryptography: Designed with best practices in mind, using robust primitives from golang.org/x/crypto.
• Argon2id password hashing: Secure, memory-hard password hashing for key derivation and user authentication.
• Symmetric encryption: Easy-to-use functions for encrypting and decrypting data with passphrase-derived keys.
• Minimal dependencies: Relies only on official Go cryptography libraries.
• Simple API: Focused, easy-to-integrate functions for rapid adoption in Go projects.

🛡️ Security

• Please read SECURITY.md for instructions on responsible disclosure and security best practices.
• Always have your implementation and configuration reviewed by your organization’s security team before deploying to production.

📝 Documentation

• See the README for usage examples and integration tips.

---

Thank you for checking out cryptio!
Contributions, feedback, and security reports are welcome.