AuroraMiddleware/mbedtls
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
3f8d78411a
mbedtls/ChangeLog

3262 lines
165 KiB
Plaintext
Raw Normal View History

Prepare for mbed TLS 1.3.10 release
2015-02-08 14:49:54 +00:00
mbed TLS ChangeLog (Sorted per branch, date)
- Changed line endings and encodings to unix and utf-8
2011-01-05 14:48:42 +00:00
Update library version to 2.17.0
2019-03-19 16:11:28 +00:00
= mbed TLS 2.17.0 branch released 2019-03-19
Merge development commit 8e76332 into development-psa Additional changes to temporarily enable running tests: ssl_srv.c and test_suite_ecdh use mbedtls_ecp_group_load instead of mbedtls_ecdh_setup test_suite_ctr_drbg uses mbedtls_ctr_drbg_update instead of mbedtls_ctr_drbg_update_ret
2019-01-31 13:20:20 +00:00
Adapt ChangeLog
2019-01-31 09:27:04 +00:00
Features
* Add a new X.509 API call `mbedtls_x509_parse_der_nocopy()`
which allows copy-less parsing of DER encoded X.509 CRTs,
at the cost of additional lifetime constraints on the input
buffer, but at the benefit of reduced RAM consumption.
Fix ChangeLog entry to correct release version
2019-02-20 10:00:03 +00:00
* Add a new function mbedtls_asn1_write_named_bitstring() to write ASN.1
named bitstring in DER as required by RFC 5280 Appendix B.
Reduce priority of 3DES ciphersuites
2018-10-30 18:21:41 +00:00
* Add MBEDTLS_REMOVE_3DES_CIPHERSUITES to allow removing 3DES ciphersuites
Fix wording of ChangeLog and 3DES_REMOVE docs
2018-11-26 20:57:49 +00:00
from the default list (enabled by default). See
https://sweet32.info/SWEET32_CCS16.pdf.
Adapt ChangeLog
2019-01-31 09:27:04 +00:00
API Changes
* Add a new X.509 API call `mbedtls_x509_parse_der_nocopy()`.
See the Features section for more information.
Adapt ChangeLog
2019-02-07 13:42:45 +00:00
* Allow to opt in to the removal the API mbedtls_ssl_get_peer_cert()
for the benefit of saving RAM, by disabling the new compile-time
option MBEDTLS_SSL_KEEP_PEER_CERTIFICATE (enabled by default for
API stability). Disabling this option makes mbedtls_ssl_get_peer_cert()
always return NULL, and removes the peer_cert field from the
mbedtls_ssl_session structure which otherwise stores the peer's
certificate.
Adapt ChangeLog
2019-01-31 09:27:04 +00:00
Merge development commit 8e76332 into development-psa Additional changes to temporarily enable running tests: ssl_srv.c and test_suite_ecdh use mbedtls_ecp_group_load instead of mbedtls_ecdh_setup test_suite_ctr_drbg uses mbedtls_ctr_drbg_update instead of mbedtls_ctr_drbg_update_ret
2019-01-31 13:20:20 +00:00
Bugfix
* Fix a compilation issue with mbedtls_ecp_restart_ctx not being defined
when MBEDTLS_ECP_ALT is defined. Reported by jwhui. Fixes #2242.
* Run the AD too long test only if MBEDTLS_CCM_ALT is not defined.
Raised as a comment in #1996.
* Reduce the stack consumption of mbedtls_mpi_fill_random() which could
previously lead to a stack overflow on constrained targets.
* Add `MBEDTLS_SELF_TEST` for the mbedtls_self_test functions
in the header files, which missed the precompilation check. #971
* Fix returning the value 1 when mbedtls_ecdsa_genkey failed.
* Remove a duplicate #include in a sample program. Fixed by Masashi Honma #2326.
* Remove the mbedtls namespacing from the header file, to fix a "file not found"
build error. Fixed by Haijun Gu #2319.
Adapt ChangeLog
2019-01-10 09:22:16 +00:00
* Fix signed-to-unsigned integer conversion warning
in X.509 module. Fixes #2212.
Update ChangeLog Update the ChangeLog with the fix.
2018-11-27 08:33:38 +00:00
* Reduce stack usage of `mpi_write_hlp()` by eliminating recursion.
Fixes #2190.
Add ChangeLog entry
2019-02-03 14:41:41 +00:00
* Fix false failure in all.sh when backup files exist in include/mbedtls
(e.g. config.h.bak). Fixed by Peter Kolbus (Garmin) #2407.
Add ChangeLog entry for unused bits in bitstrings
2018-09-26 09:59:20 +00:00
* Ensure that unused bits are zero when writing ASN.1 bitstrings when using
mbedtls_asn1_write_bitstring().
* Fix issue when writing the named bitstrings in KeyUsage and NsCertType
extensions in CSRs and CRTs that caused these bitstrings to not be encoded
correctly as trailing zeroes were not accounted for as unused bits in the
leading content octet. Fixes #1610.
Update ChangeLog for Crypto submodule update
2018-12-01 18:42:47 +00:00
Changes
Adapt ChangeLog
2019-01-30 15:14:21 +00:00
* Reduce RAM consumption during session renegotiation by not storing
the peer CRT chain and session ticket twice.
Merge development commit 8e76332 into development-psa Additional changes to temporarily enable running tests: ssl_srv.c and test_suite_ecdh use mbedtls_ecp_group_load instead of mbedtls_ecdh_setup test_suite_ctr_drbg uses mbedtls_ctr_drbg_update instead of mbedtls_ctr_drbg_update_ret
2019-01-31 13:20:20 +00:00
* Include configuration file in all header files that use configuration,
instead of relying on other header files that they include.
Inserted as an enhancement for #1371
* Add support for alternative CSR headers, as used by Microsoft and defined
in RFC 7468. Found by Michael Ernst. Fixes #767.
ChangeLog: rearrange misplaced sections. Add information about mbed TLS 2.15.0 and mbed TLS 2.15.1.
2019-02-05 09:57:13 +00:00
* Correct many misspellings. Fixed by MisterDA #2371.
* Provide an abstraction of vsnprintf to allow alternative implementations
for platforms that don't provide it. Based on contributions by Joris Aerts
and Nathaniel Wesley Filardo.
* Fix clobber list in MIPS assembly for large integer multiplication.
Previously, this could lead to functionally incorrect assembly being
produced by some optimizing compilers, showing up as failures in
e.g. RSA or ECC signature operations. Reported in #1722, fix suggested
by Aurelien Jarno and submitted by Jeffrey Martin.
Apply imperative style in the changelog entry
2019-02-05 08:11:58 +00:00
* Reduce the complexity of the timing tests. They were assuming more than the
underlying OS actually guarantees.
Add ChangeLog entries
2018-10-16 21:18:53 +00:00
* Fix configuration queries in ssl-opt.h. #2030
* Ensure that ssl-opt.h can be run in OS X. #2029
Reword changelog entry
2019-02-19 11:40:34 +00:00
* Re-enable certain interoperability tests in ssl-opt.sh which had previously
been disabled for lack of a sufficiently recent version of GnuTLS on the CI.
Clarify 3DES changes in ChangeLog
2019-02-19 20:14:00 +00:00
* Ciphersuites based on 3DES now have the lowest priority by default when
they are enabled.
Merge development commit 8e76332 into development-psa Additional changes to temporarily enable running tests: ssl_srv.c and test_suite_ecdh use mbedtls_ecp_group_load instead of mbedtls_ecdh_setup test_suite_ctr_drbg uses mbedtls_ctr_drbg_update instead of mbedtls_ctr_drbg_update_ret
2019-01-31 13:20:20 +00:00
= mbed TLS 2.16.0 branch released 2018-12-21
psa: Add ChangeLog entry for adding Mbed Crypto
2018-11-08 11:15:01 +00:00
Features
Merge development commit 8e76332 into development-psa Additional changes to temporarily enable running tests: ssl_srv.c and test_suite_ecdh use mbedtls_ecp_group_load instead of mbedtls_ecdh_setup test_suite_ctr_drbg uses mbedtls_ctr_drbg_update instead of mbedtls_ctr_drbg_update_ret
2019-01-31 13:20:20 +00:00
* Add a new config.h option of MBEDTLS_CHECK_PARAMS that enables validation
of parameters in the API. This allows detection of obvious misuses of the
API, such as passing NULL pointers. The API of existing functions hasn't
changed, but requirements on parameters have been made more explicit in
the documentation. See the corresponding API documentation for each
function to see for which parameter values it is defined. This feature is
disabled by default. See its API documentation in config.h for additional
steps you have to take when enabling it.
psa: Add ChangeLog entry for adding Mbed Crypto
2018-11-08 11:15:01 +00:00
Merge development commit 8e76332 into development-psa Additional changes to temporarily enable running tests: ssl_srv.c and test_suite_ecdh use mbedtls_ecp_group_load instead of mbedtls_ecdh_setup test_suite_ctr_drbg uses mbedtls_ctr_drbg_update instead of mbedtls_ctr_drbg_update_ret
2019-01-31 13:20:20 +00:00
API Changes
* The following functions in the random generator modules have been
deprecated and replaced as shown below. The new functions change
the return type from void to int to allow returning error codes when
using MBEDTLS_<MODULE>_ALT for the underlying AES or message digest
primitive. Fixes #1798.
mbedtls_ctr_drbg_update() -> mbedtls_ctr_drbg_update_ret()
mbedtls_hmac_drbg_update() -> mbedtls_hmac_drbg_update_ret()
* Extend ECDH interface to enable alternative implementations.
* Deprecate error codes of the form MBEDTLS_ERR_xxx_INVALID_KEY_LENGTH for
ARIA, CAMELLIA and Blowfish. These error codes will be replaced by
the more generic per-module error codes MBEDTLS_ERR_xxx_BAD_INPUT_DATA.
* Additional parameter validation checks have been added for the following
modules - AES, ARIA, Blowfish, CAMELLIA, CCM, GCM, DHM, ECP, ECDSA, ECDH,
ECJPAKE, SHA, Chacha20 and Poly1305, cipher, pk, RSA, and MPI.
Where modules have had parameter validation added, existing parameter
checks may have changed. Some modules, such as Chacha20 had existing
parameter validation whereas other modules had little. This has now been
changed so that the same level of validation is present in all modules, and
that it is now optional with the MBEDTLS_CHECK_PARAMS flag which by default
is off. That means that checks which were previously present by default
will no longer be.
New deprecations
* Deprecate mbedtls_ctr_drbg_update and mbedtls_hmac_drbg_update
in favor of functions that can return an error code.
Bugfix
* Fix for Clang, which was reporting a warning for the bignum.c inline
assembly for AMD64 targets creating string literals greater than those
permitted by the ISO C99 standard. Found by Aaron Jones. Fixes #482.
* Fix runtime error in `mbedtls_platform_entropy_poll()` when run
through qemu user emulation. Reported and fix suggested by randombit
in #1212. Fixes #1212.
* Fix an unsafe bounds check when restoring an SSL session from a ticket.
This could lead to a buffer overflow, but only in case ticket authentication
was broken. Reported and fix suggested by Guido Vranken in #659.
* Add explicit integer to enumeration type casts to example program
programs/pkey/gen_key which previously led to compilation failure
on some toolchains. Reported by phoenixmcallister. Fixes #2170.
* Fix double initialization of ECC hardware that made some accelerators
hang.
* Clarify documentation of mbedtls_ssl_set_own_cert() regarding the absence
of check for certificate/key matching. Reported by Attila Molnar, #507.
ChangeLog: rearrange misplaced sections. Add information about mbed TLS 2.15.0 and mbed TLS 2.15.1.
2019-02-05 09:57:13 +00:00
= mbed TLS 2.15.1 branch released 2018-11-30
Changes
* Update the Mbed Crypto submodule to version 0.1.0b2.
= mbed TLS 2.15.0 branch released 2018-11-23
Features
* Add an experimental build option, USE_CRYPTO_SUBMODULE, to enable use of
Mbed Crypto as the source of the cryptography implementation.
* Add an experimental configuration option, MBEDTLS_PSA_CRYPTO_C, to enable
the PSA Crypto API from Mbed Crypto when additionally used with the
USE_CRYPTO_SUBMODULE build option.
Changes
* Add unit tests for AES-GCM when called through mbedtls_cipher_auth_xxx()
from the cipher abstraction layer. Fixes #2198.
Merge development commit 8e76332 into development-psa Additional changes to temporarily enable running tests: ssl_srv.c and test_suite_ecdh use mbedtls_ecp_group_load instead of mbedtls_ecdh_setup test_suite_ctr_drbg uses mbedtls_ctr_drbg_update instead of mbedtls_ctr_drbg_update_ret
2019-01-31 13:20:20 +00:00
= mbed TLS 2.14.1 branch released 2018-11-30
Security
* Fix timing variations and memory access variations in RSA PKCS#1 v1.5
decryption that could lead to a Bleichenbacher-style padding oracle
attack. In TLS, this affects servers that accept ciphersuites based on
RSA decryption (i.e. ciphersuites whose name contains RSA but not
(EC)DH(E)). Discovered by Eyal Ronen (Weizmann Institute), Robert Gillham
(University of Adelaide), Daniel Genkin (University of Michigan),
Adi Shamir (Weizmann Institute), David Wong (NCC Group), and Yuval Yarom
(University of Adelaide, Data61). The attack is described in more detail
in the paper available here: http://cat.eyalro.net/cat.pdf CVE-2018-19608
* In mbedtls_mpi_write_binary(), don't leak the exact size of the number
via branching and memory access patterns. An attacker who could submit
a plaintext for RSA PKCS#1 v1.5 decryption but only observe the timing
of the decryption and not its result could nonetheless decrypt RSA
plaintexts and forge RSA signatures. Other asymmetric algorithms may
have been similarly vulnerable. Reported by Eyal Ronen, Robert Gillham,
Daniel Genkin, Adi Shamir, David Wong and Yuval Yarom.
* Wipe sensitive buffers on the stack in the CTR_DRBG and HMAC_DRBG
modules.
API Changes
* The new functions mbedtls_ctr_drbg_update_ret() and
mbedtls_hmac_drbg_update_ret() are similar to mbedtls_ctr_drbg_update()
and mbedtls_hmac_drbg_update() respectively, but the new functions
report errors whereas the old functions return void. We recommend that
applications use the new functions.
Adapt ChangeLog
2018-11-15 17:51:24 +00:00
Update library version number to 2.14.0
2018-11-19 18:31:40 +00:00
= mbed TLS 2.14.0 branch released 2018-11-19
Add a ChangeLog entry for changes so far
2017-05-15 15:23:37 +00:00
Adapt ChangeLog
2018-11-02 09:36:45 +00:00
Security
Fix language and formatting in ChangeLog Changed the formatting and language in the ChangeLog to the house-style.
2018-11-07 16:25:38 +00:00
* Fix overly strict DN comparison when looking for CRLs belonging to a
Refine the language in the ChangeLog Fix the language and descriptions in the ChangeLog following review of the Release Notes for the next release.
2018-11-19 15:49:26 +00:00
particular CA. This previously led to ignoring CRLs when the CRL's issuer
Fix language and formatting in ChangeLog Changed the formatting and language in the ChangeLog to the house-style.
2018-11-07 16:25:38 +00:00
name and the CA's subject name differed in their string encoding (e.g.,
one using PrintableString and the other UTF8String) or in the choice of
upper and lower case. Reported by Henrik Andersson of Bosch GmbH in issue
#1784.
Adapt ChangeLog
2018-10-08 12:51:38 +00:00
* Fix a flawed bounds check in server PSK hint parsing. In case the
Refine the language in the ChangeLog Fix the language and descriptions in the ChangeLog following review of the Release Notes for the next release.
2018-11-19 15:49:26 +00:00
incoming message buffer was placed within the first 64KiB of address
Adapt ChangeLog
2018-10-08 12:51:38 +00:00
space and a PSK-(EC)DHE ciphersuite was used, this allowed an attacker
Refine the language in the ChangeLog Fix the language and descriptions in the ChangeLog following review of the Release Notes for the next release.
2018-11-19 15:49:26 +00:00
to trigger a memory access up to 64KiB beyond the incoming message buffer,
potentially leading to an application crash or information disclosure.
Changelog: Add entry for prime validation fix
2018-09-06 09:40:04 +00:00
* Fix mbedtls_mpi_is_prime() to use more rounds of probabilistic testing. The
previous settings for the number of rounds made it practical for an
adversary to construct non-primes that would be erroneously accepted as
primes with high probability. This does not have an impact on the
Fix language and formatting in ChangeLog Changed the formatting and language in the ChangeLog to the house-style.
2018-11-07 16:25:38 +00:00
security of TLS, but can matter in other contexts with numbers chosen
potentially by an adversary that should be prime and can be validated.
Changelog: Add entry for prime validation fix
2018-09-06 09:40:04 +00:00
For example, the number of rounds was enough to securely generate RSA key
pairs or Diffie-Hellman parameters, but was insufficient to validate
Diffie-Hellman parameters properly.
See "Prime and Prejudice" by by Martin R. Albrecht and Jake Massimo and
Kenneth G. Paterson and Juraj Somorovsky.
Adapt ChangeLog
2018-11-02 09:36:45 +00:00
Add a ChangeLog entry for changes so far
2017-05-15 15:23:37 +00:00
Features
Misc documentation fixes/improvements.
2018-10-15 11:22:41 +00:00
* Add support for temporarily suspending expensive ECC computations after
Refine the language in the ChangeLog Fix the language and descriptions in the ChangeLog following review of the Release Notes for the next release.
2018-11-19 15:49:26 +00:00
some configurable amount of operations. This is intended to be used in
constrained, single-threaded systems where ECC is time consuming and can
block other operations until they complete. This is disabled by default,
but can be enabled by MBEDTLS_ECP_RESTARTABLE at compile time and
configured by mbedtls_ecp_set_max_ops() at runtime. It applies to the new
Misc documentation fixes/improvements.
2018-10-15 11:22:41 +00:00
xxx_restartable functions in ECP, ECDSA, PK and X.509 (CRL not supported
yet), and to existing functions in ECDH and SSL (currently only
implemented client-side, for ECDHE-ECDSA ciphersuites in TLS 1.2,
including client authentication).
Add ChangeLog entry for PR #1618 - ARM DSP instruction support
2018-10-28 18:00:51 +00:00
* Add support for Arm CPU DSP extensions to accelerate asymmetric key
operations. On CPUs where the extensions are available, they can accelerate
MPI multiplications used in ECC and RSA cryptography. Contributed by
Aurelien Jarno.
Refine the language in the ChangeLog Fix the language and descriptions in the ChangeLog following review of the Release Notes for the next release.
2018-11-19 15:49:26 +00:00
* Extend RSASSA-PSS signature to allow a smaller salt size. Previously, PSS
signature always used a salt with the same length as the hash, and returned
an error if this was not possible. Now the salt size may be up to two bytes
shorter. This allows the library to support all hash and signature sizes
that comply with FIPS 186-4, including SHA-512 with a 1024-bit key.
Fix merge of Changelog 128bit CTR_DRBG entry The entry describing support for 128-bit keys in CTR_DRBG was merged into the wrong version.
2018-11-06 23:46:04 +00:00
* Add support for 128-bit keys in CTR_DRBG. Note that using keys shorter
than 256 bits limits the security of generated material to 128 bits.
Fix mis-merged ChangeLog
2018-07-02 10:05:49 +00:00
Merge remote-tracking branch 'public/pr/2054' into development-proposed
2018-11-09 19:57:53 +00:00
API Changes
Clarified new platform errors in the ChangeLog Clarified new platform errors and error code deprecations in the ChangeLog.
2018-11-09 20:09:33 +00:00
* Add a common error code of `MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED` for
a feature that is not supported by underlying alternative
implementations implementing cryptographic primitives. This is useful for
hardware accelerators that don't implement all options or features.
Merge remote-tracking branch 'public/pr/2054' into development-proposed
2018-11-09 19:57:53 +00:00
Add ChangeLog entry Add the ChangeLog entry describing the change.
2018-10-04 11:32:05 +00:00
New deprecations
Clarified new platform errors in the ChangeLog Clarified new platform errors and error code deprecations in the ChangeLog.
2018-11-09 20:09:33 +00:00
* All module specific errors following the form
MBEDTLS_ERR_XXX_FEATURE_UNAVAILABLE that indicate a feature is not
supported are deprecated and are now replaced by the new equivalent
platform error.
Fix language and formatting in ChangeLog Changed the formatting and language in the ChangeLog to the house-style.
2018-11-07 16:25:38 +00:00
* All module specific generic hardware acceleration errors following the
Clarified new platform errors in the ChangeLog Clarified new platform errors and error code deprecations in the ChangeLog.
2018-11-09 20:09:33 +00:00
form MBEDTLS_ERR_XXX_HW_ACCEL_FAILED that are deprecated and are replaced
by the equivalent plaform error.
Changelog: Add entry for prime validation fix
2018-09-06 09:40:04 +00:00
* Deprecate the function mbedtls_mpi_is_prime() in favor of
mbedtls_mpi_is_prime_ext() which allows specifying the number of
Miller-Rabin rounds.
Add ChangeLog entry Add the ChangeLog entry describing the change.
2018-10-04 11:32:05 +00:00
Add ChangeLog entry for bug #1890
2018-07-30 21:10:48 +00:00
Bugfix
Fix ChangeLog entry for #2069 The fix for #2069 had accidentally been added to features, not bugfixes.
2018-10-30 15:55:10 +00:00
* Fix wrong order of freeing in programs/ssl/ssl_server2 example
application leading to a memory leak in case both
MBEDTLS_MEMORY_BUFFER_ALLOC_C and MBEDTLS_MEMORY_BACKTRACE are set.
Fixes #2069.
Merge remote-tracking branch 'public/pr/1970' into development
2018-09-27 08:48:54 +00:00
* Fix a bug in the update function for SSL ticket keys which previously
invalidated keys of a lifetime of less than a 1s. Fixes #1968.
Merge remote-tracking branch 'public/pr/1758' into development
2018-09-27 10:35:19 +00:00
* Fix failure in hmac_drbg in the benchmark sample application, when
MBEDTLS_THREADING_C is defined. Found by TrinityTonic, #1095
Adapt ChangeLog
2018-10-17 13:53:05 +00:00
* Fix a bug in the record decryption routine ssl_decrypt_buf()
which lead to accepting properly authenticated but improperly
padded records in case of CBC ciphersuites using Encrypt-then-MAC.
Adapt ChangeLog
2018-10-05 08:51:36 +00:00
* Fix memory leak and freeing without initialization in the example
program programs/x509/cert_write. Fixes #1422.
Fix language and formatting in ChangeLog Changed the formatting and language in the ChangeLog to the house-style.
2018-11-07 16:25:38 +00:00
* Ignore IV in mbedtls_cipher_set_iv() when the cipher mode is
MBEDTLS_MODE_ECB. Found by ezdevelop. Fixes #1091.
Adapt ChangeLog
2018-10-15 12:20:28 +00:00
* Zeroize memory used for buffering or reassembling handshake messages
after use.
* Use `mbedtls_platform_zeroize()` instead of `memset()` for zeroization
of sensitive data in the example programs aescrypt2 and crypt_and_hash.
Adapt ChangeLog
2018-11-06 17:43:16 +00:00
* Change the default string format used for various X.509 DN attributes to
UTF8String. Previously, the use of the PrintableString format led to
wildcards and non-ASCII characters being unusable in some DN attributes.
Fix language and formatting in ChangeLog Changed the formatting and language in the ChangeLog to the house-style.
2018-11-07 16:25:38 +00:00
Reported by raprepo in #1860 and by kevinpt in #468. Fix contributed by
Thomas-Dee.
Adapt ChangeLog
2018-10-11 09:54:45 +00:00
* Fix compilation failure for configurations which use compile time
replacements of standard calloc/free functions through the macros
MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_FREE_MACRO.
Reported by ole-de and ddhome2006. Fixes #882, #1642 and #1706.
Merge remote-tracking branch 'public/pr/1970' into development
2018-09-27 08:48:54 +00:00
Changes
Added ChangeLog entry for yotta support removal
2018-09-26 17:07:18 +00:00
* Removed support for Yotta as a build tool.
Merge remote-tracking branch 'public/pr/1970' into development
2018-09-27 08:48:54 +00:00
* Add tests for session resumption in DTLS.
Add ChangeLog entry
2018-07-10 13:55:52 +00:00
* Close a test gap in (D)TLS between the client side and the server side:
test the handling of large packets and small packets on the client side
in the same way as on the server side.
Merge remote-tracking branch 'public/pr/1627' into development
2018-10-27 17:27:41 +00:00
* Change the dtls_client and dtls_server samples to work by default over
IPv6 and optionally by a build option over IPv4.
Add ChangeLog entry for Windows threading fix
2018-10-01 13:44:22 +00:00
* Change the use of Windows threading to use Microsoft Visual C++ runtime
calls, rather than Win32 API calls directly. This is necessary to avoid
conflict with C runtime usage. Found and fixed by irwir.
Fix language and formatting in ChangeLog Changed the formatting and language in the ChangeLog to the house-style.
2018-11-07 16:25:38 +00:00
* Remember the string format of X.509 DN attributes when replicating
X.509 DNs. Previously, DN attributes were always written in their default
string format (mostly PrintableString), which could lead to CRTs being
created which used PrintableStrings in the issuer field even though the
signing CA used UTF8Strings in its subject field; while X.509 compliant,
such CRTs were rejected in some applications, e.g. some versions of
Firefox, curl and GnuTLS. Reported in #1033 by Moschn. Fix contributed by
Thomas-Dee.
Adapt ChangeLog
2018-10-30 10:08:33 +00:00
* Improve documentation of mbedtls_ssl_get_verify_result().
Fixes #517 reported by github-monoculture.
Changelog: Add entry for prime test improvement
2018-09-06 09:41:33 +00:00
* Add MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR flag to mbedtls_mpi_gen_prime() and
use it to reduce error probability in RSA key generation to levels mandated
by FIPS-186-4.
Merge remote-tracking branch 'public/pr/1970' into development
2018-09-27 08:48:54 +00:00
Merge remote-tracking branch 'public/pr/1927' into development-restricted
2018-09-06 15:24:48 +00:00
= mbed TLS 2.13.1 branch released 2018-09-06
Add ChangeLog entry for bug #1890
2018-07-30 21:10:48 +00:00
Add ChangeLog entry for configurable gmtime() in platform
2018-08-16 20:46:35 +00:00
API Changes
ChangeLog: Add missing renamings gmtime -> gmtime_r
2018-09-05 15:19:07 +00:00
* Extend the platform module with an abstraction mbedtls_platform_gmtime_r()
Replace 'thread safe' by 'thread-safe' in the documentation
2018-09-05 15:21:36 +00:00
whose implementation should behave as a thread-safe version of gmtime().
Add ChangeLog entry for configurable gmtime() in platform
2018-08-16 20:46:35 +00:00
This allows users to configure such an implementation at compile time when
ChangeLog: Add missing renamings gmtime -> gmtime_r
2018-09-05 15:19:07 +00:00
the target system cannot be deduced automatically, by setting the option
MBEDTLS_PLATFORM_GMTIME_R_ALT. At this stage Mbed TLS is only able to
automatically select implementations for Windows and POSIX C libraries.
Add ChangeLog entry for configurable gmtime() in platform
2018-08-16 20:46:35 +00:00
Add ChangeLog entry for bug #1890
2018-07-30 21:10:48 +00:00
Bugfix
Fix missing word in ChangeLog entry for gmtime()
2018-09-05 10:30:28 +00:00
* Fix build failures on platforms where only gmtime() is available but
neither gmtime_r() nor gmtime_s() are present. Fixes #1907.
Add ChangeLog entry for bug #1890
2018-07-30 21:10:48 +00:00
Update library version number to 2.13.0
2018-08-31 14:59:10 +00:00
= mbed TLS 2.13.0 branch released 2018-08-31
Add ChangeLog entry for bug #1890
2018-07-30 21:10:48 +00:00
Update change log
2018-07-09 12:42:35 +00:00
Security
Update change log
2018-07-16 10:20:10 +00:00
* Fix an issue in the X.509 module which could lead to a buffer overread
during certificate extensions parsing. In case of receiving malformed
input (extensions length field equal to 0), an illegal read of one byte
beyond the input buffer is made. Found and analyzed by Nathan Crandall.
Update change log
2018-07-09 12:42:35 +00:00
Add ChangeLog entry
2017-09-21 11:16:52 +00:00
Features
Move MTU setting to SSL context, not config This setting belongs to the individual connection, not to a configuration shared by many connections. (If a default value is desired, that can be handled by the application code that calls mbedtls_ssl_set_mtu().) There are at least two ways in which this matters: - per-connection settings can be adjusted if MTU estimates become available during the lifetime of the connection - it is at least conceivable that a server might recognize restricted clients based on range of IPs and immediately set a lower MTU for them. This is much easier to do with a per-connection setting than by maintaining multiple near-duplicated ssl_config objects that differ only by the MTU setting.
2018-08-20 08:37:23 +00:00
* Add support for fragmentation of outgoing DTLS handshake messages. This
is controlled by the maximum fragment length as set locally or negotiated
Improve wording in ChangeLog and documentation
2018-08-21 07:53:22 +00:00
with the peer, as well as by a new per-connection MTU option, set using
Move MTU setting to SSL context, not config This setting belongs to the individual connection, not to a configuration shared by many connections. (If a default value is desired, that can be handled by the application code that calls mbedtls_ssl_set_mtu().) There are at least two ways in which this matters: - per-connection settings can be adjusted if MTU estimates become available during the lifetime of the connection - it is at least conceivable that a server might recognize restricted clients based on range of IPs and immediately set a lower MTU for them. This is much easier to do with a per-connection setting than by maintaining multiple near-duplicated ssl_config objects that differ only by the MTU setting.
2018-08-20 08:37:23 +00:00
mbedtls_ssl_set_mtu().
Implement PMTU auto-reduction in handshake
2018-08-20 07:34:02 +00:00
* Add support for auto-adjustment of MTU to a safe value during the
handshake when flights do not get through (RFC 6347, section 4.1.1.1,
last paragraph).
Adapt ChangeLog
2018-08-14 15:34:55 +00:00
* Add support for packing multiple records within a single datagram,
enabled by default.
Adapt ChangeLog Make explicit that buffering support is about DTLS.
2018-08-28 11:54:27 +00:00
* Add support for buffering out-of-order handshake messages in DTLS.
Adapt ChangeLog
2018-08-22 09:27:13 +00:00
The maximum amount of RAM used for this can be controlled by the
compile-time constant MBEDTLS_SSL_DTLS_MAX_BUFFERING defined
in mbedtls/config.h.
Adapt ChangeLog
2018-08-14 15:34:55 +00:00
API Changes
Rename ssl_conf_datagram_packing() to ssl_set_datagram_packing() The naming convention is that functions of the form mbedtls_ssl_conf_xxx() apply to the SSL configuration.
2018-08-24 10:13:57 +00:00
* Add function mbedtls_ssl_set_datagram_packing() to configure
Adapt ChangeLog
2018-08-14 15:34:55 +00:00
the use of datagram packing (enabled by default).
Add ChangeLog entry
2017-09-21 11:16:52 +00:00
Add ChangeLog entry for bug #1890
2018-07-30 21:10:48 +00:00
Bugfix
Revised and clarified ChangeLog Minor changes to fix language, merge mistakes and incorrect classifications of changes.
2018-08-31 10:59:56 +00:00
* Fix a potential memory leak in mbedtls_ssl_setup() function. An allocation
failure in the function could lead to other buffers being leaked.
Add ChangeLog entry for bug #1890
2018-07-30 21:10:48 +00:00
* Fixes an issue with MBEDTLS_CHACHAPOLY_C which would not compile if
MBEDTLS_ARC4_C and MBEDTLS_CIPHER_NULL_CIPHER weren't also defined. #1890
Merge remote-tracking branch 'upstream-public/pr/1834' into development
2018-08-10 09:49:10 +00:00
* Fix a memory leak in ecp_mul_comb() if ecp_precompute_comb() fails.
Fix contributed by Espressif Systems.
Add entry in ChangeLog Add an entry in the ChangeLog, describing the fix.
2018-06-21 13:40:24 +00:00
* Add ecc extensions only if an ecc based ciphersuite is used.
Update ChangeLog Update ChangeLog with a less ambigous description.
2018-06-28 08:09:09 +00:00
This improves compliance to RFC 4492, and as a result, solves
interoperability issues with BouncyCastle. Raised by milenamil in #1157.
Revised and clarified ChangeLog Minor changes to fix language, merge mistakes and incorrect classifications of changes.
2018-08-31 10:59:56 +00:00
* Replace printf with mbedtls_printf in the ARIA module. Found by
TrinityTonic in #1908.
Improve wording in ChangeLog
2018-08-14 14:22:05 +00:00
* Fix potential use-after-free in mbedtls_ssl_get_max_frag_len()
Adapt ChangeLog
2018-08-13 15:36:58 +00:00
and mbedtls_ssl_get_record_expansion() after a session reset. Fixes #1941.
Improve ChangeLog wording for the commmit that Fixes #1954.
2018-08-17 08:47:22 +00:00
* Fix a bug that caused SSL/TLS clients to incorrectly abort the handshake
with TLS versions 1.1 and earlier when the server requested authentication
without providing a list of CAs. This was due to an overly strict bounds
check in parsing the CertificateRequest message,
introduced in Mbed TLS 2.12.0. Fixes #1954.
Adapt ChangeLog
2018-08-03 08:53:48 +00:00
* Fix a miscalculation of the maximum record expansion in
mbedtls_ssl_get_record_expansion() in case of ChachaPoly ciphersuites,
or CBC ciphersuites in (D)TLS versions 1.1 or higher. Fixes #1913, #1914.
Revised and clarified ChangeLog Minor changes to fix language, merge mistakes and incorrect classifications of changes.
2018-08-31 10:59:56 +00:00
* Fix undefined shifts with negative values in certificates parsing
(found by Catena cyber using oss-fuzz)
Adapt ChangeLog
2017-10-08 15:13:03 +00:00
* Fix memory leak and free without initialization in pk_encrypt
and pk_decrypt example programs. Reported by Brace Stout. Fixes #1128.
Revised and clarified ChangeLog Minor changes to fix language, merge mistakes and incorrect classifications of changes.
2018-08-31 10:59:56 +00:00
* Remove redundant else statement. Raised by irwir. Fixes #1776.
Add ChangeLog entry for bug #1890
2018-07-30 21:10:48 +00:00
Add a ChangeLog entry for #1816
2018-08-10 09:56:31 +00:00
Changes
* Copy headers preserving timestamps when doing a "make install".
Contributed by xueruini.
Merge remote-tracking branch 'upstream-public/pr/1861' into development Add Changelog entry
2018-08-10 10:17:14 +00:00
* Allow the forward declaration of public structs. Contributed by Dawid
Drozd. Fixes #1215 raised by randombit.
Merge remote-tracking branch 'upstream-public/pr/1598' into development Add a Changelog entry
2018-08-10 10:23:15 +00:00
* Improve compatibility with some alternative CCM implementations by using
CCM test vectors from RAM.
Adapt ChangeLog
2018-08-16 15:07:27 +00:00
* Add support for buffering of out-of-order handshake messages.
HKDF: Add warning to partial functions The standard HKDF security guarantees only hold if `mbedtls_hkdf()` is used or if `mbedtls_hkdf_extract()` and `mbedtls_hkdf_expand()` are called in succession carefully and an equivalent way. Making `mbedtls_hkdf_extract()` and `mbedtls_hkdf_expand()` static would prevent any misuse, but doing so would require the TLS 1.3 stack to break abstraction and bypass the module API. To reduce the risk of misuse we add warnings to the function descriptions.
2018-08-06 13:20:15 +00:00
* Add warnings to the documentation of the HKDF module to reduce the risk
of misusing the mbedtls_hkdf_extract() and mbedtls_hkdf_expand()
functions. Fixes #1775. Reported by Brian J. Murray.
Update version to 2.12.0
2018-07-25 14:33:39 +00:00
= mbed TLS 2.12.0 branch released 2018-07-25
Merge branch 'pr_403' into development-proposed
2018-03-22 20:34:15 +00:00
Add ChangeLog entry
2018-06-27 08:57:33 +00:00
Security
* Fix a vulnerability in TLS ciphersuites based on CBC and using SHA-384,
in (D)TLS 1.0 to 1.2, that allowed an active network attacker to
partially recover the plaintext of messages under some conditions by
exploiting timing measurements. With DTLS, the attacker could perform
this recovery by sending many messages in the same connection. With TLS
or if mbedtls_ssl_conf_dtls_badmac_limit() was used, the attack only
worked if the same secret (for example a HTTP Cookie) has been repeatedly
sent over connections manipulated by the attacker. Connections using GCM
or CCM instead of CBC, using hash sizes other than SHA-384, or using
Encrypt-then-Mac (RFC 7366) were not affected. The vulnerability was
caused by a miscalculation (for SHA-384) in a countermeasure to the
original Lucky 13 attack. Found by Kenny Paterson, Eyal Ronen and Adi
Shamir.
Fix Lucky 13 cache attack on MD/SHA padding The basis for the Lucky 13 family of attacks is for an attacker to be able to distinguish between (long) valid TLS-CBC padding and invalid TLS-CBC padding. Since our code sets padlen = 0 for invalid padding, the length of the input to the HMAC function gives information about that. Information about this length (modulo the MD/SHA block size) can be deduced from how much MD/SHA padding (this is distinct from TLS-CBC padding) is used. If MD/SHA padding is read from a (static) buffer, a local attacker could get information about how much is used via a cache attack targeting that buffer. Let's get rid of this buffer. Now the only buffer used is the internal MD/SHA one, which is always read fully by the process() function.
2018-06-28 10:10:27 +00:00
* Fix a vulnerability in TLS ciphersuites based on CBC, in (D)TLS 1.0 to
1.2, that allowed a local attacker, able to execute code on the local
machine as well as manipulate network packets, to partially recover the
Clarify attack conditions in the ChangeLog. Referring to the previous entry could imply that the current one was limited to SHA-384 too, which it isn't.
2018-07-11 16:27:08 +00:00
plaintext of messages under some conditions by using a cache attack
Fix #2370, minor typos and spelling mistakes
2019-01-23 14:24:37 +00:00
targeting an internal MD/SHA buffer. With TLS or if
Clarify attack conditions in the ChangeLog. Referring to the previous entry could imply that the current one was limited to SHA-384 too, which it isn't.
2018-07-11 16:27:08 +00:00
mbedtls_ssl_conf_dtls_badmac_limit() was used, the attack only worked if
the same secret (for example a HTTP Cookie) has been repeatedly sent over
connections manipulated by the attacker. Connections using GCM or CCM
instead of CBC or using Encrypt-then-Mac (RFC 7366) were not affected.
Found by Kenny Paterson, Eyal Ronen and Adi Shamir.
Add counter-measure to cache-based Lucky 13 The basis for the Lucky 13 family of attacks is for an attacker to be able to distinguish between (long) valid TLS-CBC padding and invalid TLS-CBC padding. Since our code sets padlen = 0 for invalid padding, the length of the input to the HMAC function, and the location where we read the MAC, give information about that. A local attacker could gain information about that by observing via a cache attack whether the bytes at the end of the record (at the location of would-be padding) have been read during MAC verification (computation + comparison). Let's make sure they're always read.
2018-06-28 08:38:35 +00:00
* Add a counter-measure against a vulnerability in TLS ciphersuites based
on CBC, in (D)TLS 1.0 to 1.2, that allowed a local attacker, able to
execute code on the local machine as well as manipulate network packets,
to partially recover the plaintext of messages under some conditions (see
previous entry) by using a cache attack targeting the SSL input record
buffer. Connections using GCM or CCM instead of CBC or using
Encrypt-then-Mac (RFC 7366) were not affected. Found by Kenny Paterson,
Eyal Ronen and Adi Shamir.
Add ChangeLog entry
2018-06-27 08:57:33 +00:00
Add ChangeLog entry for new features. Fixes #346
2018-05-03 10:49:58 +00:00
Features
* Add new crypto primitives from RFC 7539: stream cipher Chacha20, one-time
Add ChangeLog entry for ChachaPoly ciphersuites fixes #346
2018-06-19 10:48:24 +00:00
authenticator Poly1305 and AEAD construct Chacha20-Poly1305. Contributed
Clarify Changelog entries Corrected the Changelog to move an entry in the wrong place after a merge, some entries which were Changes not bugfixes, and corrected style issues.
2018-07-25 16:26:56 +00:00
by Daniel King.
Add ChangeLog entry for ChachaPoly ciphersuites fixes #346
2018-06-19 10:48:24 +00:00
* Add support for CHACHA20-POLY1305 ciphersuites from RFC 7905.
