Latch

v1.0.1 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 26d Network Security

✓ No known CVEs patched

This release patches 1 known CVE

Topics

chacha20-poly1305 cryptography security go hybrid-cryptography kyber

+7 more

ml-kem post-quantum-cryptography rust tcp tokio udp zero-allocation

Affected surfaces

auth

Summary

AI summary

HMAC-based authentication added for pre‑shared secret verification.

Full changelog

This minor release introduces critical security enhancements and improves developer experience by automating verification processes.

HMAC-based Authentication: Added a two-stage handshake verification. The server now validates incoming connections using a pre-shared secret via HMAC-SHA256 before initiating resource-heavy PQC operations.
Automation Suite: Introduced test.ps1 to streamline local development. The script performs static analysis (go vet), runs race-detector-enabled tests, and builds the binaries.
Resilience: Improved error handling for socket binding, ensuring cleaner process lifecycles and better reporting on address/port conflicts.
Documentation Update: Updated README.md to reflect the new authentication parameters and deployment workflow.

To use the new authentication feature, provide a -secret flag to both the server and the client:

./pqc-proxy -mode server -listen :8081 -target 127.0.0.1:9091 -secret "YourSecret"

./pqc-proxy -mode client -listen :3000 -target 127.0.0.1:8081 -secret "YourSecret"

You can now run the comprehensive test suite to ensure everything is functioning correctly before building:

.\test.ps1

Added HMAC-SHA256 two‑stage handshake verification before PQC operations (prevents unauthenticated access)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Latch

Get notified when new releases ship.

About Latch