Lines Matching +full:ipv4 +full:- +full:second +full:- +full:language +full:- +full:is +full:- +full:cpp
3 = Mbed TLS 3.3.0 branch released 2022-12-14
8 It is now no longer experimental, and implements the final version from
9 RFC 9146, which is not interoperable with the draft-05 version.
13 standard (non-draft) version.
21 from a release, the Python module jsonschema is now necessary, in
22 addition to jinja2. The official list of required Python modules is
37 * Expose the EC J-PAKE functionality through the Draft PSA PAKE Crypto API.
38 Only the ECC primitive with secp256r1 curve and SHA-256 hash algorithm
41 built-in implementation present, but only in some configurations.
42 - RSA OAEP and PSS (PKCS#1 v2.1), PKCS5, PKCS12 and EC J-PAKE now use
43 hashes from PSA when (and only when) MBEDTLS_MD_C is disabled.
44 - PEM parsing of encrypted files now uses MD-5 from PSA when (and only
45 when) MBEDTLS_MD5_C is disabled.
50 all hashes only provided by drivers (no built-in hash) is to use
52 * When MBEDTLS_USE_PSA_CRYPTO is enabled, X.509, TLS 1.2 and TLS 1.3 now
54 As a consequence, they now work in configurations where the built-in
56 provided by PSA drivers. (See previous entry for limitation on RSA-PSS
57 though: that module only use hashes from PSA when MBEDTLS_MD_C is off).
60 * Add the LMS post-quantum-safe stateful-hash asymmetric signature scheme.
61 Signature verification is production-ready, but generation is for testing
64 1024 messages. As such, it is not intended for use in TLS, but instead
67 * Add the LM-OTS post-quantum-safe one-time signature scheme, which is
69 be used to sign one message so is impractical for most circumstances.
70 * Mbed TLS now supports TLS 1.3 key establishment via pre-shared keys.
71 The pre-shared keys can be provisioned externally or via the ticket
73 The ticket mechanism is supported when the configuration option
74 MBEDTLS_SSL_SESSION_TICKETS is enabled.
83 supports a subset of the driver description language, including
89 * The TLS 1.2 EC J-PAKE key exchange can now use the PSA Crypto API.
98 entry point. This entry point is specified in the proposed PSA driver
100 * Add an ad-hoc key derivation function handling EC J-PAKE to PMS
102 as described in draft-cragie-tls-ecjpake-01. This can be achieved by
107 MBEDTLS_SSL_DTLS_CONNECTION_ID is enabled and
112 performing a single private-key operation if the window size used for the
114 Wenjian HE, Sharad Sinha, and Wei ZHANG. See "Cache Side-channel Attacks
115 and Defenses of the Sliding Window Algorithm in TEEs" - Design, Automation
119 * Refactor mbedtls_aes_context to support shallow-copying. Fixes #2147.
120 * Fix an issue with in-tree CMake builds in releases with GEN_FILES
123 * Fix a long-standing build failure when building x86 PIC code with old
126 * Fix support for little-endian Microblaze when MBEDTLS_HAVE_ASM is defined.
133 broken link is encountered, skip the broken link and continue parsing
143 MBEDTLS_DEPRECATED_REMOVED is enabled.
145 MBEDTLS_AES_ALT is enabled, it could call mbedtls_aes_free() on an
154 PSA drivers for AEAD (GCM, CCM, Chacha20-Poly1305).
170 in TLS 1.3 (where it is forbidden).
171 * Fix a bug in which mbedtls_x509_crt_info() would produce non-printable
176 the error code returned by mbedtls_mpi_write_file() is overwritten
178 * In the bignum module, operations of the form (-A) - (+A) or (-A) - (-A)
189 when both operands are 0 and the left operand is represented with 0 limbs.
192 to OSS-Fuzz. Fixes #6597.
195 * Move some SSL-specific code out of libmbedcrypto where it had been placed
202 * Calling AEAD tag-specific functions for non-AEAD algorithms (which
203 should not be done - they are documented for use only by AES-GCM and
207 = Mbed TLS 3.2.1 branch released 2022-07-12
210 * Re-add missing generated file library/ssl_debug_helpers_generated.c
212 = Mbed TLS 3.2.0 branch released 2022-07-11
247 a piece of user data which is reserved for the application. The user
268 * Add mbedtls_pk_sign_ext() which allows generating RSA-PSS signatures when
269 PSA Crypto is enabled.
284 mixed-PSK. Add an optional input PSA_KEY_DERIVATION_INPUT_OTHER_SECRET
286 * When MBEDTLS_PSA_CRYPTO_CONFIG is enabled, you may list the PSA crypto
293 * Add HKDF-Expand and HKDF-Extract as separate algorithms in the PSA API.
294 * Add support for the ARMv8 SHA-2 acceleration instructions when building
297 * Add support for server HelloRetryRequest message. The TLS 1.3 client is
300 * Add support for client-side TLS version negotiation. If both TLS 1.2 and
306 establishment only). See docs/architecture/tls13-support.md for a
314 docs/use-psa-crypto.md for the list of exceptions.
316 Opaque keys can now be used everywhere a private key is expected in the
318 * Opaque pre-shared keys for TLS, provisioned with
321 for the "mixed" PSK key exchanges as well: ECDHE-PSK, DHE-PSK, RSA-PSK.
322 * cmake now detects if it is being built as a sub-project, and in that case
327 by side in order to illustrate how the operation is performed in PSA.