Add ChangeLog entry for PR #1567. ChangeLog entry for platform support for the Haiku OS. PR #1567.
2018-07-10 10:56:19 +00:00
* Add platform support for the Haiku OS. (https://www.haiku-os.org).
Contributed by Augustin Cavalier.
Add ChangeLog entry for PR #536
2018-07-10 14:35:43 +00:00
* Make the receive and transmit buffers independent sizes, for situations
where the outgoing buffer can be fixed at a smaller size than the incoming
buffer, which can save some RAM. If buffer lengths are kept equal, there
is no functional difference. Contributed by Angus Gratton, and also
independently contributed again by Paul Sokolovsky.
Add ChangeLog Add entry in ChangeLog for the Key Wrapping feature.
2018-07-15 06:34:35 +00:00
* Add support for key wrapping modes based on AES as defined by
Clarify Changelog entries Corrected the Changelog to move an entry in the wrong place after a merge, some entries which were Changes not bugfixes, and corrected style issues.
2018-07-25 16:26:56 +00:00
NIST SP 800-38F algorithms KW and KWP and by RFC 3394 and RFC 5649.
Add ChangeLog entry for new features. Fixes #346
2018-05-03 10:49:58 +00:00
Add ChangeLog entry for #1257 - key_app_writer writes invalid ASN.1
2018-06-28 10:56:57 +00:00
Bugfix
* Fix the key_app_writer example which was writing a leading zero byte which
was creating an invalid ASN.1 tag. Found by Aryeh R. Fixes #1257.
update ChangeLog
2018-06-25 11:44:57 +00:00
* Fix compilation error on C++, because of a variable named new.
update ChangeLog
2018-06-25 11:47:05 +00:00
Found and fixed by Hirotaka Niisato in #1783.
Merge remote-tracking branch 'public/pr/1645' into development
2018-06-28 11:06:16 +00:00
* Fix "no symbols" warning issued by ranlib when building on Mac OS X. Fix
Clarify Changelog entries Corrected the Changelog to move an entry in the wrong place after a merge, some entries which were Changes not bugfixes, and corrected style issues.
2018-07-25 16:26:56 +00:00
contributed by tabascoeye.
Add ChangeLog entry for mbedtls_ssl_write() docs
2017-07-11 13:39:30 +00:00
* Clarify documentation for mbedtls_ssl_write() to include 0 as a valid
return value. Found by @davidwu2000. #839
Add a ChangeLog entry for memory leak in mbedtls_x509_csr_parse()
2018-06-28 11:10:56 +00:00
* Fix a memory leak in mbedtls_x509_csr_parse(), found by catenacyber,
Philippe Antoine. Fixes #1623.
Add ChangeLog entry for #992 fix
2018-07-02 11:00:54 +00:00
* Remove unused headers included in x509.c. Found by Chris Hanson and fixed
by Brendan Shanks. Part of a fix for #992.
Add entry in ChangeLog Add entry in ChangeLog for compilation error fix of #1719
2018-06-17 11:51:59 +00:00
* Fix compilation error when MBEDTLS_ARC4_C is disabled and
MBEDTLS_CIPHER_NULL_CIPHER is enabled. Found by TrinityTonic in #1719.
Clarify Changelog entries Corrected the Changelog to move an entry in the wrong place after a merge, some entries which were Changes not bugfixes, and corrected style issues.
2018-07-25 16:26:56 +00:00
* Added length checks to some TLS parsing functions. Found and fixed by
Philippe Antoine from Catena cyber. #1663.
Add fix for #1550 and credit to the ChangeLog
2018-06-24 15:20:56 +00:00
* Fix the inline assembly for the MPI multiply helper function for i386 and
i386 with SSE2. Found by László Langó. Fixes #1550
Fix typo in ChangeLog Fix typo in ChangeLog discovered in PR review
2017-10-01 14:11:54 +00:00
* Fix namespacing in header files. Remove the `mbedtls` namespacing in
Remove unneeded namesapcing in header files Remove the `mbedtls` namesapcing in the `#include` in header files Resolves issue #857
2017-05-14 13:17:33 +00:00
the `#include` in the header files. Resolves #857
Add ChangeLog entry for #1098 fix.
2018-07-24 09:03:41 +00:00
* Fix compiler warning of 'use before initialisation' in
mbedtls_pk_parse_key(). Found by Martin Boye Petersen and fixed by Dawid
Drozd. #1098
Revise ChangeLog entry for empty data records fixes
2018-07-24 11:54:15 +00:00
* Fix decryption for zero length messages (which contain all padding) when a
CBC based ciphersuite is used together with Encrypt-then-MAC. Previously,
such a message was wrongly reported as an invalid record and therefore lead
to the connection being terminated. Seen most often with OpenSSL using
TLS 1.0. Reported by @kFYatek and by Conor Murphy on the forum. Fix
contributed by Espressif Systems. Fixes #1632
Add ChangeLog entry for empty app data fix
2018-07-04 09:01:39 +00:00
* Fix ssl_client2 example to send application data with 0-length content
when the request_size argument is set to 0 as stated in the documentation.
Fixes #1833.
Clarify Changelog entries Corrected the Changelog to move an entry in the wrong place after a merge, some entries which were Changes not bugfixes, and corrected style issues.
2018-07-25 16:26:56 +00:00
* Correct the documentation for `mbedtls_ssl_get_session()`. This API has
deep copy of the session, and the peer certificate is not lost. Fixes #926.
Merge remote-tracking branch 'public/pr/1198' into development
2018-07-24 16:20:17 +00:00
* Fix build using -std=c99. Fixed by Nick Wilson.
Add ChangeLog entry for #1257 - key_app_writer writes invalid ASN.1
2018-06-28 10:56:57 +00:00
Merge remote-tracking branch 'public/pr/1533' into development
2018-06-27 09:50:58 +00:00
Changes
Clarify Changelog entries Corrected the Changelog to move an entry in the wrong place after a merge, some entries which were Changes not bugfixes, and corrected style issues.
2018-07-25 16:26:56 +00:00
* Fail when receiving a TLS alert message with an invalid length, or invalid
zero-length messages when using TLS 1.2. Contributed by Espressif Systems.
* Change the default behaviour of mbedtls_hkdf_extract() to return an error
when calling with a NULL salt and non-zero salt_len. Contributed by
Brian J Murray
Merge remote-tracking branch 'public/pr/1533' into development
2018-06-27 09:50:58 +00:00
* Change the shebang line in Perl scripts to look up perl in the PATH.
Contributed by fbrosson.
Use gmtime_r to fix thread-safety issue, and use mbedtls_time on Windows
2017-12-05 12:07:33 +00:00
* Allow overriding the time on Windows via the platform-time abstraction.
Fixed by Nick Wilson.
* Use gmtime_r/gmtime_s for thread-safety. Fixed by Nick Wilson.
Merge remote-tracking branch 'public/pr/1533' into development
2018-06-27 09:50:58 +00:00
Fix mis-merged ChangeLog
2018-07-02 10:05:49 +00:00
= mbed TLS 2.11.0 branch released 2018-06-18
Features
Fix ChangeLog whitespace errors and add entry for PR #1646 PR #1646 is a change to the behaviour of the CMake files therefore should be recorded in the Changelog.
2018-06-12 16:35:06 +00:00
* Add additional block mode, OFB (Output Feedback), to the AES module and
cipher abstraction module.
* Implement the HMAC-based extract-and-expand key derivation function
(HKDF) per RFC 5869. Contributed by Thomas Fossati.
* Add support for the CCM* block cipher mode as defined in IEEE Std. 802.15.4.
ChangeLog: Add an entry for AES-XTS
2018-05-23 13:21:02 +00:00
* Add support for the XTS block cipher mode with AES (AES-XTS).
Contributed by Aorimn in pull request #414.
Merge remote-tracking branch 'public/pr/1270' into development
2018-06-15 13:17:31 +00:00
* In TLS servers, support offloading private key operations to an external
cryptoprocessor. Private key operations can be asynchronous to allow
non-blocking operation of the TLS server stack.
Fix up the ChangeLog for the new version Fix the ChangeLog for the next version of Mbed TLS following merge of PR #1593.
2018-06-12 15:46:45 +00:00
Add entry to ChangeLog for PR #795 PR #795 fixes issue #777, 'check matching issuer crt and key for all algs' and needs a ChangeLog entry
2018-06-12 16:04:58 +00:00
Bugfix
Fix ChangeLog whitespace errors and add entry for PR #1646 PR #1646 is a change to the behaviour of the CMake files therefore should be recorded in the Changelog.
2018-06-12 16:35:06 +00:00
* Fix the cert_write example to handle certificates signed with elliptic
curves as well as RSA. Fixes #777 found by dbedev.
Add ChangeLog entry for PR #1555 Adds ChangeLog entry for PR #1555, 'Only redefine _WIN32_WINNT macro when < 0x0501'
2018-06-14 09:30:19 +00:00
* Fix for redefinition of _WIN32_WINNT to avoid overriding a definition
used by user applications. Found and fixed by Fabio Alessandrelli.
Compilation warning fixes on 32b platfrom with IAR Fix compilation warnings with IAR toolchain, on 32 bit platform. Reported by rahmanih in #683 This is based on work by Ron Eldor in PR #750, some of which was independently fixed by Azim Khan and already merged in PR #1646.
2018-06-14 07:58:59 +00:00
* Fix compilation warnings with IAR toolchain, on 32 bit platform.
Reported by rahmanih in #683
Fix version in ChangeLog for fix for #552
2018-06-18 10:54:44 +00:00
* Fix braces in mbedtls_memory_buffer_alloc_status(). Found by sbranden, #552.
Fix ChangeLog whitespace errors and add entry for PR #1646 PR #1646 is a change to the behaviour of the CMake files therefore should be recorded in the Changelog.
2018-06-12 16:35:06 +00:00
Changes
* Changed CMake defaults for IAR to treat all compiler warnings as errors.
Add ChangeLog entry for clang version fix. Issue #1072
2018-06-18 10:51:36 +00:00
* Changed the Clang parameters used in the CMake build files to work for
versions later than 3.6. Versions of Clang earlier than this may no longer
work. Fixes #1072
Add a ChangeLog entry for changes so far
2017-05-15 15:23:37 +00:00
Updated version number to 2.10.0 for release
2018-06-06 13:47:47 +00:00
= mbed TLS 2.10.0 branch released 2018-06-06
Merge branch 'pr_403' into development-proposed
2018-03-22 20:34:15 +00:00
aria: add ChangeLog entry
2018-02-27 11:43:35 +00:00
Features
* Add support for ARIA cipher (RFC 5794) and associated TLS ciphersuites
(RFC 6209). Disabled by default, see MBEDTLS_ARIA_C in config.h
Merge branch 'pr_946' into development-proposed
2018-04-04 08:33:45 +00:00
API Changes
Justify moving zeroize() to utils in ChangeLog
2018-03-08 20:06:03 +00:00
* Extend the platform module with a util component that contains
functionality shared by multiple Mbed TLS modules. At this stage
platform_util.h (and its associated platform_util.c) only contain
mbedtls_platform_zeroize(), which is a critical function from a security
point of view. mbedtls_platform_zeroize() needs to be regularly tested
against compilers to ensure that calls to it are not removed from the
output binary as part of redundant code elimination optimizations.
Therefore, mbedtls_platform_zeroize() is moved to the platform module to
facilitate testing and maintenance.
Merge branch 'development' into iotssl-1204
2018-03-28 13:52:35 +00:00
Add ChangeLog entry for PR#1651
2018-06-01 18:11:55 +00:00
Bugfix
* Fix an issue with MicroBlaze support in bn_mul.h which was causing the
build to fail. Found by zv-io. Fixes #1651.
Support out-of-tree testing with CMake: add ChangeLog entry. Fixes #1193
2018-03-21 11:38:00 +00:00
Changes
* Support TLS testing in out-of-source builds using cmake. Fixes #1193.
Remove double declaration of mbedtls_ssl_list_ciphersuites Raised by TrinityTonic. #1359
2018-02-25 11:29:03 +00:00
* Fix redundant declaration of mbedtls_ssl_list_ciphersuites. Raised by
TrinityTonic. #1359.
Support out-of-tree testing with CMake: add ChangeLog entry. Fixes #1193
2018-03-21 11:38:00 +00:00
Update version to 2.9.0 Bump SOVERSION for parity with 2.7.2 and 2.7.3.
2018-04-27 12:07:13 +00:00
= mbed TLS 2.9.0 branch released 2018-04-30
Merge branch 'pr_403' into development-proposed
2018-03-22 20:34:15 +00:00
Merge tag 'mbedtls-2.8.0' into iotssl-1381-x509-verify-refactor-restricted Conflict resolution: * ChangeLog * tests/data_files/Makefile: concurrent additions, order irrelevant * tests/data_files/test-ca.opensslconf: concurrent additions, order irrelevant * tests/scripts/all.sh: one comment change conflicted with a code addition. In addition some of the additions in the iotssl-1381-x509-verify-refactor-restricted branch need support for keep-going mode, this will be added in a subsequent commit.
2018-03-22 21:21:55 +00:00
Security
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
* Fix an issue in the X.509 module which could lead to a buffer overread
during certificate validation. Additionally, the issue could also lead to
unnecessary callback checks being made or to some validation checks to be
omitted. The overread could be triggered remotely, while the other issues
would require a non DER-compliant certificate to be correctly signed by a
trusted CA, or a trusted CA with a non DER-compliant certificate. Found by
luocm. Fixes #825.
* Fix the buffer length assertion in the ssl_parse_certificate_request()
function which led to an arbitrary overread of the message buffer. The
overreads could be caused by receiving a malformed message at the point
where an optional signature algorithms list is expected when the signature
algorithms section is too short. In builds with debug output, the overread
data is output with the debug data.
Changelog entry
2018-04-25 09:25:30 +00:00
* Fix a client-side bug in the validation of the server's ciphersuite choice
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
which could potentially lead to the client accepting a ciphersuite it didn't
offer or a ciphersuite that cannot be used with the TLS or DTLS version
chosen by the server. This could lead to corruption of internal data
structures for some configurations.
Merge tag 'mbedtls-2.8.0' into iotssl-1381-x509-verify-refactor-restricted Conflict resolution: * ChangeLog * tests/data_files/Makefile: concurrent additions, order irrelevant * tests/data_files/test-ca.opensslconf: concurrent additions, order irrelevant * tests/scripts/all.sh: one comment change conflicted with a code addition. In addition some of the additions in the iotssl-1381-x509-verify-refactor-restricted branch need support for keep-going mode, this will be added in a subsequent commit.
2018-03-22 21:21:55 +00:00
Merge remote-tracking branch 'upstream-restricted/pr/363' into development-proposed
2018-03-28 10:54:28 +00:00
Features
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
* Add an option, MBEDTLS_AES_FEWER_TABLES, to dynamically compute smaller AES
tables during runtime, thereby reducing the RAM/ROM footprint by ~6KiB.
Suggested and contributed by jkivilin in pull request #394.
Add ChangeLog entry
2018-04-04 07:18:11 +00:00
* Add initial support for Curve448 (RFC 7748). Only mbedtls_ecp_mul() and
ECDH primitive functions (mbedtls_ecdh_gen_public(),
mbedtls_ecdh_compute_shared()) are supported for now. Contributed by
Add the uodate to the soversion to the ChangeLog
2018-05-01 12:57:53 +00:00
Nicholas Wilson in pull request #348.
Merge remote-tracking branch 'upstream-restricted/pr/363' into development-proposed
2018-03-28 10:54:28 +00:00
Merge branch 'pr_946' into development-proposed
2018-04-04 08:33:45 +00:00
API Changes
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
* Extend the public API with the function of mbedtls_net_poll() to allow user
applications to wait for a network context to become ready before reading
or writing.
* Add function mbedtls_ssl_check_pending() to the public API to allow
a check for whether more more data is pending to be processed in the
internal message buffers.
Merge branch 'development' into iotssl-1204
2018-03-28 13:52:35 +00:00
This function is necessary to determine when it is safe to idle on the
underlying transport in case event-driven IO is used.
Fix redefinition of macro ssl_set_bio Fix redefinition of macro ssl_set_bio to undefined symbol mbedtls_ssl_set_bio_timeout in compat-1.3.h.
2016-12-07 10:25:19 +00:00
Bugfix
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
* Fix a spurious uninitialized variable warning in cmac.c. Fix independently
Merge branch 'pr_726' into development-proposed
2018-03-22 20:50:48 +00:00
contributed by Brian J Murray and David Brown.
Add changelog entries for improved testing Fixes #1040
2018-03-23 00:42:44 +00:00
* Add missing dependencies in test suites that led to build failures
in configurations that omit certain hashes or public-key algorithms.
Fixes #1040.
Merge remote-tracking branch 'upstream-public/pr/1435' into development-proposed
2018-03-26 17:25:58 +00:00
* Fix C89 incompatibility in benchmark.c. Contributed by Brendan Shanks.
#1353
Add ChangeLog entry Fixes #1299. Fixes #1475.
2018-03-27 21:08:53 +00:00
* Add missing dependencies for MBEDTLS_HAVE_TIME_DATE and
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
MBEDTLS_VERSION_FEATURES in some test suites. Contributed by
Deomid Ryabkov. Fixes #1299, #1475.
* Fix the Makefile build process for building shared libraries on Mac OS X.
Fixed by mnacamura.
Fix parsing of PKCS#8 encoded Elliptic Curve keys. The relevant ASN.1 definitions for a PKCS#8 encoded Elliptic Curve key are: PrivateKeyInfo ::= SEQUENCE { version Version, privateKeyAlgorithm PrivateKeyAlgorithmIdentifier, privateKey PrivateKey, attributes [0] IMPLICIT Attributes OPTIONAL } AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY DEFINED BY algorithm OPTIONAL } ECParameters ::= CHOICE { namedCurve OBJECT IDENTIFIER -- implicitCurve NULL -- specifiedCurve SpecifiedECDomain } ECPrivateKey ::= SEQUENCE { version INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1), privateKey OCTET STRING, parameters [0] ECParameters {{ NamedCurve }} OPTIONAL, publicKey [1] BIT STRING OPTIONAL } Because of the two optional fields, there are 4 possible variants that need to be parsed: no optional fields, only parameters, only public key, and both optional fields. Previously mbedTLS was unable to parse keys with "only parameters". Also, only "only public key" was tested. There was a test for "no optional fields", but it was labelled incorrectly as SEC.1 and not run because of a great renaming mixup.
2018-02-16 21:11:04 +00:00
* Fix parsing of PKCS#8 encoded Elliptic Curve keys. Previously Mbed TLS was
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
unable to parse keys which had only the optional parameters field of the
Update ChangeLog for #1380
2018-04-11 15:40:38 +00:00
ECPrivateKey structure. Found by Jethro Beekman, fixed in #1379.
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
* Return the plaintext data more quickly on unpadded CBC decryption, as
stated in the mbedtls_cipher_update() documentation. Contributed by
Andy Leiserson.
Merge remote-tracking branch 'upstream-public/pr/1142' into development-proposed
2018-04-04 07:20:59 +00:00
* Fix overriding and ignoring return values when parsing and writing to
a file in pk_sign program. Found by kevlut in #1142.
Adapt ChangeLog: Usage restriction for WANT_READ
2017-10-12 06:46:41 +00:00
* Restrict usage of error code MBEDTLS_ERR_SSL_WANT_READ to situations
where data needs to be fetched from the underlying transport in order
to make progress. Previously, this error code was also occasionally
returned when unexpected messages were being discarded, ignoring that
further messages could potentially already be pending to be processed
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
in the internal buffers; these cases led to deadlocks when event-driven
I/O was used. Found and reported by Hubert Mis in #772.
Merge remote-tracking branch 'upstream-restricted/pr/461' into development-restricted-proposed
2018-04-19 15:41:39 +00:00
* Fix buffer length assertions in the ssl_parse_certificate_request()
function which leads to a potential one byte overread of the message
buffer.
ssl_tls: Fix invalid buffer sizes during compression / decompression Adjust information passed to zlib to include already written data.
2018-04-20 11:58:53 +00:00
* Fix invalid buffer sizes passed to zlib during record compression and
decompression.
Add the uodate to the soversion to the ChangeLog
2018-05-01 12:57:53 +00:00
* Fix the soversion of libmbedcrypto to match the soversion of the
maintained 2.7 branch. The soversion was increased in Mbed TLS
version 2.7.1 to reflect breaking changes in that release, but the
increment was missed in 2.8.0 and later releases outside of the 2.7 branch.
Merge branch 'pr_726' into development-proposed
2018-03-22 20:50:48 +00:00
Merge branch 'pr_403' into development-proposed
2018-03-22 20:34:15 +00:00
Changes
* Remove some redundant code in bignum.c. Contributed by Alexey Skalozub.
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
* Support cmake builds where Mbed TLS is a subproject. Fix contributed
independently by Matthieu Volat and Arne Schwabe.
Add changelog entries for improved testing Fixes #1040
2018-03-23 00:42:44 +00:00
* Improve testing in configurations that omit certain hashes or
public-key algorithms. Includes contributions by Gert van Dijk.
* Improve negative testing of X.509 parsing.
Add ChangeLog entry for redundant mutex initialization optimizations
2018-03-21 15:05:12 +00:00
* Do not define global mutexes around readdir() and gmtime() in
configurations where the feature is disabled. Found and fixed by Gergely
Budai.
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
* Harden the function mbedtls_ssl_config_free() against misuse, so that it
doesn't leak memory if the user doesn't use mbedtls_ssl_conf_psk() and
instead incorrectly manipulates the configuration structure directly.
Found and fix submitted by junyeonLEE in #1220.
Add ChangeLog entry for PBES2 when ASN1 disabled
2018-03-27 20:19:50 +00:00
* Provide an empty implementation of mbedtls_pkcs5_pbes2() when
MBEDTLS_ASN1_PARSE_C is not enabled. This allows the use of PBKDF2
without PBES2. Fixed by Marcos Del Sol Vives.
Add a ChangeLog entry for Curve22519 N
2018-03-28 09:13:05 +00:00
* Add the order of the base point as N in the mbedtls_ecp_group structure
for Curve25519 (other curves had it already). Contributed by Nicholas
Wilson #481
Merge remote-tracking branch 'upstream-public/pr/758' into development-proposed
2018-03-29 10:01:38 +00:00
* Improve the documentation of mbedtls_net_accept(). Contributed by Ivan
Krylov.
Improve documentation of mbedtls_ssl_write()
2018-03-29 15:05:44 +00:00
* Improve the documentation of mbedtls_ssl_write(). Suggested by
Paul Sokolovsky in #1356.
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
* Add an option in the Makefile to support ar utilities where the operation
Improve ChangeLog for DLEXT and AR_DASH changes
2018-03-27 18:14:24 +00:00
letter must not be prefixed by '-', such as LLVM. Found and fixed by
Alex Hixon.
Add ChangeLog entry for library/makefile changes
2018-03-25 22:57:09 +00:00
* Allow configuring the shared library extension by setting the DLEXT
Improve ChangeLog for DLEXT and AR_DASH changes
2018-03-27 18:14:24 +00:00
environment variable when using the project makefiles.
Optimize unnecessary zeorizing in mbedtls_mpi_copy Based on a contribution by Alexey Skalozub (https://github.com/ARMmbed/mbedtls/pull/405).
2018-03-21 15:29:03 +00:00
* Optimize unnecessary zeroing in mbedtls_mpi_copy. Based on a contribution
Add original PR reference
2018-04-01 10:43:48 +00:00
by Alexey Skalozub in #405.
Merge branch 'pr_1395' into development-proposed
2018-04-04 07:14:12 +00:00
* In the SSL module, when f_send, f_recv or f_recv_timeout report
transmitting more than the required length, return an error. Raised by
Sam O'Connor in #1245.
Add ChangeLog entry to credit independent contribution Also: fixes #1437
2018-03-31 20:57:03 +00:00
* Improve robustness of mbedtls_ssl_derive_keys against the use of
HMAC functions with non-HMAC ciphersuites. Independently contributed
by Jiayuan Chen in #1377. Fixes #1437.
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
* Improve security of RSA key generation by including criteria from
FIPS 186-4. Contributed by Jethro Beekman. #1380
Improve ChangeLog entry
2018-04-19 18:59:06 +00:00
* Declare functions in header files even when an alternative implementation
of the corresponding module is activated by defining the corresponding
MBEDTLS_XXX_ALT macro. This means that alternative implementations do
not need to copy the declarations, and ensures that they will have the
same API.
Changelog entry Describing platform teardown and setup calls in test suites
2018-04-13 09:18:08 +00:00
* Add platform setup and teardown calls in test suites.
Merge branch 'pr_403' into development-proposed
2018-03-22 20:34:15 +00:00
Update version to 2.8.0
2018-03-16 16:25:12 +00:00
= mbed TLS 2.8.0 branch released 2018-03-16
Add ChangeLog entries for PR #1168 and #1362
2018-02-14 13:07:48 +00:00
Note incompatibility of truncated HMAC extension in ChangeLog The change in the truncated HMAC extension aligns Mbed TLS with the standard, but breaks interoperability with previous versions. Indicate this in the ChangeLog, as well as how to restore the old behavior.
2018-02-22 14:22:44 +00:00
Default behavior changes
* The truncated HMAC extension now conforms to RFC 6066. This means
that when both sides of a TLS connection negotiate the truncated
HMAC extension, Mbed TLS can now interoperate with other
compliant implementations, but this breaks interoperability with
prior versions of Mbed TLS. To restore the old behavior, enable
the (deprecated) option MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT in
config.h. Found by Andreas Walz (ivESK, Offenburg University of
Applied Sciences).
fix for issue 1118: check if iv is zero in gcm. 1) found by roberto in mbedtls forum 2) if iv_len is zero, return an error 3) add tests for invalid parameters
2016-12-16 14:15:56 +00:00
Fixes running order of sections in Changelog
2017-07-27 14:11:52 +00:00
Security
Note incompatibility of truncated HMAC extension in ChangeLog The change in the truncated HMAC extension aligns Mbed TLS with the standard, but breaks interoperability with previous versions. Indicate this in the ChangeLog, as well as how to restore the old behavior.
2018-02-22 14:22:44 +00:00
* Fix implementation of the truncated HMAC extension. The previous
implementation allowed an offline 2^80 brute force attack on the
HMAC key of a single, uninterrupted connection (with no
resumption of the session).
Merge remote-tracking branch 'upstream-restricted/pr/351' into development-restricted-proposed Move the added ChangeLog entry to the bottom so that the list remains in merge order.
2018-03-13 16:15:34 +00:00
* Verify results of RSA private key operations to defend
against Bellcore glitch attack.
Update change log
2018-03-14 10:14:13 +00:00
* Fix a buffer overread in ssl_parse_server_key_exchange() that could cause
a crash on invalid input.
Add Changelog entry
2018-03-13 16:17:38 +00:00
* Fix a buffer overread in ssl_parse_server_psk_hint() that could cause a
crash on invalid input.
x509: CRL: reject unsupported critical extensions
2018-03-13 10:53:30 +00:00
* Fix CRL parsing to reject CRLs containing unsupported critical
extensions. Found by Falko Strenzke and Evangelos Karatsiolis.
Adapt ChangeLog
2017-11-16 17:39:34 +00:00
pkcs5v2: add support for additional hmacSHA algorithms Currently only SHA1 is supported as PRF algorithm for PBKDF2 (PKCS#5 v2.0). This means that keys encrypted and authenticated using another algorithm of the SHA family cannot be decrypted. This deficiency has become particularly incumbent now that PKIs created with OpenSSL1.1 are encrypting keys using hmacSHA256 by default (OpenSSL1.0 used PKCS#5 v1.0 by default and even if v2 was forced, it would still use hmacSHA1). Enable support for all the digest algorithms of the SHA family for PKCS#5 v2.0. Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2017-12-19 23:03:55 +00:00
Features
* Extend PKCS#8 interface by introducing support for the entire SHA
algorithms family when encrypting private keys using PKCS#5 v2.0.
Note in the changelog that this fixes an interoperability issue. Fixes #1339
2018-02-14 10:33:30 +00:00
This allows reading encrypted PEM files produced by software that
uses PBKDF2-SHA2, such as OpenSSL 1.1. Submitted by Antonio Quartulli,
OpenVPN Inc. Fixes #1339
Add issue number to ChangeLog Resolves #1122
2018-02-14 16:19:41 +00:00
* Add support for public keys encoded in PKCS#1 format. #1122
pkcs5v2: add support for additional hmacSHA algorithms Currently only SHA1 is supported as PRF algorithm for PBKDF2 (PKCS#5 v2.0). This means that keys encrypted and authenticated using another algorithm of the SHA family cannot be decrypted. This deficiency has become particularly incumbent now that PKIs created with OpenSSL1.1 are encrypting keys using hmacSHA256 by default (OpenSSL1.0 used PKCS#5 v1.0 by default and even if v2 was forced, it would still use hmacSHA1). Enable support for all the digest algorithms of the SHA family for PKCS#5 v2.0. Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2017-12-19 23:03:55 +00:00
Deprecate support for record compression
2018-03-06 14:23:38 +00:00
New deprecations
* Deprecate support for record compression (configuration option
MBEDTLS_ZLIB_SUPPORT).
Add ChangeLog entries for PR #1168 and #1362
2018-02-14 13:07:48 +00:00
Bugfix
* Fix the name of a DHE parameter that was accidentally changed in 2.7.0.
Fixes #1358.
Merge remote-tracking branch 'upstream-public/pr/1333' into development-proposed
2018-02-14 14:12:49 +00:00
* Fix test_suite_pk to work on 64-bit ILP32 systems. #849
Rephrase Changelog Rephrase Changelog to be more coherent to users
2018-02-06 15:34:27 +00:00
* Fix mbedtls_x509_crt_profile_suiteb, which used to reject all certificates
with flag MBEDTLS_X509_BADCERT_BAD_PK even when the key type was correct.
Add attribution for #1351 report
2018-02-27 07:37:52 +00:00
In the context of SSL, this resulted in handshake failure. Reported by
daniel in the Mbed TLS forum. #1351
Add ChangeLog entry for PR #1384
2018-02-21 13:32:39 +00:00
* Fix Windows x64 builds with the included mbedTLS.sln file. #1347
Merge remote-tracking branch 'upstream-public/pr/1296' into HEAD
2018-03-10 23:44:14 +00:00
* Fix setting version TLSv1 as minimal version, even if TLS 1
is not enabled. Set MBEDTLS_SSL_MIN_MAJOR_VERSION
and MBEDTLS_SSL_MIN_MINOR_VERSION instead of
MBEDTLS_SSL_MAJOR_VERSION_3 and MBEDTLS_SSL_MINOR_VERSION_1. #664
Fix Changelog notation Remove backticks, since ChangeLog is not in MarkDown
2017-09-26 12:06:56 +00:00
* Fix compilation error on Mingw32 when _TRUNCATE is defined. Use _TRUNCATE
only if __MINGW32__ not defined. Fix suggested by Thomas Glanzmann and
Fix compilation error with Mingw32 Fix compilation error on Mingw32 when `_TRUNCATE` is defined. Use `_TRUNCATE` only if `__MINGW32__` not defined. Fix suggested by Thomas Glanzmann and Nick Wilson on issue #355
2017-09-06 14:49:10 +00:00
Nick Wilson on issue #355
Fix grammar in ChangeLog entry
2018-03-10 23:15:56 +00:00
* In test_suite_pk, pass valid parameters when testing for hash length
Test suite test_suite_pk test pk_rsa_overflow passes valid parameters for hash and sig. Test suite test_suite_pk test pk_rsa_overflow passes valid parameters for hash and sig.
2018-02-26 10:02:10 +00:00
overflow. #1179
Merge remote-tracking branch 'upstream-public/pr/778' into development-proposed
2018-03-12 22:45:08 +00:00
* Fix memory allocation corner cases in memory_buffer_alloc.c module. Found
by Guido Vranken. #639
Fix ChangeLog style. Fix #918
2018-03-12 22:54:20 +00:00
* Log correct number of ciphersuites used in Client Hello message. #918
Merge remote-tracking branch 'upstream-restricted/pr/398' into development-restricted-proposed
2018-03-13 16:18:06 +00:00
* Fix X509 CRT parsing that would potentially accept an invalid tag when
parsing the subject alternative names.
Update change log
2018-03-14 10:14:13 +00:00
* Fix a possible arithmetic overflow in ssl_parse_server_key_exchange()
that could cause a key exchange to fail on valid data.
Add Changelog entry
2018-03-13 16:17:38 +00:00
* Fix a possible arithmetic overflow in ssl_parse_server_psk_hint() that
could cause a key exchange to fail on valid data.
Add missing MBEDTLS_DEPRECATED_REMOVED guards Add missing MBEDTLS_DEPRECATED_REMOVED guards around the definitions of mbedtls_aes_decrypt and mbedtls_aes_encrypt. This fixes the build under -Wmissing-prototypes -Werror. Fixes #1388
2018-02-21 18:16:20 +00:00
* Don't define mbedtls_aes_decrypt and mbedtls_aes_encrypt under
MBEDTLS_DEPRECATED_REMOVED. #1388
Update changelog entry
2017-09-07 15:33:44 +00:00
* Fix a 1-byte heap buffer overflow (read-only) during private key parsing.
Found through fuzz testing.
Add ChangeLog entries for PR #1168 and #1362
2018-02-14 13:07:48 +00:00
Changes
* Fix tag lengths and value ranges in the documentation of CCM encryption.
Contributed by Mathieu Briand.
Add ChangeLog entry for PR #1165
2018-02-14 13:10:24 +00:00
* Fix typo in a comment ctr_drbg.c. Contributed by Paul Sokolovsky.
Merge branch 'pr_1280' into development-proposed Conflict: configs/config-picocoin.h was both edited and removed. Resolution: removed, since this is the whole point of PR #1280 and the changes in development are no longer relevant.
2018-02-14 14:49:54 +00:00
* Remove support for the library reference configuration for picocoin.
Add ChangeLog entry for PR #1382
2018-02-21 16:59:40 +00:00
* MD functions deprecated in 2.7.0 are no longer inline, to provide
a migration path for those depending on the library's ABI.
Add changelog entry
2017-05-29 12:46:36 +00:00
* Clarify the documentation of mbedtls_ssl_setup.
Add ChangeLog entry. Fixes #678
2018-03-12 23:13:06 +00:00
* Use (void) when defining functions with no parameters. Contributed by
Joris Aerts. #678
Add ChangeLog entries for PR #1168 and #1362
2018-02-14 13:07:48 +00:00
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
= mbed TLS 2.7.0 branch released 2018-02-03
Add ChangeLog entry
2017-06-26 14:19:26 +00:00
RSA: Fix buffer overflow in PSS signature verification Fix buffer overflow in RSA-PSS signature verification when the hash is too large for the key size. Found by Seth Terashima, Qualcomm. Added a non-regression test and a positive test with the smallest permitted key size for a SHA-512 hash.
2017-10-17 17:01:38 +00:00
Security
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Fix a heap corruption issue in the implementation of the truncated HMAC
extension. When the truncated HMAC extension is enabled and CBC is used,
sending a malicious application packet could be used to selectively corrupt
6 bytes on the peer's heap, which could potentially lead to crash or remote
code execution. The issue could be triggered remotely from either side in
both TLS and DTLS. CVE-2018-0488
* Fix a buffer overflow in RSA-PSS verification when the hash was too large
for the key size, which could potentially lead to crash or remote code
execution. Found by Seth Terashima, Qualcomm Product Security Initiative,
Qualcomm Technologies Inc. CVE-2018-0487
* Fix buffer overflow in RSA-PSS verification when the unmasked data is all
zeros.
* Fix an unsafe bounds check in ssl_parse_client_psk_identity() when adding
64 KiB to the address of the SSL buffer and causing a wrap around.
* Fix a potential heap buffer overflow in mbedtls_ssl_write(). When the (by
Adapt ChangeLog
2017-09-18 15:07:19 +00:00
default enabled) maximum fragment length extension is disabled in the
config and the application data buffer passed to mbedtls_ssl_write
is larger than the internal message buffer (16384 bytes by default), the
latter overflows. The exploitability of this issue depends on whether the
application layer can be forced into sending such large packets. The issue
was independently reported by Tim Nordell via e-mail and by Florin Petriuc
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
and sjorsdewit on GitHub. Fix proposed by Florin Petriuc in #1022.
Fixes #707.
* Add a provision to prevent compiler optimizations breaking the time
constancy of mbedtls_ssl_safer_memcmp().
Add ChangeLog entry for buf zeroize
2017-07-05 14:40:17 +00:00
* Ensure that buffers are cleared after use if they contain sensitive data.
Improve ChangeLog entry
2017-07-06 16:17:43 +00:00
Changes were introduced in multiple places in the library.
Set PEM buffer to zero before freeing it Set PEM buffer to zero before freeing it, to avoid private keys being leaked to memory after releasing it.
2017-09-05 12:34:35 +00:00
* Set PEM buffer to zero before freeing it, to avoid decoded private keys
being leaked to memory after release.
Refine dhm_check_range() fix Changelog entry
2017-09-20 15:26:04 +00:00
* Fix dhm_check_range() failing to detect trivial subgroups and potentially
leaking 1 bit of the private key. Reported by prashantkspatil.
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Make mbedtls_mpi_read_binary() constant-time with respect to the input
data. Previously, trailing zero bytes were detected and omitted for the
sake of saving memory, but potentially leading to slight timing
differences. Reported by Marco Macchetti, Kudelski Group.
Add ChangeLog message for EC private exponent information leak
2017-10-19 09:10:18 +00:00
* Wipe stack buffer temporarily holding EC private exponent
after keypair generation.
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Fix a potential heap buffer over-read in ALPN extension parsing
Fix heap-buffer overread in ALPN ext parsing
2018-01-09 09:43:43 +00:00
(server-side). Could result in application crash, but only if an ALPN
name larger than 16 bytes had been configured on the server.
Adapt ChangeLog
2017-10-13 16:17:28 +00:00
* Change default choice of DHE parameters from untrustworthy RFC 5114
to RFC 3526 containing parameters generated in a nothing-up-my-sleeve
manner.
RSA: Fix buffer overflow in PSS signature verification Fix buffer overflow in RSA-PSS signature verification when the hash is too large for the key size. Found by Seth Terashima, Qualcomm. Added a non-regression test and a positive test with the smallest permitted key size for a SHA-512 hash.
2017-10-17 17:01:38 +00:00
Allow comments in test data files
2017-09-29 13:45:12 +00:00
Features
* Allow comments in test data files.
selftest: allow running a subset of the tests If given command line arguments, interpret them as test names and only run those tests.
2017-12-15 14:01:27 +00:00
* The selftest program can execute a subset of the tests based on command
line arguments.
Timing self test: increased duration Increase the duration of the self test, otherwise it tends to fail on a busy machine even with the recently upped tolerance. But run the loop only once, it's enough for a simple smoke test.
2017-10-27 16:42:32 +00:00
* New unit tests for timing. Improve the self-test to be more robust
when run on a heavily-loaded machine.
Add ChangeLog entry for CCM_ALT Edit the CMAC_ALT ChangeLog entry to mention CCM_ALT which was added in a sister PR and is being merged together. Use full name rather than Github id as attribution. Move the entry under "Features" for better consistency with historical practice.
2018-01-02 15:04:19 +00:00
* Add alternative implementation support for CCM and CMAC (MBEDTLS_CCM_ALT,
ChangeLog: Use Steven Cooreman's correct name
2018-01-11 16:35:44 +00:00
MBEDTLS_CMAC_ALT). Submitted by Steven Cooreman, Silicon Labs.
Allow alternate implementation of GCM Provide the ability to use an alternative implementation of GCM in place of the library-provided implementation.
2017-09-21 11:53:48 +00:00
* Add support for alternative implementations of GCM, selected by the
Add full stop to ChangeLog entry
2018-01-02 15:09:42 +00:00
configuration flag MBEDTLS_GCM_ALT.
Merge remote-tracking branch 'upstream-public/pr/1027' into development
2018-01-09 10:42:03 +00:00
* Add support for alternative implementations for ECDSA, controlled by new
configuration flags MBEDTLS_ECDSA_SIGN_ALT, MBEDTLS_ECDSA_VERIFY_ALT and
MBEDTLS_ECDSDA_GENKEY_AT in config.h.
The following functions from the ECDSA module can be replaced
with alternative implementation:
mbedtls_ecdsa_sign(), mbedtls_ecdsa_verify() and mbedtls_ecdsa_genkey().
Minor improvement in ChangeLog
2018-01-24 16:06:25 +00:00
* Add support for alternative implementation of ECDH, controlled by the
new configuration flags MBEDTLS_ECDH_COMPUTE_SHARED_ALT and
Merge remote-tracking branch 'upstream-public/pr/1046' into development
2018-01-09 11:31:55 +00:00
MBEDTLS_ECDH_GEN_PUBLIC_ALT in config.h.
