
User-Visible Changes in python-spake2

* Upcoming Release

(Put notes about merged features here).


* Release 0.9 (24-Sep-2024)

This release mainly deals with packaging simplifications: two dependencies ("six" and "hkdf") are removed.
The "cryptography" library takes the place of "hkdf" for key derivation.

There is no longer a vendored version of "six" (nor internal use of it, thanks a-dieste).

The "versioneer" library is updated to 0.29.


* Release 0.8 (14-Feb-2018)

API BREAK (but not a compatibility break)

Applications using this release will start up faster. The library includes
multiple groups (with different message sizes, performance, and security
levels), and each group uses a different blinding factor. These factors take
a relatively long time to compute. The previous release did this computation
for all groups, even ones that the application never imported. This release
changes the import API to avoid the unnecessary calculations, which saves
about 400ms at import time on my 2016-era laptop (and several seconds on a
Raspberry Pi).

Applications must use different "import" statements when upgrading to this
release ("from spake2.parameters.ed25519 import ParamsEd25519" instead of
"from spake2 import ParamsEd25519"). However this release retains message
compatibility with spake2-0.7: apps using 0.8 can interoperate with apps
using 0.7 without problems.


* Release 0.7 (12-May-2016)

COMPATIBILITY BREAK

This release changes the way passwords are turned into scalars, and the way
the final transcript hash is formatted. Hopefully this will be compatible
with the proposed SJCL (Javascript) implementation described in the comments
of https://github.com/bitwiseshiftleft/sjcl/pull/273 . Applications which use
python-spake2-0.3 or earlier will not interoperate with those which use 0.7
or later: the session keys will never match.

pypy3 support has been dropped, until pypy3 handles python3.3 or later (it
currently implements the equivalent of python3.2).

python-spake2 now depends on the "hkdf" package. Tox and py.test are now used
for running tests. setup.py has been switched from distutils to setuptools.


* Release 0.3 (22-Sep-2015)

Use the faster "M=N" blinding factors for SPAKE2_Symmetric, instead of
running two sessions in parallel and combining the results. This gets the
same speed and message size as the asymmetric (SPAKE2_A/SPAKE2_B) approach,
and is probably safe (see README for the security proofs).


* Release 0.2 (08-Apr-2015)

Use Ed25519 group/parameters by default (improves speed, security, and
message size). Note that both sides must use the same parameter set for
compatibility.


* Release 0.1 (13-Feb-2015)

Initial release. Includes SPAKE2_A/SPAKE2_B, and SPAKE2_Symmetric. Provides
three integer-group parameter sets (Params1024, Params2048, Params3072).
