* Tue Apr 02 2019 Daniel Molkentin <daniel.molkentin@suse.com>
- Update to Botan 2.10
* Bump SONAME
* Warning: XMSS currently implements draft-06 which is not compatible with
the final RFC 8391 specification. A PR is open to fix this, however it will
break all current uses of XMSS. If you are currently using XMSS please
comment at https://github.com/randombit/botan/pull/1858. Otherwise the PR
will be merged and support for draft-06 will be removed starting in 2.11.
* Added a new certificate store implementation that can access the MacOS
keychain certificate store. (GH #1830)
* Redesigned Memory_Pool class, which services allocations out of a set of
pages locked into memory (using mlock/VirtualLock). It is now faster and
with improved exploit mitigations. (GH #1800)
* Add BMI2 implementations of SHA-512 and SHA-3 which improve performance by
25-35% on common CPUs. (GH #1815)
* Unroll SHA-3 computation improving performance by 10-12% (GH #1838)
* Add a Thread_Pool class. It is now possible to run the tests in multiple
threads with --test-threads=N flag to select the number of threads to use.
Use --test-threads=0 to run with as many CPU cores as are available on the
current system. The default remains single threaded. (GH #1819)
* XMSS signatures now uses a global thread pool instead of spawning new
threads for each usage. This improves signature generation performance by
between 10% and 60% depending on architecture and core count. (GH #1864)
* Some functions related to encoding and decoding BigInts have been
deprecated. (GH #1817)
* Binary encoding and decoding of BigInts has been optimized by performing
word-size operations when possible. (GH #1817)
* Rename the exception Integrity_Failure to Invalid_Authentication_Tag to
make its meaning and usage more clear. The old name remains as a typedef.
(GH #1816)
* Support for using Boost filesystem and MSVC’s std::filesystem have been
removed, since already POSIX and Win32 versions had to be maintained for
portability. (GH #1814)
* Newly generated McEliece and XMSS keys now default to being encrypted using
SIV mode, support for which was added in 2.8.0. Previously GCM was used by
default for these algorithms.
* Use arc4random on Android systems (GH #1851)
* Fix the encoding of PGP-S2K iteration counts (GH #1853 #1854)
* Add a facility for sandboxing the command line util. Currently FreeBSD
(Capsicum) and OpenBSD (pledge) sandboxes are supported. (GH #1808)
* Use if constexpr when available.
* Disable building shared libs on iOS as it was broken and it is not clear
shared libraries are ever useful on iOS (GH #1865)
* Renamed the darwin build target to macos. This should not cause any
user-visible change. (GH #1866)
* Add support for using sccache to cache the Windows CI build (GH #1807)
* Add --extra-cxxflags option which allows adding compilation flags without
overriding the default set. (GH #1826)
* Add --format= option to the hash cli which allows formatting the output as
base64 or base58, default output remains hex.
* Add base58_enc and base58_dec cli utils for base58 encoding/decoding. (GH #1848)
* Enable getentropy by default on macOS (GH #1862)
* Avoid using -momit-leaf-frame-pointer flags, since -fomit-frame-pointer is
already the default with recent versions of GCC.
* Fix XLC sanitizer flags.
* Rename Blake2b class to BLAKE2b to match the official name. There is a typedef for compat.
* Fix a bug where loading a raw Ed25519_PublicKey of incorrect length would
lead to a crash. (GH #1850)
* Fix a bug that caused compilation problems using CryptoNG PRNG. (GH #1832)
* Extended SHAKE-128 cipher to support any key between 1 and 160 bytes,
instead of only multiples of 8 bytes.
* Minor HMAC optimizations.
* Build fixes for GNU/Hurd.
* Fix a bug that prevented generating or verifying Ed25519 signatures in the
CLI (GH #1828 #1829)
* Fix a compilation error when building the amalgamation outside of the
original source directory when AVX2 was enabled. (GH #1812)
* Fix a crash when creating the amalgamation if a header file was edited on
Windows but then the amalgamation was built on Linux (GH #1763)
* Thu Jan 10 2019 Daniel Molkentin <daniel.molkentin@suse.com>
- Update to Botan 2.9
* Bump SONAME
* CVE-2018-20187 Address a side channel during ECC key generation, which used an
unblinded Montgomery ladder. As a result, a timing attack can reveal
information about the high bits of the secret key.
* Fix bugs in TLS which caused negotiation failures when the client used an
unknown signature algorithm or version (GH #1711 #1709 #1708)
* Fix bug affecting GCM, EAX and ChaCha20Poly1305 where if the associated data
was set after starting a message, the new AD was not reflected in the produced
tag. Now with these modes setting an AD after beginning a message throws an
exception.
* Use a smaller sieve which improves performance of prime generation.
