# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [Unreleased]

### Added

- Derive the CMZ generator `A` automatically via a RFC 9380 hash-to-group of the generator.
  Applications no longer need to call `cmz_group_init` at startup.
- Add `CMZGroup`, `cmz_generator_a`, and curve features for the automatic
  derivation. Ristretto support is enabled by default; P-256 and secp256k1 are
  available through the `p256` and `k256` features.

### Changes

- CMZ credential point types must now implement
  `group::prime::PrimeGroup + group::GroupEncoding`, and
  `hash2group::FromHash<hash2group::rfc9380::ExpandMsgXmd<sha2::Sha512>>`.

## [0.3.0] - 2026-08-04

### Changes

- Switch from `bincode` to `postcard` for serialization.  The `bincode`
  crate is no longer maintained.  Note that this causes a binary
  incompatibility with previous versions of the `cmz` crate.  That is,
  previous versions and this one will _not_ interoperate.

### Fixes

- By default, when serializing a `CMZCredential`, skip the private key.
  That way, you don't accidentally send the private key if the issuer
  creates a credential completely on its own (not via a typical
  credential issuing protocol) and sends it to the client.  Thanks to
  Morgan Hill from Radically Open Security.

### Added

- Add `serialize_with_privkey` and `deserialize_with_privkey` if you
  explicitly _do_ want to keep the private key when serializing a
  `CMZCredential` (for example, if the issuer is saving a credential to
  its own storage).

## [0.2.1] - 2026-03-26

### Fixes

- Remembered to bump version number in README

## [0.2.0] - 2026-03-25

### Added

- Add `set_keypair` function to CMZ credentials.  This function sets
  both the private and public keys, without recomputing the public key
  from the private key.  Using this function saves computation when you
  have both keys at hand.
- The new `dump` feature enables the corresponding `dump` feature of the
  `sigma_compiler` crate.

### Changes

- Don't serialize an 8-byte length header in front of each Scalar and
  Point, which makes the generated proofs noticeably shorter.
- Depend on `sigma-compiler` version 0.2.0

### Fixes

- Remove nondeterministic order of generated statements in the call to
  the `sigma_compiler` macro.  We need the generated statements to be
  identical, not just equivalent (e.g., the same statements in a
  different order) because the order of the elements in the proof
  depends on the order of the statements.
- Don't use WnafBase multiplication at this time.  It's both not
  constant time, and also in some cases slower than the regular
  multiplication (at least with Ristretto).

## [0.1.0] - 2025-10-10

### Added

- Initial release

[0.3.0]: https://git-crysp.uwaterloo.ca/SigmaProtocol/cmz/src/0.3.0
[0.2.1]: https://git-crysp.uwaterloo.ca/SigmaProtocol/cmz/src/0.2.1
[0.2.0]: https://git-crysp.uwaterloo.ca/SigmaProtocol/cmz/src/0.2.0
[0.1.0]: https://git-crysp.uwaterloo.ca/SigmaProtocol/cmz/src/0.1.0