The following functions from the ECDH module can be replaced
with an alternative implementation:
mbedtls_ecdh_gen_public() and mbedtls_ecdh_compute_shared().
Minor improvement in ChangeLog
2018-01-24 16:06:25 +00:00
* Add support for alternative implementation of ECJPAKE, controlled by
the new configuration flag MBEDTLS_ECJPAKE_ALT.
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Add mechanism to provide alternative implementation of the DHM module.
Allow comments in test data files
2017-09-29 13:45:12 +00:00
Incorporate comments on merge commit * Correct order of sections in ChangeLog * Restore unintentionally removed whitespace and formatting improvements. * Consistently rename MBEDTLS_ERR_RSA_EXPORT_UNSUPPORTED to MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION in rsa.h documentation.
2017-12-22 17:08:03 +00:00
API Changes
* Extend RSA interface by multiple functions allowing structure-
independent setup and export of RSA contexts. Most notably,
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
mbedtls_rsa_import() and mbedtls_rsa_complete() are introduced for setting
Incorporate comments on merge commit * Correct order of sections in ChangeLog * Restore unintentionally removed whitespace and formatting improvements. * Consistently rename MBEDTLS_ERR_RSA_EXPORT_UNSUPPORTED to MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION in rsa.h documentation.
2017-12-22 17:08:03 +00:00
up RSA contexts from partial key material and having them completed to the
needs of the implementation automatically. This allows to setup private RSA
contexts from keys consisting of N,D,E only, even if P,Q are needed for the
purpose or CRT and/or blinding.
* The configuration option MBEDTLS_RSA_ALT can be used to define alternative
implementations of the RSA interface declared in rsa.h.
MD API deprecation: ChangeLog updates Use the updated names for the new functions (xxx_ret instead of xxx_ext). List the new deprecations in the appropriate sections. Credit the independent report of the misuse of zeroizing to reset a hash context in entropy.c.
2018-01-22 13:55:20 +00:00
* The following functions in the message digest modules (MD2, MD4, MD5,
SHA1, SHA256, SHA512) have been deprecated and replaced as shown below.
The new functions change the return type from void to int to allow
returning error codes when using MBEDTLS_<MODULE>_ALT.
mbedtls_<MODULE>_starts() -> mbedtls_<MODULE>_starts_ret()
mbedtls_<MODULE>_update() -> mbedtls_<MODULE>_update_ret()
mbedtls_<MODULE>_finish() -> mbedtls_<MODULE>_finish_ret()
Add ChangeLog entry
2017-07-03 15:00:59 +00:00
mbedtls_<MODULE>_process() -> mbedtls_internal_<MODULE>_process()
Allow comments in test data files
2017-09-29 13:45:12 +00:00
Merge remote-tracking branch 'public/pr/1136' into development * public/pr/1136: Timing self test: shorten redundant tests Timing self test: increased duration Timing self test: increased tolerance Timing unit tests: more protection against infinite loops Unit test for mbedtls_timing_hardclock New timing unit tests selftest: allow excluding a subset of the tests selftest: allow running a subset of the tests selftest: refactor to separate the list of tests from the logic Timing self test: print some diagnosis information mbedtls_timing_get_timer: don't use uninitialized memory timing interface documentation: minor clarifications Timing: fix mbedtls_set_alarm(0) on Unix/POSIX
2017-12-26 09:42:20 +00:00
New deprecations
* Deprecate usage of RSA primitives with non-matching key-type
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
(e.g. signing with a public key).
Merge remote-tracking branch 'upstream-public/pr/1060' into development
2018-01-09 12:20:54 +00:00
* Direct manipulation of structure fields of RSA contexts is deprecated.
Users are advised to use the extended RSA API instead.
Merge remote-tracking branch 'upstream-public/pr/1294' into development
2018-01-25 14:47:39 +00:00
* Deprecate usage of message digest functions that return void
(mbedtls_<MODULE>_starts, mbedtls_<MODULE>_update,
mbedtls_<MODULE>_finish and mbedtls_<MODULE>_process where <MODULE> is
any of MD2, MD4, MD5, SHA1, SHA256, SHA512) in favor of functions
that can return an error code.
Adapt ChangeLog
2017-10-13 16:17:28 +00:00
* Deprecate untrustworthy DHE parameters from RFC 5114. Superseded by
parameters from RFC 3526 or the newly added parameters from RFC 7919.
* Deprecate hex string DHE constants MBEDTLS_DHM_RFC3526_MODP_2048_P etc.
Supserseded by binary encoded constants MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN
etc.
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Deprecate mbedtls_ssl_conf_dh_param() for setting default DHE parameters
from hex strings. Superseded by mbedtls_ssl_conf_dh_param_bin()
Adapt ChangeLog
2017-10-13 16:17:28 +00:00
accepting DHM parameters in binary form, matching the new constants.
Allow comments in test data files
2017-09-29 13:45:12 +00:00
Add ChangeLog entry
2017-06-26 14:19:26 +00:00
Bugfix
Fix ChangeLog entry
2017-06-28 08:25:10 +00:00
* Fix ssl_parse_record_header() to silently discard invalid DTLS records
as recommended in RFC 6347 Section 4.1.2.7.
Update ChangeLog for fix to #836
2017-09-30 22:39:46 +00:00
* Fix memory leak in mbedtls_ssl_set_hostname() when called multiple times.
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
Found by projectgus and Jethro Beekman, #836.
Fix changelog for ssl_server2.c usage fix
2017-10-02 18:12:54 +00:00
* Fix usage help in ssl_server2 example. Found and fixed by Bei Lin.
Parse Signature Algorithm ext when renegotiating Signature algorithm extension was skipped when renegotiation was in progress, causing the signature algorithm not to be known when renegotiating, and failing the handshake. Fix removes the renegotiation step check before parsing the extension.
2017-10-03 12:58:26 +00:00
* Parse signature algorithm extension when renegotiating. Previously,
renegotiated handshakes would only accept signatures using SHA-1
regardless of the peer's preferences, or fail if SHA-1 was disabled.
Correctly handle leap year in x509_date_is_valid() This patch ensures that invalid dates on leap years with 100 or 400 years intervals are handled correctly.
2016-11-21 15:38:02 +00:00
* Fix leap year calculation in x509_date_is_valid() to ensure that invalid
dates on leap years with 100 and 400 intervals are handled correctly. Found
by Nicholas Wilson. #694
RSA PSS: remove redundant check; changelog Remove a check introduced in the previous buffer overflow fix with keys of size 8N+1 which the subsequent fix for buffer start calculations made redundant. Added a changelog entry for the buffer start calculation fix.
2017-10-19 15:46:14 +00:00
* Fix some invalid RSA-PSS signatures with keys of size 8N+1 that were
accepted. Generating these signatures required the private key.
Merge remote-tracking branch 'upstream-public/pr/1062' into development
2017-11-24 14:35:50 +00:00
* Fix out-of-memory problem when parsing 4096-bit PKCS8-encrypted RSA keys.
Found independently by Florian in the mbed TLS forum and by Mishamax.
#878, #1019.
Add ChangeLog entry for IAR compilation warnings
2017-06-27 15:17:54 +00:00
* Fix variable used before assignment compilation warnings with IAR
toolchain. Found by gkerrien38.
Add missing ret code checks in PEM module Add missing return code checks in the functions pem_des_decrypt(), pem_3des_decrypt() and pem_aes_decrypt() so that the calling function mbedtls_pem_read_buffer() is notified of errors reported by the crypto primitives AES, DES and 3DES.
2017-02-22 16:23:26 +00:00
* Fix unchecked return codes from AES, DES and 3DES functions in
pem_aes_decrypt(), pem_des_decrypt() and pem_des3_decrypt() respectively.
If a call to one of the functions of the cryptographic primitive modules
failed, the error may not be noticed by the function
mbedtls_pem_read_buffer() causing it to return invalid values. Found by
Guido Vranken. #756
Merge remote-tracking branch 'upstream-public/pr/1055' into development
2017-11-28 16:23:37 +00:00
* Include configuration file in md.h, to fix compilation warnings.
Reported by aaronmdjones in #1001
Adapt ChangeLog
2017-09-28 13:52:26 +00:00
* Correct extraction of signature-type from PK instance in X.509 CRT and CSR
writing routines that prevented these functions to work with alternative
RSA implementations. Raised by J.B. in the Mbed TLS forum. Fixes #1011.
Adapt ChangeLog
2017-10-05 08:08:53 +00:00
* Don't print X.509 version tag for v1 CRT's, and omit extensions for
non-v3 CRT's.
Add ChangeLog entry
2017-11-28 16:40:56 +00:00
* Fix bugs in RSA test suite under MBEDTLS_NO_PLATFORM_ENTROPY. #1023 #1024
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Fix net_would_block() to avoid modification by errno through fcntl() call.
Backup errno in net_would_block Safe and restore the value of errno in net_would_block to be sure it's not affected by the guarding call to fcntl. Fixes #845.
2017-05-04 12:39:22 +00:00
Found by nkolban. Fixes #845.
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Fix handling of handshake messages in mbedtls_ssl_read() in case
Adapt ChangeLog
2017-10-12 14:39:45 +00:00
MBEDTLS_SSL_RENEGOTIATION is disabled. Found by erja-gp.
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Add a check for invalid private parameters in mbedtls_ecdsa_sign().
Add changelog for mbedtls_ecdsa_sign fix
2017-11-21 09:55:33 +00:00
Reported by Yolan Romailler.
Merge branch 'pr_1043' into development
2017-12-01 22:42:17 +00:00
* Fix word size check in in pk.c to not depend on MBEDTLS_HAVE_INT64.
Merge branch 'pr_920' into development
2017-12-01 22:46:58 +00:00
* Fix incorrect unit in benchmark output. #850
Adapt ChangeLog
2017-09-18 10:07:25 +00:00
* Add size-checks for record and handshake message content, securing
fragile yet non-exploitable code-paths.
Fix crash when calling `mbedtls_ssl_cache_free` twice Set `cache` to zero at the end of `mbedtls_ssl_cache_free` #1104
2017-10-17 15:15:41 +00:00
* Fix crash when calling mbedtls_ssl_cache_free() twice. Found by
MilenkoMitrovic, #1104
Fix alarm(0) failure on mingw32 A new test for mbedtls_timing_alarm(0) was introduced in PR 1136, which also fixed it on Unix. Apparently test results on MinGW were not checked at that point, so we missed that this new test was also failing on this platform.
2018-01-29 09:16:30 +00:00
* Fix mbedtls_timing_alarm(0) on Unix and MinGW.
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Fix use of uninitialized memory in mbedtls_timing_get_timer() when reset=1.
ChangeLog entry for PR #964
2018-01-02 15:27:50 +00:00
* Fix possible memory leaks in mbedtls_gcm_self_test().
* Added missing return code checks in mbedtls_aes_self_test().
Adapt ChangeLog
2018-01-10 10:39:20 +00:00
* Fix issues in RSA key generation program programs/x509/rsa_genkey and the
RSA test suite where the failure of CTR DRBG initialization lead to
freeing an RSA context and several MPI's without proper initialization
beforehand.
Add ChangeLog entry
2018-01-22 22:10:53 +00:00
* Fix error message in programs/pkey/gen_key.c. Found and fixed by Chris Xue.
Merge branch 'pr_1000' into development-proposed
2018-01-22 23:57:34 +00:00
* Fix programs/pkey/dh_server.c so that it actually works with dh_client.c.
Found and fixed by Martijn de Milliano.
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Fix an issue in the cipher decryption with the mode
MBEDTLS_PADDING_ONE_AND_ZEROS that sometimes accepted invalid padding.
Note, this padding mode is not used by the TLS protocol. Found and fixed by
Micha Kraus.
Merge branch 'development' into iotssl-1251-2.7 Conflict resolution: * ChangeLog: put the new entries in their rightful place. * library/x509write_crt.c: the change in development was whitespace only, so use the one from the iotssl-1251 feature branch.
2018-01-19 10:25:10 +00:00
* Fix the entropy.c module to not call mbedtls_sha256_starts() or
mbedtls_sha512_starts() in the mbedtls_entropy_init() function.
* Fix the entropy.c module to ensure that mbedtls_sha256_init() or
mbedtls_sha512_init() is called before operating on the relevant context
MD API deprecation: ChangeLog updates Use the updated names for the new functions (xxx_ret instead of xxx_ext). List the new deprecations in the appropriate sections. Credit the independent report of the misuse of zeroizing to reset a hash context in entropy.c.
2018-01-22 13:55:20 +00:00
structure. Do not assume that zeroizing a context is a correct way to
reset it. Found independently by ccli8 on Github.
* In mbedtls_entropy_free(), properly free the message digest context.
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Fix status handshake status message in programs/ssl/dtls_client.c. Found
and fixed by muddog.
Adapt ChangeLog
2017-10-05 08:08:53 +00:00
Changes
Update ChangeLog with language and technical corrections To clarify and correct the ChangeLog.
2018-02-05 01:09:13 +00:00
* Extend cert_write example program by options to set the certificate version
Adapt ChangeLog
2017-10-05 08:08:53 +00:00
and the message digest. Further, allow enabling/disabling of authority
identifier, subject identifier and basic constraints extensions.
Merge branch 'development' into iotssl-1619
2017-12-22 10:24:32 +00:00
* Only check for necessary RSA structure fields in `mbedtls_rsa_private`. In
particular, don't require P,Q if neither CRT nor blinding are
used. Reported and fix proposed independently by satur9nine and sliai
on GitHub.
ChangeLog entry for PR #964
2018-01-02 15:27:50 +00:00
* Only run AES-192 self-test if AES-192 is available. Fixes #963.
Add ChangeLog entry
2018-01-17 07:01:37 +00:00
* Tighten the RSA PKCS#1 v1.5 signature verification code and remove the
undeclared dependency of the RSA module on the ASN.1 module.
MD API deprecation: ChangeLog updates Use the updated names for the new functions (xxx_ret instead of xxx_ext). List the new deprecations in the appropriate sections. Credit the independent report of the misuse of zeroizing to reset a hash context in entropy.c.
2018-01-22 13:55:20 +00:00
* Update all internal usage of deprecated message digest functions to the
new ones with return codes. In particular, this modifies the
mbedtls_md_info_t structure. Propagate errors from these functions
everywhere except some locations in the ssl_tls.c module.
Add a ChangeLog entry
2018-01-26 12:04:12 +00:00
* Improve CTR_DRBG error handling by propagating underlying AES errors.
Error codes for hardware accelerator failures Add MBEDTLS_ERR_XXX_HW_ACCEL_FAILED error codes for all cryptography modules where the software implementation can be replaced by a hardware implementation. This does not include the individual message digest modules since they currently have no way to return error codes. This does include the higher-level md, cipher and pk modules since alternative implementations and even algorithms can be plugged in at runtime.
2018-01-26 16:56:38 +00:00
* Add MBEDTLS_ERR_XXX_HW_ACCEL_FAILED error codes for all cryptography
modules where the software implementation can be replaced by a hardware
implementation.
Adapt ChangeLog
2017-10-06 11:29:50 +00:00
* Add explicit warnings for the use of MD2, MD4, MD5, SHA-1, DES and ARC4
throughout the library.
Add ChangeLog entry
2017-06-26 14:19:26 +00:00
Update version number to 2.6.0
2017-08-10 10:51:16 +00:00
= mbed TLS 2.6.0 branch released 2017-08-10
fix for issue 1118: check if iv is zero in gcm. 1) found by roberto in mbedtls forum 2) if iv_len is zero, return an error 3) add tests for invalid parameters
2016-12-16 14:15:56 +00:00
Reorder and group sections in the ChangeLog
2017-07-28 00:04:34 +00:00
Security
Fix language in Changelog for clarity
2017-08-10 09:48:01 +00:00
* Fix authentication bypass in SSL/TLS: when authmode is set to optional,
Fixes running order of sections in Changelog
2017-07-27 14:11:52 +00:00
mbedtls_ssl_get_verify_result() would incorrectly return 0 when the peer's
X.509 certificate chain had more than MBEDTLS_X509_MAX_INTERMEDIATE_CA
Fix language in Changelog for clarity
2017-08-10 09:48:01 +00:00
(default: 8) intermediates, even when it was not trusted. This could be
triggered remotely from either side. (With authmode set to 'required'
Fix style and missing item in ChangeLog
2017-08-01 17:06:12 +00:00
(the default), the handshake was correctly aborted).
* Reliably wipe sensitive data after use in the AES example applications
Adapt ChangeLog
2017-06-27 07:26:53 +00:00
programs/aes/aescrypt2 and programs/aes/crypt_and_hash.
Found by Laurent Simon.
Fixes running order of sections in Changelog
2017-07-27 14:11:52 +00:00
Add ChangeLog entry for platform setup and teardown
2017-07-07 12:19:13 +00:00
Features
* Add the functions mbedtls_platform_setup() and mbedtls_platform_teardown()
Modify ChangeLog according to API changes
2017-07-12 10:27:05 +00:00
and the context struct mbedtls_platform_context to perform
platform-specific setup and teardown operations. The macro
Fix typo in ChangeLog and update macro name
2017-07-18 09:24:26 +00:00
MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT allows the functions to be overridden
Fix style and missing item in ChangeLog
2017-08-01 17:06:12 +00:00
by the user in a platform_alt.h file. These new functions are required in
Fix language in Changelog for clarity
2017-08-10 09:48:01 +00:00
some embedded environments to provide a means of initialising underlying
cryptographic acceleration hardware.
Add ChangeLog entry for platform setup and teardown
2017-07-07 12:19:13 +00:00
Update Changelog for API/ABI fixes to revert interface
2017-07-20 10:33:41 +00:00
API Changes
* Reverted API/ABI breaking changes introduced in mbed TLS 2.5.1, to make the
API consistent with mbed TLS 2.5.0. Specifically removed the inline
qualifier from the functions mbedtls_aes_decrypt, mbedtls_aes_encrypt,
Fix style and missing item in ChangeLog
2017-08-01 17:06:12 +00:00
mbedtls_ssl_ciphersuite_uses_ec and mbedtls_ssl_ciphersuite_uses_psk. Found
by James Cowgill. #978
Fixes running order of sections in Changelog
2017-07-27 14:11:52 +00:00
* Certificate verification functions now set flags to -1 in case the full
chain was not verified due to an internal error (including in the verify
callback) or chain length limitations.
Fix language in Changelog for clarity
2017-08-10 09:48:01 +00:00
* With authmode set to optional, the TLS handshake is now aborted if the
Fixes running order of sections in Changelog
2017-07-27 14:11:52 +00:00
verification of the peer's certificate failed due to an overlong chain or
Fix language in Changelog for clarity
2017-08-10 09:48:01 +00:00
a fatal error in the verify callback.
Update Changelog for API/ABI fixes to revert interface
2017-07-20 10:33:41 +00:00
fix for issue 1118: check if iv is zero in gcm. 1) found by roberto in mbedtls forum 2) if iv_len is zero, return an error 3) add tests for invalid parameters
2016-12-16 14:15:56 +00:00
Bugfix
Fix language in Changelog for clarity
2017-08-10 09:48:01 +00:00
* Add a check if iv_len is zero in GCM, and return an error if it is zero.
Reported by roberto. #716
* Replace preprocessor condition from #if defined(MBEDTLS_THREADING_PTHREAD)
Wrong preproccessor condition fix Fix for issue #696 Change #if defined(MBEDTLS_THREADING_PTHREAD) to #if defined(MBEDTLS_THREADING_C)
2017-01-09 17:27:59 +00:00
to #if defined(MBEDTLS_THREADING_C) as the library cannot assume they will
Fix style and missing item in ChangeLog
2017-08-01 17:06:12 +00:00
always be implemented by pthread support. #696
Fix language in Changelog for clarity
2017-08-10 09:48:01 +00:00
* Fix a resource leak on Windows platforms in mbedtls_x509_crt_parse_path(),
in the case of an error. Found by redplait. #590
Check return code of mbedtls_mpi_fill_random Add MBEDTLS_MPI_CHK to check for error value of mbedtls_mpi_fill_random. Reported and fix suggested by guidovranken in #740
2017-01-12 12:50:50 +00:00
* Add MBEDTLS_MPI_CHK to check for error value of mbedtls_mpi_fill_random.
Fix style and missing item in ChangeLog
2017-08-01 17:06:12 +00:00
Reported and fix suggested by guidovranken. #740
Enable 64-bit compilation with ARM Compiler 6 This patch fixes the conditional preprocessor directives in include/mbedtls/bignum.h to enable 64-bit compilation with ARM Compiler 6.
2017-05-04 10:05:55 +00:00
* Fix conditional preprocessor directives in bignum.h to enable 64-bit
compilation when using ARM Compiler 6.
Fix merge errors in ChangeLog
2017-07-26 16:25:55 +00:00
* Fix a potential integer overflow in the version verification for DER
Fix style and missing item in ChangeLog
2017-08-01 17:06:12 +00:00
encoded X.509 CRLs. The overflow could enable maliciously constructed CRLs
Fix merge errors in ChangeLog
2017-07-26 16:25:55 +00:00
to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
KNOX Security, Samsung Research America
Prevent signed integer overflow in CSR parsing Modify the function mbedtls_x509_csr_parse_der() so that it checks the parsed CSR version integer before it increments the value. This prevents a potential signed integer overflow, as these have undefined behaviour in the C standard.
2017-02-17 13:54:43 +00:00
* Fix potential integer overflow in the version verification for DER
Fix style and missing item in ChangeLog
2017-08-01 17:06:12 +00:00
encoded X.509 CSRs. The overflow could enable maliciously constructed CSRs
Prevent signed integer overflow in CSR parsing Modify the function mbedtls_x509_csr_parse_der() so that it checks the parsed CSR version integer before it increments the value. This prevents a potential signed integer overflow, as these have undefined behaviour in the C standard.
2017-02-17 13:54:43 +00:00
to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
KNOX Security, Samsung Research America
Fix merge errors in ChangeLog
2017-07-26 16:25:55 +00:00
* Fix a potential integer overflow in the version verification for DER
Fix style and missing item in ChangeLog
2017-08-01 17:06:12 +00:00
encoded X.509 certificates. The overflow could enable maliciously
Fix merge errors in ChangeLog
2017-07-26 16:25:55 +00:00
constructed certificates to bypass the certificate verification check.
Add credit to Changelog to fix for #666
2017-07-28 22:52:10 +00:00
* Fix a call to the libc function time() to call the platform abstraction
Fix style and missing item in ChangeLog
2017-08-01 17:06:12 +00:00
function mbedtls_time() instead. Found by wairua. #666
* Avoid shadowing of time and index functions through mbed TLS function
arguments. Found by inestlerode. #557.
Improve behaviour on fatal errors If we didn't walk the whole chain, then there may be any kind of errors in the part of the chain we didn't check, so setting all flags looks like the safe thing to do.
2017-06-22 10:19:27 +00:00
Remove mutexes from ECP hardware acceleration Protecting the ECP hardware acceleratior with mutexes is inconsistent with the philosophy of the library. Pre-existing hardware accelerator interfaces leave concurrency support to the underlying platform. Fixes #863
2017-06-22 09:02:07 +00:00
Changes
Remove mutexes from ECP hardware acceleration Protecting the ECP hardware acceleratior with mutexes is inconsistent with the philosophy of the library. Pre-existing hardware accelerator interfaces leave concurrency support to the underlying platform. Fixes #863
2017-06-22 09:02:07 +00:00
* Added config.h option MBEDTLS_NO_UDBL_DIVISION, to prevent the use of
Fix style and missing item in ChangeLog
2017-08-01 17:06:12 +00:00
64-bit division. This is useful on embedded platforms where 64-bit division
created a dependency on external libraries. #708
Remove mutexes from ECP hardware acceleration Protecting the ECP hardware acceleratior with mutexes is inconsistent with the philosophy of the library. Pre-existing hardware accelerator interfaces leave concurrency support to the underlying platform. Fixes #863
2017-06-22 09:02:07 +00:00
* Removed mutexes from ECP hardware accelerator code. Now all hardware
accelerator code in the library leaves concurrency handling to the
platform. Reported by Steven Cooreman. #863
Add ChangeLog entry for config-no-entropy.h change
2017-06-26 11:57:44 +00:00
* Define the macro MBEDTLS_AES_ROM_TABLES in the configuration file
config-no-entropy.h to reduce the RAM footprint.
Fix style and missing item in ChangeLog
2017-08-01 17:06:12 +00:00
* Added a test script that can be hooked into git that verifies commits
before they are pushed.
Improve documentation of PKCS1 decryption functions Document the preconditions on the input and output buffers for the PKCS1 decryption functions - mbedtls_rsa_pkcs1_decrypt, - mbedtls_rsa_rsaes_pkcs1_v15_decrypt - mbedtls_rsa_rsaes_oaep_decrypt
2017-05-04 10:27:39 +00:00
* Improve documentation of PKCS1 decryption functions.
Remove mutexes from ECP hardware acceleration Protecting the ECP hardware acceleratior with mutexes is inconsistent with the philosophy of the library. Pre-existing hardware accelerator interfaces leave concurrency support to the underlying platform. Fixes #863
2017-06-22 09:02:07 +00:00
Update the version number to 2.5.1
2017-06-20 22:08:10 +00:00
= mbed TLS 2.5.1 released 2017-06-21
Adapt ChangeLog
2017-06-05 14:19:01 +00:00
Remove SHA-1 in TLS by default Default to forbidding the use of SHA-1 in TLS where it is unsafe: for certificate signing, and as the signature hash algorithm for the TLS 1.2 handshake signature. SHA-1 remains allowed in HMAC-SHA-1 in the XXX_SHA ciphersuites and in the PRF for TLS <= 1.1. For easy backward compatibility for use in controlled environments, turn on the MBEDTLS_TLS_DEFAULT_ALLOW_SHA1 compiled-time option.
2017-05-04 14:17:21 +00:00
Security
Add ChangeLog entry
2017-06-09 10:28:45 +00:00
* Fixed unlimited overread of heap-based buffer in mbedtls_ssl_read().
The issue could only happen client-side with renegotiation enabled.
Could result in DoS (application crash) or information leak
(if the application layer sent data read from mbedtls_ssl_read()
back to the server or to a third party). Can be triggered remotely.
SHA-1 deprecation: allow it in key exchange By default, keep allowing SHA-1 in key exchange signatures. Disabling it causes compatibility issues, especially with clients that use TLS1.2 but don't send the signature_algorithms extension. SHA-1 is forbidden in certificates by default, since it's vulnerable to offline collision-based attacks.
2017-05-12 11:16:40 +00:00
* Removed SHA-1 and RIPEMD-160 from the default hash algorithms for
certificate verification. SHA-1 can be turned back on with a compile-time
option if needed.
Fix FALLBACK_SCSV parsing Fixed a bug in ssl_srv.c when parsing TLS_FALLBACK_SCSV in the ciphersuite list that caused it to miss it sometimes. Reported by Hugo Leisink as issue #810. Fix initially by @andreasag01; this commit isolates the bug fix and adds a non-regression test.
2017-05-16 15:53:03 +00:00
* Fixed offset in FALLBACK_SCSV parsing that caused TLS server to fail to
detect it sometimes. Reported by Hugo Leisink. #810
RSA PKCS1v1.5 verification: check padding length The test case was generated by modifying our signature code so that it produces a 7-byte long padding (which also means garbage at the end, so it is essential in to check that the error that is detected first is indeed the padding rather than the final length check).
2017-05-11 10:49:51 +00:00
* Tighten parsing of RSA PKCS#1 v1.5 signatures, to avoid a
potential Bleichenbacher/BERserk-style attack.
Remove SHA-1 in TLS by default Default to forbidding the use of SHA-1 in TLS where it is unsafe: for certificate signing, and as the signature hash algorithm for the TLS 1.2 handshake signature. SHA-1 remains allowed in HMAC-SHA-1 in the XXX_SHA ciphersuites and in the PRF for TLS <= 1.1. For easy backward compatibility for use in controlled environments, turn on the MBEDTLS_TLS_DEFAULT_ALLOW_SHA1 compiled-time option.
2017-05-04 14:17:21 +00:00
Adapt ChangeLog
2017-06-05 14:19:01 +00:00
Bugfix
Improve Changelog
2017-06-16 08:00:07 +00:00
* Remove size zero arrays from ECJPAKE test suite. Size zero arrays are not
valid C and they prevented the test from compiling in Visual Studio 2015
and with GCC using the -Wpedantic compilation option.
Remember suitable hash function for any signature algorithm. This commit changes `ssl_parse_signature_algorithms_ext` to remember one suitable ( := supported by client and by our config ) hash algorithm per signature algorithm. It also modifies the ciphersuite checking function `ssl_ciphersuite_match` to refuse a suite if there is no suitable hash algorithm. Finally, it adds the corresponding entry to the ChangeLog.
2017-04-28 16:15:26 +00:00
* Fix insufficient support for signature-hash-algorithm extension,
resulting in compatibility problems with Chrome. Found by hfloyrd. #823
Improve Changelog
2017-06-16 08:00:07 +00:00
* Fix behaviour that hid the original cause of fatal alerts in some cases
when sending the alert failed. The fix makes sure not to hide the error
Changelog entry for the bug fixes
2017-05-10 15:47:40 +00:00
that triggered the alert.
Improve Changelog
2017-06-16 08:00:07 +00:00
* Fix SSLv3 renegotiation behaviour and stop processing data received from
peer after sending a fatal alert to refuse a renegotiation attempt.
Previous behaviour was to keep processing data even after the alert has
been sent.
Fix implementation of VERIFY_OPTIONAL verification mode This commit changes the behaviour of mbedtls_ssl_parse_certificate to make the two authentication modes MBEDTLS_SSL_VERIFY_REQUIRED and MBEDTLS_SSL_VERIFY_OPTIONAL be in the following relationship: Mode == MBEDTLS_SSL_VERIFY_REQUIRED <=> Mode == MBEDTLS_SSL_VERIFY_OPTIONAL + check verify result Also, it changes the behaviour to perform the certificate chain verification even if the trusted CA chain is empty. Previously, the function failed in this case, even when using optional verification, which was brought up in #864.
2017-05-08 15:31:14 +00:00
* Accept empty trusted CA chain in authentication mode
Fix the ChangeLog for clarity, english and credit
2018-04-30 15:40:25 +00:00
MBEDTLS_SSL_VERIFY_OPTIONAL. Found by Jethro Beekman. #864
Improve Changelog
2017-06-16 08:00:07 +00:00
* Fix implementation of mbedtls_ssl_parse_certificate() to not annihilate
fatal errors in authentication mode MBEDTLS_SSL_VERIFY_OPTIONAL and to
reflect bad EC curves within verification result.
* Fix bug that caused the modular inversion function to accept the invalid
modulus 1 and therefore to hang. Found by blaufish. #641.
* Fix incorrect sign computation in modular exponentiation when the base is
a negative MPI. Previously the result was always negative. Found by Guido
Vranken.
* Fix a numerical underflow leading to stack overflow in mpi_read_file()
that was triggered uppon reading an empty line. Found by Guido Vranken.
Changelog entry for the bug fixes
2017-05-10 15:47:40 +00:00
Added changelog entry
2017-05-03 14:55:03 +00:00
Changes
Improve Changelog
2017-06-16 08:00:07 +00:00
* Send fatal alerts in more cases. The previous behaviour was to skip
sending the fatal alert and just drop the connection.
Clarify the use of ECDSA API In the ecdsa.c sample application we don't use hashing, we use ecdsa directly on a buffer containing plain text. Although the text explains that it should be the message hash it still can be confusing. Any misunderstandings here are potentially very dangerous, because ECDSA truncates the message hash if necessary and this can lead to trivial signature forgeries if the API is misused and the message is passed directly to the function without hashing. This commit adds a hash computation step to the ecdsa.c sample application and clarification to the doxygen documentation of the ECDSA functions involved.
2017-03-10 11:31:41 +00:00
* Clarify ECDSA documentation and improve the sample code to avoid
Improve Changelog
2017-06-16 08:00:07 +00:00
misunderstanding and potentially dangerous use of the API. Pointed out
Clarify the use of ECDSA API In the ecdsa.c sample application we don't use hashing, we use ecdsa directly on a buffer containing plain text. Although the text explains that it should be the message hash it still can be confusing. Any misunderstandings here are potentially very dangerous, because ECDSA truncates the message hash if necessary and this can lead to trivial signature forgeries if the API is misused and the message is passed directly to the function without hashing. This commit adds a hash computation step to the ecdsa.c sample application and clarification to the doxygen documentation of the ECDSA functions involved.
2017-03-10 11:31:41 +00:00
by Jean-Philippe Aumasson.
Added changelog entry
2017-05-03 14:55:03 +00:00
Updated version number to 2.5.0
2017-05-15 14:13:59 +00:00
= mbed TLS 2.5.0 branch released 2017-05-17
Remove obsolete macros from compat-1.3.h
2017-05-02 15:01:20 +00:00
Add Changelog entry for RSA exponent blinding
2017-03-23 10:41:56 +00:00
Security
RSA: wipe stack buffers The RSA private key functions rsa_rsaes_pkcs1_v15_decrypt and rsa_rsaes_oaep_decrypt put sensitive data (decryption results) on the stack. Wipe it before returning. Thanks to Laurent Simon for reporting this issue.
2017-03-23 13:37:37 +00:00
* Wipe stack buffers in RSA private key operations
Improve Changelog
2017-06-16 08:00:07 +00:00
(rsa_rsaes_pkcs1_v15_decrypt(), rsa_rsaes_oaep_decrypt). Found by Laurent
Simon.
Add Changelog entry for RSA exponent blinding
2017-03-23 10:41:56 +00:00
* Add exponent blinding to RSA private operations as a countermeasure
against side-channel attacks like the cache attack described in
https://arxiv.org/abs/1702.08719v2.
Found and fix proposed by Michael Schwarz, Samuel Weiser, Daniel Gruss,
Clémentine Maurice and Stefan Mangard.
Fix ChangeLog Fixes the ChangeLog following the merge of the ECP HW acceleration interfaces in aab9efb.
2017-05-13 21:56:08 +00:00
Features
Improve Changelog
2017-06-16 08:00:07 +00:00
* Add hardware acceleration support for the Elliptic Curve Point module.
This involved exposing parts of the internal interface to enable
replacing the core functions and adding and alternative, module level
replacement support for enabling the extension of the interface.
Add Changelog entry for CA list suppression
2017-04-10 15:13:06 +00:00
* Add a new configuration option to 'mbedtls_ssl_config' to enable
suppressing the CA list in Certificate Request messages. The default
behaviour has not changed, namely every configured CAs name is included.
Change return type of AES decrypt and encrypt This patch modifies the following 2 functions in the AES module to change the return type from void to int: * mbedtls_aes_encrypt() -> mbedtls_internal_aes_encrypt() * mbedtls_aes_decrypt() -> mbedtls_internal_aes_decrypt() This change is necessary to allow users of MBEDTLS_AES_ALT, MBEDTLS_AES_DECRYPT_ALT and MBEDTLS_AES_ENCRYPT_ALT to return an error code when replacing the default with their own implementation, e.g. a hardware crypto accelerator.
2017-03-03 14:09:56 +00:00
API Changes
* The following functions in the AES module have been deprecated and replaced
by the functions shown below. The new functions change the return type from
void to int to allow returning error codes when using MBEDTLS_AES_ALT,
MBEDTLS_AES_DECRYPT_ALT or MBEDTLS_AES_ENCRYPT_ALT.
mbedtls_aes_decrypt() -> mbedtls_internal_aes_decrypt()
mbedtls_aes_encrypt() -> mbedtls_internal_aes_encrypt()
Remove obsolete macros from compat-1.3.h
2017-05-02 15:01:20 +00:00
Bugfix
* Remove macros from compat-1.3.h that correspond to deleted items from most
recent versions of the library. Found by Kyle Keen.
Improve Changelog
2017-06-16 08:00:07 +00:00
* Fixed issue in the Threading module that prevented mutexes from
initialising. Found by sznaider. #667 #843
* Add checks in the PK module for the RSA functions on 64-bit systems.
The PK and RSA modules use different types for passing hash length and
without these checks the type cast could lead to data loss. Found by Guido
Vranken.
Remove obsolete macros from compat-1.3.h
2017-05-02 15:01:20 +00:00
Updated version number to 2.4.2 for release
2017-03-10 18:50:44 +00:00
= mbed TLS 2.4.2 branch released 2017-03-08
Fix buffer overreads in mbedtls_pem_read_buffer()
2016-10-24 10:23:36 +00:00
Prevent SLOTH attacks
2016-10-25 09:50:22 +00:00
Security
Updated version number to 2.4.2 for release
2017-03-10 18:50:44 +00:00
* Add checks to prevent signature forgeries for very large messages while
using RSA through the PK module in 64-bit systems. The issue was caused by
some data loss when casting a size_t to an unsigned int value in the
functions rsa_verify_wrap(), rsa_sign_wrap(), rsa_alt_sign_wrap() and
mbedtls_pk_sign(). Found by Jean-Philippe Aumasson.
Fix CRL parsing to avoid infinite loop This patch modifies the function mbedtls_x509_crl_parse() to ensure that a CRL in PEM format with trailing characters after the footer does not result in the execution of an infinite loop.
2016-12-08 17:08:44 +00:00
* Fixed potential livelock during the parsing of a CRL in PEM format in
mbedtls_x509_crl_parse(). A string containing a CRL followed by trailing
characters after the footer could result in the execution of an infinite
loop. The issue can be triggered remotely. Found by Greg Zaverucha,
Microsoft.
Prevent SLOTH attacks
2016-10-25 09:50:22 +00:00
* Removed MD5 from the allowed hash algorithms for CertificateRequest and
CertificateVerify messages, to prevent SLOTH attacks against TLS 1.2.
Add detail to ChangeLog for SLOTH fix
2017-02-05 16:48:47 +00:00
Introduced by interoperability fix for #513.
ECP: Prevent freeing a buffer on stack The function ecp_mod_koblitz computed the space for the result of a multiplication optimally for that specific case, but unfortunately the function mbedtls_mpi_mul_mpi performs a generic, suboptimal calculation and needs one more limb for the result. Since the result's buffer is on the stack, the best case scenario is that the program stops. This only happened on 64 bit platforms. Fixes #569
2017-01-27 16:05:20 +00:00
* Fixed a bug that caused freeing a buffer that was allocated on the stack,
when verifying the validity of a key on secp224k1. This could be
triggered remotely for example with a maliciously constructed certificate
Clarify ChangeLog for #569
2017-02-28 18:47:27 +00:00
and potentially could lead to remote code execution on some platforms.
Corrected attibution in Changelog
2017-03-07 12:37:14 +00:00
Reported independently by rongsaws and Aleksandar Nikolic, Cisco Talos
team. #569 CVE-2017-2784
ECP: Prevent freeing a buffer on stack The function ecp_mod_koblitz computed the space for the result of a multiplication optimally for that specific case, but unfortunately the function mbedtls_mpi_mul_mpi performs a generic, suboptimal calculation and needs one more limb for the result. Since the result's buffer is on the stack, the best case scenario is that the program stops. This only happened on 64 bit platforms. Fixes #569
2017-01-27 16:05:20 +00:00
Fix buffer overreads in mbedtls_pem_read_buffer()
2016-10-24 10:23:36 +00:00
Bugfix
Fix verify out flags from x509_crt_verify_top() This change fixes a regression introduced by an earlier commit that modified x509_crt_verify_top() to ensure that valid certificates that are after past or future valid in the chain are processed. However the change introduced a change in behaviour that caused the verification flags MBEDTLS_X509_BADCERT_EXPIRED and MBEDTLS_BADCERT_FUTURE to always be set whenever there is a failure in the verification regardless of the cause. The fix maintains both behaviours: * Ensure that valid certificates after future and past are verified * Ensure that the correct verification flags are set. To do so, a temporary pointer to the first future or past valid certificate is maintained while traversing the chain. If a truly valid certificate is found then that one is used, otherwise if no valid certificate is found and the end of the chain is reached, the program reverts back to using the future or past valid certificate.
2016-12-09 17:26:23 +00:00
* Fix output certificate verification flags set by x509_crt_verify_top() when
traversing a chain of trusted CA. The issue would cause both flags,
MBEDTLS_X509_BADCERT_NOT_TRUSTED and MBEDTLS_X509_BADCERT_EXPIRED, to be
set when the verification conditions are not met regardless of the cause.
Found by Harm Verhagen and inestlerode. #665 #561
Clarify fix for #673 in Changelog Clarified fix, and added credit.
2017-02-02 13:08:37 +00:00
* Fix the redefinition of macro ssl_set_bio to an undefined symbol
mbedtls_ssl_set_bio_timeout in compat-1.3.h, by removing it.
Found by omlib-lin. #673
Fix unused variable/function compilation warnings This PR fixes a number of unused variable/function compilation warnings that arise when using a config.h that does not define the macro MBEDTLS_PEM_PARSE_C.