* Fixed a bug that caused ChaCha to produce incorrect output after encrypting 256
GB. (GH #1728)
* Add NEON and AltiVec implementations of ChaCha (GH #1719 #1728 #1729)
* Optimize AVX2 ChaCha (GH #1730)
* Many more operations in BigInt, ECC and RSA code paths are either fully const
time or avoid problematic branches that could potentially be exploited in a
side channel attack. (GH #1738 #1750 #1754 #1755 #1757 #1758 #1759 #1762 #1765
[#1770] #1773 #1774 #1779 #1780 #1794 #1795 #1796 #1797)
* Several optimizations for BigInt and ECC, improving ECDSA performance by as
much as 30%. (GH #1734 #1737 #1777 #1750 #1737 #1788)
* Support recovering an ECDSA public key from a message/signature pair (GH #664
[#1784])
* Add base58 encoding/decoding functions (GH #1783)
* In the command line interface, add support for reading passphrases from the
terminal with echo disabled (GH #1756)
* Add CT::Mask type to simplify const-time programming (GH #1751)
* Add new configure options --disable-bmi2, --disable-rdrand, and
- -disable-rdseed to prevent use of those instruction sets.
* Add error_type and error_code functions to Exception type (GH #1744)
* Now on POSIX systems posix_memalign is used instead of mmap for allocating the
page-locked memory pool. This avoids issues with fork. (GH #602 #1798)
* When available, use RDRAND to generate the additional data in
Stateful_RNG::randomize_with_ts_input
* Use vzeroall/vzeroupper intrinsics to avoid AVX2/SSE transition penalties.
* Support for Visual C++ 2013 has been removed (GH #1557 #1697)
* Resolve a memory leak when verifying ECDSA signatures with versions of OpenSSL
before 1.1.0 (GH #1698)
* Resolve a memory leak using ECDH via OpenSSL (GH #1767)
* Fix an error in XTS which prohibited encrypting values which were exactly the
same length as the underlying block size. Messages of this size are allowed by
the standard and other XTS implementations. (GH #1706)
* Resolve a bug in TSS which resulted in it using an incorrect length field in
the shares. Now the correct length is encoded, but either correct or buggy
lengths are accepted when decoding. (GH #1722)
* Correct a bug when reducing a negative BigInt modulo a small power of 2. (GH
[#1755])
* Add CLI utils for threshold secret splitting. (GH #1722)
* Fix a bug introduced in 2.8.0 that caused compilation failure if using a single
amalgamation file with AVX2 enabled. (GH #1700)
* Add an explicit OS target for Emscripten and improve support for it. (GH #1702)
* Fix small issues when building for QNX
* Switch the Travis CI build to using Ubuntu 16.04 (GH #1767)
* Add options to configure.py to disable generation of pkg-config file, and (for
systems where pkg-config support defaults to off, like Windows), to enable
generating it. (GH #1268)
* Modify configure.py to accept empty lists or trailing/extra commas. (GH #1705)
- Update to Botan 2.8
* Add support for using Apple CommonCrypto library for hashing (GH #1667),
cipher modes (GH #1674) and block ciphers (GH #1673).
* Support for negotiating TLS versions 1.0 and 1.1 is disabled in the default
TLS policy. In addition, support for negotiating TLS ciphersuites using CBC
or CCM mode is disabled by default. Applications which need to interop with
old peers must enable these in their TLS policy object. (GH #1651)
* During primality testing, use a Lucas test in addition to Miller-Rabin. It
is possible to construct a composite integer which passes n Miller-Rabin
tests with probability (1/4)^n. So for a incautious verifier using a small
number of tests (under 16 or so) it is possible if unlikely they would
accept such a composite as prime. Adding a Lucas test precludes such an
attack. (GH #1636)
* Add XChaCha and XChaCha20Poly1305 (GH #1640)
* Add AVX2 implementations of ChaCha (GH #1662) and Serpent (GH #1660)
* Add a new password hashing interface in pwdhash.h (GH #1670)
* C binding improvements. Added functions to get name and supported
keylengths of cipher, hash and MAC objects, support for FE1 format
preserving encryption (GH #1625 #1646), functions to load and save RSA keys
in PKCS #1 format (GH #1621), HOTP and TOTP algorithms, scrypt, certificate
verification (GH #1647), functions to get the output length of public key
operations (GH #1642), and functions for loading and serializing X25519
keys (GH #1681)
* Support for building with BOTAN_MP_WORD_BITS set to 8 or 16 has been removed.
* Previously SM2 had two distinct key types, one for signatures and another
for encryption. They have now been merged into a single key type since in
practice it seems the same key is at times used for both operations. (GH
[#1637])
* The Cipher_Mode class now derives from SymmetricAlgorithm (GH #1639)
* Add support for using the ARMv8 instructions for SM4 encryption (GH #1622)
* The entropy source using SecRandomCopyBytes has been removed as it was
redundant with other entropy sources (GH #1668)
* The Python module has much better error checking and reporting, and offers
new functionality such as scrypt, MPI and FPE. (GH #1643 #1646)
* Fixed a bug that caused CCM to fail with an exception when used with L=8 (GH #1631 #1632)
* The default bcrypt work factor has been increased from 10 to 12.
* The default algorithm used in passhash9 has changed from SHA-256 to
SHA-512, and the default work factor increased from 10 to 15.