331 * Zeroize dynamically-allocated buffers used by the PSA Crypto key storage
340 * Fix a potential heap buffer overread in TLS 1.2 server-side when
341 MBEDTLS_USE_PSA_CRYPTO is enabled, an opaque key (created with
342 mbedtls_pk_setup_opaque()) is provisioned, and a static ECDH ciphersuite
343 is selected. This may result in an application crash or potentially an
347 or a man-in-the-middle could cause a DTLS server to read up to 255 bytes
349 when MBEDTLS_SSL_IN_CONTENT_LEN is less than a threshold that depends on
358 buffer is rather small but increases as its size
371 * Fix a memory leak if mbedtls_ssl_config_defaults() is called twice.
375 in reduced configurations when MBEDTLS_USE_PSA_CRYPTO is enabled.
377 enabled and an ECDHE-ECDSA or ECDHE-RSA key exchange was used, the
382 * The TLS 1.3 implementation is now compatible with the
389 * Fix compile errors when MBEDTLS_HAVE_TIME is not defined. Add tests
391 * Fix a race condition in out-of-source builds with CMake when generated data
397 the function needs to be re-called after initially returning
407 * Fix undefined behavior in mbedtls_asn1_find_named_data(), where val is
408 not NULL and val_len is zero.
428 when MBEDTLS_SSL_PROTO_TLS1_3 is specified, and make this and other
443 non-compliant. This could not lead to a buffer overflow. In particular,
460 * The file library/psa_crypto_driver_wrappers.c is now generated
463 see docs/proposed/psa-driver-wrappers-codegen-migration-guide.md
464 * Return PSA_ERROR_INVALID_ARGUMENT if the algorithm passed to one-shot
465 AEAD functions is not an AEAD algorithm. This aligns them with the
467 * In mbedtls_pk_parse_key(), if no password is provided, don't allocate a
469 * Assume source files are in UTF-8 when using MSVC with CMake.
475 LIB_INSTALL_DIR is set.
479 targets work when MbedTLS is built as a subdirectory. This allows the
482 = mbed TLS 3.1.0 branch released 2021-12-17
488 MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL in case the buffer length is too small.
494 POSIX/Unix-like platforms.
497 * Sign-magnitude and one's complement representations for signed integers are
498 not supported. Two's complement is the only supported representation.
515 * Warn if errors from certain functions are ignored. This is currently
516 supported on GCC-like compilers and on MSVC and can be configured through
519 value is almost always a bug. Enable the new configuration option
521 is currently implemented in the AES, DES and md modules, and will be
525 * Add support for CCM*-no-tag cipher to the PSA.
526 Currently only 13-byte long IV's are supported.
527 For decryption a minimum of 16-byte long input is expected.
535 protocol. See docs/architecture/tls13-support.md for the definition of
547 man-in-the-middle to inject fake ciphertext into a DTLS connection.
550 if the output buffer is in memory that is shared with an untrusted
554 oracle vulnerability if the output buffer is in memory that is shared with
556 * Fix a double-free that happened after mbedtls_ssl_set_session() or
565 The check was accidentally not performed when cross-compiling for Windows
577 * Fix mbedtls_cipher_crypt: AES-ECB when MBEDTLS_USE_PSA_CRYPTO is enabled.
578 * Failures of alternative implementations of AES or DES single-block
582 where this function cannot fail, or full-module replacements with
587 * Fix compile-time or run-time errors in PSA
588 AEAD functions when ChachaPoly is disabled. Fixes #5065.
591 psa_aead_finish() and psa_aead_verify() does not apply to the built-in
594 the built-in implementation of the GCM.
596 input buffer size is valid only for the built-in implementation of GCM.
599 MBEDTLS_ERROR_STRERROR_DUMMY is enabled.
604 * The existing predicate macro name PSA_ALG_IS_HASH_AND_SIGN is now reserved
616 * Fix the build when no SHA2 module is included. Fixes #4930.
617 * Fix the build when only the bignum module is included. Fixes #4929.
619 pkcs12 functions when the password is empty. Fix the documentation to
630 oversight during the run-up to the release of Mbed TLS 3.0.
632 * Implement multi-part CCM API.
633 The multi-part functions: mbedtls_ccm_starts(), mbedtls_ccm_set_lengths(),
643 * Improve the performance of base64 constant-flow code. The result is still
644 slower than the original non-constant-flow implementation, but much faster
645 than the previous constant-flow implementation. Fixes #4814.
646 * Ignore plaintext/ciphertext lengths for CCM*-no-tag operations.
650 ChaCha20-Poly1305 is invalid, and not just unsupported.
655 most of the interface of this module is private and may change at any
657 * The generated configuration-independent files are now automatically
658 generated by the CMake build system on Unix-like systems. This is not
659 yet supported when cross-compiling.
661 = Mbed TLS 3.0.0 branch released 2021-07-07
670 https://mbed-tls.readthedocs.io/en/latest/kb/how-to/add-entropy-sources-to-entropy-pool/ for
674 header compat-1.3.h and the script rename.pl.
693 * Drop support for TLS record-level compression (MBEDTLS_ZLIB_SUPPORT).
695 * Drop support for single-DES ciphersuites.
699 key type used, as well as the key bit-size in the case of
714 when outputting a SHA-384 or SHA-224 hash into a buffer of exactly
718 how the input to multipart operations is broken down. mbedtls_gcm_finish()
735 session-ID based session resumption) has changed to that of
736 a key-value store with keys being session IDs and values
750 * For multi-part AEAD operations with the cipher module, calling
751 mbedtls_cipher_finish() is now mandatory. Previously the documentation
754 possible to skip calling it, which is no longer supported.
