Tink v1.18.0 release notes

Tink is a multi-language, cross-platform library that provides simple and misuse-proof APIs for common cryptographic tasks.

This is Tink Java 1.18.0

The complete list of changes since 1.17.0 can be found here.

Dropped support

Tink Android no longer supports API level 21 and 22. From Tink 1.18.0, the minimum API level is 23.
Removed Registry.wrap. This API cannot have been used by users: the PrimitiveSet needed for it was already moved to internal in Tink 1.13.0.

New Features

Use Conscrypt's implementation of Ed25519 when available.
Improved performance of AES-GCM-SIV.
Tink now provides a flag GlobalTinkFlags.validateKeysetsOnParsing(). If set to true, Tink will run certain validations on a keyset before it creates a KeysetHandle. We plan to flip the default of this flag to true in Tink 2.0.

Bug fixes

AeadConfig.register() now always registers AES-GCM-SIV. If it's not supported by the registered JCE Providers, it will fail when the primitive is created.
The Aead implementation returned by com.google.crypto.tink.integration.android.AndroidKeystore.getAead() created invalid ciphertexts on Android API version 28 and older when the input was larger than 128kB. Now, it throws an exception instead.
JwtHmacKey, LegacyKmsAeadKey, and LegacyKmsEnvelopeAeadKey are now final. These cannot be properly subclassed as this would break equalsKey.

Obscure behaviour changes

Primitive creation of AES-GCM-SIV now will fail if the algorithm is not available. Previously, this used to work with some Configurations succeeding and the primitive then failed when encrypt or decrypt was called.

Future work

To see what we're working towards, check our project roadmap.

Getting started

To get started using Tink, see the setup guide.

Maven:

<dependency>
    <groupId>com.google.crypto.tink</groupId>
    <artifactId>tink</artifactId>
    <version>1.18.0</version>
</dependency>

Gradle:

dependencies {
  implementation 'com.google.crypto.tink:tink-android:1.18.0'
}

Bazel:

load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

RULES_JVM_EXTERNAL_TAG = "4.5"
RULES_JVM_EXTERNAL_SHA ="b17d7388feb9bfa7f2fa09031b32707df529f26c91ab9e5d909eb1676badd9a6"

http_archive(
    name = "rules_jvm_external",
    strip_prefix = "rules_jvm_external-%s" % RULES_JVM_EXTERNAL_TAG,
    sha256 = RULES_JVM_EXTERNAL_SHA,
    url = "https://github.com/bazelbuild/rules_jvm_external/archive/refs/tags/%s.zip" % RULES_JVM_EXTERNAL_TAG,
)

load("@rules_jvm_external//:repositories.bzl", "rules_jvm_external_deps")

rules_jvm_external_deps()

load("@rules_jvm_external//:setup.bzl", "rules_jvm_external_setup")

rules_jvm_external_setup()

load("@rules_jvm_external//:defs.bzl", "maven_install")

maven_install(
    artifacts = [
        "com.google.crypto.tink:tink:1.18.0",
        # ... other dependencies ...
    ],
    repositories = [
        "https://repo1.maven.org/maven2",
    ],
)

Alternatively, one can build Tink from source, and include it with http_archive:

http_archive(
    name = "com_github_tink_crypto_tink_java",
    urls = ["https://github.com/tink-crypto/tink-java/archive/refs/tags/1.18.0.zip"],
    strip_prefix = "tink-java-1.18.0",
    sha256 = ...
)

load("@tink_java//:tink_java_deps.bzl", "TINK_MAVEN_ARTIFACTS", "tink_java_deps")

tink_java_deps()

load("@tink_java//:tink_java_deps_init.bzl", "tink_java_deps_init")

tink_java_deps_init()

# ...

maven_install(
    artifacts = TINK_MAVEN_ARTIFACTS + # ... other dependencies ...
    repositories = [
        "https://repo1.maven.org/maven2",
    ],
)

Tink v1.18.0

Tink Java v1.18.0