2016-12-07 15:05:53 +00:00
* Fix unused variable/function compilation warnings in pem.c, x509_crt.c and
x509_csr.c that are reported when building mbed TLS with a config.h that
Add credit to Changelog for #562
2017-02-02 16:17:37 +00:00
does not define MBEDTLS_PEM_PARSE_C. Found by omnium21. #562
Fix renegotiation at incorrect times in DTLS Fix an incorrect condition in ssl_check_ctr_renegotiate() that compared 64 bits of record counter instead of 48 bits as described in RFC 6347 Section 4.3.1. This would cause the function's return value to be occasionally incorrect and the renegotiation routines to be triggered at unexpected times.
2016-12-15 17:01:16 +00:00
* Fix incorrect renegotiation condition in ssl_check_ctr_renegotiate() that
would compare 64 bits of the record counter instead of 48 bits as indicated
in RFC 6347 Section 4.3.1. This could cause the execution of the
renegotiation routines at unexpected times when the protocol is DTLS. Found
by wariua. #687
Fix buffer overreads in mbedtls_pem_read_buffer()
2016-10-24 10:23:36 +00:00
* Fixed multiple buffer overreads in mbedtls_pem_read_buffer() when parsing
Add tests for overreads in pem_read_buffer()
2016-10-24 13:31:54 +00:00
the input string in PEM format to extract the different components. Found
Fix buffer overreads in mbedtls_pem_read_buffer()
2016-10-24 10:23:36 +00:00
by Eyal Itkin.
Fix integer overflows in buffer bound checks Fix potential integer overflows in the following functions: * mbedtls_md2_update() to be bypassed and cause * mbedtls_cipher_update() * mbedtls_ctr_drbg_reseed() This overflows would mainly be exploitable in 32-bit systems and could cause buffer bound checks to be bypassed.
2017-01-17 23:04:22 +00:00
* Fixed potential arithmetic overflow in mbedtls_ctr_drbg_reseed() that could
cause buffer bound checks to be bypassed. Found by Eyal Itkin.
* Fixed potential arithmetic overflows in mbedtls_cipher_update() that could
cause buffer bound checks to be bypassed. Found by Eyal Itkin.
* Fixed potential arithmetic overflow in mbedtls_md2_update() that could
cause buffer bound checks to be bypassed. Found by Eyal Itkin.
Fix integer overflow mbedtls_base64_decode() Fix potential integer overflows in the function mbedtls_base64_decode(). This overflow would mainly be exploitable in 32-bit systems and could cause buffer bound checks to be bypassed.
2017-01-18 17:21:03 +00:00
* Fixed potential arithmetic overflow in mbedtls_base64_decode() that could
cause buffer bound checks to be bypassed. Found by Eyal Itkin.
Fix buffer overread in mbedtls_x509_get_time() A heap overread might happen when parsing malformed certificates. Reported by Peng Li and Yueh-Hsun Lin. Refactoring the parsing fixes the problem. This commit applies the relevant part of the OpenVPN contribution applied to mbed TLS 1.3 in commit 17da9dd82931abdf054a01c466bce45e7d12b742.
2017-02-03 12:36:59 +00:00
* Fixed heap overreads in mbedtls_x509_get_time(). Found by Peng
Li/Yueh-Hsun Lin, KNOX Security, Samsung Research America.
Fix memory leak in mbedtls_x509_crl_parse() The memory leak call was caused by missing calls to mbedtls_pem_free() when a MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT error was encountered.
2016-12-08 17:19:21 +00:00
* Fix potential memory leak in mbedtls_x509_crl_parse(). The leak was caused
by missing calls to mbedtls_pem_free() in cases when a
Fix credit in ChangeLog for #722
2017-02-28 16:36:22 +00:00
MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT error was encountered. Found and
fix proposed by Guido Vranken. #722
Add fix and credit for #742 to the ChangeLog
2017-03-02 09:18:09 +00:00
* Fixed the templates used to generate project and solution files for Visual
Studio 2015 as well as the files themselves, to remove a build warning
generated in Visual Studio 2015. Reported by Steve Valliere. #742
Fix resource leak when using mutex and ssl_cookie When using ssl_cookie with MBEDTLS_THREADING_C, fix a resource leak caused by initiating a mutex in mbedtls_ssl_cookie_free instead of freeing it. Raised and fix suggested by lan Gillingham in the mbed TLS forum Tracked in #771
2017-01-29 16:51:35 +00:00
* Fix a resource leak in ssl_cookie, when using MBEDTLS_THREADING_C.
Raised and fix suggested by Alan Gillingham in the mbed TLS forum. #771
Fix buffer overflow in mbedtls_mpi_write_string() Fix a buffer overflow when writting a string representation of an MPI number to a buffer in hexadecimal. The problem occurs because hex digits are written in pairs and this is not accounted for in the calculation of the required buffer size when the number of digits is odd.
2017-01-06 13:17:35 +00:00
* Fix 1 byte buffer overflow in mbedtls_mpi_write_string() when the MPI
number to write in hexadecimal is negative and requires an odd number of
digits. Found and fixed by Guido Vranken.
Added missing credit to ChangeLog for #555
2017-03-07 19:35:49 +00:00
* Fix unlisted DES configuration dependency in some pkparse test cases. Found
by inestlerode. #555
Fix buffer overreads in mbedtls_pem_read_buffer()
2016-10-24 10:23:36 +00:00
Update library version number to 2.4.1
2016-12-13 14:14:03 +00:00
= mbed TLS 2.4.1 branch released 2016-12-13
Update CMAC test vectors.
2016-12-13 11:51:04 +00:00
Changes
* Update to CMAC test data, taken from - NIST Special Publication 800-38B -
Recommendation for Block Cipher Modes of Operation: The CMAC Mode for
Authentication – October 2016
Update Changelog version number to 2.4.0
2016-10-16 18:35:49 +00:00
= mbed TLS 2.4.0 branch released 2016-10-17
Update ChangeLog to include the most recent fixes
2016-09-02 18:29:39 +00:00
Add missing bounds check in X509 DER write funcs This patch adds checks in both mbedtls_x509write_crt_der and mbedtls_x509write_csr_der before the signature is written to buf using memcpy().
2016-09-02 14:23:48 +00:00
Security
Tidied up style and phrasing of ChangeLog
2016-10-15 23:44:08 +00:00
* Removed the MBEDTLS_SSL_AEAD_RANDOM_IV option, because it was not compliant
with RFC-5116 and could lead to session key recovery in very long TLS
sessions. "Nonce-Disrespecting Adversaries Practical Forgery Attacks on GCM in
TLS" - H. Bock, A. Zauner, S. Devlin, J. Somorovsky, P. Jovanovic.
https://eprint.iacr.org/2016/475.pdf
* Fixed potential stack corruption in mbedtls_x509write_crt_der() and
Add missing bounds check in X509 DER write funcs This patch adds checks in both mbedtls_x509write_crt_der and mbedtls_x509write_csr_der before the signature is written to buf using memcpy().
2016-09-02 14:23:48 +00:00
mbedtls_x509write_csr_der() when the signature is copied to the buffer
Add test for bounds in X509 DER write funcs
2016-09-07 10:09:44 +00:00
without checking whether there is enough space in the destination. The
Tidied up style and phrasing of ChangeLog
2016-10-15 23:44:08 +00:00
issue cannot be triggered remotely. Found by Jethro Beekman.
Add missing bounds check in X509 DER write funcs This patch adds checks in both mbedtls_x509write_crt_der and mbedtls_x509write_csr_der before the signature is written to buf using memcpy().
2016-09-02 14:23:48 +00:00
Update ChangeLog to include the most recent fixes
2016-09-02 18:29:39 +00:00
Features
Add CMAC to ChangeLog
2016-10-05 13:17:37 +00:00
* Added support for CMAC for AES and 3DES and AES-CMAC-PRF-128, as defined by
NIST SP 800-38B, RFC-4493 and RFC-4615.
Update ChangeLog to include the most recent fixes
2016-09-02 18:29:39 +00:00
* Added hardware entropy selftest to verify that the hardware entropy source
is functioning correctly.
* Added a script to print build environment info for diagnostic use in test
scripts, which is also now called by all.sh.
Allow the entry_name size to be set in config.h Allow the size of the entry_name character array in x509_crt.c to be configurable through a macro in config.h. entry_name holds a path/filename string. The macro introduced in MBEDTLS_X509_MAX_FILE_PATH_LEN.
2016-09-02 13:06:04 +00:00
* Added the macro MBEDTLS_X509_MAX_FILE_PATH_LEN that enables the user to
configure the maximum length of a file path that can be buffered when
calling mbedtls_x509_crt_parse_path().
Tidied up style and phrasing of ChangeLog
2016-10-15 23:44:08 +00:00
* Added a configuration file config-no-entropy.h that configures the subset of
Add new config.h that does not need entropy source
2016-09-19 14:33:30 +00:00
library features that do not require an entropy source.
Add config macro for min bytes hw entropy
2016-09-23 16:58:49 +00:00
* Added the macro MBEDTLS_ENTROPY_MIN_HARDWARE in config.h. This allows users
to configure the minimum number of bytes for entropy sources using the
mbedtls_hardware_poll() function.
Update ChangeLog to include the most recent fixes
2016-09-02 18:29:39 +00:00
Bugfix
* Fix for platform time abstraction to avoid dependency issues where a build
may need time but not the standard C library abstraction, and added
configuration consistency checks to check_config.h
* Fix dependency issue in Makefile to allow parallel builds.
Tidied up style and phrasing of ChangeLog
2016-10-15 23:44:08 +00:00
* Fix incorrect handling of block lengths in crypt_and_hash.c sample program,
when GCM is used. Found by udf2457. #441
Update to ChangeLog for bug #428
2016-09-04 22:46:59 +00:00
* Fix for key exchanges based on ECDH-RSA or ECDH-ECDSA which weren't
enabled unless others were also present. Found by David Fernandez. #428
Update ChangeLog for fix for #541 - out-of-tree CMake builds
2016-09-07 14:25:16 +00:00
* Fix for out-of-tree builds using CMake. Found by jwurzer, and fix based on
a contribution from Tobias Tangemann. #541
Tidied up style and phrasing of ChangeLog
2016-10-15 23:44:08 +00:00
* Fixed cert_app.c sample program for debug output and for use when no root
Update for ChangeLog for fixes for cert_app
2016-09-26 19:48:56 +00:00
certificates are provided.
Fix 1 byte overread in mbedtls_asn1_get_int()
2016-09-26 08:52:41 +00:00
* Fix conditional statement that would cause a 1 byte overread in
Updated Changelog for fix #599
2016-10-12 15:37:59 +00:00
mbedtls_asn1_get_int(). Found and fixed by Guido Vranken. #599
Revise Changelog to clarify and add credit
2016-10-11 09:13:52 +00:00
* Fixed pthread implementation to avoid unintended double initialisations
Tidied up style and phrasing of ChangeLog
2016-10-15 23:44:08 +00:00
and double frees. Found by Niklas Amnebratt.
Update Changelog for fixes to X.509 sample apps
2016-10-07 14:56:07 +00:00
* Fixed the sample applications gen_key.c, cert_req.c and cert_write.c for
builds where the configuration MBEDTLS_PEM_WRITE_C is not defined. Found
by inestlerode. #559.
Fix sig->tag update in mbedtls_x509_get_sig()
2016-09-19 15:58:45 +00:00
* Fix mbedtls_x509_get_sig() to update the ASN1 type in the mbedtls_x509_buf
data structure until after error checks are successful. Found by
Update and clean up Changelog for #622
2016-10-13 13:03:37 +00:00
subramanyam-c. #622
Fix documentation for mbedtls_gcm_finish() Fix implementation and documentation missmatch for the function arguments to mbedtls_gcm_finish(). Also, removed redundant if condition that always evaluates to true.
2016-09-26 09:09:30 +00:00
* Fix documentation and implementation missmatch for function arguments of
Clarified Changelog for fix #602
2016-10-12 18:47:29 +00:00
mbedtls_gcm_finish(). Found by cmiatpaar. #602
Added credit to Changelog for fix #558
2016-10-12 23:14:37 +00:00
* Guarantee that P>Q at RSA key generation. Found by inestlerode. #558
Fix overread when verifying SERVER_HELLO in DTLS
2016-09-26 13:53:05 +00:00
* Fix potential byte overread when verifying malformed SERVER_HELLO in
ssl_parse_hello_verify_request() for DTLS. Found by Guido Vranken.
Add check for validity of date in x509_get_time()
2016-09-23 12:16:02 +00:00
* Fix check for validity of date when parsing in mbedtls_x509_get_time().
Update to Changelog for #626
2016-10-13 15:29:56 +00:00
Found by subramanyam-c. #626
Merge fix for IE Certificate Compatibility
2016-10-13 16:21:01 +00:00
* Fix compatibility issue with Internet Explorer client authentication,
where the limited hash choices prevented the client from sending its
certificate. Found by teumas. #513
Update ChangeLog for MBEDTLS_SELF_TEST fix
2016-10-14 14:23:21 +00:00
* Fix compilation without MBEDTLS_SELF_TEST enabled.
Update ChangeLog to include the most recent fixes
2016-09-02 18:29:39 +00:00
Changes
* Extended test coverage of special cases, and added new timing test suite.
* Removed self-tests from the basic-built-test.sh script, and added all
missing self-tests to the test suites, to ensure self-tests are only
executed once.
* Added support for 3 and 4 byte lengths to mbedtls_asn1_write_len().
* Added support for a Yotta specific configuration file -
through the symbol YOTTA_CFG_MBEDTLS_TARGET_CONFIG_FILE.
Updated ChangeLog for PR#565 Updated ChangeLog for pull request #565 - Remove unused consts from oid lists
2016-09-04 14:12:09 +00:00
* Added optimization for code space for X.509/OID based on configured
Tidied up style and phrasing of ChangeLog
2016-10-15 23:44:08 +00:00
features. Contributed by Aviv Palivoda.
Rename net.{c,h} to net_sockets.{c,h} The library/net.c and its corresponding include/mbedtls/net.h file are renamed to library/net_sockets.c and include/mbedtls/net_sockets.h respectively. This is to avoid naming collisions in projects which also have files with the common name 'net'.
2016-09-14 13:32:09 +00:00
* Renamed source file library/net.c to library/net_sockets.c to avoid
naming collision in projects which also have files with the common name
net.c. For consistency, the corresponding header file, net.h, is marked as
deprecated, and its contents moved to net_sockets.h.
Update Changelog for X.509 unrecognised field fix
2016-10-13 14:55:56 +00:00
* Changed the strategy for X.509 certificate parsing and validation, to no
longer disregard certificates with unrecognised fields.
Update ChangeLog to include the most recent fixes
2016-09-02 18:29:39 +00:00
Updates ChangeLog with final changes for release
2016-06-27 18:43:55 +00:00
= mbed TLS 2.3.0 branch released 2016-06-28
Update ChangeLog for latest PR merged fixes #309
2016-01-07 12:26:11 +00:00
Add Changelog entry for current branch
2016-02-10 16:25:55 +00:00
Security
Add Changelog entry for current branch
2016-02-10 16:25:55 +00:00
* Fix missing padding length check in mbedtls_rsa_rsaes_pkcs1_v15_decrypt
Add Changelog entry for current branch
2016-02-10 16:14:10 +00:00
required by PKCS1 v2.2
Add Changelog entry for current branch
2016-02-10 16:25:55 +00:00
* Fix potential integer overflow to buffer overflow in
mbedtls_rsa_rsaes_pkcs1_v15_encrypt and mbedtls_rsa_rsaes_oaep_encrypt
Add precision about exploitability in ChangeLog Also fix some whitespace while at it.
2016-02-11 09:35:13 +00:00
(not triggerable remotely in (D)TLS).
Correct indentation and labelling in ChangeLog
2017-07-26 10:49:40 +00:00
* Fix a potential integer underflow to buffer overread in
Extended ChangeLog entry
2016-02-11 11:15:44 +00:00
mbedtls_rsa_rsaes_oaep_decrypt. It is not triggerable remotely in
SSL/TLS.
Add Changelog entry for current branch
2016-02-10 16:25:55 +00:00
Fixes time() abstraction for custom configs Added platform abstraction of time() to ChangeLog, version features, and fixed the build for dynamic configuration.
2016-04-26 18:51:29 +00:00
Features
* Support for platform abstraction of the standard C library time()
function.
Update ChangeLog for latest PR merged fixes #309
2016-01-07 12:26:11 +00:00
Bugfix
* Fix bug in mbedtls_mpi_add_mpi() that caused wrong results when the three
arguments where the same (in-place doubling). Found and fixed by Janos
Make ar invocation more portable armar doesn't understand the syntax without dash. OTOH, the syntax with dash is the only one specified by POSIX, and it's accepted by GNU ar, BSD ar (as bundled with OS X) and armar, so it looks like the most portable syntax. fixes #386
2016-01-07 12:06:51 +00:00
Follath. #309
Revert changes done to 'make apidoc' target This partially reverts 1989caf71c1d4 (only the changes to Makefile and CMakeLists, the addition to scripts/config.pl is kept). Modifying config.h in the apidoc target creates a race condition with make -j4 all apidoc where some parts of the library, tests or programs could be built with the wrong config.h, resulting in all kinds of (semi-random) errors. Recent versions of CMake mitigate this by adding a .NOTPARALLEL target to the generated Makefile, but people would still get errors with older CMake versions that are still in use (eg in RHEL 5), and with plain make. An additional issue is that, by failing to use cp -p, the apidoc target was updating the timestamp on config.h, which seems to cause further build issues. Let's get back to the previous, safe, situation. The improved apidoc building will be resurrected in a script in the next commit. fixes #390 fixes #391
2016-01-12 13:59:39 +00:00
* Fix potential build failures related to the 'apidoc' target, introduced
in the previous patch release. Found by Robert Scheck. #390 #391
Make ar invocation more portable armar doesn't understand the syntax without dash. OTOH, the syntax with dash is the only one specified by POSIX, and it's accepted by GNU ar, BSD ar (as bundled with OS X) and armar, so it looks like the most portable syntax. fixes #386
2016-01-07 12:06:51 +00:00
* Fix issue in Makefile that prevented building using armar. #386
Fix #2370, minor typos and spelling mistakes
2019-01-23 14:24:37 +00:00
* Fix memory leak that occurred only when ECJPAKE was enabled and ECDHE and
Add Changelog entry and improve coding style
2016-02-10 11:27:43 +00:00
ECDSA was disabled in config.h . The leak didn't occur by default.
Remove redundant test certificates and clarify ChangeLog
2016-03-01 20:26:16 +00:00
* Fix an issue that caused valid certificates to be rejected whenever an
expired or not yet valid certificate was parsed before a valid certificate
in the trusted certificate list.
Correct indentation and labelling in ChangeLog
2017-07-26 10:49:40 +00:00
* Fix bug in mbedtls_x509_crt_parse that caused trailing extra data in the
x509: trailing bytes in DER: fix bug Fix bug in mbedtls_x509_crt_parse that caused trailing extra data in the buffer after DER certificates to be included in the raw representation. #377
2016-02-17 14:34:12 +00:00
buffer after DER certificates to be included in the raw representation.
Adds test for odd bit length RSA key size Also tidy up ChangeLog following review.
2016-04-15 18:06:59 +00:00
* Fix issue that caused a hang when generating RSA keys of odd bitlength
Fix null pointer dereference in the RSA module. Introduced null pointer checks in mbedtls_rsa_rsaes_pkcs1_v15_encrypt
2016-03-18 11:45:44 +00:00
* Fix bug in mbedtls_rsa_rsaes_pkcs1_v15_encrypt that made null pointer
dereference possible.
Fix bug in ssl_write_supported_elliptic_curves_ext Passing invalid curves to mbedtls_ssl_conf_curves potentially could caused a crash later in ssl_write_supported_elliptic_curves_ext. #373
2016-04-21 22:37:09 +00:00
* Fix issue that caused a crash if invalid curves were passed to
mbedtls_ssl_conf_curves. #373
Update ChangeLog for bug #429 in ssl_fork_server
2016-04-28 23:05:32 +00:00
* Fix issue in ssl_fork_server which was preventing it from functioning. #429
Amended ChangeLog
2016-05-12 15:38:27 +00:00
* Fix memory leaks in test framework
Update ChangeLog to reflect
2016-05-13 09:50:41 +00:00
* Fix test in ssl-opt.sh that does not run properly with valgrind
Updates ChangeLog with final changes for release
2016-06-27 18:43:55 +00:00
* Fix unchecked calls to mmbedtls_md_setup(). Fix by Brian Murray. #502
Update ChangeLog for latest PR merged fixes #309
2016-01-07 12:26:11 +00:00
Avoid build errors with -O0 due to assembly
2016-01-08 13:29:11 +00:00
Changes
* On ARM platforms, when compiling with -O0 with GCC, Clang or armcc5,
don't use the optimized assembly for bignum multiplication. This removes
the need to pass -fomit-frame-pointer to avoid a build error with -O0.
Updates ChangeLog with faster MPI zeroize fix Added optimised mbedtls_mpi_zeroise() credit to ChangeLog.
2016-04-25 15:07:12 +00:00
* Disabled SSLv3 in the default configuration.
Fixes mbedtls_mpi_zeroize() function name in ChangeLog
2016-04-26 11:51:37 +00:00
* Optimized mbedtls_mpi_zeroize() for MPI integer size. (Fix by Alexey
Skalozub).
Fix non compliance SSLv3 in server extension handling. The server code parses the client hello extensions even when the protocol is SSLv3 and this behaviour is non compliant with rfc6101. Also the server sends extensions in the server hello and omitting them may prevent interoperability problems.
2016-05-23 13:27:02 +00:00
* Fix non-compliance server extension handling. Extensions for SSLv3 are now
ignored, as required by RFC6101.
Update ChangeLog for latest PR merged fixes #309
2016-01-07 12:26:11 +00:00
Change version number to 2.2.1 Changed version for library files and yotta module
2016-01-04 22:26:36 +00:00
= mbed TLS 2.2.1 released 2016-01-05
Added description of change to the Changelog Also clarified some comments following review.
2015-12-16 01:51:30 +00:00
Fix potential double free in cert writing code In case an entry with the given OID already exists in the list passed to mbedtls_asn1_store_named_data() and there is not enough memory to allocate room for the new value, the existing entry will be freed but the preceding entry in the list will sill hold a pointer to it. (And the following entries in the list are no longer reachable.) This results in memory leak or a double free. The issue is we want to leave the list in a consistent state on allocation failure. (We could add a warning that the list is left in inconsistent state when the function returns NULL, but behaviour changes that require more care from the user are undesirable, especially in a stable branch.) The chosen solution is a bit inefficient in that there is a time where both blocks are allocated, but at least it's safe and this should trump efficiency here: this code is only used for generating certificates, which is unlikely to be done on very constrained devices, or to be in the critical loop of anything. Also, the sizes involved should be fairly small anyway. fixes #367
2015-12-10 09:50:51 +00:00
Security
* Fix potential double free when mbedtls_asn1_store_named_data() fails to
allocate memory. Only used for certificate generation, not triggerable
remotely in SSL/TLS. Found by Rafał Przywara. #367
Update reference to attack in ChangeLog We couldn't do that before the attack was public
2016-01-07 12:18:01 +00:00
* Disable MD5 handshake signatures in TLS 1.2 by default to prevent the
SLOTH attack on TLS 1.2 server authentication (other attacks from the
SLOTH paper do not apply to any version of mbed TLS or PolarSSL).
https://www.mitls.org/pages/attacks/SLOTH
Fix potential double free in cert writing code In case an entry with the given OID already exists in the list passed to mbedtls_asn1_store_named_data() and there is not enough memory to allocate room for the new value, the existing entry will be freed but the preceding entry in the list will sill hold a pointer to it. (And the following entries in the list are no longer reachable.) This results in memory leak or a double free. The issue is we want to leave the list in a consistent state on allocation failure. (We could add a warning that the list is left in inconsistent state when the function returns NULL, but behaviour changes that require more care from the user are undesirable, especially in a stable branch.) The chosen solution is a bit inefficient in that there is a time where both blocks are allocated, but at least it's safe and this should trump efficiency here: this code is only used for generating certificates, which is unlikely to be done on very constrained devices, or to be in the critical loop of anything. Also, the sizes involved should be fairly small anyway. fixes #367
2015-12-10 09:50:51 +00:00
Fix wrong length limit in GCM See for example page 8 of http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf The previous constant probably came from a typo as it was 2^26 - 2^5 instead of 2^36 - 2^5. Clearly the intention was to allow for a constant bigger than 2^32 as the ull suffix and cast to uint64_t show. fixes #362
2015-12-10 13:46:25 +00:00
Bugfix
Fix typo in Changelog
2015-12-22 19:04:24 +00:00
* Fix over-restrictive length limit in GCM. Found by Andreas-N. #362
Fix bug checking pathlen on first intermediate Remove check on the pathLenConstraint value when looking for a parent to the EE cert, as the constraint is on the number of intermediate certs below the parent, and that number is always 0 at that point, so the constraint is always satisfied. The check was actually off-by-one, which caused valid chains to be rejected under the following conditions: - the parent certificate is not a trusted root, and - it has pathLenConstraint == 0 (max_pathlen == 1 in our representation) fixes #280
2015-11-19 08:23:06 +00:00
* Fix bug in certificate validation that caused valid chains to be rejected
when the first intermediate certificate has pathLenConstraint=0. Found by
Nicholas Wilson. Introduced in mbed TLS 2.2.0. #280
Tune description of a change/bugfix in ChangeLog
2016-01-04 16:36:44 +00:00
* Removed potential leak in mbedtls_rsa_rsassa_pkcs1_v15_sign(), found by
Fix for memory leak in RSA-SSA signing Fix in mbedtls_rsa_rsassa_pkcs1_v15_sign() in rsa.c
2016-01-01 21:42:47 +00:00
JayaraghavendranK. #372
Tune description of a change/bugfix in ChangeLog
2016-01-04 16:36:44 +00:00
* Fix suboptimal handling of unexpected records that caused interop issues
with some peers over unreliable links. Avoid dropping an entire DTLS
datagram if a single record in a datagram is unexpected, instead only
drop the record and look at subsequent records (if any are present) in
the same datagram. Found by jeannotlapin. #345
Added description of change to the Changelog Also clarified some comments following review.
2015-12-16 01:51:30 +00:00
Change version number to 2.2.0 Changed for library and yotta module
2015-11-04 11:04:00 +00:00
= mbed TLS 2.2.0 released 2015-11-04
Fixed copy and paste error Accidental additional assignment in ssl_write_alpn_ext()
2015-09-28 23:31:09 +00:00
Add Changelog entries for this branch
2015-10-30 08:35:03 +00:00
Security
Fix potential double-free in ssl_conf_psk()
2015-10-20 17:56:45 +00:00
* Fix potential double free if mbedtls_ssl_conf_psk() is called more than
once and some allocation fails. Cannot be forced remotely. Found by Guido
Vranken, Intelworks.
Fix potential heap corruption on Windows If len is large enough, when cast to an int it will be negative and then the test if( len > MAX_PATH - 3 ) will not behave as expected.
2015-10-21 08:16:29 +00:00
* Fix potential heap corruption on Windows when
mbedtls_x509_crt_parse_path() is passed a path longer than 2GB. Cannot be
Corrected typo in ChangeLog
2015-11-03 23:09:28 +00:00
triggered remotely. Found by Guido Vranken, Intelworks.
Fix potential buffer overflow in asn1write
2015-10-21 10:07:47 +00:00
* Fix potential buffer overflow in some asn1_write_xxx() functions.
Cannot be triggered remotely unless you create X.509 certificates based
on untrusted input or write keys of untrusted origin. Found by Guido
Corrected typo in ChangeLog
2015-11-03 23:09:28 +00:00
Vranken, Intelworks.
Add Changelog entries for this branch
2015-10-30 08:35:03 +00:00
* The X509 max_pathlen constraint was not enforced on intermediate
certificates. Found by Nicholas Wilson, fix and tests provided by
Janos Follath. #280 and #319
Update ChangeLog for the EC J-PAKE branch
2015-10-20 13:04:57 +00:00
Features
* Experimental support for EC J-PAKE as defined in Thread 1.0.0.
Disabled by default as the specification might still change.
* Added a key extraction callback to accees the master secret and key
block. (Potential uses include EAP-TLS and Thread.)
Fix missing check for RSA key length on EE certs - also adapt tests to use lesser requirement for compatibility with old testing material
2015-10-23 12:08:48 +00:00
ECHDE-PSK does not use a certificate fixes #270
2015-10-09 13:47:17 +00:00
Bugfix
Add Changelog entries for this branch
2015-10-30 08:35:03 +00:00
* Self-signed certificates were not excluded from pathlen counting,
resulting in some valid X.509 being incorrectly rejected. Found and fix
provided by Janos Follath. #319
ECHDE-PSK does not use a certificate fixes #270
2015-10-09 13:47:17 +00:00
* Fix build error with configurations where ECDHE-PSK is the only key
exchange. Found and fix provided by Chris Hammond. #270
Fix #ifdef inconsistency fixes #310 Actually all key exchanges that use a certificate use signatures too, and there is no key exchange that uses signatures but no cert, so merge those two flags.
2015-10-22 15:01:15 +00:00
* Fix build error with configurations where RSA, RSA-PSK, ECDH-RSA or
ECHD-ECDSA if the only key exchange. Multiple reports. #310
Merge branch 'development' into iotssl-513-alerts
2015-10-27 16:05:34 +00:00
* Fixed a bug causing some handshakes to fail due to some non-fatal alerts
not being properly ignored. Found by mancha and Kasom Koht-arsa, #308
Fix missing check for RSA key length on EE certs - also adapt tests to use lesser requirement for compatibility with old testing material
2015-10-23 12:08:48 +00:00
* mbedtls_x509_crt_verify(_with_profile)() now also checks the key type and
size/curve against the profile. Before that, there was no way to set a
minimum key size for end-entity certificates with RSA keys. Found by
Merge branch iotssl-521-keylen-check
2015-10-27 15:14:55 +00:00
Matthew Page of Scannex Electronics Ltd.
Disable reportedly broken assembly of Sparc(64) fixes #292
2015-10-21 12:52:24 +00:00
* Fix failures in MPI on Sparc(64) due to use of bad assembly code.
Found by Kurt Danielson. #292
Fix typo in an OID name fixes #314
2015-10-21 14:40:29 +00:00
* Fix typo in name of the extKeyUsage OID. Found by inestlerode, #314
Add ChangeLog entry for ASN.1 DER boolean fix
2015-11-01 21:00:02 +00:00
* Fix bug in ASN.1 encoding of booleans that caused generated CA
certificates to be rejected by some applications, including OS X
Keychain. Found and fixed by Jonathan Leroy, Inikup.
Merge branch iotssl-521-keylen-check
2015-10-27 15:14:55 +00:00
Mention performance fix in ChangeLog
2015-10-27 09:24:54 +00:00
Changes
* Improved performance of mbedtls_ecp_muladd() when one of the scalars is 1
or -1.
ECHDE-PSK does not use a certificate fixes #270
2015-10-09 13:47:17 +00:00
= mbed TLS 2.1.2 released 2015-10-06
Fixed copy and paste error Accidental additional assignment in ssl_write_alpn_ext()
2015-09-28 23:31:09 +00:00
Security
Fix CVE number in ChangeLog
2015-10-05 17:21:34 +00:00
* Added fix for CVE-2015-5291 to prevent heap corruption due to buffer
Changed attribution for Guido Vranken
2015-10-05 09:18:17 +00:00
overflow of the hostname or session ticket. Found by Guido Vranken,
Intelworks.
Fix for IOTSSL-473 Double free error Fix potential double-free in mbedtls_ssl_set_hs_psk(.)
2015-10-04 21:06:51 +00:00
* Fix potential double-free if mbedtls_ssl_set_hs_psk() is called more than
once in the same handhake and mbedtls_ssl_conf_psk() was used.
Changed attribution for Guido Vranken
2015-10-05 09:18:17 +00:00
Found and patch provided by Guido Vranken, Intelworks. Cannot be forced
remotely.
Fix stack buffer overflow in pkcs12
2015-09-28 16:34:48 +00:00
* Fix stack buffer overflow in pkcs12 decryption (used by
mbedtls_pk_parse_key(file)() when the password is > 129 bytes.
Changed attribution for Guido Vranken
2015-10-05 09:18:17 +00:00
Found by Guido Vranken, Intelworks. Not triggerable remotely.
Fix potential buffer overflow in mpi_read_string() Found by Guido Vranken. Two possible integer overflows (during << 2 or addition in BITS_TO_LIMB()) could result in far too few memory to be allocated, then overflowing the buffer in the subsequent for loop. Both integer overflows happen when slen is close to or greater than SIZE_T_MAX >> 2 (ie 2^30 on a 32 bit system). Note: one could also avoid those overflows by changing BITS_TO_LIMB(s << 2) to CHARS_TO_LIMB(s >> 1) but the solution implemented looks more robust with respect to future code changes.
2015-09-28 11:48:04 +00:00
* Fix potential buffer overflow in mbedtls_mpi_read_string().
Changed attribution for Guido Vranken
2015-10-05 09:18:17 +00:00
Found by Guido Vranken, Intelworks. Not exploitable remotely in the context
of TLS, but might be in other uses. On 32 bit machines, requires reading a
string of close to or larger than 1GB to exploit; on 64 bit machines, would
require reading a string of close to or larger than 2^62 bytes.
Merge of IOTSSL-476 - Random malloc in pem_read()
2015-10-04 23:26:36 +00:00
* Fix potential random memory allocation in mbedtls_pem_read_buffer()
Changed attribution for Guido Vranken
2015-10-05 09:18:17 +00:00
on crafted PEM input data. Found and fix provided by Guido Vranken,
Intelworks. Not triggerable remotely in TLS. Triggerable remotely if you
accept PEM data from an untrusted source.
* Fix possible heap buffer overflow in base64_encoded() when the input
buffer is 512MB or larger on 32-bit platforms. Found by Guido Vranken,
Intelworks. Not trigerrable remotely in TLS.
Fix potential double-free in mbedtls_ssl_conf_psk()
2015-09-28 16:09:45 +00:00
* Fix potential double-free if mbedtls_conf_psk() is called repeatedly on
Merge of fix for IOTSSL-481 - Double free Potential double free in mbedtls_ssl_conf_psk()
2015-10-05 09:40:31 +00:00
the same mbedtls_ssl_config object and memory allocation fails. Found by
Guido Vranken, Intelworks. Cannot be forced remotely.
Fix potential overflow in CertificateRequest
2015-10-02 09:16:47 +00:00
* Fix potential heap buffer overflow in servers that perform client
authentication against a crafted CA cert. Cannot be triggered remotely
unless you allow third parties to pick trust CAs for client auth.
Merge fix of IOTSSL-496 - Potential heap overflow Fix for potential overflow in ssl_write_certificate_request()
2015-10-05 10:57:54 +00:00
Found by Guido Vranken, Intelworks.
Fixed copy and paste error Accidental additional assignment in ssl_write_alpn_ext()
2015-09-28 23:31:09 +00:00
Fix compile error in net.c with musl libc fixes #278
2015-10-05 11:16:06 +00:00
Bugfix
* Fix compile error in net.c with musl libc. Found and patch provided by
zhasha (#278).
Fix for #279 macroisation of 'inline' keyword
2015-10-05 14:44:18 +00:00
* Fix macroization of 'inline' keyword when building as C++. (#279)
Fix compile error in net.c with musl libc fixes #278
2015-10-05 11:16:06 +00:00
Fixed copy and paste error Accidental additional assignment in ssl_write_alpn_ext()
2015-09-28 23:31:09 +00:00
Changes
* Added checking of hostname length in mbedtls_ssl_set_hostname() to ensure
domain names are compliant with RFC 1035.
Updated ChangeLog with credit
2015-10-01 00:59:33 +00:00
* Fixed paths for check_config.h in example config files. (Found by bachp)
(#291)
Fixed copy and paste error Accidental additional assignment in ssl_write_alpn_ext()
2015-09-28 23:31:09 +00:00
Reordered TLS extension fields in client Session ticket placed at end
2015-09-29 00:06:06 +00:00
= mbed TLS 2.1.1 released 2015-09-17
Fix bug in benchmark.c with DHM params
2015-07-19 13:01:28 +00:00
Add counter-measure against RSA-CRT attack https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/
2015-09-03 18:03:15 +00:00
Security
* Add countermeasure against Lenstra's RSA-CRT attack for PKCS#1 v1.5
signatures. (Found by Florian Weimer, Red Hat.)
https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/
Fix ChangeLog - misplaced entries
2015-09-09 10:15:13 +00:00
* Fix possible client-side NULL pointer dereference (read) when the client
tries to continue the handshake after it failed (a misuse of the API).
Fix for IOTSSL-473 Double free error Fix potential double-free in mbedtls_ssl_set_hs_psk(.)
2015-10-04 21:06:51 +00:00
(Found and patch provided by Fabian Foerg, Gotham Digital Science using
afl-fuzz.)
Fix ChangeLog - misplaced entries
2015-09-09 10:15:13 +00:00
Updated ChangeLog for fix #275
2015-09-14 20:30:40 +00:00
Bugfix
* Fix warning when using a 64bit platform. (found by embedthis) (#275)
Fix bug in server parsing point formats extension There is only one length byte but for some reason we skipped two, resulting in reading one byte past the end of the extension. Fortunately, even if that extension is at the very end of the ClientHello, it can't be at the end of the buffer since the ClientHello length is at most SSL_MAX_CONTENT_LEN and the buffer has some more room after that for MAC and so on. So there is no buffer overread. Possible consequences are: - nothing, if the next byte is 0x00, which is a comment first byte for other extensions, which is why the bug remained unnoticed - using a point format that was not offered by the peer if next byte is 0x01. In that case the peer will reject our ServerKeyExchange message and the handshake will fail. - thinking that we don't have a common point format even if we do, which will cause us to immediately abort the handshake. None of these are a security issue. The same bug was fixed client-side in fd35af15
2015-09-16 09:32:18 +00:00
* Fix off-by-one error in parsing Supported Point Format extension that
caused some handshakes to fail.
Updated Changelog for new version
2015-09-11 19:00:20 +00:00
Changes
* Made X509 profile pointer const in mbedtls_ssl_conf_cert_profile() to allow
use of mbedtls_x509_crt_profile_next. (found by NWilson)
Update Changelog
2015-09-08 13:12:45 +00:00
* When a client initiates a reconnect from the same port as a live
connection, if cookie verification is available
(MBEDTLS_SSL_DTLS_HELLO_VERIFY defined in config.h, and usable cookie
callbacks set with mbedtls_ssl_conf_dtls_cookies()), this will be
detected and mbedtls_ssl_read() will return
MBEDTLS_ERR_SSL_CLIENT_RECONNECT - it is then possible to start a new
handshake with the same context. (See RFC 6347 section 4.2.8.)
Updated Changelog for new version
2015-09-11 19:00:20 +00:00
Fix ChangeLog - misplaced entries
2015-09-09 10:15:13 +00:00
= mbed TLS 2.1.0 released 2015-09-04
Add counter-measure against RSA-CRT attack https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/
2015-09-03 18:03:15 +00:00
Add support for MBEDTLS_USER_CONFIG_FILE
2015-07-31 13:52:30 +00:00
Features
Add ChangeLog entry about license change
2015-09-04 12:38:26 +00:00
* Added support for yotta as a build system.
* Primary open source license changed to Apache 2.0 license.
Add support for MBEDTLS_USER_CONFIG_FILE
2015-07-31 13:52:30 +00:00
Fix bug in benchmark.c with DHM params
2015-07-19 13:01:28 +00:00
Bugfix
* Fix segfault in the benchmark program when benchmarking DHM.
Fix bug with cmake and old version of GCC
2015-07-19 14:00:04 +00:00
* Fix build error with CMake and pre-4.5 versions of GCC (found by Hugo
Leisink).
Fix bug with extension-less ServerHello https://tls.mbed.org/discussions/bug-report-issues/server-hello-parsing-bug in_hslen include the length of the handshake header. (We might want to change that in the future, as it is a bit annoying.)
2015-07-23 10:14:13 +00:00
* Fix bug when parsing a ServerHello without extensions (found by David
Sears).
Fix bug with install target in make closes #223
2015-07-27 08:36:12 +00:00
* Fix bug in CMake lists that caused libmbedcrypto.a not to be installed
Fix typo in that broke installation in cmake closes #221
2015-07-24 14:53:46 +00:00
(found by Benoit Lecocq).
Fix bug with install target in make closes #223
2015-07-27 08:36:12 +00:00
* Fix bug in Makefile that caused libmbedcrypto and libmbedx509 not to be
installed (found by Rawi666).