755 * The option MBEDTLS_ECP_FIXED_POINT_OPTIM use pre-computed comb tables
772 * Instead of accessing the len field of a DHM context, which is no longer
780 parameter, this parameter is now mandatory (that is, NULL is not an
797 context are now connection-specific.
806 * Implement one-shot cipher functions, psa_cipher_encrypt and
809 * Direct access to fields of structures declared in public headers is no
819 They are: ARIA block cipher, CMAC mode, elliptic curve J-PAKE library and
820 Key Wrapping mode as defined in NIST SP 800-38F. Fixes #4036.
832 release, some configuration-independent files are now generated at build
843 compile-time option, which was off by default. Users should not trust
844 certificates signed with SHA-1 due to the known attacks against SHA-1.
845 If needed, SHA-1 certificates can still be verified by using a custom
853 https://lists.trustedfirmware.org/pipermail/mbed-tls/2020-April/000024.html
857 compile-time option. This option has been inactive for a long time.
860 * Remove the following deprecated functions and constants of hex-encoded
886 * The RSA module no longer supports private-key operations with the public
899 MBEDTLS_REMOVE_3DES_CIPHERSUITES option which is no longer relevant.
904 backward compatibility which is no longer supported. Addresses #4404.
909 option. The mbedtls_x509_crt_parse_der_with_ext_cb() is the way to go for
914 * MBEDTLS_ECP_MAX_BITS is no longer a configuration option because it is
926 using a CCM-8 ciphersuite than a CBC ciphersuite with truncated HMAC.
928 * Remove the compile-time option
936 * Added support for built-in driver keys through the PSA opaque crypto
940 * The multi-part GCM interface (mbedtls_gcm_update() or
943 * The multi-part GCM interface now supports chunked associated data through
950 See docs/architecture/alternative-implementations.md for the remaining
953 query the size of the modulus in a Diffie-Hellman context.
955 Diffie-Hellman context.
958 directly, which is no longer supported.
963 * Fix a bias in the generation of finite-field Diffie-Hellman-Merkle (DHM)
967 An adversary who is capable of very precise timing measurements could
975 performing a single private-key operation. Found and reported by
978 co-located process) could recover a Curve25519 or Curve448 static ECDH key
980 corresponding private-key operation. Found and reported by Leila Batina,
985 lead to the seed file corruption in case if the path to the seed file is
990 to create is not valid, bringing them in line with version 1.0.0 of the
997 * Fix a bug in ECDSA that would cause it to fail when the hash is all-bits
1002 mbedtls_mpi_read_string() was called on "-0", or when
1005 * Fix a compilation error when MBEDTLS_ECP_RANDOMIZE_MXZ_ALT is
1008 * In a TLS client, enforce the Diffie-Hellman minimum parameter size
1012 defined to specific values. If the code is used in a context
1019 * The cipher suite TLS-RSA-WITH-CAMELLIA-256-GCM-SHA384 was not available
1020 when SHA-1 was disabled and was offered when SHA-1 was enabled but SHA-384
1022 * Do not offer SHA384 cipher suites when SHA-384 is disabled. Fixes #4499.
1023 * Fix test suite code on platforms where int32_t is not int, such as
1024 Arm Cortex-M. Fixes #4530.
1026 directive in a header and a missing initialization in the self-test.
1027 * Fix a missing initialization in the Camellia self-test, affecting
1031 is not defined PSA will no longer attempt to use mbedtls_rsa_gen_key().
1034 (when the encrypt-then-MAC extension is not in use) with some ALT
1035 implementations of the underlying hash (SHA-1, SHA-256, SHA-384), causing
1037 * Remove outdated check-config.h check that prevented implementing the
1049 * psa_verify_hash() was relying on implementation-specific behavior of
1051 implementations. This reliance is now removed. Fixes #3990.
1060 Credit to OSS-Fuzz. Fixes #4641.
1061 * Fix mbedtls_mpi_gcd(G,A,B) when the value of B is zero. This had no
1065 read-only lifetime. The persistence level PSA_KEY_PERSISTENCE_READ_ONLY
1068 * When MBEDTLS_PSA_CRYPTO_SPM is enabled, crypto_spe.h was not included
1069 in all the right places. Include it from crypto_platform.h, which is
1071 * Fix which alert is sent in some cases to conform to the
1086 * Remove configs/config-psa-crypto.h, which no longer had any intended
1089 python2, which is no longer supported upstream.
1090 * fix build failure on MinGW toolchain when __USE_MING_ANSI_STDIO is on.
1091 When that flag is on, standard GNU C printf format specifiers
1100 when their input has length 0. Note that this is an implementation detail
1108 build_info.h is intended to be included from C code directly, while
1109 mbedtls_config.h is intended to be edited by end users wishing to
1118 The only value supported by Mbed TLS 3.0.0 is 0x03000000.
1122 PSA_KEY_USAGE_SIGN_HASH flag is set and PSA_KEY_USAGE_VERIFY_MESSAGE flag
1123 when PSA_KEY_USAGE_VERIFY_HASH flag is set. This usage flag extension
1124 is also applied when loading a key from storage.
1126 = mbed TLS 2.26.0 branch released 2021-03-08
1139 as always 0. It is now reserved for internal purposes and may take
1152 CTR_DRBG is used by default if it is available, but you can override
1180 length, or when the entropy module uses SHA-256 and CTR_DRBG uses AES-256.
1186 |A| - |B| where |B| is larger than |A| and has more limbs (so the
1189 all calls inside the library were safe since this function is
1192 mbedtls_pk_write_key_pem(). If MBEDTLS_MPI_MAX_SIZE is set to an odd
1197 mbedtls_net_recv_timeout() when given a file descriptor that is
1203 * Fix use-after-scope error in programs/ssl/ssl_client2.c and ssl_server2.c
1209 is enabled, on platforms where initializing a mutex allocates resources.
