v3.1.0

This release adds forward compatibility for decrypting and sharing the upcoming "transparent session" encryption formats.

v3.0.2

There are no new features or externally visible changes in this version of the SDK. This release includes fixes for the HIGH-severity OpenSSL advisories from November 1st (CVE-2022-3786 and CVE-2022-3602).

v3.0.1

There is no new feature or API changes in this version of the SDK.

The native Tanker library used internally by sdk-ruby now targets glibc versions >= 2.31-0.
This change is not expected to have a visible impact.

v3.0.0

Version v2.30.0 introduced forward compatibility for padded encryption scheme. Make sure your end users use at least v2.30.0 before upgrading to v3.0.0.

Padded Encryption

Tanker now uses a padded symmetric encryption scheme by default. Adding padding to encrypted data aims at hiding the length of the clear message, see the dedicated guide.

Remove UMD build

We no longer ship the fully bundled UMD build of the JS SDK for @tanker/client-browser.

Remove device APIs

• Remove the device_id() function
• Remove the device_list() function
• Remove DeviceRevoked error

v2.32.0

End-to-end passphrase verification

A new end-to-end passphrase verification method is now available for users who need strict end-to-end security guarantees.

See the guide for more information.

Performance improvements

Reduce the number of group and resource key lookups by sharing results from in-progress lookups between calls.

This makes concurrent operations involving groups or encrypted resources faster, as fewer round trips to the network and/or local storage are made.

For example, parallel decryption of multiple resources shared with the same group now requires only one lookup to recover the last group key instead of one lookup per resource.

Bug fix

• Fix encrypt_utf8 and encrypt_data when called with more than ~4GB of clear data:

  • An overflow of an unsigned integer was causing a corruption of the encrypted data
  • Data encrypted through encrypt_stream is not affected

• Fix decrypt_utf8 and decrypt_data when called with more than ~4GB of encrypted data:

  • An overflow of an unsigned integer was causing incorrect parsing of encrypted data
  • Data decrypted through decrypt_stream is not affected

• Add missing runtime dependency to faraday in gemspec

v2.31.1

Fix Ruby deadlock in start when used with the Spring gem.

v2.31.0

This release will use the Faraday HTTP backend.
Note that Faraday will use the net-http adapter by default which is slower.
You can override it with the faraday_adapter option in Core's constructor.

v2.30.0

• Add forward compatibility for the decryption of padded data.
• Phone number verification method can now be used with session token.
• oidc_test_nonce= is available to test the new verification flow without requiring any end-user action.

Offline mode

No connection to Tanker remote services is made if not necessary, this is true when:

• The user already exists
• The device is already registered
• The operation can be completed using the device's local cache

Any user registration, device verification, group operation, new encryption or decryption of resource not in cache will open a new connection.

v2.29.1

OpenID Connect

Pro Santé Connect is now a supported OpenID Provider.
Select the OpenID Provider from the dashboard:

• pro-sante: for the production environment
• pro-sante-bas: for the sandbox

v2.29.0

OpenID Connect

The identity verification using the OIDC has been revamped to improve security and isolation between Tanker servers and an application server using Tanker:

• A new mandatory nonce, created through create_oidc_nonce, should be used in OIDC authorization code flow. It allows:
  • Application server to deny any request using an IdToken already seen. Preventing Tanker from impersonating end-users
  • Tanker to perform an additional challenge with end-users before accepting an IdToken. Preventing an Application server from impersonating end-users
• OIDC for provisional identity verification is not available anymore

The OIDC verification guide has been updated accordingly.