Fix compile error with armcc5 --gnu
2015-07-30 20:46:55 +00:00
* Fix compile error with armcc 5 with --gnu option.
Fix Make bug when installing programs
2015-08-03 08:24:05 +00:00
* Fix bug in Makefile that caused programs not to be installed correctly
(found by robotanarchy) (#232).
Fix bug with make install without tests closes #232
2015-08-03 08:34:09 +00:00
* Fix bug in Makefile that prevented from installing without building the
tests (found by robotanarchy) (#232).
Add test build of shared libs for windows
2015-08-07 11:17:23 +00:00
* Fix missing -static-libgcc when building shared libraries for Windows
with make.
* Fix link error when building shared libraries for Windows with make.
Fix error when loading libmbedtls.so
2015-08-10 08:17:32 +00:00
* Fix error when loading libmbedtls.so.
Fix missing break in switch for SSL presets closes #235
2015-08-11 02:21:01 +00:00
* Fix bug in mbedtls_ssl_conf_default() that caused the default preset to
be always used (found by dcb314) (#235)
Fix possible mutex lock/unlock mismatch fixes #257
2015-08-27 09:30:58 +00:00
* Fix bug in mbedtls_rsa_public() and mbedtls_rsa_private() that could
result trying to unlock an unlocked mutex on invalid input (found by
Fredrik Axelsson) (#257)
Merging iotssl-457-badtail with development branch
2015-09-03 12:06:01 +00:00
* Fix -Wshadow warnings (found by hnrkp) (#240)
* Fix memory corruption on client with overlong PSK identity, around
SSL_MAX_CONTENT_LEN or higher - not triggerrable remotely (found by
Aleksandrs Saveljevs) (#238)
* Fix unused function warning when using MBEDTLS_MDx_ALT or
MBEDTLS_SHAxxx_ALT (found by Henrik) (#239)
* Fix memory corruption in pkey programs (found by yankuncheng) (#210)
Fix bug with install target in make closes #223
2015-07-27 08:36:12 +00:00
Accept a trailing space at end of PEM lines With certs being copy-pasted from webmails and all, this will probably become more and more common. closes #226
2015-07-31 09:09:59 +00:00
Changes
* The PEM parser now accepts a trailing space at end of lines (#226).
Add support for MBEDTLS_USER_CONFIG_FILE
2015-07-31 13:52:30 +00:00
* It is now possible to #include a user-provided configuration file at the
end of the default config.h by defining MBEDTLS_USER_CONFIG_FILE on the
compiler's command line.
Changelog entry fro the previous commit
2015-09-01 17:37:32 +00:00
* When verifying a certificate chain, if an intermediate certificate is
trusted, no later cert is checked. (suggested by hannes-landeholm)
(#220).
Merging iotssl-457-badtail with development branch
2015-09-03 12:06:01 +00:00
* Prepend a "thread identifier" to debug messages (issue pointed out by
Hugo Leisink) (#210).
* Add mbedtls_ssl_get_max_frag_len() to query the current maximum fragment
length.
Fix bug in benchmark.c with DHM params
2015-07-19 13:01:28 +00:00
Prepare for 2.0.0 release
2015-07-10 13:09:43 +00:00
= mbed TLS 2.0.0 released 2015-07-13
Update release date and added note
2015-02-16 15:18:33 +00:00
Update Changelog
2014-10-15 13:40:55 +00:00
Features
Update Changelog for session ticket changes
2015-05-25 17:41:37 +00:00
* Support for DTLS 1.0 and 1.2 (RFC 6347).
* Ability to override core functions from MDx, SHAx, AES and DES modules
with custom implementation (eg hardware accelerated), complementing the
ability to override the whole module.
* New server-side implementation of session tickets that rotate keys to
preserve forward secrecy, and allows sharing across multiple contexts.
Update Changelog for the profiles branch
2015-06-17 12:26:49 +00:00
* Added a concept of X.509 cerificate verification profile that controls
which algorithms and key sizes (curves for ECDSA) are acceptable.
* Expanded configurability of security parameters in the SSL module with
mbedtls_ssl_conf_dhm_min_bitlen() and mbedtls_ssl_conf_sig_hashes().
* Introduced a concept of presets for SSL security-relevant configuration
parameters.
Update Changelog
2014-10-15 13:40:55 +00:00
Document previous API changes in this branch
2014-09-17 08:56:54 +00:00
API Changes
Update Changelog for target split
2015-06-25 10:01:16 +00:00
* The library has been split into libmbedcrypto, libmbedx509, libmbedtls.
You now need to link to all of them if you use TLS for example.
Restructure Changelog
2015-04-28 15:56:12 +00:00
* All public identifiers moved to the mbedtls_* or MBEDTLS_* namespace.
Group all renamings together in Changelog
2015-05-06 16:53:08 +00:00
Some names have been further changed to make them more consistent.
Fix #2370, minor typos and spelling mistakes
2019-01-23 14:24:37 +00:00
Migration helpers scripts/rename.pl and include/mbedtls/compat-1.3.h are
Group all renamings together in Changelog
2015-05-06 16:53:08 +00:00
provided. Full list of renamings in scripts/data_files/rename-1.3-2.0.txt
Rename key_length in cipher_info
2015-06-18 13:28:12 +00:00
* Renamings of fields inside structures, not covered by the previous list:
Rename ecp_curve_info.size to bit_size
2015-06-18 13:45:05 +00:00
mbedtls_cipher_info_t.key_length -> key_bitlen
mbedtls_cipher_context_t.key_length -> key_bitlen
mbedtls_ecp_curve_info.size -> bit_size
Restructure Changelog
2015-04-28 15:56:12 +00:00
* Headers are now found in the 'mbedtls' directory (previously 'polarssl').
Split mbedtls_ccm_init() -> setkey()
2015-04-28 16:02:54 +00:00
* The following _init() functions that could return errors have
Fix typos in the Changelog
2015-05-11 07:52:24 +00:00
been split into an _init() that returns void and another function that
Fix order of ssl_conf vs ssl_setup in programs Except ssl_phtread_server that will be done later
2015-05-11 09:25:46 +00:00
should generally be the first function called on this context after init:
Split ssl_init() -> ssl_setup()
2015-04-28 22:48:22 +00:00
mbedtls_ssl_init() -> mbedtls_ssl_setup()
Split mbedtls_ccm_init() -> setkey()
2015-04-28 16:02:54 +00:00
mbedtls_ccm_init() -> mbedtls_ccm_setkey()
Split mbedtls_gcm_init() -> gcm_setkey()
2015-04-28 19:42:17 +00:00
mbedtls_gcm_init() -> mbedtls_gcm_setkey()
Fix typos in the Changelog
2015-05-11 07:52:24 +00:00
mbedtls_hmac_drbg_init() -> mbedtls_hmac_drbg_seed(_buf)()
mbedtls_ctr_drbg_init() -> mbedtls_ctr_drbg_seed()
Fix a fairly common typo in comments
2015-09-25 02:27:22 +00:00
Note that for mbedtls_ssl_setup(), you need to be done setting up the
Fix order of ssl_conf vs ssl_setup in programs Except ssl_phtread_server that will be done later
2015-05-11 09:25:46 +00:00
ssl_config structure before calling it.
Tune Changelog (typos, ordering)
2015-06-02 14:14:15 +00:00
* Most ssl_set_xxx() functions (all except ssl_set_bio(), ssl_set_hostname(),
Update Changelog for recent config split
2015-05-11 07:57:11 +00:00
ssl_set_session() and ssl_set_client_transport_id(), plus
ssl_legacy_renegotiation()) have been renamed to mbedtls_ssl_conf_xxx()
(see rename.pl and compat-1.3.h above) and their first argument's type
changed from ssl_context to ssl_config.
Tune Changelog (typos, ordering)
2015-06-02 14:14:15 +00:00
* ssl_set_bio() changed signature (contexts merged, order switched, one
additional callback for read-with-timeout).
Update Changelog with forgotten change
2015-05-11 08:35:53 +00:00
* The following functions have been introduced and must be used in callback
implementations (SNI, PSK) instead of their *conf counterparts:
mbedtls_ssl_set_hs_own_cert()
mbedtls_ssl_set_hs_ca_chain()
mbedtls_ssl_set_hs_psk()
Update Changelog for recent config split
2015-05-11 07:57:11 +00:00
* mbedtls_ssl_conf_ca_chain() lost its last argument (peer_cn), now set
Move ssl_set_ca_chain() to work on config
2015-05-06 10:14:19 +00:00
using mbedtls_ssl_set_hostname().
Change a few ssl_conf return types to void
2015-05-11 08:11:56 +00:00
* mbedtls_ssl_conf_session_cache() changed prototype (only one context
Merge contexts for session cache
2015-05-06 17:06:26 +00:00
pointer, parameters reordered).
Update Changelog for session ticket changes
2015-05-25 17:41:37 +00:00
* On server, mbedtls_ssl_conf_session_tickets_cb() must now be used in
place of mbedtls_ssl_conf_session_tickets() to enable session tickets.
Change SSL debug API in the library
2015-06-23 14:34:24 +00:00
* The SSL debug callback gained two new arguments (file name, line number).
* Debug modes were removed.
Change a few ssl_conf return types to void
2015-05-11 08:11:56 +00:00
* mbedtls_ssl_conf_truncated_hmac() now returns void.
Tune Changelog (typos, ordering)
2015-06-02 14:14:15 +00:00
* mbedtls_memory_buffer_alloc_init() now returns void.
Change X.509 verify flags to uint32_t
2015-05-11 17:54:43 +00:00
* X.509 verification flags are now an uint32_t. Affect the signature of:
mbedtls_ssl_get_verify_result()
mbedtls_x509_ctr_verify_info()
Tune Changelog (typos, ordering)
2015-06-02 14:14:15 +00:00
mbedtls_x509_crt_verify() (flags, f_vrfy -> needs to be updated)
Change X.509 verify flags to uint32_t
2015-05-11 17:54:43 +00:00
mbedtls_ssl_conf_verify() (f_vrfy -> needs to be updated)
Update changelog for i/o lengths
2015-06-02 15:33:08 +00:00
* The following functions changed prototype to avoid an in-out length
parameter:
mbedtls_base64_encode()
mbedtls_base64_decode()
mbedtls_mpi_write_string()
mbedtls_dhm_calc_secret()
Move from naked int to a structure in net.c Provides more flexibility for future changes/extensions.
2015-06-30 11:34:45 +00:00
* In the NET module, all "int" and "int *" arguments for file descriptors
changed type to "mbedtls_net_context *".
Adapt prototype of net_accept() for explicit size
2015-05-14 19:52:40 +00:00
* net_accept() gained new arguments for the size of the client_ip buffer.
Change mutex_init/free to return void
2015-04-24 12:42:34 +00:00
* In the threading layer, mbedtls_mutex_init() and mbedtls_mutex_free() now
return void.
Fix #2370, minor typos and spelling mistakes
2019-01-23 14:24:37 +00:00
* ecdsa_write_signature() gained an additional md_alg argument and
Merge ecdsa_write_signature{,_det}() together
2015-03-31 09:41:42 +00:00
ecdsa_write_signature_det() was deprecated.
pk_sign() now requires non-NONE md_alg for ECDSA
2015-03-31 09:04:45 +00:00
* pk_sign() no longer accepts md_alg == POLARSSL_MD_NONE with ECDSA.
Update prototype of x509write_set_key_usage() Allow for future support of decipherOnly and encipherOnly. Some work will be required to ensure we still write only one byte when only one is needed.
2015-06-23 09:07:37 +00:00
* Last argument of x509_crt_check_key_usage() and
mbedtls_x509write_crt_set_key_usage() changed from int to unsigned.
Rename test_ca_list to test_cas_pem
2015-03-27 09:23:53 +00:00
* test_ca_list (from certs.h) is renamed to test_cas_pem and is only
available if POLARSSL_PEM_PARSE_C is defined (it never worked without).
* Test certificates in certs.c are no longer guaranteed to be nul-terminated
Add len constants to certs.c
2015-03-27 08:56:18 +00:00
strings; use the new *_len variables instead of strlen().
Fix use of pem_read_buffer() in PK, DHM and X509
2015-05-12 09:20:10 +00:00
* Functions mbedtls_x509_xxx_parse(), mbedtls_pk_parse_key(),
mbedtls_pk_parse_public_key() and mbedtls_dhm_parse_dhm() now expect the
length parameter to include the terminating null byte for PEM input.
Update signature of mpi_mul_mpi()
2015-03-19 12:42:40 +00:00
* Signature of mpi_mul_mpi() changed to make the last argument unsigned
Update ChangeLog for s/malloc/calloc
2015-05-26 15:46:09 +00:00
* calloc() is now used instead of malloc() everywhere. API of platform
layer and the memory_buffer_alloc module changed accordingly.
Remove a few redundant memset after calloc. Using the following semantic patch provided by Mansour Moufid: @@ expression x; @@ x = mbedtls_calloc(...) ... - memset(x, 0, ...);
2015-05-27 14:49:37 +00:00
(Thanks to Mansour Moufid for helping with the replacement.)
Update Changelog with recent changes
2015-03-10 14:02:33 +00:00
* Change SSL_DISABLE_RENEGOTIATION config.h flag to SSL_RENEGOTIATION
(support for renegotiation now needs explicit enabling in config.h).
Split HAVE_TIME into HAVE_TIME + HAVE_TIME_DATE First one means we have time() but it may not return the actual wall clock time, second means it does.
2015-06-18 18:52:58 +00:00
* Split MBEDTLS_HAVE_TIME into MBEDTLS_HAVE_TIME and MBEDTLS_HAVE_TIME_DATE
in config.h
Document previous API changes in this branch
2014-09-17 08:56:54 +00:00
* net_connect() and net_bind() have a new 'proto' argument to choose
between TCP and UDP, using the macros NET_PROTO_TCP or NET_PROTO_UDP.
Make 'port' a string in NET module - avoids dependency on snprintf - allows using "smtps" instead of "456" if desired
2015-06-23 10:30:57 +00:00
Their 'port' argument type is changed to a string.
Restructure Changelog
2015-04-28 15:56:12 +00:00
* Some constness fixes
Removals
Remove ecp_group_read_string()
2015-05-11 16:11:57 +00:00
* Removed mbedtls_ecp_group_read_string(). Only named groups are supported.
Rm ecp_add() and add ecp_muladd()
2015-05-11 16:40:45 +00:00
* Removed mbedtls_ecp_sub() and mbedtls_ecp_add(), use
mbedtls_ecp_muladd().
Remove individual mdX_file() and shaX_file()
2015-05-28 12:56:20 +00:00
* Removed individual mdX_hmac, shaX_hmac, mdX_file and shaX_file functions
(use generic functions from md.h)
* Removed mbedtls_timing_msleep(). Use mbedtls_net_usleep() or a custom
Remove timing_m_sleep() -> net_usleep()
2015-05-14 16:22:47 +00:00
waiting function.
Remove test DHM params from certs.c certs.c belongs to the X.509 library, while DHM belongs to the crypto lib.
2015-06-25 06:52:25 +00:00
* Removed test DHM parameters from the test certs module.
Restructure Changelog
2015-04-28 15:56:12 +00:00
* Removed the PBKDF2 module (use PKCS5).
* Removed POLARSSL_ERROR_STRERROR_BC (use mbedtls_strerror()).
* Removed compat-1.2.h (helper for migrating from 1.2 to 1.3).
* Removed openssl.h (very partial OpenSSL compatibility layer).
* Configuration options POLARSSL_HAVE_LONGLONG was removed (now always on).
* Configuration options POLARSSL_HAVE_INT8 and POLARSSL_HAVE_INT16 have
been removed (compiler is required to support 32-bit operations).
* Configuration option POLARSSL_HAVE_IPV6 was removed (always enabled).
* Removed test program o_p_test, the script compat.sh does more.
* Removed test program ssl_test, superseded by ssl-opt.sh.
* Removed helper script active-config.pl
Remove redundant sig_oid2 in x509 structures
2015-03-27 15:30:47 +00:00
New deprecations
* md_init_ctx() is deprecated in favour of md_setup(), that adds a third
argument (allowing memory savings if HMAC is not used)
Document previous API changes in this branch
2014-09-17 08:56:54 +00:00
Remove redundant sig_oid2 in x509 structures
2015-03-27 15:30:47 +00:00
Semi-API changes (technically public, morally private)
Rename _wrap headers to _internal Makes it clearer that the user is not supposed to include them
2015-05-26 09:04:15 +00:00
* Renamed a few headers to include _internal in the name. Those headers are
not supposed to be included by users.
Make pk_info_t opaque
2015-03-31 12:43:19 +00:00
* Changed md_info_t into an opaque structure (use md_get_xxx() accessors).
* Changed pk_info_t into an opaque structure.
Rename _wrap headers to _internal Makes it clearer that the user is not supposed to include them
2015-05-26 09:04:15 +00:00
* Changed cipher_base_t into an opaque structure.
* Removed sig_oid2 and rename sig_oid1 to sig_oid in x509_crt and x509_crl.
Move key_usage to more that 8 bits
2015-03-27 15:50:00 +00:00
* x509_crt.key_usage changed from unsigned char to unsigned int.
Rename _wrap headers to _internal Makes it clearer that the user is not supposed to include them
2015-05-26 09:04:15 +00:00
* Removed r and s from ecdsa_context
* Removed mode from des_context and des3_context
Remove redundant sig_oid2 in x509 structures
2015-03-27 15:30:47 +00:00
Re-section ChangeLog
2015-03-27 16:13:17 +00:00
Default behavior changes
Change default min TLS version to TLS 1.0
2015-03-31 12:21:11 +00:00
* The default minimum TLS version is now TLS 1.0.
Re-section ChangeLog
2015-03-27 16:13:17 +00:00
* RC4 is now blacklisted by default in the SSL/TLS layer, and excluded from the
default ciphersuite list returned by ssl_list_ciphersuites()
Update Changelog with recent changes
2015-03-10 14:02:33 +00:00
* Support for receiving SSLv2 ClientHello is now disabled by default at
compile time.
Change authmode default to Required on client
2015-03-27 16:52:25 +00:00
* The default authmode for SSL/TLS clients is now REQUIRED.
Make RSA_ALT support optionnal
2015-03-31 12:01:33 +00:00
* Support for RSA_ALT contexts in the PK layer is now optional. Since is is
enabled in the default configuration, this is only noticeable if using a
custom config.h
Upgrade default DHM params size
2015-05-06 16:33:07 +00:00
* Default DHM parameters server-side upgraded from 1024 to 2048 bits.
Update Changelog for the profiles branch
2015-06-17 12:26:49 +00:00
* A minimum RSA key size of 2048 bits is now enforced during ceritificate
chain verification.
Disable truncated HMAC by default
2015-05-06 16:39:23 +00:00
* Negotiation of truncated HMAC is now disabled by default on server too.
Avoid non-standard strcasecmp()
2015-05-28 15:06:07 +00:00
* The following functions are now case-sensitive:
mbedtls_cipher_info_from_string()
mbedtls_ecp_curve_info_from_name()
mbedtls_md_info_from_string()
mbedtls_ssl_ciphersuite_from_string()
mbedtls_version_check_feature()
Re-section ChangeLog
2015-03-27 16:13:17 +00:00
Remove ecp_group_read_string()
2015-05-11 16:11:57 +00:00
Requirement changes
Just use stdint.h even with MSVC
2015-04-15 09:53:16 +00:00
* The minimum MSVC version required is now 2010 (better C99 support).
net.c now depends on select() unconditionally
2015-05-14 16:58:17 +00:00
* The NET layer now unconditionnaly relies on getaddrinfo() and select().
Update changelog
2015-05-06 16:08:54 +00:00
* Compiler is required to support C99 types such as long long and uint32_t.
Update Changelog with recent changes
2015-03-10 14:02:33 +00:00
Change a few ssl_conf return types to void
2015-05-11 08:11:56 +00:00
API changes from the 1.4 preview branch
Rename ssl_set_bio_timeout() to set_bio() Initially thought it was best to keep the old function around and add a new one, but this so many ssl_set_xxx() functions are changing anyway...
2015-05-06 14:54:23 +00:00
* ssl_set_bio_timeout() was removed, split into mbedtls_ssl_set_bio() with
new prototype, and mbedtls_ssl_set_read_timeout().
Change a few ssl_conf return types to void
2015-05-11 08:11:56 +00:00
* The following functions now return void:
mbedtls_ssl_conf_transport()
mbedtls_ssl_conf_max_version()
mbedtls_ssl_conf_min_version()
Update Changelog for recent timer changes
2015-05-13 08:28:41 +00:00
* DTLS no longer hard-depends on TIMING_C, but uses a callback interface
instead, see mbedtls_ssl_set_timer_cb(), with the Timing module providing
an example implementation, see mbedtls_timing_delay_context and
mbedtls_timing_set/get_delay().
Simplify net_accept() with UDP sockets This is made possible by the new API where net_accept() gets a pointer to bind_ctx, so it can update it.
2015-06-30 23:28:24 +00:00
* With UDP sockets, it is no longer necessary to call net_bind() again
after a successful net_accept().
Rename ssl_set_bio_timeout() to set_bio() Initially thought it was best to keep the old function around and add a new one, but this so many ssl_set_xxx() functions are changing anyway...
2015-05-06 14:54:23 +00:00
Make xxx_drbg_random() thread-safe
2015-05-07 11:50:31 +00:00
Changes
* mbedtls_ctr_drbg_random() and mbedtls_hmac_drbg_random() are now
thread-safe if MBEDTLS_THREADING_C is enabled.
Update Changelog for the profiles branch
2015-06-17 12:26:49 +00:00
* Reduced ROM fooprint of SHA-256 and added an option to reduce it even
more (at the expense of performance) MBEDTLS_SHA256_SMALLER.
Make xxx_drbg_random() thread-safe
2015-05-07 11:50:31 +00:00
Prepare Changelog for 1.3 branch development This is meant to minimize/simplify merge conflict between topic branches.
2015-02-10 10:09:37 +00:00
= mbed TLS 1.3 branch
Security
Make results of (ext)KeyUsage accessible
2015-04-17 14:55:53 +00:00
* With authmode set to SSL_VERIFY_OPTIONAL, verification of keyUsage and
manually merge 9f98251 make extKeyUsage accessible
2015-04-20 10:01:48 +00:00
extendedKeyUsage on the leaf certificate was lost (results not accessible
via ssl_get_verify_results()).
Add countermeasure against cache-based lucky 13
2015-04-28 23:35:48 +00:00
* Add countermeasure against "Lucky 13 strikes back" cache-based attack,
https://dl.acm.org/citation.cfm?id=2714625
Prepare Changelog for 1.3 branch development This is meant to minimize/simplify merge conflict between topic branches.
2015-02-10 10:09:37 +00:00
Features
Update Changelog for recent contribution
2015-05-11 19:05:36 +00:00
* Improve ECC performance by using more efficient doubling formulas
(contributed by Peter Dettman).
Add x509_crt_verify_info()
2015-04-17 14:14:32 +00:00
* Add x509_crt_verify_info() to display certificate verification results.
Update Changelog for DH params
2015-04-15 12:12:05 +00:00
* Add support for reading DH parameters with privateValueLength included
Fix typo in contributor name (oops!)
2015-04-17 14:16:52 +00:00
(contributed by Daniel Kahn Gillmor).
Add test certificate for bitstring in DN
2015-03-27 12:09:21 +00:00
* Add support for bit strings in X.509 names (request by Fredrik Axelsson).
* Add support for id-at-uniqueIdentifier in X.509 names.
Update Changelog for portability improvements
2015-02-13 15:14:10 +00:00
* Add support for overriding snprintf() (except on Windows) and exit() in
the platform layer.
* Add an option to use macros instead of function pointers in the platform
layer (helps get rid of unwanted references).
Document changes to make for windows
2015-02-16 15:42:16 +00:00
* Improved Makefiles for Windows targets by fixing library targets and making
cross-compilation easier (thanks to Alon Bar-Lev).
Update Changelog for the mem-measure branch
2015-02-16 17:45:35 +00:00
* The benchmark program also prints heap usage for public-key primitives
if POLARSSL_MEMORY_BUFFER_ALLOC_C and POLARSSL_MEMORY_DEBUG are defined.
* New script ecc-heap.sh helps measuring the impact of ECC parameters on
speed and RAM (heap only for now) usage.
* New script memory.sh helps measuring the ROM and RAM requirements of two
reduced configurations (PSK-CCM and NSA suite B).
Official deprecate compat-1.2.h and openssl.h
2015-04-09 12:10:26 +00:00
* Add config flag POLARSSL_DEPRECATED_WARNING (off by default) to produce
Update Changelog for deprecation config flags
2015-03-23 13:20:04 +00:00
warnings on use of deprecated functions (with GCC and Clang only).
Official deprecate compat-1.2.h and openssl.h
2015-04-09 12:10:26 +00:00
* Add config flag POLARSSL_DEPRECATED_REMOVED (off by default) to produce
Update Changelog for deprecation config flags
2015-03-23 13:20:04 +00:00
errors on use of deprecated functions.
Prepare Changelog for 1.3 branch development This is meant to minimize/simplify merge conflict between topic branches.
2015-02-10 10:09:37 +00:00
Bugfix
Fix compile errors with NO_STD_FUNCTIONS
2015-06-03 09:20:33 +00:00
* Fix compile errors with PLATFORM_NO_STD_FUNCTIONS.
Ack external bugfix in Changelog
2015-06-03 08:50:07 +00:00
* Fix compile error with PLATFORM_EXIT_ALT (thanks to Rafał Przywara).
FIx misplaced Changelog entry (oops)
2015-06-03 08:48:26 +00:00
* Fix bug in entropy.c when THREADING_C is also enabled that caused
entropy_free() to crash (thanks to Rafał Przywara).
Manually merge 1.3 changelog
2015-05-27 15:59:46 +00:00
* Fix memory leak when gcm_setkey() and ccm_setkey() are used more than
once on the same context.
fix bug in ssl_mail_client
2015-04-30 10:50:22 +00:00
* Fix bug in ssl_mail_client when password is longer that username (found
by Bruno Pape).
Fix undefined behaviour in x509
2015-04-30 09:15:22 +00:00
* Fix undefined behaviour (memcmp( NULL, NULL, 0 );) in X.509 modules
(detected by Clang's 3.6 UBSan).
Fix missing NULL check in MPI
2015-04-29 15:02:01 +00:00
* mpi_size() and mpi_msb() would segfault when called on an mpi that is
initialized but not set (found by pravic).
Fix detection of getrandom()
2015-04-29 12:03:28 +00:00
* Fix detection of support for getrandom() on Linux (reported by syzzer) by
doing it at runtime (using uname) rather that compile time.
Fix "make install" handling of symlinks
2015-04-29 07:58:00 +00:00
* Fix handling of symlinks by "make install" (found by Gaël PORTAY).
Fix potential NULL dereference on bad usage
2015-04-15 17:09:03 +00:00
* Fix potential NULL pointer dereference (not trigerrable remotely) when
ssl_write() is called before the handshake is finished (introduced in
1.3.10) (first reported by Martin Blumenstingl).
Fix bug in pk_parse_key()
2015-04-14 09:18:04 +00:00
* Fix bug in pk_parse_key() that caused some valid private EC keys to be
rejected.
Fix bug in Via Padlock support
2015-04-02 09:46:55 +00:00
* Fix bug in Via Padlock support (found by Nikos Mavrogiannopoulos).
Fix thread safety issue in RSA operations The race was due to mpi_exp_mod storing a Montgomery coefficient in the context (RM, RP, RQ). The fix was verified with -fsanitize-thread using ssl_pthread_server and two concurrent clients. A more fine-grained fix should be possible, locking just enough time to check if those values are OK and set them if not, rather than locking for the whole mpi_exp_mod() operation, but it will be for later.
2015-03-27 14:06:07 +00:00
* Fix thread safety bug in RSA operations (found by Fredrik Axelsson).
Fix hardclock() with mingw64
2015-02-11 11:35:58 +00:00
* Fix hardclock() (only used in the benchmarking program) with some
versions of mingw64 (found by kxjhlele).
Fix harmless warnings with mingw in timing.c
2015-02-11 11:36:31 +00:00
* Fix warnings from mingw64 in timing.c (found by kxjklele).
Fix potential signedness issue
2015-02-13 17:15:18 +00:00
* Fix potential unintended sign extension in asn1_get_len() on 64-bit
platforms.
Update Changelog
2015-02-18 10:11:06 +00:00
* Fix potential memory leak in ssl_set_psk() (found by Mansour Moufid).
Fix compile error with renego disabled
2015-03-10 16:09:08 +00:00
* Fix compile error when POLARSSL_SSL_DISABLE_RENEGOTATION and
POLARSSL_SSL_SSESSION_TICKETS where both enabled in config.h (introduced
in 1.3.10).
Add missing extern "C" guard in aesni.h
2015-03-10 16:12:29 +00:00
* Add missing extern "C" guard in aesni.h (reported by amir zamani).
Add missing depends in x509 programs
2015-03-31 13:13:29 +00:00
* Add missing dependency on SHA-256 in some x509 programs (reported by
Gergely Budai).
Fix bug with ssl_set_curves() check on client
2015-04-03 15:26:50 +00:00
* Fix bug related to ssl_set_curves(): the client didn't check that the
curve picked by the server was actually allowed.
Prepare Changelog for 1.3 branch development This is meant to minimize/simplify merge conflict between topic branches.
2015-02-10 10:09:37 +00:00
Changes
Update Changelog for recent merge
2015-04-15 12:20:14 +00:00
* Remove bias in mpi_gen_prime (contributed by Pascal Junod).
* Remove potential sources of timing variations (some contributed by Pascal
Junod).
Deprecate HAVE_INT8 and HAVE_INT16
2015-04-09 12:51:51 +00:00
* Options POLARSSL_HAVE_INT8 and POLARSSL_HAVE_INT16 are deprecated.
Deprecate using NET_C without HAVE_IPV6
2015-04-09 12:40:46 +00:00
* Enabling POLARSSL_NET_C without POLARSSL_HAVE_IPV6 is deprecated.
Official deprecate compat-1.2.h and openssl.h
2015-04-09 12:10:26 +00:00
* compat-1.2.h and openssl.h are deprecated.
Fix typos in Changelog
2015-04-15 09:14:22 +00:00
* Adjusting/overriding CFLAGS and LDFLAGS with the make build system is now
Document recent make changes
2015-03-13 13:49:26 +00:00
more flexible (warning: OFLAGS is not used any more) (see the README)
(contributed by Alon Bar-Lev).
Fix typos in Changelog
2015-04-15 09:14:22 +00:00
* ssl_set_own_cert() no longer calls pk_check_pair() since the
Stop checking key-cert match systematically
2015-03-10 15:35:29 +00:00
performance impact was bad for some users (this was introduced in 1.3.10).
Move from SHA-1 to SHA-256 as default in programs
2015-02-10 10:47:03 +00:00
* Move from SHA-1 to SHA-256 in example programs using signatures
(suggested by Thorsten Mühlfelder).
Update Changelog for the cleanup branch
2015-02-10 11:41:57 +00:00
* Remove some unneeded inclusions of header files from the standard library
"minimize" others (eg use stddef.h if only size_t is needed).
* Change #include lines in test files to use double quotes instead of angle
brackets for uniformity with the rest of the code.
Update Changelog for portability improvements
2015-02-13 15:14:10 +00:00
* Remove dependency on sscanf() in X.509 parsing modules.
Update Changelog for FALLBACK_SCSV
2014-10-20 12:56:56 +00:00
Prepare for mbed TLS 1.3.10 release
2015-02-08 14:49:54 +00:00
= mbed TLS 1.3.10 released 2015-02-09
Fix NULL dereference in buffer-based allocator
2014-11-26 14:42:16 +00:00
Security
* NULL pointer dereference in the buffer-based allocator when the buffer is
Fix misattribution
2015-01-28 14:02:38 +00:00
full and polarssl_free() is called (found by Mark Hasemeyer)
Fix NULL dereference in buffer-based allocator
2014-11-26 14:42:16 +00:00
(only possible if POLARSSL_MEMORY_BUFFER_ALLOC_C is enabled, which it is
not by default).
Fix uninitialised pointer dereference
2014-11-11 21:17:26 +00:00
* Fix remotely-triggerable uninitialised pointer dereference caused by
Fix potential stack overflow
2014-11-12 00:25:31 +00:00
crafted X.509 certificate (TLS server is not affected if it doesn't ask for a
Fix uninitialised pointer dereference
2014-11-11 21:17:26 +00:00
client certificate) (found using Codenomicon Defensics).
Fix memory leak with crafted X.509 certs
2014-11-11 22:11:16 +00:00
* Fix remotely-triggerable memory leak caused by crafted X.509 certificates
Fix potential stack overflow
2014-11-12 00:25:31 +00:00
(TLS server is not affected if it doesn't ask for a client certificate)
(found using Codenomicon Defensics).
* Fix potential stack overflow while parsing crafted X.509 certificates
(TLS server is not affected if it doesn't ask for a client certificate)
Fix memory leak with crafted X.509 certs
2014-11-11 22:11:16 +00:00
(found using Codenomicon Defensics).
Fix potential timing issue in RSA pms handling
2015-02-06 10:30:58 +00:00
* Fix timing difference that could theoretically lead to a
Bleichenbacher-style attack in the RSA and RSA-PSK key exchanges
(reported by Sebastian Schinzel).
Fix uninitialised pointer dereference
2014-11-11 21:17:26 +00:00
Update ChangeLog for pk_check_pair() & Co
2014-11-08 16:58:24 +00:00
Features
Fix typos/cosmetics in Changelog
2015-01-14 15:59:23 +00:00
* Add support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv).
* Add support for Extended Master Secret (draft-ietf-tls-session-hash).
* Add support for Encrypt-then-MAC (RFC 7366).
Update ChangeLog for pk_check_pair() & Co
2014-11-08 16:58:24 +00:00
* Add function pk_check_pair() to test if public and private keys match.
Split x509_crl_parse_der() out of x509_crl_parse()
2014-11-19 15:58:28 +00:00
* Add x509_crl_parse_der().
Set a compile-time limit to X.509 chain length
2014-11-20 15:34:20 +00:00
* Add compile-time option POLARSSL_X509_MAX_INTERMEDIATE_CA to limit the
length of an X.509 verification chain.
Update Changelog for compile-option renegotiation
2014-11-04 18:57:55 +00:00
* Support for renegotiation can now be disabled at compile-time
Add tests for CBC record splitting
2015-01-08 10:15:09 +00:00
* Support for 1/n-1 record splitting, a countermeasure against BEAST.
Fixed typos
2015-04-14 13:00:09 +00:00
* Certificate selection based on signature hash, preferring SHA-1 over SHA-2
Prefer SHA-1 certificates for pre-1.2 clients
2015-01-08 15:43:07 +00:00
for pre-1.2 clients when multiple certificates are available.
Add support for getrandom()
2015-01-09 13:34:13 +00:00
* Add support for getrandom() syscall on recent Linux kernels with Glibc or
a compatible enough libc (eg uClibc).
Fix typos/cosmetics in Changelog
2015-01-14 15:59:23 +00:00
* Add ssl_set_arc4_support() to make it easier to disable RC4 at runtime
Add ssl_set_arc4_support() Rationale: if people want to disable RC4 but otherwise keep the default suite list, it was cumbersome. Also, since it uses a global array, ssl_list_ciphersuite() is not a convenient place. So the SSL modules look like the best place, even if it means temporarily adding one SSL setting.
2015-01-12 12:43:29 +00:00
while using the default ciphersuite list.
Add debug info for cert/suite selection
2015-01-26 11:17:20 +00:00
* Added new error codes and debug messages about selection of
ciphersuite/certificate.
Fix NULL dereference in buffer-based allocator
2014-11-26 14:42:16 +00:00
Fix missing bound check
2014-11-25 16:41:50 +00:00
Bugfix
* Stack buffer overflow if ctr_drbg_update() is called with too large
add_len (found by Jean-Philippe Aumasson) (not triggerable remotely).
Fix len miscalculation in buffer-based allocator
2014-11-27 12:57:42 +00:00
* Possible buffer overflow of length at most POLARSSL_MEMORY_ALIGN_MULTIPLE
if memory_buffer_alloc_init() was called with buf not aligned and len not
Fix typos/cosmetics in Changelog
2015-01-14 15:59:23 +00:00
a multiple of POLARSSL_MEMORY_ALIGN_MULTIPLE (not triggerable remotely).
* User set CFLAGS were ignored by Cmake with gcc (introduced in 1.3.9, found
Fix CFLAGS with cmake and gcc
2014-11-10 11:15:39 +00:00
by Julian Ospald).
Fix potential undefined behaviour in Camellia
2014-11-10 12:05:43 +00:00
* Fix potential undefined behaviour in Camellia.
Fix ECDSA sign buffer size
2014-11-10 12:43:55 +00:00
* Fix potential failure in ECDSA signatures when POLARSSL_ECP_MAX_BITS is a
multiple of 8 (found by Gergely Budai).
Fix unchecked error code on Windows
2015-01-23 17:50:34 +00:00
* Fix unchecked return code in x509_crt_parse_path() on Windows (found by
Peter Vaskovic).
Update Changelog
2015-01-19 17:16:54 +00:00
* Fix assembly selection for MIPS64 (thanks to James Cowgill).
Fix bug in ssl_get_verify_result()
2015-01-23 14:30:57 +00:00
* ssl_get_verify_result() now works even if the handshake was aborted due
to a failed verification (found by Fredrik Axelsson).
Re-categorize changelog entry
2015-01-28 14:13:30 +00:00
* Skip writing and parsing signature_algorithm extension if none of the
key exchanges enabled needs certificates. This fixes a possible interop
issue with some servers when a zero-length extension was sent. (Reported
by Peter Dettman.)
Add attribution
2015-02-02 09:30:45 +00:00
* On a 0-length input, base64_encode() did not correctly set output length
(found by Hendrik van den Boogaard).
Fix CFLAGS with cmake and gcc
2014-11-10 11:15:39 +00:00
Use seq_num as AEAD nonce by default
2014-10-29 21:29:20 +00:00
Changes
* Use deterministic nonces for AEAD ciphers in TLS by default (possible to
switch back to random with POLARSSL_SSL_AEAD_RANDOM_IV in config.h).
Blind RSA operations even without CRT
2014-11-06 17:15:12 +00:00
* Blind RSA private operations even when POLARSSL_RSA_NO_CRT is defined.
Update ChangeLog for pk_check_pair() & Co
2014-11-08 16:58:24 +00:00
* ssl_set_own_cert() now returns an error on key-certificate mismatch.
Forbid repeated X.509 extensions
2014-11-12 16:47:28 +00:00
* Forbid repeated extensions in X.509 certificates.
Add text view to debug_print_buf()
2014-11-19 09:17:21 +00:00
* debug_print_buf() now prints a text view in addition to hexadecimal.
Specific error for suites in common but none good
2015-01-08 16:06:16 +00:00
* A specific error is now returned when there are ciphersuites in common
but none of them is usable due to external factors such as no certificate
Merge smarter certificate selection for pre-TLS-1.2 clients
2015-01-14 15:12:48 +00:00
with a suitable (extended)KeyUsage or curve or no PSK set.
Fix typos/cosmetics in Changelog
2015-01-14 15:59:23 +00:00
* It is now possible to disable negotiation of truncated HMAC server-side
Make truncated hmac a runtime option server-side Reading the documentation of ssl_set_truncated_hmac() may give the impression I changed the default for clients but I didn't, the old documentation was wrong.
2015-01-09 11:39:35 +00:00
at runtime with ssl_set_truncated_hmac().
Merge new security defaults for programs (RC4 disabled, SSL3 disabled)
2015-01-14 15:26:54 +00:00
* Example programs for SSL client and server now disable SSLv3 by default.
* Example programs for SSL client and server now disable RC4 by default.
Update Changelog
2015-01-19 16:24:23 +00:00
* Use platform.h in all test suites and programs.
Fix missing bound check
2014-11-25 16:41:50 +00:00
Prepare for release 1.3.9
2014-10-20 11:56:15 +00:00
= PolarSSL 1.3.9 released 2014-10-20
Fix selection of hash from sig_alg ClientHello ext.
2014-08-21 17:38:32 +00:00
Security
* Lowest common hash was selected from signature_algorithms extension in
TLS 1.2 (found by Darren Bane) (introduced in 1.3.8).
Fix memory leak while parsing some X.509 certs
2014-10-17 10:41:41 +00:00
* Remotely-triggerable memory leak when parsing some X.509 certificates
Fix typos in ChangeLog
2014-10-20 11:37:51 +00:00
(server is not affected if it doesn't ask for a client certificate)
(found using Codenomicon Defensics).
Fix memory leak with crafted ClientHello
2014-10-17 10:42:11 +00:00
* Remotely-triggerable memory leak when parsing crafted ClientHello
Fix typos in ChangeLog
2014-10-20 11:37:51 +00:00
(not affected if ECC support was compiled out) (found using Codenomicon
Defensics).