1213 twice is safe. This happens for RSA when some Mbed TLS library functions
1214 fail. Such a double-free was not safe when MBEDTLS_THREADING_C was
1215 enabled on platforms where freeing a mutex twice is not safe.
1216 * Fix a resource leak in a bad-arguments case of mbedtls_rsa_gen_key()
1217 when MBEDTLS_THREADING_C is enabled on platforms where initializing
1227 the extension was always marked as non-critical. This was fixed by
1233 implementation is not included into the library.
1237 = mbed TLS 2.25.0 branch released 2020-12-11
1243 The underlying stream cipher is determined by the key type
1247 as they have no way to check if the output buffer is large enough.
1249 mbedtls_cipher_auth_decrypt_ext() instead. Credit to OSS-Fuzz and
1274 This is currently non-standard behaviour, but expected to make it into a
1276 * Add MBEDTLS_TARGET_PREFIX CMake variable, which is prefixed to the mbedtls,
1279 clashes. The default value of this variable is "", so default target names
1281 * Add support for DTLS-SRTP as defined in RFC 5764. Contributed by Johan
1283 * In the PSA API, it is no longer necessary to open persistent keys:
1284 operations now accept the key identifier. The type psa_key_handle_t is now
1285 identical to psa_key_id_t instead of being platform-defined. This bridges
1287 version 1.0.0. Opening persistent keys is still supported for backward
1303 generating Diffie-Hellman key pairs. Credit to OSS-Fuzz.
1305 which is how most uses of randomization in asymmetric cryptography
1307 are implemented. This could cause failures or the silent use of non-random
1330 * Fix build failure in configurations where MBEDTLS_USE_PSA_CRYPTO is
1331 enabled but ECDSA is disabled. Contributed by jdurkop. Fixes #3294.
1334 * Fix rsa_prepare_blinding() to retry when the blinding value is not
1336 addresses a regression but is rare in practice (approx. 1 in 2/sqrt(N)).
1339 * Use socklen_t on Android and other POSIX-compliant system
1340 * Fix the build when the macro _GNU_SOURCE is defined to a non-empty value.
1355 chars. Fixes a build failure on platforms where char is unsigned. Fixes
1357 * Fix an off-by-one error in the additional data length check for
1358 CCM, which allowed encryption with a non-standard length field.
1362 * Make arc4random_buf available on NetBSD and OpenBSD when _POSIX_C_SOURCE is
1367 * Attempting to create a volatile key with a non-zero key identifier now
1375 (an error condition) and the second operand was aliased to the result.
1376 * Fix a case in elliptic curve arithmetic where an out-of-memory condition
1393 * The PSA persistent storage format is updated to always store the key bits
1394 attribute. No automatic upgrade path is provided. Previously stored keys
1396 specification (docs/architecture/mbed-crypto-storage-specification.md).
1400 zeroize the pointed-to buffer. Reported by Antonio de la Piedra, CEA
1403 = mbed TLS 2.24.0 branch released 2020-09-01
1406 * In the PSA API, rename the types of elliptic curve and Diffie-Hellman
1422 a byte buffer. It is the inverse of the existing mbedtls_ecp_read_key().
1424 -Wformat-signedness, and fix the code that causes signed-one-bit-field
1425 and sign-compare warnings. Contributed by makise-homura (Igor Molchanov)
1432 subjecAltName extension is present, the expected name was compared to any
1434 attacker could for example impersonate a 4-bytes or 16-byte domain by
1435 getting a certificate for the corresponding IPv4 or IPv6 (this would
1450 Encrypt-then-Mac extension, use constant code flow memory access patterns
1451 to extract and check the MAC. This is an improvement to the existing
1453 effective against network-based attackers, but less so against local
1455 if they have access to fine-grained measurements. In particular, this
1459 * Fix side channel in RSA private key operations and static (finite-field)
1460 Diffie-Hellman. An adversary with precise enough timing and memory access
1462 enclave) could bypass an existing counter-measure (base blinding) and
1464 * Fix a 1-byte buffer overread in mbedtls_x509_crl_parse_der().
1465 Credit to OSS-Fuzz for detecting the problem and to Philippe Antoine
1475 redefinition if the function is inlined.
1479 Montgomery keys in little-endian as defined by RFC7748. Contributed by
1482 curves. Raised by signpainter in #941 and by Taiki-San in #1412. This
1484 * Fix self-test failure when the only enabled short Weierstrass elliptic
1485 curve is secp192k1. Fixes #2017.
1492 * Fix bug in redirection of unit test outputs on platforms where stdout is
1496 * Only pass -Wformat-signedness to versions of GCC that support it. Reported
1501 * Undefine the ASSERT macro before defining it locally, in case it is defined
1504 the copyright of contributors other than Arm is now acknowledged, and the
1511 these applications with password-protected key files. Analogously but for
1516 = mbed TLS 2.23.0 branch released 2020-07-01
1523 instead of the keys' lifetime. If the library is upgraded on an existing
1529 high- and low-level error codes, complementing mbedtls_strerror()
1533 * The new utility programs/ssl/ssl_context_info prints a human-readable
1550 Ming-Wei Shih, Prasun Gera, Taesoo Kim and Hyesoon Kim (Georgia Institute
1561 * Fix issue in Lucky 13 counter-measure that could make it ineffective when
1573 pathLenConstraint basic constraint value is equal to INT_MAX.
