« Changelog History


Halite v5.1.0 Release Notes

Release Date: 2202-05-23 // over 177 years ago
    • ⬇️ Dropped PHP 8.0 support, increased minimum PHP version to 8.1.
      • This is due to the significant performance difference between ext/sodium and sodium_compat, and the functions we use in 5.x aren't available until PHP 8.1. See #178.
    • The 5.0.x branch will continue to function on PHP 8.0 but performance is not guaranteed.

Previous changes from v5.0.0

    • Increased minimum PHP version to 8.0.
    • 🔒 Security: Asymmetric encryption now uses HKDF-BLAKE2b to extract a 256-bit uniformly random bit string for the encryption key, rather than using the raw X25519 output directly as an encryption key. This is important because Elliptic Curve Diffie-Hellman results in a random group element, but that isn't necessarily a uniformly random bit string.
      • Because Halite v4 and earlier did not perform this step, it's superficially susceptible to Cheon's attack. This reduces the effective security from 125 bits (Pollard's rho) to 123 bits, but neither is a practical concern today.
    • 🔒 Security: Halite v5 uses the PAE strategy from PASETO to prevent canonicalization attacks.
    • 🔒 Security: Halite v5 appends the random salt to HKDF's info parameter instead of the salt parameter. This allows us to meet the KDF Security Definition (which is stronger than a mere Pseudo-Random Function).
    • Encryption now uses XChaCha20 instead of XSalsa20.
    • 👍 The File class no longer supports the resource type. To migrate code, wrap your resource arguments in a ReadOnlyFile or MutableFile object.
    • ➕ Added File::asymmetricEncrypt() and File::asymmetricDecrypt().