Fix selection of hash from sig_alg ClientHello ext.
2014-08-21 17:38:32 +00:00
Support escaping of commas in x509_string_to_names()
2014-08-08 10:22:30 +00:00
Bugfix
* Support escaping of commas in x509_string_to_names()
Fix compile error in ssl_pthread_server
2014-07-11 23:27:34 +00:00
* Fix compile error in ssl_pthread_server (found by Julian Ospald).
Fix non-blocking sockets in net_accept()
2014-07-21 11:42:54 +00:00
* Fix net_accept() regarding non-blocking sockets (found by Luca Pesce).
Don't print uninitialized buffer in ssl_mail_client
2014-07-21 11:55:54 +00:00
* Don't print uninitialised buffer in ssl_mail_client (found by Marc Abel).
Update Changelog for the last few commits
2014-07-21 12:18:17 +00:00
* Fix warnings from Clang's scan-build (contributed by Alfred Klomp).
Do no test net_usleep() when not defined
2014-07-21 15:37:01 +00:00
* Fix compile error in timing.c when POLARSSL_NET_C and POLARSSL_SELFTEST
are defined but not POLARSSL_HAVE_TIME (found by Stephane Di Vito).
Rm reference to non-existent file in VS projects
2014-07-21 16:15:22 +00:00
* Remove non-existent file from VS projects (found by Peter Vaskovic).
ssl_read() stops returning non-application data
2014-08-19 10:28:50 +00:00
* ssl_read() could return non-application data records on server while
renegotation was pending, and on client when a HelloRequest was received.
Fix server-initiated renego with non-blocking I/O
2014-08-15 17:04:47 +00:00
* Server-initiated renegotiation would fail with non-blocking I/O if the
write callback returned WANT_WRITE when requesting renegotiation.
Fix bug with ssl_close_notify and non-blocking I/O
2014-08-19 14:14:04 +00:00
* ssl_close_notify() could send more than one message in some circumstances
with non-blocking I/O.
Added explicit casts to prevent compiler warnings when trying to build for iOS
2014-08-16 10:45:52 +00:00
* Fix compiler warnings on iOS (found by Sander Niemeijer).
x509_crt_parse() did not increase total_failed on PEM error Result was that PEM errors in files with multiple certificates were not detectable by the user.
2014-09-26 12:53:04 +00:00
* x509_crt_parse() did not increase total_failed on PEM error
Fix compile error with armcc in mpi_is_prime()
2014-10-14 18:56:02 +00:00
* Fix compile error with armcc in mpi_is_prime()
Fix potential bad read of length
2014-10-17 15:02:10 +00:00
* Fix potential bad read in parsing ServerHello (found by Adrien
Vialletelle).
Support escaping of commas in x509_string_to_names()
2014-08-08 10:22:30 +00:00
SHA-2 ciphersuites now require TLS 1.x
2014-07-13 12:43:28 +00:00
Changes
* Ciphersuites using SHA-256 or SHA-384 now require TLS 1.x (there is no
standard defining how to use SHA-2 with SSL 3.0).
RSA-PSK key exchange requires TLS 1.x It's not clear if, with SSL3, one should include send the two length bytes for EncryptedPreMasterSecret or not, so require TLS to avoid interop issues.
2014-07-13 14:16:44 +00:00
* Ciphersuites using RSA-PSK key exchange new require TLS 1.x (the spec is
ambiguous on how to encode some packets with SSL 3.0).
Fix buffer size in pk_write_*_pem()
2014-07-21 14:37:15 +00:00
* Made buffer size in pk_write_(pub)key_pem() more dynamic, eg smaller if
RSA is disabled, larger if POLARSSL_MPI_MAX_SIZE is larger.
ssl_read() stops returning non-application data
2014-08-19 10:28:50 +00:00
* ssl_read() now returns POLARSSL_ERR_NET_WANT_READ rather than
POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE on harmless alerts.
Increase MPI_MAX_BYTES to allow RSA 8192
2014-09-08 15:03:50 +00:00
* POLARSSL_MPI_MAX_SIZE now defaults to 1024 in order to allow 8192 bits
RSA keys.
Accept spaces at end of line/buffer in base64
2014-10-15 19:45:39 +00:00
* Accept spaces at end of line or end of buffer in base64_decode().
Fix memory leak while parsing some X.509 certs
2014-10-17 10:41:41 +00:00
* X.509 certificates with more than one AttributeTypeAndValue per
RelativeDistinguishedName are not accepted any more.
SHA-2 ciphersuites now require TLS 1.x
2014-07-13 12:43:28 +00:00
Fix release date for 1.3.8
2014-07-11 09:28:56 +00:00
= PolarSSL 1.3.8 released 2014-07-11
Fix length checking for AEAD ciphersuites
2014-06-17 08:54:17 +00:00
Security
* Fix length checking for AEAD ciphersuites (found by Codenomicon).
It was possible to crash the server (and client) using crafted messages
when a GCM suite was chosen.
Updated ChangeLog for CCM
2014-05-22 13:45:03 +00:00
Features
* Add CCM module and cipher mode to Cipher Layer
* Support for CCM and CCM_8 ciphersuites
Update Changelog for RSASSA-PSS in X.509
2014-06-06 16:10:44 +00:00
* Support for parsing and verifying RSASSA-PSS signatures in the X.509
modules (certificates, CRLs and CSRs).
Blowfish accepts variable key len in cipher layer
2014-06-23 10:10:59 +00:00
* Blowfish in the cipher layer now supports variable length keys.
Update Changelog for example configs changes
2014-06-24 15:33:54 +00:00
* Add example config.h for PSK with CCM, optimized for low RAM usage.
* Optimize for RAM usage in example config.h for NSA Suite B profile.
Add POLARSSL_REMOVE_RC4_CIPHERSUITES
2014-06-24 20:42:34 +00:00
* Add POLARSSL_REMOVE_ARC4_CIPHERSUITES to allow removing RC4 ciphersuites
from the default list (inactive by default).
Update ChangeLog
2014-07-04 13:00:12 +00:00
* Add server-side enforcement of sent renegotiation requests
(ssl_set_renegotiation_enforced())
Add SSL_CIPHERSUITES config option
2014-06-30 15:59:55 +00:00
* Add SSL_CIPHERSUITES config.h flag to allow specifying a list of
ciphersuites to use and save some memory if the list is small.
Updated ChangeLog for CCM
2014-05-22 13:45:03 +00:00
Add LINK_WITH_PTHREAD to ChangeLog
2014-06-12 19:49:01 +00:00
Changes
* Add LINK_WITH_PTHREAD option in CMake for explicit linking that is
required on some platforms (e.g. OpenBSD)
Introduce polarssl_zeroize() instead of memset() for zeroization
2014-06-13 15:20:13 +00:00
* Migrate zeroizing of data to polarssl_zeroize() instead of memset()
against unwanted compiler optimizations
md_list() starting with strongest hash
2014-07-07 12:02:33 +00:00
* md_list() now returns hashes strongest first
Change selection of hash algorithm for TLS 1.2
2014-07-08 10:56:25 +00:00
* Selection of hash for signing ServerKeyExchange in TLS 1.2 now picks
strongest offered by client.
Updated ChangeLog
2014-07-01 13:59:04 +00:00
* All public contexts have _init() and _free() functions now for simpler
usage pattern
Add LINK_WITH_PTHREAD to ChangeLog
2014-06-12 19:49:01 +00:00
Fix typo in debug_print_msg()
2014-05-06 08:29:28 +00:00
Bugfix
* Fix in debug_print_msg()
Fix typos
2014-05-22 13:47:58 +00:00
* Enforce alignment in the buffer allocator even if buffer is not aligned
Updated ChangeLog
2014-05-22 13:06:41 +00:00
* Remove less-than-zero checks on unsigned numbers
Stricter check on SSL ClientHello internal sizes compared to actual packet size
2014-05-22 13:12:19 +00:00
* Stricter check on SSL ClientHello internal sizes compared to actual packet
size (found by TrustInSoft)
Update ChangeLog for external fixes
2014-06-12 19:46:13 +00:00
* Fix WSAStartup() return value check (found by Peter Vaskovic)
* Other minor issues (found by Peter Vaskovic)
* Fix symlink command for cross compiling with CMake (found by Andre
Heinecke)
Fix DER output of gen_key app (found by Gergely Budai)
2014-06-13 15:37:46 +00:00
* Fix DER output of gen_key app (found by Gergely Budai)
Fix SSL_BUFFER_LEN
2014-06-18 21:11:34 +00:00
* Very small records were incorrectly rejected when truncated HMAC was in
Fix computation of minlen for encrypted packets
2014-06-18 14:06:02 +00:00
use with some ciphersuites and versions (RC4 in all versions, CBC with
versions < TLS 1.1).
Fix SSL_BUFFER_LEN
2014-06-18 21:11:34 +00:00
* Very large records using more than 224 bytes of padding were incorrectly
rejected with CBC-based ciphersuites and TLS >= 1.1
* Very large records using less padding could cause a buffer overread of up
to 32 bytes with CBC-based ciphersuites and TLS >= 1.1
Restore ability to use v1 CA if trusted locally
2014-06-19 10:18:08 +00:00
* Restore ability to use a v1 cert as a CA if trusted locally. (This had
been removed in 1.3.6.)
Restore ability to trust non-CA selfsigned EE cert
2014-06-24 09:49:16 +00:00
* Restore ability to locally trust a self-signed cert that is not a proper
CA for use as an end entity certificate. (This had been removed in
1.3.6.)
Fix preprocessor checks for bn_mul PPC asm On OS X, neither __powerpc__ nor __ppc__ is defined on PPC64, so the asm code was only being used on PPC32.
2014-05-06 06:26:13 +00:00
* Fix preprocessor checks for bn_mul PPC asm (found by Barry K. Nathan).
Fix asm format of bn_mul.h for more portability Found by Barry K. Nathan. Quoting from http://gcc.gnu.org/onlinedocs/gcc/Extended-Asm.html: "You can put multiple assembler instructions together in a single asm template, separated by the characters normally used in assembly code for the system. A combination that works in most places is a newline to break the line, plus a tab character to move to the instruction field (written as ‘\n\t’). Sometimes semicolons can be used, if the assembler allows semicolons as a line-breaking character. Note that some assembler dialects use semicolons to start a comment."
2014-06-19 15:20:43 +00:00
* Use \n\t rather than semicolons for bn_mul asm, since some assemblers
interpret semicolons as comment delimiters (found by Barry K. Nathan).
Fix off-by-one error in point format parsing
2014-06-23 12:10:13 +00:00
* Fix off-by-one error in parsing Supported Point Format extension that
caused some handshakes to fail.
Fix bug in DHE-PSK PMS computation
2014-06-23 15:56:08 +00:00
* Fix possible miscomputation of the premaster secret with DHE-PSK key
exchange that caused some handshakes to fail with other implementations.
(Failure rate <= 1/255 with common DHM moduli.)
Disable broken Sparc64 bn_mul assembly
2014-06-24 15:57:57 +00:00
* Disable broken Sparc64 bn_mul assembly (found by Florian Obser).
Fix base64_decode() to return and check length correctly
2014-07-04 11:50:31 +00:00
* Fix base64_decode() to return and check length correctly (in case of
tight buffers)
Fix mpi_write_string() to write "00" as hex output for empty MPI
2014-07-10 12:36:19 +00:00
* Fix mpi_write_string() to write "00" as hex output for empty MPI (found
by Hui Dong)
Fix typo in debug_print_msg()
2014-05-06 08:29:28 +00:00
Updated ChangeLog for 1.3.7 to 2014-05-02
2014-05-02 11:27:13 +00:00
= PolarSSL 1.3.7 released on 2014-05-02
debug_set_log_mode() added to determine raw or full logging
2014-04-25 13:04:14 +00:00
Features
Add debug_set_threshold() and thresholding of messages
2014-04-25 14:34:30 +00:00
* debug_set_log_mode() added to determine raw or full logging
* debug_set_threshold() added to ignore messages over threshold level
version_check_feature() added to check for compile-time options at run-time
2014-04-30 09:49:44 +00:00
* version_check_feature() added to check for compile-time options at
run-time
Debug module only outputs full lines instead of parts
2014-04-25 13:18:34 +00:00
POLARSSL_CONFIG_OPTIONS has been removed. Values are set individually For the Platform module this requires the introduction of POLARSSL_PLATFORM_NO_STD_FUNCTIONS to allow not performing the default assignments.
2014-04-25 09:11:10 +00:00
Changes
* POLARSSL_CONFIG_OPTIONS has been removed. All values are individually
checked and filled in the relevant module headers
Debug module only outputs full lines instead of parts
2014-04-25 13:18:34 +00:00
* Debug module only outputs full lines instead of parts
Better support for the different Attribute Types from IETF PKIX (RFC 5280)
2014-04-30 13:34:12 +00:00
* Better support for the different Attribute Types from IETF PKIX (RFC 5280)
Update Changelog for AES-NI
2014-04-26 15:21:07 +00:00
* AES-NI now compiles with "old" assemblers too
Move RC4 ciphersuites down the list
2014-04-29 16:23:07 +00:00
* Ciphersuites based on RC4 now have the lowest priority by default
POLARSSL_CONFIG_OPTIONS has been removed. Values are set individually For the Platform module this requires the introduction of POLARSSL_PLATFORM_NO_STD_FUNCTIONS to allow not performing the default assignments.
2014-04-25 09:11:10 +00:00
Updated ChangeLog
2014-04-18 12:08:26 +00:00
Bugfix
* Only iterate over actual certificates in ssl_write_certificate_request()
(found by Matthew Page)
Typo in PKCS#11 module
2014-04-25 09:44:12 +00:00
* Typos in platform.c and pkcs11.c (found by Daniel Phillips and Steffan
Karger)
cert_write app should use subject of issuer certificate as issuer of cert
2014-04-25 09:48:35 +00:00
* cert_write app should use subject of issuer certificate as issuer of cert
Fix false reject in padding check in ssl_decrypt_buf() for CBC ciphersuites In case full SSL frames arrived, they were rejected because an overly strict padding check.
2014-04-25 10:59:03 +00:00
* Fix false reject in padding check in ssl_decrypt_buf() for CBC
ciphersuites, for full SSL frames of data.
Improve interop by not writing ext_len in ClientHello / ServerHello when 0 The RFC also indicates that without any extensions, we should write a struct {} (empty) not an array of length zero.
2014-04-30 08:15:38 +00:00
* Improve interoperability by not writing extension length in ClientHello /
ServerHello when no extensions are present (found by Matthew Page)
rsa_check_pubkey() now allows an E up to N
2014-04-30 11:33:35 +00:00
* rsa_check_pubkey() now allows an E up to N
On OpenBSD, use arc4random_buf() instead of rand() to prevent warnings
2014-04-30 14:02:38 +00:00
* On OpenBSD, use arc4random_buf() instead of rand() to prevent warnings
Fix bug with mpi_fill_random() on big-endian
2014-04-30 14:11:39 +00:00
* mpi_fill_random() was creating numbers larger than requested on
big-endian platform when size was not an integer number of limbs
Fix some more curve depends in X.509 tests
2014-04-29 13:06:49 +00:00
* Fix dependencies issues in X.509 test suite.
Fix misplaced #endif in ssl_tls.c
2014-04-29 13:11:17 +00:00
* Some parts of ssl_tls.c were compiled even when the module was disabled.
Make compilation on DragonFly work
2014-04-22 20:16:15 +00:00
* Fix detection of DragonflyBSD in net.c (found by Markus Pfeiffer)
Fix build with cc from Apple LLVM On Xcode 4.x and above (I tested Xcode 4.6.3 on 10.7.5 and Xcode 5.5.1 on 10.9.2), cmake (2.8.12.2, whether from MacPorts or from clang.org, FWIW) is detecting /usr/bin/cc as Clang, but CMAKE_COMPILER_IS_CLANG is not getting set, so the tests aren't being built. (There may have been other build problems as well, but the fact that the tests weren't being built was by far the most obvious problem.) Checking the compiler ID detected by cmake, rather than the name of the command used to invoke the compiler, fixes this.
2014-04-24 00:40:25 +00:00
* Fix detection of Clang on some Apple platforms with CMake
(found by Barry K. Nathan)
Updated ChangeLog
2014-04-18 12:08:26 +00:00
Prepared for version 1.3.6
2014-04-11 13:33:59 +00:00
= PolarSSL 1.3.6 released on 2014-04-11
Fix length checking of various ClientKeyExchange's
2014-03-26 18:53:25 +00:00
Support for the ALPN SSL extension (re-enabled in config.h)
2014-04-08 10:33:37 +00:00
Features
* Support for the ALPN SSL extension
Add option 'use_dev_random' to gen_key application
2014-04-09 13:25:13 +00:00
* Add option 'use_dev_random' to gen_key application
Update Changelog for extendedKeyUsage
2014-04-11 09:32:39 +00:00
* Enable verification of the keyUsage extension for CA and leaf
Updated ChangeLog for keyUsage merge
2014-04-09 13:55:20 +00:00
certificates (POLARSSL_X509_CHECK_KEY_USAGE)
Update Changelog for extendedKeyUsage
2014-04-11 09:32:39 +00:00
* Enable verification of the extendedKeyUsage extension
(POLARSSL_X509_CHECK_EXTENDED_KEY_USAGE)
Support for the ALPN SSL extension (re-enabled in config.h)
2014-04-08 10:33:37 +00:00
Updated ChangeLog for x509_crt_info() change
2014-04-04 13:39:37 +00:00
Changes
* x509_crt_info() now prints information about parsed extensions as well
Specific return code for PK sig length mismatch
2014-04-08 10:40:15 +00:00
* pk_verify() now returns a specific error code when the signature is valid
but shorter than the supplied length.
Use UTC to heck certificate validity
2014-04-11 10:25:45 +00:00
* Use UTC time to check certificate validity.
Reject certificates with times not in UTC
2014-04-11 10:29:49 +00:00
* Reject certificates with times not in UTC, per RFC 5280.
Updated ChangeLog for x509_crt_info() change
2014-04-04 13:39:37 +00:00
Remove potential timing leak in ecdsa_sign()
2014-03-31 09:55:42 +00:00
Security
* Avoid potential timing leak in ecdsa_sign() by blinding modular division.
(Found by Watson Ladd.)
Fix embarrassing X.509 bug introduced in 9533765
2014-04-08 09:55:03 +00:00
* The notAfter date of some certificates was no longer checked since 1.3.5.
This affects certificates in the user-supplied chain except the top
certificate. If the user-supplied chain contains only one certificates,
it is not affected (ie, its notAfter date is properly checked).
Prevent potential NULL pointer dereference in ssl_read_record()
2014-04-08 12:36:50 +00:00
* Prevent potential NULL pointer dereference in ssl_read_record() (found by
TrustInSoft)
Remove potential timing leak in ecdsa_sign()
2014-03-31 09:55:42 +00:00
Fix length checking of various ClientKeyExchange's
2014-03-26 18:53:25 +00:00
Bugfix
* The length of various ClientKeyExchange messages was not properly checked.
Add ssl_close_notify() to servers that missed it
2014-03-25 10:24:43 +00:00
* Some example server programs were not sending the close_notify alert.
Potential memory leak in mpi_exp_mod() when error occurs during calculation of RR.
2014-03-31 10:08:17 +00:00
* Potential memory leak in mpi_exp_mod() when error occurs during
calculation of RR.
Fix default #define for malloc/free
2014-04-02 11:20:00 +00:00
* Fixed malloc/free default #define in platform.c (found by Gergely Budai).
Fix typo which broke ENTROPY_FORCE_SHA256
2014-04-02 11:50:05 +00:00
* Fixed type which made POLARSSL_ENTROPY_FORCE_SHA256 uneffective (found by
Gergely Budai).
Fix include path in ecdsa.h
2014-04-04 11:57:20 +00:00
* Fix #include path in ecdsa.h which wasn't accepted by some compilers.
(found by Gergely Budai)
Fix compile error when POLARSSL_ERROR_STRERROR_BC is undefined.
2014-04-05 04:04:40 +00:00
* Fix compile errors when POLARSSL_ERROR_STRERROR_BC is undefined (found by
Shuo Chen).
Test and fix x509_oid functions
2014-03-28 15:06:35 +00:00
* oid_get_numeric_string() used to truncate the output without returning an
error if the output buffer was just 1 byte too small.
Add test for dhm_parse_dhmfile
2014-03-29 15:42:38 +00:00
* dhm_parse_dhm() (hence dhm_parse_dhmfile()) did not set dhm->len.
Add tests and fix bugs for RSA-alt contexts
2014-04-03 20:09:18 +00:00
* Calling pk_debug() on an RSA-alt key would segfault.
* pk_get_size() and pk_get_len() were off by a factor 8 for RSA-alt keys.
Potential buffer overwrite in pem_write_buffer() fixed Length indication when given a too small buffer was off. Added regression test in test_suite_pem to detect this.
2014-04-11 11:28:43 +00:00
* Potential buffer overwrite in pem_write_buffer() because of low length
indication (found by Thijs Alkemade)
Declare EC constants as 'const'
2014-04-10 15:45:07 +00:00
* EC curves constants, which should be only in ROM since 1.3.3, were also
stored in RAM due to missing 'const's (found by Gergely Budai).
Fix length checking of various ClientKeyExchange's
2014-03-26 18:53:25 +00:00
Made ready for release 1.3.5
2014-03-26 15:55:50 +00:00
= PolarSSL 1.3.5 released on 2014-03-26
Merged HMAC-DRBG code
2014-02-05 14:54:34 +00:00
Features
* HMAC-DRBG as a separate module
Fix memory leak in ssl_cache
2014-02-26 16:38:55 +00:00
* Option to set the Curve preference order (disabled by default)
Merged platform compatibility layer
2014-02-06 12:41:55 +00:00
* Single Platform compatilibity layer (for memory / printf / fprintf)
Ability to provide alternate timing implementation
2014-02-06 14:11:55 +00:00
* Ability to provide alternate timing implementation
Ability to force the Entropy module to use SHA-256 as its basis By default the SHA-512 module is used if both are available. On some systems, SHA-256 is the better choice. Contributed by: Gergely Budai
2014-02-06 14:55:25 +00:00
* Ability to force the entropy module to use SHA-256 as its basis
(POLARSSL_ENTROPY_FORCE_SHA256)
Added ChangeLog lines for new SSL tests
2014-03-17 12:45:06 +00:00
* Testing script ssl-opt.sh added for testing 'live' ssl option
interoperability against OpenSSL and PolarSSL
Update Changelog
2014-03-19 15:55:29 +00:00
* Support for reading EC keys that use SpecifiedECDomain in some cases.
Support for seed file writing and reading in Entropy
2014-03-26 10:54:05 +00:00
* Entropy module now supports seed writing and reading
Merged platform compatibility layer
2014-02-06 12:41:55 +00:00
Changes
* Deprecated the Memory layer
More entropy functions made thread-safe (add_source, update_manual, gather)
2014-02-06 14:01:20 +00:00
* entropy_add_source(), entropy_update_manual() and entropy_gather()
now thread-safe if POLARSSL_THREADING_C defined
Update changelog for cmake changes
2014-03-11 09:16:25 +00:00
* Improvements to the CMake build system, contributed by Julian Ospald.
Work around a compiler bug on OS X.
2014-03-14 08:21:20 +00:00
* Work around a bug of the version of Clang shipped by Apple with Mavericks
that prevented bignum.c from compiling. (Reported by Rafael Baptista.)
Added ChangeLog lines for new SSL tests
2014-03-17 12:45:06 +00:00
* Revamped the compat.sh interoperatibility script to include support for
testing against GnuTLS
Deprecate some non-PK compatibility functions (Should have been deprecated in 1.3.0 already.)
2014-03-25 15:37:27 +00:00
* Deprecated ssl_set_own_cert_rsa() and ssl_set_own_cert_rsa_alt()
Improvements to tests/Makefile when using shared library
2014-03-26 12:26:52 +00:00
* Improvements to tests/Makefile, contributed by Oden Eriksson.
Merged HMAC-DRBG code
2014-02-05 14:54:34 +00:00
Countermeasure against "triple handshake" attack
2014-03-10 08:34:49 +00:00
Security
* Forbid change of server certificate during renegotiation to prevent
Fix possible buffer overflow with PSK
2014-03-25 15:28:12 +00:00
"triple handshake" attack when authentication mode is 'optional' (the
Countermeasure against "triple handshake" attack
2014-03-10 08:34:49 +00:00
attack was already impossible when authentication is required).
Reject certs and CRLs from the future
2014-03-10 12:15:18 +00:00
* Check notBefore timestamp of certificates and CRLs from the future.
Forbid sequence number wrapping
2014-03-10 20:20:29 +00:00
* Forbid sequence number wrapping
Deprecate some non-PK compatibility functions (Should have been deprecated in 1.3.0 already.)
2014-03-25 15:37:27 +00:00
* Fixed possible buffer overflow with overlong PSK
Further tightened the padlen check to prevent underflow / overflow
2014-03-26 13:06:55 +00:00
* Possible remotely-triggered out-of-bounds memory access fixed (found by
TrustInSoft)
Countermeasure against "triple handshake" attack
2014-03-10 08:34:49 +00:00
Fix ecp_gen_keypair() Too few tries caused failures for some curves (esp. secp224k1)
2014-01-28 18:30:56 +00:00
Bugfix
* ecp_gen_keypair() does more tries to prevent failure because of
statistics
Deprecate some non-PK compatibility functions (Should have been deprecated in 1.3.0 already.)
2014-03-25 15:37:27 +00:00
* Fixed bug in RSA PKCS#1 v1.5 "reversed" operations
Fixed testing with out-of-source builds using cmake
2014-02-06 14:43:21 +00:00
* Fixed testing with out-of-source builds using cmake
Fix verion-major intolerance
2014-02-12 09:14:54 +00:00
* Fixed version-major intolerance in server
Fixed CMake symlinking on out-of-source builds
2014-03-07 09:33:55 +00:00
* Fixed CMake symlinking on out-of-source builds
Fix depend issues in test suites for cipher modes
2014-03-10 10:32:07 +00:00
* Fixed dependency issues in test suite
Fix RSASSA-PSS example programs
2014-03-10 20:55:35 +00:00
* Programs rsa_sign_pss and rsa_verify_pss were not using PSS since 1.3.0
Don't try to use MIPS32 asm macros on MIPS64 The MIPS32 bn_mul asm code causes segfaults on MIPS64 and failing tests. Until someone has time to fix this up, MIPS64 platforms should fall back to the C implementation (which works fine).
2014-03-05 14:04:09 +00:00
* Bignum's MIPS-32 assembly was used on MIPS-64, causing chaos. (Found by
Alex Wilson.)
Fix memory leak in ssl_cache
2014-02-26 16:38:55 +00:00
* ssl_cache was creating entries when max_entries=0 if TIMING_C was enabled.
* m_sleep() was sleeping twice too long on most Unix platforms.
Fix bug with NewSessionTicket and non-blocking I/O
2014-02-26 13:23:33 +00:00
* Fixed bug with session tickets and non-blocking I/O in the unlikely case
Fixed spaces in ChangeLog
2014-03-17 12:42:23 +00:00
send() would return an EAGAIN error when sending the ticket.
Fix memory leak in ssl_cache
2014-02-26 16:38:55 +00:00
* ssl_cache was leaking memory when reusing a timed out entry containing a
Fixed spaces in ChangeLog
2014-03-17 12:42:23 +00:00
client certificate.
Fix memory leak in server with expired tickets
2014-02-26 16:54:07 +00:00
* ssl_srv was leaking memory when client presented a timed out ticket
Fixed spaces in ChangeLog
2014-03-17 12:42:23 +00:00
containing a client certificate
ssl_init() left a dirty in_ctr pointer on failed allocation of out_ctr
2014-03-17 12:41:51 +00:00
* ssl_init() was leaving a dirty pointer in ssl_context if malloc of
out_ctr failed
Make sure no random pointer occur during failed malloc()'s
2014-03-26 14:28:55 +00:00
* ssl_handshake_init() was leaving dirty pointers in subcontexts if malloc
of one of them failed
Fix stupid bug in rsa_copy()
2014-03-25 14:58:35 +00:00
* Fix typo in rsa_copy() that impacted PKCS#1 v2 contexts
x509_get_current_time() uses localtime_r() to prevent thread issues
2014-03-26 14:34:54 +00:00
* x509_get_current_time() uses localtime_r() to prevent thread issues
Fix ecp_gen_keypair() Too few tries caused failures for some curves (esp. secp224k1)
2014-01-28 18:30:56 +00:00
Ready for release 1.3.4
2014-01-27 10:49:46 +00:00
= PolarSSL 1.3.4 released on 2014-01-27
Updated ChangeLog with recent changes
2014-01-22 12:08:19 +00:00
Features
Merged support for secp224k1, secp192k1 and secp25k1
2014-01-22 12:08:44 +00:00
* Support for the Koblitz curves: secp192k1, secp224k1, secp256k1
Merged RIPEMD-160 support
2014-01-22 13:18:03 +00:00
* Support for RIPEMD-160
Added AES CFB8 mode
2014-01-24 14:38:12 +00:00
* Support for AES CFB8 mode
Updated ChangeLog with deterministic ECDSA
2014-01-27 10:47:15 +00:00
* Support for deterministic ECDSA (RFC 6979)
Updated ChangeLog with recent changes
2014-01-22 12:08:19 +00:00
Bugfix
* Potential memory leak in bignum_selftest()
* Replaced expired test certificate
SMTP lines are officially terminated with CRLF, ssl_mail_client fixed
2014-01-24 15:11:17 +00:00
* ssl_mail_client now terminates lines with CRLF, instead of LF
Fixed up ChangeLog with missing bug fixes
2014-01-27 11:23:43 +00:00
* net module handles timeouts on blocking sockets better (found by Tilman
Sauerbeck)
Fixed indication for TrustInSoft fix
2014-01-27 12:36:23 +00:00
* Assembly format fixes in bn_mul.h
Security
Fixed up ChangeLog with missing bug fixes
2014-01-27 11:23:43 +00:00
* Missing MPI_CHK calls added around unguarded mpi calls (found by
TrustInSoft)
Updated ChangeLog with recent changes
2014-01-22 12:08:19 +00:00
Prepped for 1.3.3
2013-12-31 09:57:44 +00:00
= PolarSSL 1.3.3 released on 2013-12-31
Merged EC key generation support
2013-12-02 13:54:01 +00:00
Features
* EC key generation support in gen_key app
Merged client ciphersuite order preference option
2013-12-02 13:55:28 +00:00
* Support for adhering to client ciphersuite order preference
(POLARSSL_SSL_SRV_RESPECT_CLIENT_PREFERENCE)
Merged support for Curve25519
2013-12-05 15:11:38 +00:00
* Support for Curve25519
Merged support for ECDH-RSA / ECDH-ECDSA key exchanges and ciphersuites
2013-12-17 12:09:31 +00:00
* Support for ECDH-RSA and ECDH-ECDSA key exchanges and ciphersuites
Merged IPv6 support in the NET module
2013-12-17 13:33:42 +00:00
* Support for IPv6 in the NET module
Merged AES-NI support for AES, AES-GCM and AES key scheduling
2013-12-30 13:09:47 +00:00
* AES-NI support for AES, AES-GCM and AES key scheduling
Added version of the SSL pthread server example
2013-12-19 14:40:58 +00:00
* SSL Pthread-based server example added (ssl_pthread_server)
Merged EC key generation support
2013-12-02 13:54:01 +00:00
Updated ChangeLog to reflect recent changes
2013-11-26 16:37:31 +00:00
Changes
* gen_prime() speedup
* Speedup of ECP multiplication operation
* Relaxed some SHA2 ciphersuite's version requirements
Merged change from readdir_r() to readdir() + threading
2013-12-02 13:50:49 +00:00
* Dropped use of readdir_r() instead of readdir() with threading support
Merged more constant-time checking in RSA
2013-12-02 13:52:57 +00:00
* More constant-time checks in the RSA module
Updated ChangeLog for splitting off curves from ecp.c
2013-12-02 21:03:23 +00:00
* Split off curves from ecp.c into ecp_curves.c
Merged storing curves fully in ROM
2013-12-17 12:10:48 +00:00
* Curves are now stored fully in ROM
Merged ECP memory usage optimizations
2013-12-31 09:32:50 +00:00
* Memory usage optimizations in ECP module
Removed POLARSSL_THREADING_DUMMY option
2013-12-31 10:54:08 +00:00
* Removed POLARSSL_THREADING_DUMMY
Updated ChangeLog to reflect recent changes
2013-11-26 16:37:31 +00:00
Fixed X.509 hostname comparison (with non-regular characters) In situations with 'weird' certificate names or hostnames (containing non-western allowed names) the check would falsely report a name or wildcard match.
2013-11-20 16:23:53 +00:00
Bugfix
Fix bug in mpi_set_bit
2013-12-04 17:05:29 +00:00
* Fixed bug in mpi_set_bit() on platforms where t_uint is wider than int
Fixed X.509 hostname comparison (with non-regular characters) In situations with 'weird' certificate names or hostnames (containing non-western allowed names) the check would falsely report a name or wildcard match.
2013-11-20 16:23:53 +00:00
* Fixed X.509 hostname comparison (with non-regular characters)
SSL now gracefully handles missing RNG
2013-11-21 16:31:06 +00:00
* SSL now gracefully handles missing RNG
Updated ChangeLog to reflect recent changes
2013-11-26 16:37:31 +00:00
* Missing defines / cases for RSA_PSK key exchange
* crypt_and_hash app checks MAC before final decryption
Potential memory leak in ssl_ticket_keys_init()
2013-12-16 14:24:05 +00:00
* Potential memory leak in ssl_ticket_keys_init()
Fixed memory leak in benchmark application
2013-12-16 15:43:10 +00:00
* Memory leak in benchmark application
Fixed x509_crt_parse_path() bug on Windows platforms
2013-12-19 12:51:24 +00:00
* Fixed x509_crt_parse_path() bug on Windows platforms
Added missing MPI_CHK() around some statements
2013-12-31 10:16:03 +00:00
* Added missing MPI_CHK() around some statements in mpi_div_mpi() (found by
TrustInSoft)
Fixed potential overflow in certificate size in ssl_write_certificate()
2013-12-31 10:35:16 +00:00
* Fixed potential overflow in certificate size verification in
ssl_write_certificate() (found by TrustInSoft)
Fixed X.509 hostname comparison (with non-regular characters) In situations with 'weird' certificate names or hostnames (containing non-western allowed names) the check would falsely report a name or wildcard match.
2013-11-20 16:23:53 +00:00
Reduced the input / output overhead with 200+ bytes and covered corner case The actual input / output buffer overhead is only 301 instead of 512. This requires a proper check on the padding_idx to prevent out of bounds reads. Previously a remote party could potentially trigger an access error and thus stop the application when sending a malicious packet having MAX_CONTENT_LEN of data, 32 bytes of MAC and a decrypted padlen of . This would result in reading from in_ctr + 13 + 32 + MAX_CONTENT_LEN - 1 - 1 for 256 bytes (including fake padding check). Or 13 + 32 bytes over the buffer length. We now reset padding_idx to 0, if it's clear that it will never be a valid padding (padlen > msg_len || msg_len + padlen + 256 > buffer_len)
2013-12-19 13:42:28 +00:00
Security
* Possible remotely-triggered out-of-bounds memory access fixed (found by
TrustInSoft)
Prep for PolarSSL 1.3.2
2013-11-04 16:29:42 +00:00
= PolarSSL 1.3.2 released on 2013-11-04
Merged Public Key framwork tests
2013-10-28 13:03:26 +00:00
Features
* PK tests added to test framework
Merged optimizations for MODP NIST curves
2013-10-28 13:16:59 +00:00
* Added optional optimization for NIST MODP curves (POLARSSL_ECP_NIST_OPTIM)
Merged support for Camellia-GCM + ciphersuite and fixes to cipher layer
2013-10-28 13:37:09 +00:00
* Support for Camellia-GCM mode and ciphersuites
Merged Public Key framwork tests
2013-10-28 13:03:26 +00:00
Merged constant-time padding checks
2013-10-28 13:39:49 +00:00
Changes
* Padding checks in cipher layer are now constant-time
Update ChangeLog for renegotiation changes
2013-10-31 13:37:37 +00:00
* Value comparisons in SSL layer are now constant-time
Support for serialNumber, postalAddress and postalCode in X509 names
2013-10-29 13:24:37 +00:00
* Support for serialNumber, postalAddress and postalCode in X509 names
Update ChangeLog for renegotiation changes
2013-10-31 13:37:37 +00:00
* SSL Renegotiation was refactored
Merged constant-time padding checks
2013-10-28 13:39:49 +00:00
Server does not send out extensions not advertised by client
2013-10-28 11:54:26 +00:00
Bugfix
Merged support for Camellia-GCM + ciphersuite and fixes to cipher layer
2013-10-28 13:37:09 +00:00
* More stringent checks in cipher layer
Server does not send out extensions not advertised by client
2013-10-28 11:54:26 +00:00
* Server does not send out extensions not advertised by client
Prevent possible alignment warnings on casting from char * to 'aligned *'
2013-10-28 11:57:08 +00:00
* Prevent possible alignment warnings on casting from char * to 'aligned *'
Update Changelog for minor fixes
2013-10-28 13:02:40 +00:00
* Misc fixes and additions to dependency checks
Const correctness
2013-10-28 20:19:10 +00:00
* Const correctness
Fixed that selfsign copies issuer_name to subject_name
2013-10-28 21:28:09 +00:00
* cert_write with selfsign should use issuer_name as subject_name
Fix ECDSA corner case: missing reduction mod N No security issue, can cause valid signatures to be rejected. Reported by DualTachyon on github.
2013-10-29 09:45:28 +00:00
* Fix ECDSA corner case: missing reduction mod N (found by DualTachyon)
Defines for UEFI environment under MSVC added
2013-10-28 17:48:30 +00:00
* Defines to handle UEFI environment under MSVC
Update ChangeLog for renegotiation changes
2013-10-31 13:37:37 +00:00
* Server-side initiated renegotiations send HelloRequest
Server does not send out extensions not advertised by client
2013-10-28 11:54:26 +00:00
Bumped version to 1.3.1
2013-10-15 11:12:41 +00:00
= PolarSSL 1.3.1 released on 2013-10-15
Merged support for Brainpool curves and ciphersuites
2013-10-11 08:03:27 +00:00
Features
* Support for Brainpool curves and TLS ciphersuites (RFC 7027)
Merged ECDHE-PSK ciphersuites
2013-10-15 10:44:23 +00:00
* Support for ECDHE-PSK key-exchange and ciphersuites
Merged RSA-PSK key-exchange and ciphersuites
2013-10-15 10:46:17 +00:00
* Support for RSA-PSK key-exchange and ciphersuites
Merged support for Brainpool curves and ciphersuites
2013-10-11 08:03:27 +00:00
Added bugfixes to ChangeLog
2013-10-11 07:21:56 +00:00
Changes
* RSA blinding locks for a smaller amount of time
TLS compression only allocates working buffer once
2013-10-11 07:59:44 +00:00
* TLS compression only allocates working buffer once
Introduced POLARSSL_HAVE_READDIR_R for systems without it
2013-10-14 13:51:50 +00:00
* Introduced POLARSSL_HAVE_READDIR_R for systems without it
config.h is more script-friendly
2013-10-15 09:55:10 +00:00
* config.h is more script-friendly
Added bugfixes to ChangeLog
2013-10-11 07:21:56 +00:00
Bugfix
* Missing MSVC defines added
* Compile errors with POLARSSL_RSA_NO_CRT
* Header files with 'polarssl/'
Fixed const-correctness issues
2013-10-11 07:36:52 +00:00
* Const correctness
Possible naming collision in dhm_context
2013-10-11 07:38:49 +00:00
* Possible naming collision in dhm_context
Better support for MSVC
2013-10-11 08:49:24 +00:00
* Better support for MSVC
threading_set_own() renamed to threading_set_alt()
2013-10-11 08:51:32 +00:00
* threading_set_alt() name
Added missing x509write_crt_set_version()
2013-10-11 08:54:28 +00:00
* Added missing x509write_crt_set_version()
Added bugfixes to ChangeLog
2013-10-11 07:21:56 +00:00
Bumped version to 1.3.1
2013-10-15 11:12:41 +00:00
= PolarSSL 1.3.0 released on 2013-10-01
Added Ephemeral Elliptic Curve Diffie Hellman ciphersuites to SSL/TLS Made all modifications to include Ephemeral Elliptic Curve Diffie Hellman ciphersuites into the existing SSL/TLS modules. All basic handling of the ECDHE-ciphersuites (TLS_ECDHE_RSA_WITH_NULL_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) has been included.