1574 The actual effect with almost every compiler is the intended
1575 behavior, so this is unlikely to be exploitable anywhere. #3192
1578 * Avoid NULL pointer dereferencing if mbedtls_ssl_free() is called with a
1597 * Fix false positive uninitialised variable reported by cpp-check.
1605 * Fix warnings about signedness issues in format strings. The build is now
1606 clean of -Wformat-signedness warnings. Contributed by Kenneth Soerensen
1618 * Fix mbedtls_x509_dn_gets to escape non-ASCII characters as "?".
1624 buffer is not large enough to hold the ClientHello.
1630 `MBEDTLS_CTR_DRBG_C` or `MBEDTLS_HMAC_DRBG_C` for some side-channel
1639 = mbed TLS 2.22.0 branch released 2020-04-14
1647 fragment length is desired.
1655 (which it is by default).
1660 Billy Brumley and Cesar Pereida Garcia. CVE-2020-10932
1678 * Mbed Crypto is no longer a Git submodule. The crypto part of the library
1679 is back directly in the present repository.
1683 buffer is allocated by the server (if MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH
1684 is defined), regardless of what MFL was configured for it.
1686 = mbed TLS 2.21.0 branch released 2020-02-20
1692 * Deprecate for MBEDTLS_PKCS11_C, the wrapper around the pkcs11-helper
1699 probability (of the order of 2^-n where n is the bitsize of the curve)
1700 unless the RNG is broken, and could result in information disclosure or
1707 ARMmbed/mbed-crypto#352
1710 * The new build option MBEDTLS_SHA512_NO_SHA384 allows building SHA-512
1711 support without SHA-384.
1717 existing code is that elliptic curve key types no longer encode the
1720 PSA_ECC_CURVE_SECP_R1 with 256 bits is P256R1). ARMmbed/mbed-crypto#330
1726 * Fix some false-positive uninitialized variable warnings in X.509. Fix
1727 contributed by apple-ihack-geek in #2663.
1729 a cryptographic accelerator fails. ARMmbed/mbed-crypto#345
1732 keys. Found by Catena cyber using oss-fuzz (issue 20467).
1736 = mbed TLS 2.20.0 branch released 2020-01-15
1739 * The initial seeding of a CTR_DRBG instance makes a second call to the
1740 entropy function to obtain entropy for a nonce if the entropy size is less
1749 entropy module formerly only grabbed 32 bytes, which is good enough for
1750 security if the source is genuinely strong, but less than the expected 64
1760 * Fix side channel vulnerability in ECDSA. Our bignum implementation is not
1762 blinded value, factor it (as it is smaller than RSA keys and not guaranteed
1778 initial seeding. The default nonce length is chosen based on the key size
1779 to achieve the security strength defined by NIST SP 800-90A. You can
1782 msopiha-linaro in ARMmbed/mbed-crypto#307.
1785 * In the PSA API, forbid zero-length keys. To pass a zero-length input to a
1786 key derivation function, use a buffer instead (this is now always
1799 unsupported algorithm. Fixes ARMmbed/mbed-crypto#254.
1801 to OSS-Fuzz for finding a bug in an intermediate version of the fix.
1816 no known instances where this changes the behavior of the library: this is
1817 merely a robustness improvement. ARMmbed/mbed-crypto#323
1819 Alexander Krizhanovsky in ARMmbed/mbed-crypto#210.
1821 Lloyd and Fortanix Inc in ARMmbed/mbed-crypto#277.
1823 Alexander Krizhanovsky in ARMmbed/mbed-crypto#308.
1825 = mbed TLS 2.19.1 branch released 2019-09-16
1835 mbedtls_ssl_export_keys_ext_t, so that the key exporter is discouraged
1839 * Fix some false-positive uninitialized variable warnings in crypto. Fix
1840 contributed by apple-ihack-geek in #2663.
1842 = mbed TLS 2.19.0 branch released 2019-09-06
1853 * The deterministic ECDSA calculation reused the scheme's HMAC-DRBG to
1862 store it in non-volatile storage, and later using it for TLS session
1865 an incoming record is valid, authentic and has not been seen before. This
1867 The feature is enabled at compile-time by MBEDTLS_SSL_RECORD_CHECKING
1870 (https://project-everest.github.io/). It can be enabled at compile time
1871 with MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED. This implementation is formally
1872 verified and significantly faster, but is only supported on x86 platforms
1873 (32-bit and 64-bit) using GCC, Clang or Visual Studio. Contributed by
1881 * Add DER-encoded test CRTs to library/certs.c, allowing
1886 list all curves for which at least one of ECDH or ECDSA is supported, not
1888 mbedtls_ecdh_can_do() on each result to check whether each algorithm is
1890 * The new function mbedtls_ecdsa_sign_det_ext() is similar to
1898 is now deprecated.
1902 lead to successful parsing of ill-formed X.509 CRTs. Fixes #2437.
1903 * Fix multiple X.509 functions previously returning ASN.1 low-level error
1908 * Fix typo in net_would_block(). Fixes #528 reported by github-monoculture.
1929 address-sanitizer and enabling but not using MBEDTLS_ECP_RESTARTABLE.
1932 * Improve code clarity in x509_crt module, removing false-positive
1940 * Replace multiple uses of MD2 by SHA-256 in X.509 test suite. Fixes #821.
1944 * Add a Dockerfile and helper scripts (all-in-docker.sh, basic-in-docker.sh,
1945 docker-env.sh) to simplify running test suites on a Linux host. Contributed
1951 * Adds fuzz targets, especially for continuous fuzzing with OSS-Fuzz.
