v0.6.1 - Security Hardening Patch

Security Improvements

Race Condition Prevention

• Added deprecation warnings to save_json() and load_json()
• Recommend using atomic_update_config(), atomic_read_config(), or lock_file() for safer concurrent access

Key Zeroization

• Implemented secure memory zeroization for encryption keys using zeroize crate
• Applied to derive_key(), derive_key_secure(), encrypt_data(), and decrypt_data()

Weak Key Detection

• Enhanced is_key_too_weak() with comprehensive checks:
  • Sequential patterns (ascending/descending)
  • Alternating patterns (0xAA, 0x55...)
  • Low entropy keys (< 8 unique bytes)
  • Half zeros or half 0xFF (> 24 bytes)

Secure Memory Allocation

• Added Zeroizing wrapper for plaintext buffers during encryption/decryption

Unicode Normalization

• Early null byte detection before Unicode normalization
• Added normalize_config_key() and normalize_environment_name() helpers

Test Results

• ✅ All 257 tests passing (100% success rate)

Installation

cargo install naru-config

Deprecated APIs

• save_json() → use atomic_update_config() instead
• load_json() → use atomic_read_config() or lock_file() instead