v3.1.0

This release adds forward compatibility for decrypting and sharing the upcoming "transparent session" encryption formats.

v3.2.0

This release enable the new "transparent session" encryption formats by default.

These formats optimize resource key usage. Encryption for the same recipients will reuse the same key for several hours.
As a result, performance of encrypt and decrypt operations should be improved, due to less network requests.

v3.0.2

There are no new features or externally visible changes in this version of the SDK. This release includes fixes for the HIGH-severity OpenSSL advisories from November 1st (CVE-2022-3786 and CVE-2022-3602).

v3.0.1

• The Windows wheel is now built for Python 3.10, instead of Python 3.8

The native Tanker library used internally by sdk-python now targets glibc versions >= 2.31-0.
This change is not expected to have a visible impact.

v3.0.0

Version v2.30.0 introduced forward compatibility for padded encryption scheme. Make sure your end users use at least v2.30.0 before upgrading to v3.0.0.

Padded Encryption

Tanker now uses a padded symmetric encryption scheme by default. Adding padding to encrypted data aims at hiding the length of the clear message, see the dedicated guide.

Remove UMD build

We no longer ship the fully bundled UMD build of the JS SDK for @tanker/client-browser.

Remove device APIs

• Remove the device_id() function
• Remove the get_device_list() function
• Remove DeviceRevoked error

v2.32.0

End-to-end passphrase verification

A new end-to-end passphrase verification method is now available for users who need strict end-to-end security guarantees.

See the guide for more information.

Performance improvements

Reduce the number of group and resource key lookups by sharing results from in-progress lookups between calls.

This makes concurrent operations involving groups or encrypted resources faster, as fewer round trips to the network and/or local storage are made.

For example, parallel decryption of multiple resources shared with the same group now requires only one lookup to recover the last group key instead of one lookup per resource.

Bug fix

• Fix encrypt() when called with more than ~4GB of clear data:

  • An overflow of an unsigned integer was causing a corruption of the encrypted data
  • Data encrypted through encrypt_stream() is not affected

• Fix decrypt() when called with more than ~4GB of encrypted data:

  • An overflow of an unsigned integer was causing incorrect parsing of encrypted data
  • Data decrypted through decrypt_stream() is not affected

v2.31.0

There is no new feature or externally visible change in this version of the SDK.

v2.30.0

• Add forward compatibility for the decryption of padded data.
• Phone number verification method can now be used with session token.
• set_oidc_test_nonce is available to test the new verification flow without requiring any end-user action.

Offline mode

No connection to Tanker remote services is made if not necessary, this is true when:

• The user already exists
• The device is already registered
• The operation can be completed using the device's local cache

Any user registration, device verification, group operation, new encryption or decryption of resource not in cache will open a new connection.

v2.29.1

OpenID Connect

Pro Santé Connect is now a supported OpenID Provider.
Select the OpenID Provider from the dashboard:

• pro-sante: for the production environment
• pro-sante-bas: for the sandbox

v2.29.0

OpenID Connect

The identity verification using the OIDC has been revamped to improve security and isolation between Tanker servers and an application server using Tanker:

• A new mandatory nonce, created through create_oidc_oonce(), should be used in OIDC authorization code flow. It allows:
  • Application server to deny any request using an IdToken already seen. Preventing Tanker from impersonating end-users
  • Tanker to perform an additional challenge with end-users before accepting an IdToken. Preventing an Application server from impersonating end-users
• OIDC for provisional identity verification is not available anymore

The OIDC verification guide has been updated accordingly.