1957 = mbed TLS 2.18.1 branch released 2019-07-12
1967 = mbed TLS 2.18.0 branch released 2019-06-11
1972 * It is now possible to use NIST key wrap mode via the mbedtls_cipher API.
1974 * Add the Wi-SUN Field Area Network (FAN) device extended key usage.
1976 * It is now possible to perform RSA PKCS v1.5 signatures with RIPEMD-160 digest.
1979 and the used tls-prf.
1980 * Add public API for tls-prf function, according to requested enum.
1985 RFC 5280 section 4.2.1.4. Currently, only the "Any Policy" policy is
1989 * Add support for draft-05 of the Connection ID extension, as specified
1990 in https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05.
1995 changed its IP or port. The feature is enabled at compile-time by setting
1996 MBEDTLS_SSL_DTLS_CONNECTION_ID (disabled by default), and at run-time
2002 and the used tls-prf.
2003 * Add public API for tls-prf function, according to requested enum.
2012 * Fix 1-byte buffer overflow in mbedtls_mpi_write_string() when
2014 OSS-Fuzz.
2030 Credit to OSS-Fuzz.
2033 * Server's RSA certificate in certs.c was SHA-1 signed. In the default
2034 mbedTLS configuration only SHA-2 signed certificates are accepted.
2035 This certificate is used in the demo server programs, which lead the
2038 updated to one that is SHA-256 signed. Fix contributed by
2041 provided SSL context is unset.
2049 = mbed TLS 2.17.0 branch released 2019-03-19
2053 which allows copy-less parsing of DER encoded X.509 CRTs,
2066 for the benefit of saving RAM, by disabling the new compile-time
2074 * Make mbedtls_ecdh_get_params return an error if the second key
2077 interpreted according to the second group, which could lead to either
2083 when MBEDTLS_ECP_ALT is defined. Reported by jwhui. Fixes #2242.
2084 * Run the AD too long test only if MBEDTLS_CCM_ALT is not defined.
2094 * Fix signed-to-unsigned integer conversion warning
2126 * Fix configuration queries in ssl-opt.h. #2030
2127 * Ensure that ssl-opt.h can be run in OS X. #2029
2128 * Re-enable certain interoperability tests in ssl-opt.sh which had previously
2133 = mbed TLS 2.16.0 branch released 2018-12-21
2141 function to see for which parameter values it is defined. This feature is
2151 mbedtls_ctr_drbg_update() -> mbedtls_ctr_drbg_update_ret()
2152 mbedtls_hmac_drbg_update() -> mbedtls_hmac_drbg_update_ret()
2156 the more generic per-module error codes MBEDTLS_ERR_xxx_BAD_INPUT_DATA.
2158 modules - AES, ARIA, Blowfish, CAMELLIA, CCM, GCM, DHM, ECP, ECDSA, ECDH,
2163 changed so that the same level of validation is present in all modules, and
2164 that it is now optional with the MBEDTLS_CHECK_PARAMS flag which by default
2165 is off. That means that checks which were previously present by default
2190 = mbed TLS 2.15.1 branch released 2018-11-30
2195 = mbed TLS 2.15.0 branch released 2018-11-23
2205 * Add unit tests for AES-GCM when called through mbedtls_cipher_auth_xxx()
2208 = mbed TLS 2.14.1 branch released 2018-11-30
2212 decryption that could lead to a Bleichenbacher-style padding oracle
2218 (University of Adelaide, Data61). The attack is described in more detail
2219 in the paper available here: http://cat.eyalro.net/cat.pdf CVE-2018-19608
2237 = mbed TLS 2.14.0 branch released 2018-11-19
2248 space and a PSK-(EC)DHE ciphersuite was used, this allowed an attacker
2253 adversary to construct non-primes that would be erroneously accepted as
2258 pairs or Diffie-Hellman parameters, but was insufficient to validate
2259 Diffie-Hellman parameters properly.
2265 some configurable amount of operations. This is intended to be used in
2266 constrained, single-threaded systems where ECC is time consuming and can
2267 block other operations until they complete. This is disabled by default,
2272 implemented client-side, for ECDHE-ECDSA ciphersuites in TLS 1.2,
2278 * Extend RSASSA-PSS signature to allow a smaller salt size. Previously, PSS
2282 that comply with FIPS 186-4, including SHA-512 with a 1024-bit key.
2283 * Add support for 128-bit keys in CTR_DRBG. Note that using keys shorter
2288 a feature that is not supported by underlying alternative
2289 implementations implementing cryptographic primitives. This is useful for
2294 MBEDTLS_ERR_XXX_FEATURE_UNAVAILABLE that indicate a feature is not
2302 Miller-Rabin rounds.
2312 MBEDTLS_THREADING_C is defined. Found by TrinityTonic, #1095
2315 padded records in case of CBC ciphersuites using Encrypt-then-MAC.
2318 * Ignore IV in mbedtls_cipher_set_iv() when the cipher mode is
2326 wildcards and non-ASCII characters being unusable in some DN attributes.
2328 Thomas-Dee.
2332 Reported by ole-de and ddhome2006. Fixes #882, #1642 and #1706.
2341 IPv6 and optionally by a build option over IPv4.
2343 calls, rather than Win32 API calls directly. This is necessary to avoid
2352 Thomas-Dee.
2354 Fixes #517 reported by github-monoculture.
2357 by FIPS-186-4.
2359 = mbed TLS 2.13.1 branch released 2018-09-06
2363 whose implementation should behave as a thread-safe version of gmtime().
2366 MBEDTLS_PLATFORM_GMTIME_R_ALT. At this stage Mbed TLS is only able to
2370 * Fix build failures on platforms where only gmtime() is available but
2373 = mbed TLS 2.13.0 branch released 2018-08-31
2379 beyond the input buffer is made. Found and analyzed by Nathan Crandall.