2013-03-20 13:39:14 +00:00
Features
* Elliptic Curve Cryptography module added
* Elliptic Curve Diffie Hellman module added
* Ephemeral Elliptic Curve Diffie Hellman support for SSL/TLS
(ECDHE-based ciphersuites)
Amended ChangeLog for ECDSA-ciphersuites
2013-08-28 10:15:11 +00:00
* Ephemeral Elliptic Curve Digital Signature Algorithm support for SSL/TLS
(ECDSA-based ciphersuites)
Ability to specify allowed ciphersuites based on the protocol version. The ciphersuites parameter in the ssl_session structure changed from 'int *' to 'int *[4]'. The new function ssl_set_ciphersuite_for_version() sets specific entries inside this array. ssl_set_ciphersuite() sets all entries to the same value. (cherry picked from commit a62729888b9d8eafbfa952fca63a04100ed90f69) Conflicts: ChangeLog library/ssl_srv.c library/ssl_tls.c
2013-04-15 13:09:54 +00:00
* Ability to specify allowed ciphersuites based on the protocol version.
PSK and DHE-PSK addition to ChangeLog
2013-04-19 14:05:16 +00:00
* PSK and DHE-PSK based ciphersuites added
Memory-allocation abstraction layer and buffer-based allocator added
2013-07-03 11:37:05 +00:00
* Memory allocation abstraction layer added
* Buffer-based memory allocator added (no malloc() / free() / HEAP usage)
Threading abstraction layer added
2013-09-28 12:40:38 +00:00
* Threading abstraction layer added (dummy / pthread / alternate)
Prepared for 1.3.0 RC0
2013-09-18 19:21:30 +00:00
* Public Key abstraction layer added
Updated Changelog for EC Key / Cert and RFC 6066 extensions
2013-07-19 12:55:25 +00:00
* Parsing Elliptic Curve keys
* Parsing Elliptic Curve certificates
* Support for max_fragment_length extension (RFC 6066)
* Support for truncated_hmac extension (RFC 6066)
Updated Changelog to reflect feature addition
2013-08-14 10:24:34 +00:00
* Support for zeros-and-length (ANSI X.923) padding, one-and-zeros
(ISO/IEC 7816-4) padding and zero padding in the cipher layer
Updated Changelog to reflect addition of session tickets
2013-08-14 11:49:20 +00:00
* Support for session tickets (RFC 5077)
Merged refactored x509write module into development
2013-08-28 14:31:30 +00:00
* Certificate Request (CSR) generation with extensions (key_usage,
ns_cert_type)
Added merged functionality to ChangeLog
2013-09-12 10:00:52 +00:00
* X509 Certificate writing with extensions (basic_constraints,
issuer_key_identifier, etc)
Added ChangeLog for blinding
2013-09-10 12:53:46 +00:00
* Optional blinding for RSA, DHM and EC
Merged support for multiple certificate/key pairs in SSL into development
2013-09-25 16:03:58 +00:00
* Support for multiple active certificate / key pairs in SSL servers for
Fix minor code style issues
2018-03-13 15:22:58 +00:00
the same host (Not to be confused with SNI!)
Added Ephemeral Elliptic Curve Diffie Hellman ciphersuites to SSL/TLS Made all modifications to include Ephemeral Elliptic Curve Diffie Hellman ciphersuites into the existing SSL/TLS modules. All basic handling of the ECDHE-ciphersuites (TLS_ECDHE_RSA_WITH_NULL_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA) has been included.
2013-03-20 13:39:14 +00:00
Modified ChangeLog to include explanations of last SSL module changes
2013-03-13 12:53:00 +00:00
Changes
Ability to enable / disable SSL v3 / TLS 1.0 / TLS 1.1 / TLS 1.2 individually
2013-08-27 19:19:20 +00:00
* Ability to enable / disable SSL v3 / TLS 1.0 / TLS 1.1 / TLS 1.2
individually
Moved to advanced ciphersuite representation and more dynamic SSL code
2013-01-07 17:20:04 +00:00
* Introduced separate SSL Ciphersuites module that is based on
Cipher and MD information
Modified ChangeLog to include explanations of last SSL module changes
2013-03-13 12:53:00 +00:00
* Internals for SSL module adapted to have separate IV pointer that is
dynamically set (Better support for hardware acceleration)
OID functionality moved to a separate module. A new OID module has been created that contains the main OID searching functionality based on type-dependent arrays. A base type is used to contain the basic values (oid_descriptor_t) and that type is extended to contain type specific information (like a pk_alg_t). As a result the rsa sign and verify function prototypes have changed. They now expect a md_type_t identifier instead of the removed RSA_SIG_XXX defines. All OID definitions have been moved to oid.h All OID matching code is in the OID module. The RSA PKCS#1 functions cleaned up as a result and adapted to use the MD layer. The SSL layer cleanup up as a result and adapted to use the MD layer. The X509 parser cleaned up and matches OIDs in certificates with new module and adapted to use the MD layer. The X509 writer cleaned up and adapted to use the MD layer. Apps and tests modified accordingly
2013-04-07 20:00:46 +00:00
* Moved all OID functionality to a separate module. RSA function
prototypes for the RSA sign and verify functions changed as a result
Split up GCM into a start/update/finish cycle
2013-06-26 13:07:16 +00:00
* Split up the GCM module into a starts/update/finish cycle
Client and server now filter sent and accepted ciphersuites on minimum and maximum protocol version
2013-06-29 14:01:15 +00:00
* Client and server now filter sent and accepted ciphersuites on minimum
and maximum protocol version
Ability to disable server_name extension (RFC 6066)
2013-08-27 19:55:01 +00:00
* Ability to disable server_name extension (RFC 6066)
Renamed error_strerror() to the less conflicting polarssl_strerror() Ability to keep old function error_strerror() as well with POLARSSL_ERROR_STRERROR_BC. Also works with POLARSSL_ERROR_STRERROR_DUMMY.
2013-06-29 16:24:32 +00:00
* Renamed error_strerror() to the less conflicting polarssl_strerror()
(Ability to keep old as well with POLARSSL_ERROR_STRERROR_BC)
SHA2 renamed to SHA256, SHA4 renamed to SHA512 and functions accordingly The SHA4 name was not clear with regards to the new SHA-3 standard. So SHA2 and SHA4 have been renamed to better represent what they are: SHA256 and SHA512 modules.
2013-06-30 12:34:05 +00:00
* SHA2 renamed to SHA256, SHA4 renamed to SHA512 and functions accordingly
Refactored RSA to have random generator in every RSA operation Primarily so that rsa_private() receives an RNG for blinding purposes.
2013-08-30 08:30:02 +00:00
* All RSA operations require a random generator for blinding purposes
PK layer and X509 core refactoring in ChangeLog
2013-09-18 13:33:49 +00:00
* X509 core refactored
* x509_crt_verify() now case insensitive for cn (RFC 6125 6.4)
Prepared for 1.3.0 RC0
2013-09-18 19:21:30 +00:00
* Also compiles / runs without time-based functions (!POLARSSL_HAVE_TIME)
Support faulty X509 v1 certificates with extensions (POLARSSL_X509_ALLOW_EXTENSIONS_NON_V3)
2013-09-23 13:01:36 +00:00
* Support faulty X509 v1 certificates with extensions
(POLARSSL_X509_ALLOW_EXTENSIONS_NON_V3)
Modified ChangeLog to include explanations of last SSL module changes
2013-03-13 12:53:00 +00:00
Fixed MPI assembly for ARM when -O2 is used GCC with -O2 or higher also needs to now about 'cc' in the clobber list.
2013-04-11 15:13:22 +00:00
Bugfix
Fixed parse error in ssl_parse_certificate_request()
2013-05-22 11:56:26 +00:00
* Fixed parse error in ssl_parse_certificate_request()
zlib compression/decompression skipped on empty blocks
2013-06-30 12:57:46 +00:00
* zlib compression/decompression skipped on empty blocks
Support for AIX header locations in net.c module
2013-07-26 12:10:22 +00:00
* Support for AIX header locations in net.c module
Fixed file descriptor leak in x509parse_crtpath()
2013-09-09 15:26:14 +00:00
* Fixed file descriptor leaks
Fixed MPI assembly for ARM when -O2 is used GCC with -O2 or higher also needs to now about 'cc' in the clobber list.
2013-04-11 15:13:22 +00:00
RSA blinding added for CRT operations
2013-08-30 09:00:25 +00:00
Security
* RSA blinding on CRT operations to counter timing attacks
(found by Cyril Arnaud and Pierre-Alain Fouque)
Include changes from the 1.2 branch
2015-04-30 08:16:19 +00:00
= Version 1.2.14 released 2015-05-??
Security
* Fix potential invalid memory read in the server, that allows a client to
crash it remotely (found by Caj Larsson).
* Fix potential invalid memory read in certificate parsing, that allows a
client to crash the server remotely if client authentication is enabled
(found using Codenomicon Defensics).
* Add countermeasure against "Lucky 13 strikes back" cache-based attack,
https://dl.acm.org/citation.cfm?id=2714625
Bugfix
* Fix bug in Via Padlock support (found by Nikos Mavrogiannopoulos).
* Fix hardclock() (only used in the benchmarking program) with some
versions of mingw64 (found by kxjhlele).
* Fix warnings from mingw64 in timing.c (found by kxjklele).
* Fix potential unintended sign extension in asn1_get_len() on 64-bit
platforms (found with Coverity Scan).
= Version 1.2.13 released 2015-02-16
Note: Although PolarSSL has been renamed to mbed TLS, no changes reflecting
this will be made in the 1.2 branch at this point.
Security
* Fix remotely-triggerable uninitialised pointer dereference caused by
crafted X.509 certificate (TLS server is not affected if it doesn't ask
for a client certificate) (found using Codenomicon Defensics).
* Fix remotely-triggerable memory leak caused by crafted X.509 certificates
(TLS server is not affected if it doesn't ask for a client certificate)
(found using Codenomicon Defensics).
* Fix potential stack overflow while parsing crafted X.509 certificates
(TLS server is not affected if it doesn't ask for a client certificate)
found using Codenomicon Defensics).
* Fix buffer overread of size 1 when parsing crafted X.509 certificates
(TLS server is not affected if it doesn't ask for a client certificate).
Bugfix
* Fix potential undefined behaviour in Camellia.
* Fix memory leaks in PKCS#5 and PKCS#12.
* Stack buffer overflow if ctr_drbg_update() is called with too large
add_len (found by Jean-Philippe Aumasson) (not triggerable remotely).
* Fix bug in MPI/bignum on s390/s390x (reported by Dan Horák) (introduced
in 1.2.12).
* Fix unchecked return code in x509_crt_parse_path() on Windows (found by
Peter Vaskovic).
* Fix assembly selection for MIPS64 (thanks to James Cowgill).
* ssl_get_verify_result() now works even if the handshake was aborted due
to a failed verification (found by Fredrik Axelsson).
* Skip writing and parsing signature_algorithm extension if none of the
key exchanges enabled needs certificates. This fixes a possible interop
issue with some servers when a zero-length extension was sent. (Reported
by Peter Dettman.)
* On a 0-length input, base64_encode() did not correctly set output length
(found by Hendrik van den Boogaard).
Changes
* Blind RSA private operations even when POLARSSL_RSA_NO_CRT is defined.
* Forbid repeated extensions in X.509 certificates.
* Add compile-time option POLARSSL_X509_MAX_INTERMEDIATE_CA to limit the
length of an X.509 verification chain (default = 8).
Include 1.2.12 release information in ChangeLog
2014-10-24 14:26:29 +00:00
= Version 1.2.12 released 2014-10-24
Security
* Remotely-triggerable memory leak when parsing some X.509 certificates
(server is not affected if it doesn't ask for a client certificate).
(Found using Codenomicon Defensics.)
Bugfix
* Fix potential bad read in parsing ServerHello (found by Adrien
Vialletelle).
* ssl_close_notify() could send more than one message in some circumstances
with non-blocking I/O.
* x509_crt_parse() did not increase total_failed on PEM error
* Fix compiler warnings on iOS (found by Sander Niemeijer).
* Don't print uninitialised buffer in ssl_mail_client (found by Marc Abel).
* Fix net_accept() regarding non-blocking sockets (found by Luca Pesce).
* ssl_read() could return non-application data records on server while
renegotation was pending, and on client when a HelloRequest was received.
* Fix warnings from Clang's scan-build (contributed by Alfred Klomp).
Changes
* X.509 certificates with more than one AttributeTypeAndValue per
RelativeDistinguishedName are not accepted any more.
* ssl_read() now returns POLARSSL_ERR_NET_WANT_READ rather than
POLARSSL_ERR_SSL_UNEXPECTED_MESSAGE on harmless alerts.
* Accept spaces at end of line or end of buffer in base64_decode().
Include 1.2.11 ChangeLog
2014-07-11 09:28:30 +00:00
= Version 1.2.11 released 2014-07-11
Features
* Entropy module now supports seed writing and reading
Changes
* Introduced POLARSSL_HAVE_READDIR_R for systems without it
* Improvements to the CMake build system, contributed by Julian Ospald.
* Work around a bug of the version of Clang shipped by Apple with Mavericks
that prevented bignum.c from compiling. (Reported by Rafael Baptista.)
* Improvements to tests/Makefile, contributed by Oden Eriksson.
* Use UTC time to check certificate validity.
* Reject certificates with times not in UTC, per RFC 5280.
* Migrate zeroizing of data to polarssl_zeroize() instead of memset()
against unwanted compiler optimizations
Security
* Forbid change of server certificate during renegotiation to prevent
"triple handshake" attack when authentication mode is optional (the
attack was already impossible when authentication is required).
* Check notBefore timestamp of certificates and CRLs from the future.
* Forbid sequence number wrapping
* Prevent potential NULL pointer dereference in ssl_read_record() (found by
TrustInSoft)
* Fix length checking for AEAD ciphersuites (found by Codenomicon).
It was possible to crash the server (and client) using crafted messages
when a GCM suite was chosen.
Bugfix
* Fixed X.509 hostname comparison (with non-regular characters)
* SSL now gracefully handles missing RNG
* crypt_and_hash app checks MAC before final decryption
* Fixed x509_crt_parse_path() bug on Windows platforms
* Added missing MPI_CHK() around some statements in mpi_div_mpi() (found by
TrustInSoft)
* Fixed potential overflow in certificate size verification in
ssl_write_certificate() (found by TrustInSoft)
* Fix ASM format in bn_mul.h
* Potential memory leak in bignum_selftest()
* Replaced expired test certificate
* ssl_mail_client now terminates lines with CRLF, instead of LF
* Fix bug in RSA PKCS#1 v1.5 "reversed" operations
* Fixed testing with out-of-source builds using cmake
* Fixed version-major intolerance in server
* Fixed CMake symlinking on out-of-source builds
* Bignum's MIPS-32 assembly was used on MIPS-64, causing chaos. (Found by
Alex Wilson.)
* ssl_init() was leaving a dirty pointer in ssl_context if malloc of
out_ctr failed
* ssl_handshake_init() was leaving dirty pointers in subcontexts if malloc
of one of them failed
* x509_get_current_time() uses localtime_r() to prevent thread issues
* Some example server programs were not sending the close_notify alert.
* Potential memory leak in mpi_exp_mod() when error occurs during
calculation of RR.
* Improve interoperability by not writing extension length in ClientHello
when no extensions are present (found by Matthew Page)
* rsa_check_pubkey() now allows an E up to N
* On OpenBSD, use arc4random_buf() instead of rand() to prevent warnings
* mpi_fill_random() was creating numbers larger than requested on
big-endian platform when size was not an integer number of limbs
* Fix detection of DragonflyBSD in net.c (found by Markus Pfeiffer)
* Stricter check on SSL ClientHello internal sizes compared to actual packet
size (found by TrustInSoft)
* Fix preprocessor checks for bn_mul PPC asm (found by Barry K. Nathan).
* Use \n\t rather than semicolons for bn_mul asm, since some assemblers
interpret semicolons as comment delimiters (found by Barry K. Nathan).
* Disable broken Sparc64 bn_mul assembly (found by Florian Obser).
* Fix base64_decode() to return and check length correctly (in case of
tight buffers)
Added 1.2.10 to ChangeLog
2013-10-07 14:22:05 +00:00
= Version 1.2.10 released 2013-10-07
Changes
* Changed RSA blinding to a slower but thread-safe version
Bugfix
* Fixed memory leak in RSA as a result of introduction of blinding
* Fixed ssl_pkcs11_decrypt() prototype
* Fixed MSVC project files
Fixed release date for 1.3.0
2013-10-01 08:12:42 +00:00
= Version 1.2.9 released 2013-10-01
Added 1.1.8 and 1.2.9 release
2013-09-26 08:12:19 +00:00
Changes
* x509_verify() now case insensitive for cn (RFC 6125 6.4)
Bugfix
* Fixed potential memory leak when failing to resume a session
* Fixed potential file descriptor leaks (found by Remi Gacogne)
* Minor fixes
Security
* Fixed potential heap buffer overflow on large hostname setting
* Fixed potential negative value misinterpretation in load_file()
* RSA blinding on CRT operations to counter timing attacks
(found by Cyril Arnaud and Pierre-Alain Fouque)
PolarSSL 1.2.6 and PolarSSL 1.2.7 changes added to ChangeLog
2013-06-24 17:07:34 +00:00
= Version 1.2.8 released 2013-06-19
Features
* Parsing of PKCS#8 encrypted private key files
* PKCS#12 PBE and derivation functions
* Centralized module option values in config.h to allow user-defined
settings without editing header files by using POLARSSL_CONFIG_OPTIONS
Changes
* HAVEGE random generator disabled by default
* Internally split up x509parse_key() into a (PEM) handler function
and specific DER parser functions for the PKCS#1 and unencrypted
PKCS#8 private key formats
* Added mechanism to provide alternative implementations for all
symmetric cipher and hash algorithms (e.g. POLARSSL_AES_ALT in
Fix minor code style issues
2018-03-13 15:22:58 +00:00
config.h)
PolarSSL 1.2.6 and PolarSSL 1.2.7 changes added to ChangeLog
2013-06-24 17:07:34 +00:00
* PKCS#5 module added. Moved PBKDF2 functionality inside and deprecated
old PBKDF2 module
Bugfix
* Secure renegotiation extension should only be sent in case client
supports secure renegotiation
* Fixed offset for cert_type list in ssl_parse_certificate_request()
* Fixed const correctness issues that have no impact on the ABI
* x509parse_crt() now better handles PEM error situations
* ssl_parse_certificate() now calls x509parse_crt_der() directly
instead of the x509parse_crt() wrapper that can also parse PEM
Fix minor code style issues
2018-03-13 15:22:58 +00:00
certificates
PolarSSL 1.2.6 and PolarSSL 1.2.7 changes added to ChangeLog
2013-06-24 17:07:34 +00:00
* x509parse_crtpath() is now reentrant and uses more portable stat()
* Fixed bignum.c and bn_mul.h to support Thumb2 and LLVM compiler
* Fixed values for 2-key Triple DES in cipher layer
* ssl_write_certificate_request() can handle empty ca_chain
Security
* A possible DoS during the SSL Handshake, due to faulty parsing of
PEM-encoded certificates has been fixed (found by Jack Lloyd)
= Version 1.2.7 released 2013-04-13
Features
* Ability to specify allowed ciphersuites based on the protocol version.
Changes
* Default Blowfish keysize is now 128-bits
* Test suites made smaller to accommodate Raspberry Pi
Bugfix
* Fix for MPI assembly for ARM
* GCM adapted to support sizes > 2^29
Prepared for PolarSSL 1.2.6 release
2013-03-11 10:38:44 +00:00
= Version 1.2.6 released 2013-03-11
Fixed memory leak in ssl_free() and ssl_reset() for active session
2013-02-14 10:19:38 +00:00
Bugfix
* Fixed memory leak in ssl_free() and ssl_reset() for active session
Corrected GCM counter incrementation to use only 32-bits instead of 128-bits Using 32-bits has the possibility to overwrite the IV in the first 12 bytes of the Y variable. Found by Yawning Angel
2013-02-27 13:52:37 +00:00
* Corrected GCM counter incrementation to use only 32-bits instead of
128-bits (found by Yawning Angel)
Added bugfix line for previous fixes for MS Visual Studio
2013-02-28 09:20:53 +00:00
* Fixes for 64-bit compilation with MS Visual Studio
Fixed net_bind() for specified IP addresses on little endian systems
2013-03-06 15:55:11 +00:00
* Fixed net_bind() for specified IP addresses on little endian systems
Fixed assembly code for ARM (Thumb and regular) for some compilers
2013-03-06 17:14:52 +00:00
* Fixed assembly code for ARM (Thumb and regular) for some compilers
Fixed memory leak in ssl_free() and ssl_reset() for active session
2013-02-14 10:19:38 +00:00
Split up the RSA PKCS#1 encrypt, decrypt, sign and verify functions Split rsa_pkcs1_encrypt() into rsa_rsaes_oaep_encrypt() and rsa_rsaes_pkcs1_v15_encrypt() Split rsa_pkcs1_decrypt() into rsa_rsaes_oaep_decrypt() and rsa_rsaes_pkcs1_v15_decrypt() Split rsa_pkcs1_sign() into rsa_rsassa_pss_sign() and rsa_rsassa_pkcs1_v15_sign() Split rsa_pkcs1_verify() into rsa_rsassa_pss_verify() and rsa_rsassa_pkcs1_v15_verify() The original functions exist as generic wrappers to these functions.
2013-02-28 16:21:01 +00:00
Changes
* Internally split up rsa_pkcs1_encrypt(), rsa_pkcs1_decrypt(),
rsa_pkcs1_sign() and rsa_pkcs1_verify() to separate PKCS#1 v1.5 and
PKCS#1 v2.1 functions
Added support for custom labels when using rsa_rsaes_oaep_encrypt() or rsa_rsaes_oaep_decrypt()
2013-02-28 16:33:49 +00:00
* Added support for custom labels when using rsa_rsaes_oaep_encrypt()
or rsa_rsaes_oaep_decrypt()
Re-added support for parsing and handling SSLv2 Client Hello messages If the define POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is enabled, the SSL Server module can handle the old SSLv2 Client Hello messages. It has been updated to deny SSLv2 Client Hello messages during renegotiation.
2013-03-06 16:01:52 +00:00
* Re-added handling for SSLv2 Client Hello when the define
POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is set
The SSL session cache module (ssl_cache) now also retains peer_cert information (not the entire chain) The real peer certificate is copied into a x509_buf in the ssl_cache_entry and reinstated upon cache retrieval. The information about the rest of the certificate chain is lost in the process. As the handshake (and certificate verification) has already been performed, no issue is foreseen.
2013-03-06 16:40:46 +00:00
* The SSL session cache module (ssl_cache) now also retains peer_cert
information (not the entire chain)
Split up the RSA PKCS#1 encrypt, decrypt, sign and verify functions Split rsa_pkcs1_encrypt() into rsa_rsaes_oaep_encrypt() and rsa_rsaes_pkcs1_v15_encrypt() Split rsa_pkcs1_decrypt() into rsa_rsaes_oaep_decrypt() and rsa_rsaes_pkcs1_v15_decrypt() Split rsa_pkcs1_sign() into rsa_rsassa_pss_sign() and rsa_rsassa_pkcs1_v15_sign() Split rsa_pkcs1_verify() into rsa_rsassa_pss_verify() and rsa_rsassa_pkcs1_v15_verify() The original functions exist as generic wrappers to these functions.
2013-02-28 16:21:01 +00:00
Removed further timing differences during SSL message decryption in ssl_decrypt_buf() New padding checking is unbiased on correct or incorrect padding and has no branch prediction timing differences. The additional MAC checks further straighten out the timing differences.
2013-02-27 13:48:00 +00:00
Security
* Removed further timing differences during SSL message decryption in
ssl_decrypt_buf()
Removed timing differences due to bad padding from RSA decrypt for PKCS#1 v1.5 operations
2013-02-28 17:06:26 +00:00
* Removed timing differences due to bad padding from
rsa_rsaes_pkcs1_v15_decrypt() and rsa_pkcs1_decrypt() for PKCS#1 v1.5
operations
Removed further timing differences during SSL message decryption in ssl_decrypt_buf() New padding checking is unbiased on correct or incorrect padding and has no branch prediction timing differences. The additional MAC checks further straighten out the timing differences.
2013-02-27 13:48:00 +00:00
Updated for PolarSSL 1.2.5
2013-02-02 18:23:57 +00:00
= Version 1.2.5 released 2013-02-02
Allow enabling of dummy error_strerror() to support some use-cases Enable a dummy error function to make use of error_strerror() in third party libraries easier. Disable if you run into name conflicts and want to really remove the error_strerror()
2013-02-02 11:43:08 +00:00
Changes
* Allow enabling of dummy error_strerror() to support some use-cases
Disable debug messages that can introduce a timing side channel. Introduced the POLARSSL_SSL_DEBUG_ALL flag to enable all these debug messages in case somebody does want to see the reason checks fail.
2013-01-31 15:57:45 +00:00
* Debug messages about padding errors during SSL message decryption are
Correct indentation and labelling in ChangeLog
2017-07-26 10:49:40 +00:00
disabled by default and can be enabled with POLARSSL_SSL_DEBUG_ALL
Added sending of alert messages in case of decryption failures as per RFC The flag POLARSSL_SSL_ALERT_MESSAGES switched between enabling and disabling the sending of alert messages that give adversaries intel about the result of their action. PolarSSL can still communicate with other parties if they are disabled, but debugging of issues might be harder.
2013-01-31 16:13:13 +00:00
* Sending of security-relevant alert messages that do not break
interoperability can be switched on/off with the flag
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
POLARSSL_SSL_ALL_ALERT_MESSAGES
Allow enabling of dummy error_strerror() to support some use-cases Enable a dummy error function to make use of error_strerror() in third party libraries easier. Disable if you run into name conflicts and want to really remove the error_strerror()
2013-02-02 11:43:08 +00:00
Fixed timing difference resulting from badly formatted padding.
2013-01-03 13:52:21 +00:00
Security
* Removed timing differences during SSL message decryption in
ssl_decrypt_buf() due to badly formatted padding
Updated for PolarSSL 1.2.4
2013-01-25 16:11:37 +00:00
= Version 1.2.4 released 2013-01-25
Added ssl_handshake_step() to allow single stepping the handshake process Single stepping the handshake process allows for better support of non-blocking network stacks and for getting information from specific handshake messages if wanted.
2013-01-25 13:49:24 +00:00
Changes
Moved to advanced ciphersuite representation and more dynamic SSL code
2013-01-07 17:20:04 +00:00
* More advanced SSL ciphersuite representation and moved to more dynamic
SSL core
Added ssl_handshake_step() to allow single stepping the handshake process Single stepping the handshake process allows for better support of non-blocking network stacks and for getting information from specific handshake messages if wanted.
2013-01-25 13:49:24 +00:00
* Added ssl_handshake_step() to allow single stepping the handshake process
Memory leak when using RSA_PKCS_V21 operations fixed
2013-01-03 09:50:31 +00:00
Bugfix
* Memory leak when using RSA_PKCS_V21 operations fixed
Handle future version properly in ssl_write_certificate_request()
2013-01-03 10:41:08 +00:00
* Handle future version properly in ssl_write_certificate_request()
Correctly handle CertificateRequest with empty DN list in <= TLS 1.1
2013-01-22 12:45:33 +00:00
* Correctly handle CertificateRequest message in client for <= TLS 1.1
without DN list
Memory leak when using RSA_PKCS_V21 operations fixed
2013-01-03 09:50:31 +00:00
Updated for release 1.2.3
2012-11-26 15:28:25 +00:00
= Version 1.2.3 released 2012-11-26
Bugfix
* Server not always sending correct CertificateRequest message
Updated for 1.2.2 release
2012-11-24 11:20:19 +00:00
= Version 1.2.2 released 2012-11-24
Added p_hw_data to ssl_context for context specific hardware acceleration data
2012-11-20 12:50:22 +00:00
Changes
* Added p_hw_data to ssl_context for context specific hardware acceleration
data
Correct indentation and labelling in ChangeLog
2017-07-26 10:49:40 +00:00
* During verify trust-CA is only checked for expiration and CRL presence
Added p_hw_data to ssl_context for context specific hardware acceleration data
2012-11-20 12:50:22 +00:00
Amended ChangeLog for client authentication fix
2012-11-23 13:02:40 +00:00
Bugfixes
Updated for 1.2.2 release
2012-11-24 11:20:19 +00:00
* Fixed client authentication compatibility
* Fixed dependency on POLARSSL_SHA4_C in SSL modules
Amended ChangeLog for client authentication fix
2012-11-23 13:02:40 +00:00
Updated date for release
2012-11-20 09:58:09 +00:00
= Version 1.2.1 released 2012-11-20
- Depth that the certificate verify callback receives is now numbered bottom-up (Peer cert depth is 0)
2012-11-14 12:11:38 +00:00
Changes
* Depth that the certificate verify callback receives is now numbered
bottom-up (Peer cert depth is 0)
- Fixes for MSVC6
2012-11-02 10:59:36 +00:00
Bugfixes
* Fixes for MSVC6
- Moved mpi_inv_mod() outside POLARSSL_GENPRIME
2012-11-02 11:02:58 +00:00
* Moved mpi_inv_mod() outside POLARSSL_GENPRIME
- Allow R and A to point to same mpi in mpi_div_mpi
2012-11-13 10:25:21 +00:00
* Allow R and A to point to same mpi in mpi_div_mpi (found by Manuel
Pégourié-Gonnard)
Fixed segfault in mpi_shift_r() Fixed memory leak in test_suite_mpi Amended ChangeLog
2012-11-17 11:42:51 +00:00
* Fixed possible segfault in mpi_shift_r() (found by Manuel
Pégourié-Gonnard)
- Added max length check for rsa_pkcs1_sign with PKCS#1 v2.1
2012-11-13 12:13:27 +00:00
* Added max length check for rsa_pkcs1_sign with PKCS#1 v2.1
- Fixes for MSVC6
2012-11-02 10:59:36 +00:00
- Updated for PolarSSL 1.2.0
2012-10-31 13:55:27 +00:00
= Version 1.2.0 released 2012-10-31
- Added support for NULL cipher (POLARSSL_CIPHER_NULL_CIPHER) and weak ciphersuites (POLARSSL_ENABLE_WEAK_CIPHERSUITES). They are disabled by default!
2012-02-06 16:45:10 +00:00
Features
* Added support for NULL cipher (POLARSSL_CIPHER_NULL_CIPHER) and weak
ciphersuites (POLARSSL_ENABLE_WEAK_CIPHERSUITES). They are disabled by
default!
- Added support for wildcard certificates - Added support for multi-domain certificates through the X509 Subject Alternative Name extension
2012-02-11 16:09:32 +00:00
* Added support for wildcard certificates
* Added support for multi-domain certificates through the X509 Subject
Alternative Name extension
- Added preliminary ASN.1 buffer writing support - Added preliminary X509 Certificate Request writing support - Added key_app_writer example application - Added cert_req example application
2012-02-13 23:11:30 +00:00
* Added preliminary ASN.1 buffer writing support
* Added preliminary X509 Certificate Request writing support
* Added key_app_writer example application
* Added cert_req example application
- Added base Galois/Counter mode (GCM) for AES
2012-03-20 13:50:09 +00:00
* Added base Galois Counter Mode (GCM) for AES
- Added Secure Renegotiation (RFC 5746)
2012-09-16 19:57:18 +00:00
* Added TLS 1.2 support (RFC 5246)
- Added GCM ciphersuites to TLS implementation
2012-04-18 14:23:57 +00:00
* Added GCM suites to TLS 1.2 (RFC 5288)
- Added commandline error code convertor (util/strerror)
2012-05-08 08:36:15 +00:00
* Added commandline error code convertor (util/strerror)
- Added support for Hardware Acceleration hooking in SSL/TLS
2012-05-08 09:17:57 +00:00
* Added support for Hardware Acceleration hooking in SSL/TLS
- Added OpenSSL / PolarSSL compatibility script (tests/compat.sh) and example application (programs/ssl/o_p_test) (Requires OpenSSL) - Handle encryption with private key and decryption with public key as per RFC 2313
2012-05-19 08:43:48 +00:00
* Added OpenSSL / PolarSSL compatibility script (tests/compat.sh) and
- Updated for PolarSSL 1.2.0
2012-10-31 13:55:27 +00:00
example application (programs/ssl/o_p_test) (requires OpenSSL)
- Added X509 CA Path support
2012-06-04 12:46:42 +00:00
* Added X509 CA Path support
- Added Thumb assembly optimizations
2012-07-02 08:36:36 +00:00
* Added Thumb assembly optimizations
- Added DEFLATE compression support as per RFC3749 (requires zlib)
2012-07-03 13:30:23 +00:00
* Added DEFLATE compression support as per RFC3749 (requires zlib)
- Added Blowfish to generic cipher layer - Renamed POLARSSL_MODE_CFB128 to POLARSSL_MODE_CFB
2012-07-04 17:10:40 +00:00
* Added blowfish algorithm (Generic and cipher layer)
- Added PKCS#5 PBKDF2 key derivation function
2012-08-23 13:03:18 +00:00
* Added PKCS#5 PBKDF2 key derivation function
- Added Secure Renegotiation (RFC 5746)
2012-09-16 19:57:18 +00:00
* Added Secure Renegotiation (RFC 5746)
- Added predefined DHM groups from RFC 5114
2012-09-25 09:36:44 +00:00
* Added predefined DHM groups from RFC 5114
- Added simple SSL session cache implementation - Revamped session resumption handling
2012-09-25 21:55:46 +00:00
* Added simple SSL session cache implementation
- Added ServerName extension parsing (SNI) at server side
2012-09-27 21:49:42 +00:00
* Added ServerName extension parsing (SNI) at server side
- Added option to add minimum accepted SSL/TLS protocol version
2012-09-28 13:28:45 +00:00
* Added option to add minimum accepted SSL/TLS protocol version
- Added support for NULL cipher (POLARSSL_CIPHER_NULL_CIPHER) and weak ciphersuites (POLARSSL_ENABLE_WEAK_CIPHERSUITES). They are disabled by default!
2012-02-06 16:45:10 +00:00
- Removed redundant POLARSSL_DEBUG_MSG define
2012-02-11 16:17:43 +00:00
Changes
* Removed redundant POLARSSL_DEBUG_MSG define
- AES code only check for Padlock once
2012-02-12 17:31:04 +00:00
* AES code only check for Padlock once
- Const correctness mpi_get_bit() - Documentation mpi_lsb(), mpi_msb()
2012-05-08 12:01:43 +00:00
* Fixed const-correctness mpi_get_bit()
* Documentation for mpi_lsb() and mpi_msb()
- Moved out_msg to out_hdr + 32 to support hardware acceleration
2012-05-08 13:16:14 +00:00
* Moved out_msg to out_hdr + 32 to support hardware acceleration
- Changed certificate verify behaviour to comply with RFC 6125 section 6.3 to not match CN if subjectAltName extension is present.
2012-05-10 14:12:46 +00:00
* Changed certificate verify behaviour to comply with RFC 6125 section 6.3
- Updated with tickets
2012-05-16 07:57:36 +00:00
to not match CN if subjectAltName extension is present (Closes ticket #56)
- Added Blowfish to generic cipher layer - Renamed POLARSSL_MODE_CFB128 to POLARSSL_MODE_CFB
2012-07-04 17:10:40 +00:00
* Cipher layer cipher_mode_t POLARSSL_MODE_CFB128 is renamed to
POLARSSL_MODE_CFB, to also handle different block size CFB modes.
- Removed handling for SSLv2 Client Hello (as per RFC 5246 recommendation)
2012-09-09 19:17:02 +00:00
* Removed handling for SSLv2 Client Hello (as per RFC 5246 recommendation)
- Added simple SSL session cache implementation - Revamped session resumption handling
2012-09-25 21:55:46 +00:00
* Revamped session resumption handling
- Generalized external private key implementation handling (like PKCS#11) in SSL/TLS
2012-09-27 19:15:01 +00:00
* Generalized external private key implementation handling (like PKCS#11)
in SSL/TLS
- Revamped x509_verify() and the SSL f_vrfy callback implementations
2012-09-28 07:10:55 +00:00
* Revamped x509_verify() and the SSL f_vrfy callback implementations
- Moved from unsigned long to uint32_t throughout code
2012-10-01 14:41:15 +00:00
* Moved from unsigned long to fixed width uint32_t types throughout code
- Moved ciphersuite naming scheme to IANA reserved names
2012-10-31 12:32:41 +00:00
* Renamed ciphersuites naming scheme to IANA reserved names
- Removed redundant POLARSSL_DEBUG_MSG define
2012-02-11 16:17:43 +00:00
- Added Changelog for bugfix in mpi_cmp_mpi()
2012-03-22 14:10:22 +00:00
Bugfix
2012-03-22 14:19:49 +00:00
* Fixed handling error in mpi_cmp_mpi() on longer B values (found by
Hui Dong)
- Fixed potential heap corruption in x509_name allocation
2012-05-01 08:14:20 +00:00
* Fixed potential heap corruption in x509_name allocation
- Updated with tickets
2012-05-16 07:57:36 +00:00
* Fixed single RSA test that failed on Big Endian systems (Closes ticket #54)
- mpi_exp_mod() now correctly handles negative base numbers (Closes ticket #52)
2012-05-16 08:02:29 +00:00
* mpi_exp_mod() now correctly handles negative base numbers (Closes ticket
#52)
- Added OpenSSL / PolarSSL compatibility script (tests/compat.sh) and example application (programs/ssl/o_p_test) (Requires OpenSSL) - Handle encryption with private key and decryption with public key as per RFC 2313
2012-05-19 08:43:48 +00:00
* Handle encryption with private key and decryption with public key as per
Fix minor code style issues
2018-03-13 15:22:58 +00:00
RFC 2313
- Handle empty certificate subject names
2012-06-27 11:51:09 +00:00
* Handle empty certificate subject names
- Better checking for reading over buffer boundaries - Zeroize altSubjectName chain memory before use
2012-08-23 10:49:55 +00:00
* Prevent reading over buffer boundaries on X509 certificate parsing
- Added bug
2012-09-16 21:35:30 +00:00
* mpi_add_abs() now correctly handles adding short numbers to long numbers
- Added credits
2012-09-25 08:19:56 +00:00
with carry rollover (found by Ruslan Yushchenko)
- Handle existence of OpenSSL Trust Extensions at end of X.509 DER blob
2012-09-25 12:10:00 +00:00
* Handle existence of OpenSSL Trust Extensions at end of X.509 DER blob
- Fixed for SPARC64
2012-10-30 07:29:57 +00:00
* Fixed MPI assembly for SPARC64 platform
- Added Changelog for bugfix in mpi_cmp_mpi()
2012-03-22 14:10:22 +00:00
- Fixed potential memory corruption on miscrafted client messages (found by Frama-C team at CEA LIST)
2012-04-05 12:07:34 +00:00
Security
- Fixed potential memory zeroization on miscrafted RSA key
2012-07-05 13:58:08 +00:00
* Fixed potential memory zeroization on miscrafted RSA key (found by Eloi
Vanderbeken)
- Fixed potential memory corruption on miscrafted client messages (found by Frama-C team at CEA LIST)
2012-04-05 12:07:34 +00:00
Fixed release date for 1.3.0
2013-10-01 08:12:42 +00:00
= Version 1.1.8 released on 2013-10-01
Added 1.1.8 and 1.2.9 release
2013-09-26 08:12:19 +00:00
Bugfix
* Fixed potential memory leak when failing to resume a session
* Fixed potential file descriptor leaks
Security
* Potential buffer-overflow for ssl_read_record() (independently found by
both TrustInSoft and Paul Brodeur of Leviathan Security Group)
* Potential negative value misinterpretation in load_file()
* Potential heap buffer overflow on large hostname setting
PolarSSL 1.1.6 and PolarSSL 1.1.7 changed added to ChangeLog
2013-06-24 17:08:50 +00:00
= Version 1.1.7 released on 2013-06-19
Changes
* HAVEGE random generator disabled by default
Bugfix
* x509parse_crt() now better handles PEM error situations
* ssl_parse_certificate() now calls x509parse_crt_der() directly
instead of the x509parse_crt() wrapper that can also parse PEM
Fix minor code style issues
2018-03-13 15:22:58 +00:00
certificates
PolarSSL 1.1.6 and PolarSSL 1.1.7 changed added to ChangeLog
2013-06-24 17:08:50 +00:00
* Fixed values for 2-key Triple DES in cipher layer
* ssl_write_certificate_request() can handle empty ca_chain
Security
* A possible DoS during the SSL Handshake, due to faulty parsing of
PEM-encoded certificates has been fixed (found by Jack Lloyd)
= Version 1.1.6 released on 2013-03-11
Bugfix
* Fixed net_bind() for specified IP addresses on little endian systems
Changes
* Allow enabling of dummy error_strerror() to support some use-cases
* Debug messages about padding errors during SSL message decryption are
disabled by default and can be enabled with POLARSSL_SSL_DEBUG_ALL
Security
* Removed timing differences during SSL message decryption in
ssl_decrypt_buf()
* Removed timing differences due to bad padding from
rsa_rsaes_pkcs1_v15_decrypt() and rsa_pkcs1_decrypt() for PKCS#1 v1.5
operations
Added PolarSSL 1.1.5 ChangeLog from 1.1 branch
2013-01-25 15:07:49 +00:00
= Version 1.1.5 released on 2013-01-16
Bugfix
* Fixed MPI assembly for SPARC64 platform
* Handle existence of OpenSSL Trust Extensions at end of X.509 DER blob
* mpi_add_abs() now correctly handles adding short numbers to long numbers
with carry rollover
* Moved mpi_inv_mod() outside POLARSSL_GENPRIME
* Prevent reading over buffer boundaries on X509 certificate parsing
* mpi_exp_mod() now correctly handles negative base numbers (Closes ticket
#52)
* Fixed possible segfault in mpi_shift_r() (found by Manuel
Pégourié-Gonnard)
* Allow R and A to point to same mpi in mpi_div_mpi (found by Manuel
Pégourié-Gonnard)
* Added max length check for rsa_pkcs1_sign with PKCS#1 v2.1
* Memory leak when using RSA_PKCS_V21 operations fixed
* Handle encryption with private key and decryption with public key as per
RFC 2313
* Fixes for MSVC6
Security
* Fixed potential memory zeroization on miscrafted RSA key (found by Eloi
Vanderbeken)
- Added release text for 1.1.4 to ChangeLog
2012-10-02 14:38:56 +00:00
= Version 1.1.4 released on 2012-05-31
Bugfix
* Correctly handle empty SSL/TLS packets (Found by James Yonan)
* Fixed potential heap corruption in x509_name allocation
* Fixed single RSA test that failed on Big Endian systems (Closes ticket #54)
- Added release notes for 1.1.2 and 1.1.3 to trunk
2012-05-08 09:04:04 +00:00
= Version 1.1.3 released on 2012-04-29
Bugfix
* Fixed random MPI generation to not generate more size than requested.
