⚠️ Upgrading from 1.0.0 or 1.0.1
Those releases shipped a debug-signed Android APK. Releases since 1.0.2 are
signed properly, so Android refuses to install this one over them — uninstall
the old app first, then install this APK and re-add youraivpn://key.
Upgrading from 1.0.2/1.0.3 works in place.
Fixed
Old clients connected, then reconnected forever
The handshake put a pre-Variant-A peer into legacy compatibility mode — one
session key in both directions, as those clients expect — but that was a
one-shot fixup of the keys present at that moment. The inline rekey runs every
couple of minutes and installs freshly derived keys, so the downlink silently
switched to a directional S2C key such a client cannot decrypt. Its session went
deaf, the watchdog fired, and it handshaked again.
Measured on a live server: 115 accepted legacy handshakes from a single client
in 40 minutes, each followed by silence. The session now carries an explicit
legacy_peer flag that every key derivation honours, and a mask pushed to such a
peer keeps the tag-prefix layout so a MaskUpdate cannot diverge the framing the
moment the client applies it.
Desktop clients could not use the legacy fallback at all
The fallback is a two-part contract: the tag-prefix wire layout AND the single,
non-directional session key. Only the mobile cores implemented both. The desktop
client — the tunnel process behind the macOS and Windows GUIs — had neither, so
it could never reach a server older than the embedded-tag change; and once a
server answered it in compatibility mode, it could not decrypt its own
ServerHello: handshake timeout, reconnect, forever.
It now mirrors the mobile ladder, collapsing the directional split for such a
session at every key derivation — zero-RTT, PFS ratchet and inline rekey.
Upgrade note for operators
Both fixes are server-side and client-side halves of the same contract. Upgrading
the server is what stops old clients from looping; upgrading the client
is what lets a new app reach an old server. Order does not matter.