2383 is controlled by the maximum fragment length as set locally or negotiated
2384 with the peer, as well as by a new per-connection MTU option, set using
2386 * Add support for auto-adjustment of MTU to a safe value during the
2391 * Add support for buffering out-of-order handshake messages in DTLS.
2393 compile-time constant MBEDTLS_SSL_DTLS_MAX_BUFFERING defined
2407 * Add ecc extensions only if an ecc based ciphersuite is used.
2412 * Fix potential use-after-free in mbedtls_ssl_get_max_frag_len()
2423 (found by Catena cyber using oss-fuzz)
2435 * Add support for buffering of out-of-order handshake messages.
2440 = mbed TLS 2.12.0 branch released 2018-07-25
2443 * Fix a vulnerability in TLS ciphersuites based on CBC and using SHA-384,
2451 or CCM instead of CBC, using hash sizes other than SHA-384, or using
2452 Encrypt-then-Mac (RFC 7366) were not affected. The vulnerability was
2453 caused by a miscalculation (for SHA-384) in a countermeasure to the
2464 instead of CBC or using Encrypt-then-Mac (RFC 7366) were not affected.
2466 * Add a counter-measure against a vulnerability in TLS ciphersuites based
2472 Encrypt-then-Mac (RFC 7366) were not affected. Found by Kenny Paterson,
2476 * Add new crypto primitives from RFC 7539: stream cipher Chacha20, one-time
2477 authenticator Poly1305 and AEAD construct Chacha20-Poly1305. Contributed
2479 * Add support for CHACHA20-POLY1305 ciphersuites from RFC 7905.
2480 * Add platform support for the Haiku OS. (https://www.haiku-os.org).
2485 is no functional difference. Contributed by Angus Gratton, and also
2488 NIST SP 800-38F algorithms KW and KWP and by RFC 3394 and RFC 5649.
2503 * Fix compilation error when MBEDTLS_ARC4_C is disabled and
2504 MBEDTLS_CIPHER_NULL_CIPHER is enabled. Found by TrinityTonic in #1719.
2515 CBC based ciphersuite is used together with Encrypt-then-MAC. Previously,
2520 * Fix ssl_client2 example to send application data with 0-length content
2521 when the request_size argument is set to 0 as stated in the documentation.
2524 deep copy of the session, and the peer certificate is not lost. Fixes #926.
2525 * Fix build using -std=c99. Fixed by Nick Wilson.
2529 zero-length messages when using TLS 1.2. Contributed by Espressif Systems.
2531 when calling with a NULL salt and non-zero salt_len. Contributed by
2535 * Allow overriding the time on Windows via the platform-time abstraction.
2537 * Use gmtime_r/gmtime_s for thread-safety. Fixed by Nick Wilson.
2539 = mbed TLS 2.11.0 branch released 2018-06-18
2544 * Implement the HMAC-based extract-and-expand key derivation function
2547 * Add support for the XTS block cipher mode with AES (AES-XTS).
2551 non-blocking operation of the TLS server stack.
2568 = mbed TLS 2.10.0 branch released 2018-06-06
2578 mbedtls_platform_zeroize(), which is a critical function from a security
2582 Therefore, mbedtls_platform_zeroize() is moved to the platform module to
2587 build to fail. Found by zv-io. Fixes #1651.
2590 * Support TLS testing in out-of-source builds using cmake. Fixes #1193.
2594 = mbed TLS 2.9.0 branch released 2018-04-30
2601 would require a non DER-compliant certificate to be correctly signed by a
2602 trusted CA, or a trusted CA with a non DER-compliant certificate. Found by
2607 where an optional signature algorithms list is expected when the signature
2608 algorithms section is too short. In builds with debug output, the overread
2609 data is output with the debug data.
2610 * Fix a client-side bug in the validation of the server's ciphersuite choice
2630 a check for whether more more data is pending to be processed in the
2632 This function is necessary to determine when it is safe to idle on the
2633 underlying transport in case event-driven IO is used.
2639 in configurations that omit certain hashes or public-key algorithms.
2661 in the internal buffers; these cases led to deadlocks when event-driven
2675 * Support cmake builds where Mbed TLS is a subproject. Fix contributed
2678 public-key algorithms. Includes contributions by Gert van Dijk.
2681 configurations where the feature is disabled. Found and fixed by Gergely
2688 MBEDTLS_ASN1_PARSE_C is not enabled. This allows the use of PBKDF2
2698 letter must not be prefixed by '-', such as LLVM. Found and fixed by
2708 HMAC functions with non-HMAC ciphersuites. Independently contributed
2711 FIPS 186-4. Contributed by Jethro Beekman. #1380
2713 of the corresponding module is activated by defining the corresponding
2719 = mbed TLS 2.8.0 branch released 2018-03-16
2749 uses PBKDF2-SHA2, such as OpenSSL 1.1. Submitted by Antonio Quartulli,
2760 * Fix test_suite_pk to work on 64-bit ILP32 systems. #849
2767 is not enabled. Set MBEDTLS_SSL_MIN_MAJOR_VERSION
2770 * Fix compilation error on Mingw32 when _TRUNCATE is defined. Use _TRUNCATE
2786 * Fix a 1-byte heap buffer overflow (read-only) during private key parsing.