= Version 1.1.2 released on 2012-04-26
Bugfix
* Fixed handling error in mpi_cmp_mpi() on longer B values (found by
Hui Dong)
Security
* Fixed potential memory corruption on miscrafted client messages (found by
Frama-C team at CEA LIST)
* Fixed generation of DHM parameters to correct length (found by Ruslan
Yushchenko)
- Final changes for 1.1.1 release
2012-01-23 09:31:41 +00:00
= Version 1.1.1 released on 2012-01-23
- Check for failed malloc() in ssl_set_hostname() and x509_get_entries() (Closes ticket #47, found by Hugo Leisink)
2012-01-13 13:44:06 +00:00
Bugfix
* Check for failed malloc() in ssl_set_hostname() and x509_get_entries()
(Closes ticket #47, found by Hugo Leisink)
- Fixed issue with Intel compiler on 64-bit platforms
2012-01-21 05:41:23 +00:00
* Fixed issues with Intel compiler on 64-bit systems (Closes ticket #50)
- Final changes for 1.1.1 release
2012-01-23 09:31:41 +00:00
* Fixed multiple compiler warnings for VS6 and armcc
* Fixed bug in CTR_CRBG selftest
- Check for failed malloc() in ssl_set_hostname() and x509_get_entries() (Closes ticket #47, found by Hugo Leisink)
2012-01-13 13:44:06 +00:00
- Updated release date
2011-12-22 09:43:57 +00:00
= Version 1.1.0 released on 2011-12-22
- Added ssl_session_reset() to allow re-use of already set non-connection specific context information
2011-10-06 12:37:39 +00:00
Features
* Added ssl_session_reset() to allow better multi-connection pools of
SSL contexts without needing to set all non-connection-specific
Fix minor code style issues
2018-03-13 15:22:58 +00:00
data and pointers again. Adapted ssl_server to use this functionality.
- Added ssl_set_max_version() to set the client's maximum sent version number
2011-10-06 13:04:09 +00:00
* Added ssl_set_max_version() to allow clients to offer a lower maximum
supported version to a server to help buggy server implementations.
Fix minor code style issues
2018-03-13 15:22:58 +00:00
(Closes ticket #36)
- Added latest fix to ChangeLog
2011-11-11 10:55:02 +00:00
* Added cipher_get_cipher_mode() and cipher_get_cipher_operation()
introspection functions (Closes ticket #40)
- Added CTR_DRBG based on AES-256-CTR (NIST SP 800-90) random generator
2011-11-27 14:46:59 +00:00
* Added CTR_DRBG based on AES-256-CTR (NIST SP 800-90) random generator
- Added a generic entropy accumulator that provides support for adding custom entropy sources and added some generic and platform dependent entropy sources
2011-12-03 21:45:14 +00:00
* Added a generic entropy accumulator that provides support for adding
custom entropy sources and added some generic and platform dependent
Fix minor code style issues
2018-03-13 15:22:58 +00:00
entropy sources
- Added ssl_session_reset() to allow re-use of already set non-connection specific context information
2011-10-06 12:37:39 +00:00
- Clarified use of AES and Camellia in CFB and CTR modes
2011-10-06 13:11:08 +00:00
Changes
* Documentation for AES and Camellia in modes CTR and CFB128 clarified.
- Fixed rsa_encrypt and rsa_decrypt example programs to use public key for encryption and private key for decryption (Fixes ticket #34)
2011-10-06 13:18:27 +00:00
* Fixed rsa_encrypt and rsa_decrypt examples to use public key for
encryption and private key for decryption. (Closes ticket #34)
- Inceased maximum size of ASN1 length reads to 32-bits
2011-10-12 09:52:22 +00:00
* Inceased maximum size of ASN1 length reads to 32-bits.
- Added an EXPLICIT tag number parameter to x509_get_ext()
2011-10-12 09:56:41 +00:00
* Added an EXPLICIT tag number parameter to x509_get_ext()
- Added a separate CRL entry extension parsing function
2011-10-12 09:58:41 +00:00
* Added a separate CRL entry extension parsing function
- Extracted ASN.1 parsing code from the X.509 parsing code. Added new module.
2011-11-10 14:43:23 +00:00
* Separated the ASN.1 parsing code from the X.509 specific parsing code.
So now there is a module that is controlled with POLARSSL_ASN1_PARSE_C.
- Changed the defined key-length of DES ciphers in cipher.h to include the parity bits, to prevent mistakes in copying data. (Closes ticket #33)
2011-11-15 15:38:45 +00:00
* Changed the defined key-length of DES ciphers in cipher.h to include the
parity bits, to prevent mistakes in copying data. (Closes ticket #33)
- Lots of minimal changes to better support WINCE as a build target
2011-11-18 14:26:47 +00:00
* Loads of minimal changes to better support WINCE as a build target
- Added credits!
2011-11-18 14:34:17 +00:00
(Credits go to Marco Lizza)
- Added POLARSSL_MPI_WINDOW_SIZE definition to allow easier time to memory trade-off
2011-11-25 11:52:11 +00:00
* Added POLARSSL_MPI_WINDOW_SIZE definition to allow easier time to memory
trade-off
- Introduced POLARSSL_MPI_MAX_SIZE and POLARSSL_MPI_MAX_BITS for MPI size management (Closes ticket #44)
2011-11-25 12:11:43 +00:00
* Introduced POLARSSL_MPI_MAX_SIZE and POLARSSL_MPI_MAX_BITS for MPI size
management (Closes ticket #44)
- Changed the used random function pointer to more flexible format. Renamed havege_rand() to havege_random() to prevent mistakes. Lots of changes as a consequence in library code and programs
2011-11-27 21:07:34 +00:00
* Changed the used random function pointer to more flexible format. Renamed
havege_rand() to havege_random() to prevent mistakes. Lots of changes as
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
a consequence in library code and programs
- Moved all examples programs to use the new entropy and CTR_DRBG
2011-12-04 17:09:26 +00:00
* Moved all examples programs to use the new entropy and CTR_DRBG
- Added permissive certificate parsing to x509parse_crt() and x509parse_crtfile(). With permissive parsing the parsing does not stop on encountering a parse-error
2011-12-04 12:24:18 +00:00
* Added permissive certificate parsing to x509parse_crt() and
x509parse_crtfile(). With permissive parsing the parsing does not stop on
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
encountering a parse-error. Beware that the meaning of return values has
changed!
- Changed the behaviour of x509parse_parse_crt for permissive parsing. Now returns the number of 'failed certificates' instead of having a switch to enable it. - As a consequence all error code that were positive were changed. A lot of MALLOC_FAILED and FILE_IO_ERROR error codes added for different modules. - Programs and tests were adapted accordingly
2011-12-10 21:55:01 +00:00
* All error codes are now negative. Even on mermory failures and IO errors.
- Clarified use of AES and Camellia in CFB and CTR modes
2011-10-06 13:11:08 +00:00
- Fixed faulty HMAC-MD2 implementation (Fixes ticket #37)
2011-10-06 14:18:49 +00:00
Bugfix
* Fixed faulty HMAC-MD2 implementation. Found by dibac. (Closes
ticket #37)
- Fixed a bug where the CRL parser expected an EXPLICIT ASN.1 tag before version numbers
2011-10-12 09:55:01 +00:00
* Fixed a bug where the CRL parser expected an EXPLICIT ASN.1 tag
before version numbers
- Allowed X509 key usage parsing to accept 4 byte values instead of the standard 1 byte version sometimes used by Microsoft. (Closes ticket #38)
2011-11-11 15:01:31 +00:00
* Allowed X509 key usage parsing to accept 4 byte values instead of the
standard 1 byte version sometimes used by Microsoft. (Closes ticket #38)
- Fixed incorrect behaviour in case of RSASSA-PSS with a salt length smaller than the hash length. (Closes ticket #41)
2011-11-15 15:26:03 +00:00
* Fixed incorrect behaviour in case of RSASSA-PSS with a salt length
smaller than the hash length. (Closes ticket #41)
- * If certificate serial is longer than 32 octets, serial number is now appended with '....' after first 28 octets
2011-11-25 12:37:37 +00:00
* If certificate serial is longer than 32 octets, serial number is now
appended with '....' after first 28 octets
- Improved build support for s390x and sparc64 in bignum.h
2011-11-26 09:23:07 +00:00
* Improved build support for s390x and sparc64 in bignum.h
- Fixed MS Visual C++ name clash with int64 in sha4.h
2011-12-04 22:10:28 +00:00
* Fixed MS Visual C++ name clash with int64 in sha4.h
- Updated version of PolarSSL to 1.1.0
2011-12-05 14:38:36 +00:00
* Corrected removal of leading "00:" in printing serial numbers in
- Corrected removal of leading '00:' in printing serial numbers in certificates and CRLs
2011-12-05 14:22:49 +00:00
certificates and CRLs
- Fixed faulty HMAC-MD2 implementation (Fixes ticket #37)
2011-10-06 14:18:49 +00:00
- Preparations for v1.0.0 release of PolarSSL
2011-07-27 17:03:00 +00:00
= Version 1.0.0 released on 2011-07-27
- Expanded generic cipher layer with support for CTR and CFB128 modes of operation.
2011-06-09 14:27:58 +00:00
Features
* Expanded cipher layer with support for CFB128 and CTR mode
- Added rsa_encrypt and rsa_decrypt example programs
2011-08-09 10:30:36 +00:00
* Added rsa_encrypt and rsa_decrypt simple example programs.
- Expanded generic cipher layer with support for CTR and CFB128 modes of operation.
2011-06-09 14:27:58 +00:00
- Updated to reflect changes in error codes in the generic cipher and message digest layers
2011-06-09 15:55:41 +00:00
Changes
* The generic cipher and message digest layer now have normal error
codes instead of integers
- Undid fix for ssl_write that introduced a true bug when buffers are running full.
2011-06-08 13:10:54 +00:00
Bugfix
* Undid faulty bug fix in ssl_write() when flushing old data (Ticket
#18)
- Updated for release 0.99-pre5
2011-05-27 09:25:42 +00:00
= Version 0.99-pre5 released on 2011-05-26
- Added additional (configurable) cipher block modes. AES-CTR, Camellia-CTR, XTEA-CBC
2011-04-19 14:29:23 +00:00
Features
* Added additional Cipher Block Modes to symmetric ciphers
(AES CTR, Camellia CTR, XTEA CBC) including the option to
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
enable and disable individual modes when needed
- Functions requiring File System functions can now be disables by undefining POLARSSL_FS_IO
2011-04-25 15:28:35 +00:00
* Functions requiring File System functions can now be disabled
by undefining POLARSSL_FS_IO
- A error_strerror function() has been added to translate between error codes and their description. - The error codes have been remapped and combining error codes is now done with a PLUS instead of an OR as error codes used are negative. - Descriptions to all error codes have been added. - Generation script for error.c has been created to automatically generate error.c from the available error definitions in the headers.
2011-05-09 16:17:09 +00:00
* A error_strerror function() has been added to translate between
error codes and their description.
- Added mpi_get_bit() and mpi_set_bit() individual bit setter/getter functions.
2011-05-18 15:47:11 +00:00
* Added mpi_get_bit() and mpi_set_bit() individual bit setter/getter
functions.
- Added the ssl_mail_client example application
2011-05-23 12:07:29 +00:00
* Added ssl_mail_client and ssl_fork_server as example programs.
- Added additional (configurable) cipher block modes. AES-CTR, Camellia-CTR, XTEA-CBC
2011-04-19 14:29:23 +00:00
- Major type rewrite of int to size_t for most variables and arguments used for buffer lengths and loops
2011-04-24 08:57:21 +00:00
Changes
* Major argument / variable rewrite. Introduced use of size_t
instead of int for buffer lengths and loop variables for
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
better unsigned / signed use. Renamed internal bigint types
t_int and t_dbl to t_uint and t_udbl in the process
- mpi_init() and mpi_free() only accept a single argument and do not accept variable arguments anymore. This prevents unexpected memory corruption in a number of use cases.
2011-05-05 11:49:20 +00:00
* mpi_init() and mpi_free() now only accept a single MPI
argument and do not accept variable argument lists anymore.
- A error_strerror function() has been added to translate between error codes and their description. - The error codes have been remapped and combining error codes is now done with a PLUS instead of an OR as error codes used are negative. - Descriptions to all error codes have been added. - Generation script for error.c has been created to automatically generate error.c from the available error definitions in the headers.
2011-05-09 16:17:09 +00:00
* The error codes have been remapped and combining error codes
is now done with a PLUS instead of an OR as error codes
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
used are negative.
- Changed behaviour of net_recv(), ssl_fetch_input() and ssl_read(). net_recv() now returns 0 on EOF instead of POLARSSL_ERR_NET_CONN_RESET. ssl_fetch_input() returns POLARSSL_ERR_SSL_CONN_EOF on an EOF from its f_recv() function. ssl_read() returns 0 if a POLARSSL_ERR_SSL_CONN_EOF is received after the handshake. - Network functions now return POLARSSL_ERR_NET_WANT_READ or POLARSSL_ERR_NET_WANT_WRITE instead of the ambiguous POLARSSL_ERR_NET_TRY_AGAIN
2011-05-18 13:32:51 +00:00
* Changed behaviour of net_read(), ssl_fetch_input() and ssl_recv().
net_recv() now returns 0 on EOF instead of
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
POLARSSL_ERR_NET_CONN_RESET. ssl_fetch_input() returns
POLARSSL_ERR_SSL_CONN_EOF on an EOF from its f_recv() function.
ssl_read() returns 0 if a POLARSSL_ERR_SSL_CONN_EOF is received
after the handshake.
- Changed behaviour of net_recv(), ssl_fetch_input() and ssl_read(). net_recv() now returns 0 on EOF instead of POLARSSL_ERR_NET_CONN_RESET. ssl_fetch_input() returns POLARSSL_ERR_SSL_CONN_EOF on an EOF from its f_recv() function. ssl_read() returns 0 if a POLARSSL_ERR_SSL_CONN_EOF is received after the handshake. - Network functions now return POLARSSL_ERR_NET_WANT_READ or POLARSSL_ERR_NET_WANT_WRITE instead of the ambiguous POLARSSL_ERR_NET_TRY_AGAIN
2011-05-18 13:32:51 +00:00
* Network functions now return POLARSSL_ERR_NET_WANT_READ or
POLARSSL_ERR_NET_WANT_WRITE instead of the ambiguous
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
POLARSSL_ERR_NET_TRY_AGAIN
- Major type rewrite of int to size_t for most variables and arguments used for buffer lengths and loops
2011-04-24 08:57:21 +00:00
- Ready for release 0.99-pre4
2011-04-01 12:23:26 +00:00
= Version 0.99-pre4 released on 2011-04-01
- Added support for PKCS#1 v2.1 encoding and thus support for the RSAES-OAEP and RSASSA-PSS operations (enabled by POLARSSL_PKCS1_V21)
2011-03-08 14:16:06 +00:00
Features
* Added support for PKCS#1 v2.1 encoding and thus support
for the RSAES-OAEP and RSASSA-PSS operations.
- Added bugfix info for previous checkin
2011-03-25 14:01:32 +00:00
* Reading of Public Key files incorporated into default x509
functionality as well.
- Added mpi_fill_random() for centralized filling of big numbers with random data (Fixed ticket #10)
2011-03-26 13:18:49 +00:00
* Added mpi_fill_random() for centralized filling of big numbers
with random data (Fixed ticket #10)
- Added support for PKCS#1 v2.1 encoding and thus support for the RSAES-OAEP and RSASSA-PSS operations (enabled by POLARSSL_PKCS1_V21)
2011-03-08 14:16:06 +00:00
- Debug print of MPI now removes leading zero octets and displays actual bit size of the value
2011-03-14 20:41:31 +00:00
Changes
Correct indentation and labelling in ChangeLog
2017-07-26 10:49:40 +00:00
* Debug print of MPI now removes leading zero octets and
- Debug print of MPI now removes leading zero octets and displays actual bit size of the value
2011-03-14 20:41:31 +00:00
displays actual bit size of the value.
Correct indentation and labelling in ChangeLog
2017-07-26 10:49:40 +00:00
* x509parse_key() (and as a consequence x509parse_keyfile())
- Added information about changed behaviour of x509parse_key()
2011-03-26 13:17:12 +00:00
does not zeroize memory in advance anymore. Use rsa_init()
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
before parsing a key or keyfile!
- Debug print of MPI now removes leading zero octets and displays actual bit size of the value
2011-03-14 20:41:31 +00:00
Bugfix
* Debug output of MPI's now the same independent of underlying
platform (32-bit / 64-bit) (Fixes ticket #19, found by Mads
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
Kiilerich and Mihai Militaru)
- Fixed bug in ssl_write() when flushing old data (Fixes ticket #18)
2011-03-14 20:50:15 +00:00
* Fixed bug in ssl_write() when flushing old data (Fixed ticket
#18, found by Nikolay Epifanov)
- Added bugfix info for previous checkin
2011-03-25 14:01:32 +00:00
* Fixed proper handling of RSASSA-PSS verification with variable
length salt lengths
- Debug print of MPI now removes leading zero octets and displays actual bit size of the value
2011-03-14 20:41:31 +00:00
- Replaced function that fixes man-in-the-middle attack - Added message to indicate inclusion of man-in-the-middle attack (Reported by Larry Highsmith, Subreption LLC) - Released version 0.99-pre3
2011-02-28 21:20:02 +00:00
= Version 0.99-pre3 released on 2011-02-28
This release replaces version 0.99-pre2 which had possible copyright issues.
- Parsing of PEM files moved to separate module (Fixes ticket #13). Also possible to remove PEM support for systems only using DER encoding - Parsing PEM private keys encrypted with DES and AES are now supported (Fixes ticket #5) - Added tests for encrypted keyfiles
2011-02-12 14:30:57 +00:00
Features
* Parsing PEM private keys encrypted with DES and AES
are now supported as well (Fixes ticket #5)
- Added crl_app program to allow easy reading and printing of X509 CRLs from file
2011-02-12 15:27:28 +00:00
* Added crl_app program to allow easy reading and
printing of X509 CRLs from file
- Parsing of PEM files moved to separate module (Fixes ticket #13). Also possible to remove PEM support for systems only using DER encoding - Parsing PEM private keys encrypted with DES and AES are now supported (Fixes ticket #5) - Added tests for encrypted keyfiles
2011-02-12 14:30:57 +00:00
Changes
Correct indentation and labelling in ChangeLog
2017-07-26 10:49:40 +00:00
* Parsing of PEM files moved to separate module (Fixes
- Parsing of PEM files moved to separate module (Fixes ticket #13). Also possible to remove PEM support for systems only using DER encoding - Parsing PEM private keys encrypted with DES and AES are now supported (Fixes ticket #5) - Added tests for encrypted keyfiles
2011-02-12 14:30:57 +00:00
ticket #13). Also possible to remove PEM support for
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
systems only using DER encoding
- Parsing of PEM files moved to separate module (Fixes ticket #13). Also possible to remove PEM support for systems only using DER encoding - Parsing PEM private keys encrypted with DES and AES are now supported (Fixes ticket #5) - Added tests for encrypted keyfiles
2011-02-12 14:30:57 +00:00
- Corrected parsing of UTCTime dates before 1990 and after 1950 - Support more exotic OID's when parsing certificates - Support more exotic name representations when parsing certificates - Replaced the expired test certificates
2011-02-20 10:40:16 +00:00
Bugfixes
* Corrected parsing of UTCTime dates before 1990 and
after 1950
* Support more exotic OID's when parsing certificates
Fix minor code style issues
2018-03-13 15:22:58 +00:00
(found by Mads Kiilerich)
- Corrected parsing of UTCTime dates before 1990 and after 1950 - Support more exotic OID's when parsing certificates - Support more exotic name representations when parsing certificates - Replaced the expired test certificates
2011-02-20 10:40:16 +00:00
* Support more exotic name representations when parsing
- Do not bail out if no client certificate specified. Try to negotiate anonymous connection (Fixes ticket #12)
2011-02-20 13:49:27 +00:00
certificates (found by Mads Kiilerich)
- Corrected parsing of UTCTime dates before 1990 and after 1950 - Support more exotic OID's when parsing certificates - Support more exotic name representations when parsing certificates - Replaced the expired test certificates
2011-02-20 10:40:16 +00:00
* Replaced the expired test certificates
- Do not bail out if no client certificate specified. Try to negotiate anonymous connection (Fixes ticket #12)
2011-02-20 13:49:27 +00:00
* Do not bail out if no client certificate specified. Try
to negotiate anonymous connection (Fixes ticket #12,
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
found by Boris Krasnovskiy)
- Corrected parsing of UTCTime dates before 1990 and after 1950 - Support more exotic OID's when parsing certificates - Support more exotic name representations when parsing certificates - Replaced the expired test certificates
2011-02-20 10:40:16 +00:00
- Replaced function that fixes man-in-the-middle attack - Added message to indicate inclusion of man-in-the-middle attack (Reported by Larry Highsmith, Subreption LLC) - Released version 0.99-pre3
2011-02-28 21:20:02 +00:00
Security fixes
* Fixed a possible Man-in-the-Middle attack on the
Diffie Hellman key exchange (thanks to Larry Highsmith,
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
Subreption LLC)
- Replaced function that fixes man-in-the-middle attack - Added message to indicate inclusion of man-in-the-middle attack (Reported by Larry Highsmith, Subreption LLC) - Released version 0.99-pre3
2011-02-28 21:20:02 +00:00
- Preparing for Release of 0.99 prerelease 1
2011-01-30 16:59:02 +00:00
= Version 0.99-pre1 released on 2011-01-30
- Added Doxygen source code documentation parts (donated by Fox-IT)
2011-01-06 12:28:03 +00:00
Features
- Added verification callback in certificate verification chain in order to allow external blacklisting
2011-01-13 17:54:59 +00:00
Note: Most of these features have been donated by Fox-IT
* Added Doxygen source code documentation parts
- Added reading of DHM context from memory and file
2011-01-06 15:48:19 +00:00
* Added reading of DHM context from memory and file
- Improved X509 certificate parsing to include extended certificate fields, such as Key Usage
2011-01-15 16:57:55 +00:00
* Improved X509 certificate parsing to include extended
- Improved certificate validation and validation against the available CRLs
2011-01-16 21:12:10 +00:00
certificate fields, including Key Usage
* Improved certificate verification and verification
against the available CRLs
- Support for DES weak keys and parity bits added
2011-01-15 17:32:24 +00:00
* Detection for DES weak keys and parity bits added
- Improved information provided about current Hashing, Cipher and Suite capabilities
2011-01-16 21:27:44 +00:00
* Improvements to support integration in other
applications:
+ Added generic message digest and cipher wrapper
+ Improved information about current capabilities,
status, objects and configuration
+ Added verification callback on certificate chain
verification to allow external blacklisting
Fix minor code style issues
2018-03-13 15:22:58 +00:00
+ Additional example programs to show usage
- Support for PKCS#11 through the use of the pkcs11-helper library
2011-01-18 15:27:19 +00:00
* Added support for PKCS#11 through the use of the
libpkcs11-helper library
- Added Doxygen source code documentation parts (donated by Fox-IT)
2011-01-06 12:28:03 +00:00
- x509parse_time_expired() checks time now in addition to the existing date check
2011-01-16 21:40:22 +00:00
Changes
* x509parse_time_expired() checks time in addition to
the existing date check
- Renamed ciphers member of ssl_context and cipher member of ssl_session to ciphersuites and ciphersuite respectively. This clarifies the difference with the generic cipher layer and is better naming altogether - Adapted in the rest of using code as well
2011-01-27 17:40:50 +00:00
* The ciphers member of ssl_context and the cipher member
of ssl_session have been renamed to ciphersuites and
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
ciphersuite respectively. This clarifies the difference
with the generic cipher layer and is better naming
altogether
- x509parse_time_expired() checks time now in addition to the existing date check
2011-01-16 21:40:22 +00:00
- Changed line endings and encodings to unix and utf-8
2011-01-05 14:48:42 +00:00
= Version 0.14.0 released on 2010-08-16
Features
* Added support for SSL_EDH_RSA_AES_128_SHA and
SSL_EDH_RSA_CAMELLIA_128_SHA ciphersuites
* Added compile-time and run-time version information
* Expanded ssl_client2 arguments for more flexibility
* Added support for TLS v1.1
Changes
* Made Makefile cleaner
* Removed dependency on rand() in rsa_pkcs1_encrypt().
Now using random fuction provided to function and
Fixed whitespaces in ChangeLog
2013-03-06 16:06:21 +00:00
changed the prototype of rsa_pkcs1_encrypt(),
rsa_init() and rsa_gen_key().
- Changed line endings and encodings to unix and utf-8
2011-01-05 14:48:42 +00:00
* Some SSL defines were renamed in order to avoid
future confusion
Bug fixes
* Fixed CMake out of source build for tests (found by
kkert)
* rsa_check_private() now supports PKCS1v2 keys as well
* Fixed deadlock in rsa_pkcs1_encrypt() on failing random
generator
= Version 0.13.1 released on 2010-03-24
Bug fixes
* Fixed Makefile in library that was mistakenly merged
* Added missing const string fixes
= Version 0.13.0 released on 2010-03-21
Features
* Added option parsing for host and port selection to
ssl_client2
* Added support for GeneralizedTime in X509 parsing
* Added cert_app program to allow easy reading and
printing of X509 certificates from file or SSL
connection.
Changes
* Added const correctness for main code base
* X509 signature algorithm determination is now
in a function to allow easy future expansion
* Changed symmetric cipher functions to
identical interface (returning int result values)
Fixed spelling / typos (from PowerDNS:codespell)
2013-10-29 09:02:51 +00:00
* Changed ARC4 to use separate input/output buffer
- Changed line endings and encodings to unix and utf-8
2011-01-05 14:48:42 +00:00
* Added reset function for HMAC context as speed-up
for specific use-cases
Bug fixes
* Fixed bug resulting in failure to send the last
certificate in the chain in ssl_write_certificate() and
ssl_write_certificate_request() (found by fatbob)
* Added small fixes for compiler warnings on a Mac
(found by Frank de Brabander)
* Fixed algorithmic bug in mpi_is_prime() (found by
Smbat Tonoyan)
= Version 0.12.1 released on 2009-10-04
Changes
* Coverage test definitions now support 'depends_on'
tagging system.
* Tests requiring specific hashing algorithms now honor
the defines.
Bug fixes
* Changed typo in #ifdef in x509parse.c (found
by Eduardo)
= Version 0.12.0 released on 2009-07-28
Features
* Added CMake makefiles as alternative to regular Makefiles.
* Added preliminary Code Coverage tests for AES, ARC4,
Base64, MPI, SHA-family, MD-family, HMAC-SHA-family,
Camellia, DES, 3-DES, RSA PKCS#1, XTEA, Diffie-Hellman
and X509parse.
Changes
* Error codes are not (necessarily) negative. Keep
this is mind when checking for errors.
* RSA_RAW renamed to SIG_RSA_RAW for consistency.
* Fixed typo in name of POLARSSL_ERR_RSA_OUTPUT_TOO_LARGE.
* Changed interface for AES and Camellia setkey functions
to indicate invalid key lengths.
Bug fixes
* Fixed include location of endian.h on FreeBSD (found by
Gabriel)
* Fixed include location of endian.h and name clash on
Apples (found by Martin van Hensbergen)
* Fixed HMAC-MD2 by modifying md2_starts(), so that the
required HMAC ipad and opad variables are not cleared.
(found by code coverage tests)
Correct indentation and labelling in ChangeLog
2017-07-26 10:49:40 +00:00
* Prevented use of long long in bignum if
- Changed line endings and encodings to unix and utf-8
2011-01-05 14:48:42 +00:00
POLARSSL_HAVE_LONGLONG not defined (found by Giles
Bathgate).
* Fixed incorrect handling of negative strings in
mpi_read_string() (found by code coverage tests).
* Fixed segfault on handling empty rsa_context in
rsa_check_pubkey() and rsa_check_privkey() (found by
code coverage tests).
* Fixed incorrect handling of one single negative input
value in mpi_add_abs() (found by code coverage tests).
* Fixed incorrect handling of negative first input
value in mpi_sub_abs() (found by code coverage tests).
* Fixed incorrect handling of negative first input
value in mpi_mod_mpi() and mpi_mod_int(). Resulting
change also affects mpi_write_string() (found by code
coverage tests).
* Corrected is_prime() results for 0, 1 and 2 (found by
code coverage tests).
* Fixed Camellia and XTEA for 64-bit Windows systems.
= Version 0.11.1 released on 2009-05-17
* Fixed missing functionality for SHA-224, SHA-256, SHA384,
SHA-512 in rsa_pkcs1_sign()
= Version 0.11.0 released on 2009-05-03
* Fixed a bug in mpi_gcd() so that it also works when both
input numbers are even and added testcases to check
(found by Pierre Habouzit).
* Added support for SHA-224, SHA-256, SHA-384 and SHA-512
one way hash functions with the PKCS#1 v1.5 signing and
verification.
* Fixed minor bug regarding mpi_gcd located within the
POLARSSL_GENPRIME block.
* Fixed minor memory leak in x509parse_crt() and added better
handling of 'full' certificate chains (found by Mathias
Olsson).
* Centralized file opening and reading for x509 files into
load_file()
* Made definition of net_htons() endian-clean for big endian
systems (Found by Gernot).
* Undefining POLARSSL_HAVE_ASM now also handles prevents asm in
Correct indentation and labelling in ChangeLog
2017-07-26 10:49:40 +00:00
padlock and timing code.
- Changed line endings and encodings to unix and utf-8
2011-01-05 14:48:42 +00:00
* Fixed an off-by-one buffer allocation in ssl_set_hostname()
responsible for crashes and unwanted behaviour.
* Added support for Certificate Revocation List (CRL) parsing.
* Added support for CRL revocation to x509parse_verify() and
SSL/TLS code.
* Fixed compatibility of XTEA and Camellia on a 64-bit system
(found by Felix von Leitner).
= Version 0.10.0 released on 2009-01-12
* Migrated XySSL to PolarSSL
* Added XTEA symmetric cipher
* Added Camellia symmetric cipher
* Added support for ciphersuites: SSL_RSA_CAMELLIA_128_SHA,
SSL_RSA_CAMELLIA_256_SHA and SSL_EDH_RSA_CAMELLIA_256_SHA
* Fixed dangerous bug that can cause a heap overflow in
rsa_pkcs1_decrypt (found by Christophe Devine)
================================================================
XySSL ChangeLog
= Version 0.9 released on 2008-03-16
* Added support for ciphersuite: SSL_RSA_AES_128_SHA
* Enabled support for large files by default in aescrypt2.c
* Preliminary openssl wrapper contributed by David Barrett
* Fixed a bug in ssl_write() that caused the same payload to
be sent twice in non-blocking mode when send returns EAGAIN
* Fixed ssl_parse_client_hello(): session id and challenge must
not be swapped in the SSLv2 ClientHello (found by Greg Robson)
* Added user-defined callback debug function (Krystian Kolodziej)
* Before freeing a certificate, properly zero out all cert. data
* Fixed the "mode" parameter so that encryption/decryption are
not swapped on PadLock; also fixed compilation on older versions
of gcc (bug reported by David Barrett)
* Correctly handle the case in padlock_xcryptcbc() when input or
Fix #2370, minor typos and spelling mistakes
2019-01-23 14:24:37 +00:00
output data is non-aligned by falling back to the software
- Changed line endings and encodings to unix and utf-8
2011-01-05 14:48:42 +00:00
implementation, as VIA Nehemiah cannot handle non-aligned buffers
* Fixed a memory leak in x509parse_crt() which was reported by Greg
Robson-Garth; some x509write.c fixes by Pascal Vizeli, thanks to
Matthew Page who reported several bugs
* Fixed x509_get_ext() to accept some rare certificates which have
an INTEGER instead of a BOOLEAN for BasicConstraints::cA.
* Added support on the client side for the TLS "hostname" extension
(patch contributed by David Patino)
* Make x509parse_verify() return BADCERT_CN_MISMATCH when an empty
string is passed as the CN (bug reported by spoofy)
* Added an option to enable/disable the BN assembly code
* Updated rsa_check_privkey() to verify that (D*E) = 1 % (P-1)*(Q-1)
* Disabled obsolete hash functions by default (MD2, MD4); updated
selftest and benchmark to not test ciphers that have been disabled
* Updated x509parse_cert_info() to correctly display byte 0 of the
serial number, setup correct server port in the ssl client example
* Fixed a critical denial-of-service with X.509 cert. verification:
peer may cause xyssl to loop indefinitely by sending a certificate
for which the RSA signature check fails (bug reported by Benoit)
* Added test vectors for: AES-CBC, AES-CFB, DES-CBC and 3DES-CBC,
HMAC-MD5, HMAC-SHA1, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512
* Fixed HMAC-SHA-384 and HMAC-SHA-512 (thanks to Josh Sinykin)
* Modified ssl_parse_client_key_exchange() to protect against
Daniel Bleichenbacher attack on PKCS#1 v1.5 padding, as well
as the Klima-Pokorny-Rosa extension of Bleichenbacher's attack
* Updated rsa_gen_key() so that ctx->N is always nbits in size
* Fixed assembly PPC compilation errors on Mac OS X, thanks to
David Barrett and Dusan Semen
= Version 0.8 released on 2007-10-20
* Modified the HMAC functions to handle keys larger
than 64 bytes, thanks to Stephane Desneux and gary ng
* Fixed ssl_read_record() to properly update the handshake
message digests, which fixes IE6/IE7 client authentication
* Cleaned up the XYSSL* #defines, suggested by Azriel Fasten
* Fixed net_recv(), thanks to Lorenz Schori and Egon Kocjan
* Added user-defined callbacks for handling I/O and sessions
* Added lots of debugging output in the SSL/TLS functions
* Added preliminary X.509 cert. writing by Pascal Vizeli
* Added preliminary support for the VIA PadLock routines
* Added AES-CFB mode of operation, contributed by chmike
* Added an SSL/TLS stress testing program (ssl_test.c)
* Updated the RSA PKCS#1 code to allow choosing between
RSA_PUBLIC and RSA_PRIVATE, as suggested by David Barrett
* Updated ssl_read() to skip 0-length records from OpenSSL
* Fixed the make install target to comply with *BSD make
* Fixed a bug in mpi_read_binary() on 64-bit platforms
* mpi_is_prime() speedups, thanks to Kevin McLaughlin
* Fixed a long standing memory leak in mpi_is_prime()
* Replaced realloc with malloc in mpi_grow(), and set
the sign of zero as positive in mpi_init() (reported
by Jonathan M. McCune)
= Version 0.7 released on 2007-07-07
* Added support for the MicroBlaze soft-core processor
* Fixed a bug in ssl_tls.c which sometimes prevented SSL
connections from being established with non-blocking I/O
* Fixed a couple bugs in the VS6 and UNIX Makefiles
* Fixed the "PIC register ebx clobbered in asm" bug
* Added HMAC starts/update/finish support functions
* Added the SHA-224, SHA-384 and SHA-512 hash functions
* Fixed the net_set_*block routines, thanks to Andreas
* Added a few demonstration programs: md5sum, sha1sum,
dh_client, dh_server, rsa_genkey, rsa_sign, rsa_verify
* Added new bignum import and export helper functions
* Rewrote README.txt in program/ssl/ca to better explain
how to create a test PKI
= Version 0.6 released on 2007-04-01
* Ciphers used in SSL/TLS can now be disabled at compile
time, to reduce the memory footprint on embedded systems
* Added multiply assembly code for the TriCore and modified
havege_struct for this processor, thanks to David Patiño
* Added multiply assembly code for 64-bit PowerPCs,
thanks to Peking University and the OSU Open Source Lab
* Added experimental support of Quantum Cryptography
* Added support for autoconf, contributed by Arnaud Cornet
* Fixed "long long" compilation issues on IA-64 and PPC64
* Fixed a bug introduced in xyssl-0.5/timing.c: hardclock
was not being correctly defined on ARM and MIPS
= Version 0.5 released on 2007-03-01
* Added multiply assembly code for SPARC and Alpha
* Added (beta) support for non-blocking I/O operations
* Implemented session resuming and client authentication
* Fixed some portability issues on WinCE, MINIX 3, Plan9
(thanks to Benjamin Newman), HP-UX, FreeBSD and Solaris
* Improved the performance of the EDH key exchange
* Fixed a bug that caused valid packets with a payload
size of 16384 bytes to be rejected
= Version 0.4 released on 2007-02-01
* Added support for Ephemeral Diffie-Hellman key exchange
* Added multiply asm code for SSE2, ARM, PPC, MIPS and M68K
* Various improvement to the modular exponentiation code
* Rewrote the headers to generate the API docs with doxygen
* Fixed a bug in ssl_encrypt_buf (incorrect padding was
generated) and in ssl_parse_client_hello (max. client
version was not properly set), thanks to Didier Rebeix
* Fixed another bug in ssl_parse_client_hello: clients with
cipherlists larger than 96 bytes were incorrectly rejected
* Fixed a couple memory leak in x509_read.c
= Version 0.3 released on 2007-01-01
* Added server-side SSLv3 and TLSv1.0 support
* Multiple fixes to enhance the compatibility with g++,
thanks to Xosé Antón Otero Ferreira
* Fixed a bug in the CBC code, thanks to dowst; also,
Fixed spelling / typos (from PowerDNS:codespell)
2013-10-29 09:02:51 +00:00
the bignum code is no longer dependent on long long
- Changed line endings and encodings to unix and utf-8
2011-01-05 14:48:42 +00:00
* Updated rsa_pkcs1_sign to handle arbitrary large inputs
* Updated timing.c for improved compatibility with i386
and 486 processors, thanks to Arnaud Cornet
= Version 0.2 released on 2006-12-01
* Updated timing.c to support ARM and MIPS arch
* Updated the MPI code to support 8086 on MSVC 1.5
* Added the copyright notice at the top of havege.h
* Fixed a bug in sha2_hmac, thanks to newsoft/Wenfang Zhang
* Fixed a bug reported by Adrian Rüegsegger in x509_read_key
* Fixed a bug reported by Torsten Lauter in ssl_read_record
* Fixed a bug in rsa_check_privkey that would wrongly cause
valid RSA keys to be dismissed (thanks to oldwolf)
* Fixed a bug in mpi_is_prime that caused some primes to fail
the Miller-Rabin primality test
I'd also like to thank Younès Hafri for the CRUX linux port,
Khalil Petit who added XySSL into pkgsrc and Arnaud Cornet
who maintains the Debian package :-)
= Version 0.1 released on 2006-11-01
Reference in New Issue Copy Permalink