* In ECC private keys, include the public key data for compatibility with GnuTLS (GH #1634 #1635)
* Add support for using Linux getrandom syscall to access the system PRNG.
This is disabled by default, use --with-os-feature=getrandom to enable.
* It is now possible to encrypt private keys using SIV mode.
* The FFI function botan_privkey_load now ignores its rng argument.
* Resolve a problem when building under Visual C++ 15.8 (GH #1624)
* Fix a bug in XSalsa20 (192-bit Salsa nonces) where if set_iv was called
twice without calling set_key, the resulting encryption was incorrect. (GH
[#1640])
* Handle an error seen when verifying invalid ECDSA signatures using LibreSSL
on non x86-64 platforms (GH #1627 #1628)
* Fix bugs in PKCS7 and X9.23 CBC padding schemes, which would ignore the
first byte in the event the padding took up the entire block. (GH #1690)
* Correct bugs which would cause CFB, OCB, and GCM modes to crash when they
were used in an unkeyed state. (GH #1639)
* Optimizations for SM4 and Poly1305
* Avoid a cache side channel in the AES key schedule
* Add pk_encrypt and pk_decrypt CLI operations
* Now asn1print CLI defaults to printing context-specific fields.
* Use codec_base for Base64, which matches how Base32 is implemented (GH #1597)
* The cast module has been split up into cast128 and cast256 (GH #1685)
* When building under Visual C++ 2013, the user must acknowledge the upcoming
removal of support using the configure.py flag --ack-vc2013-deprecated (GH
[#1557])
* Tue Jul 10 2018 daniel.molkentin@suse.com
- Update to Botan 2.7
* CVE-2018-12435 Avoid a side channel in ECDSA signature generation (GH
[#1604])
* Avoid a side channel in RSA key generation due to use of a non-constant
time gcd algorithm. (GH #1542 #1556)
* Optimize prime generation, especially improving RSA key generation. (GH
[#1542])
* Make Karatsuba multiplication, Montgomery field operations, Barrett
reduction and Montgomery exponentiation const time (GH #1540 #1606 #1609
[#1610])
* Optimizations for elliptic curve operations especially improving reductions
and inversions modulo NIST primes (GH #1534 #1538 #1545 #1546 #1547 #1550)
* Add 24 word wide Comba multiplication, improving 3072-bit RSA and DH by
~25%. (GH #1564)
* Unroll Montgomery reduction for specific sizes (GH #1603)
* Improved performance of signature verification in ECGDSA, ECKCDSA, SM2 and
GOST by 10-15%.
* XMSS optimizations (GH #1583 #1585)
* Fix an error that meant XMSS would only sign half as many signatures as is
allowed (GH #1582)
* Add support for base32 encoding/decoding (GH #1541)
* Add BMI2 optimized version of SHA-256, 40% faster on Skylake (GH #1584)
* Allow the year to be up to 2200 in ASN.1 time objects. Previously this was
limited to 2100. (GH #1536)
* Add support for Scrypt password hashing (GH #1570)
* Add support for using Scrypt for private key encryption (GH #1574)
* Optimizations for DES/3DES, approx 50% faster when used in certain modes
such as CBC decrypt or CTR.
* XMSS signature verification did not check that the signature was of the
expected length which could lead to a crash. (GH #1537)
* The bcrypt variants 2b and 2y are now supported.
* Support for 192-bit Suite B TLS profile is now implemented, as the 128-bit
Suite B is since 2015 not allowed anymore.
* Previously botan allowed GCM to be used with an empty nonce, which is not
allowed by the specification. Now such nonces are rejected.
* Avoid problems on Windows when compiling in Unicode mode (GH #1615 #1616)
* Previously for ASN.1 encoded signatures (eg ECDSA) Botan would accept any
valid BER encoding. Now only the single valid DER encoding is accepted.
* Correct an error that could in rare cases cause an internal error exception
when doing computations with the P-224 curve.
* Optimizations to reduce allocations/copies during DER encoding and BER
decoding (GH #1571 #1572 #1600)
* Botan generates X.509 subject key IDs by hashing the public key with
whatever hash function is being used to sign the certificate. However
especially for SHA-512 this caused SKIDs that were far longer than
necessary. Now all SKIDs are truncated to 192 bits.
* In the test suite use mkstemp to create temporary files instead of creating
them in the current working directory. (GH #1533 #1530)
* It is now possible to safely override CXX when invoking make in addition to
when configure.py is run. (GH #1579)
* OIDs for Camellia and SM4 in CBC and GCM mode are now defined, making it
possible to use this algorithms for private key encryption.
* Avoid creating symlinks to the shared object on OpenBSD (#1535)
* The factor command runs much faster on larger inputs now.
* Support for Windows Phone/UWP was deprecated starting in 2.5. This
deprecation has been reversed as it seems UWP is still actively used. (GH
[#1586] #1587)
* Support for Visual C++ 2013 is deprecated, and will be removed in Jan 2019.
* Added support for GCC’s –sysroot option to configure.py for
cross-compiling.