Tink is a multi-language, cross-platform library that provides simple and misuse-proof APIs for common cryptographic tasks.

This is Tink 1.5.0.

The complete list of changes since 1.4.0 can be found here.

What's new

Security fixes

This release fixes a ciphertext malleability issue (CVE-2020-8929) in Tink for Java and Android. This is a low severity issue. No loss of confidentiality or loss of plaintext integrity occurs due to this problem, only ciphertext integrity is compromised.

New language: Javascript/Typescript

This release introduces alpha support for Javascript/Typescript. Check out the HOW-TO and let us know what you think!

New primitive: PRF set

The PRF set primitive allows to redact data in a deterministic fashion, for example personal identifiable information or internal IDs, or to come up with a user ID from user information without revealing said information in the ID. This allows someone with access to the output of the PRF without access to the key do some types of analysis, while limiting others.

This primitive is supported in C++, Java, Python and Golang.

Python

Added Streaming AEAD. Check out the example for how to encrypt arbitrary large files.
Added CMAC.
Added a lot of examples.

pip3 install tink

C++

Added examples for using hybrid encryption and digital signatures.

We no longer offer prebuilt binaries for C++. Please check out the HOW-TO for compiling your application together with Tink using Bazel or CMake.

Obj-C

Added support for accessGropus to TINKKeysetHandle.

cd /path/to/your/Xcode project/
pod init
pod 'Tink', '1.5.0'
pod install

Golang

Added Streaming AEAD with AES-CTR-HMAC.
Bundled HCVault with Tink. In 1.4.0, HCVault was offered as a separate module, but we were advised by the Golang's team that it should be bundled with Tink.

go get github.com/google/tink/go/...

Java

Added AES-GCM-SIV. This requires a Java security provider that supports AES-GCM-SIV such as Conscrypt.

<dependency>
  <groupId>com.google.crypto.tink</groupId>
  <artifactId>tink</artifactId>
  <version>1.5.0</version>
</dependency>

Android

When a call to Android KeyStore failed, Tink will wait a random number of milliseconds (up to 100) before retrying one more time.

dependencies {
  implementation 'com.google.crypto.tink:tink-android:1.5.0'
}

Tinkey

brew tap google/tink https://github.com/google/tink
brew install tinkey

The prebuilt binary attached to this release should also work well on Windows.

Known issues

Tink for Obj-C doesn't build with Bazel. You can still use it in your apps by installing our prebuilt package, as noted above.

tink-crypto/tink v1.5.0 Tink 1.5.0 on GitHub