2800 = mbed TLS 2.7.0 branch released 2018-02-03
2804 extension. When the truncated HMAC extension is enabled and CBC is used,
2808 both TLS and DTLS. CVE-2018-0488
2809 * Fix a buffer overflow in RSA-PSS verification when the hash was too large
2812 Qualcomm Technologies Inc. CVE-2018-0487
2813 * Fix buffer overflow in RSA-PSS verification when the unmasked data is all
2818 default enabled) maximum fragment length extension is disabled in the
2820 is larger than the internal message buffer (16384 bytes by default), the
2823 was independently reported by Tim Nordell via e-mail and by Florin Petriuc
2834 * Make mbedtls_mpi_read_binary() constant-time with respect to the input
2840 * Fix a potential heap buffer over-read in ALPN extension parsing
2841 (server-side). Could result in application crash, but only if an ALPN
2844 to RFC 3526 containing parameters generated in a nothing-up-my-sleeve
2851 * New unit tests for timing. Improve the self-test to be more robust
2852 when run on a heavily-loaded machine.
2874 * Extend RSA interface by multiple functions allowing structure-
2887 mbedtls_<MODULE>_starts() -> mbedtls_<MODULE>_starts_ret()
2888 mbedtls_<MODULE>_update() -> mbedtls_<MODULE>_update_ret()
2889 mbedtls_<MODULE>_finish() -> mbedtls_<MODULE>_finish_ret()
2890 mbedtls_<MODULE>_process() -> mbedtls_internal_<MODULE>_process()
2893 * Deprecate usage of RSA primitives with non-matching key-type
2895 * Direct manipulation of structure fields of RSA contexts is deprecated.
2899 mbedtls_<MODULE>_finish and mbedtls_<MODULE>_process where <MODULE> is
2918 renegotiated handshakes would only accept signatures using SHA-1
2919 regardless of the peer's preferences, or fail if SHA-1 was disabled.
2923 * Fix some invalid RSA-PSS signatures with keys of size 8N+1 that were
2925 * Fix out-of-memory problem when parsing 4096-bit PKCS8-encrypted RSA keys.
2938 * Correct extraction of signature-type from PK instance in X.509 CRT and CSR
2942 non-v3 CRT's.
2947 MBEDTLS_SSL_RENEGOTIATION is disabled. Found by erja-gp.
2952 * Add size-checks for record and handshake message content, securing
2953 fragile yet non-exploitable code-paths.
2969 Note, this padding mode is not used by the TLS protocol. Found and fixed by
2974 mbedtls_sha512_init() is called before operating on the relevant context
2975 structure. Do not assume that zeroizing a context is a correct way to
2989 * Only run AES-192 self-test if AES-192 is available. Fixes #963.
3000 * Add explicit warnings for the use of MD2, MD4, MD5, SHA-1, DES and ARC4
3003 = mbed TLS 2.6.0 branch released 2017-08-10
3006 * Fix authentication bypass in SSL/TLS: when authmode is set to optional,
3019 platform-specific setup and teardown operations. The macro
3031 * Certificate verification functions now set flags to -1 in case the full
3034 * With authmode set to optional, the TLS handshake is now aborted if the
3039 * Add a check if iv_len is zero in GCM, and return an error if it is zero.
3048 * Fix conditional preprocessor directives in bignum.h to enable 64-bit
3052 to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
3056 to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
3068 64-bit division. This is useful on embedded platforms where 64-bit division
3074 config-no-entropy.h to reduce the RAM footprint.
3079 = mbed TLS 2.5.1 released 2017-06-21
3082 * Fixed unlimited overread of heap-based buffer in mbedtls_ssl_read().
3083 The issue could only happen client-side with renegotiation enabled.
3087 * Removed SHA-1 and RIPEMD-160 from the default hash algorithms for
3088 certificate verification. SHA-1 can be turned back on with a compile-time
3093 potential Bleichenbacher/BERserk-style attack.
3098 and with GCC using the -Wpedantic compilation option.
3099 * Fix insufficient support for signature-hash-algorithm extension,
3115 * Fix incorrect sign computation in modular exponentiation when the base is
3126 by Jean-Philippe Aumasson.
3128 = mbed TLS 2.5.0 branch released 2017-05-17
3135 against side-channel attacks like the cache attack described in
3147 behaviour has not changed, namely every configured CAs name is included.
3154 mbedtls_aes_decrypt() -> mbedtls_internal_aes_decrypt()
3155 mbedtls_aes_encrypt() -> mbedtls_internal_aes_encrypt()
3158 * Remove macros from compat-1.3.h that correspond to deleted items from most
3162 * Add checks in the PK module for the RSA functions on 64-bit systems.
3167 = mbed TLS 2.4.2 branch released 2017-03-08
3171 using RSA through the PK module in 64-bit systems. The issue was caused by
3174 mbedtls_pk_sign(). Found by Jean-Philippe Aumasson.
3188 team. #569 CVE-2017-2784
3197 mbedtls_ssl_set_bio_timeout in compat-1.3.h, by removing it.
3198 Found by omlib-lin. #673
3205 renegotiation routines at unexpected times when the protocol is DTLS. Found
3219 Li/Yueh-Hsun Lin, KNOX Security, Samsung Research America.
3230 number to write in hexadecimal is negative and requires an odd number of
3235 = mbed TLS 2.4.1 branch released 2016-12-13
3238 * Update to CMAC test data, taken from - NIST Special Publication 800-38B -
3242 = mbed TLS 2.4.0 branch released 2016-10-17
3246 with RFC-5116 and could lead to session key recovery in very long TLS
3247 sessions. "Nonce-Disrespecting Adversaries Practical Forgery Attacks on GCM in
3248 TLS" - H. Bock, A. Zauner, S. Devlin, J. Somorovsky, P. Jovanovic.
3251 mbedtls_x509write_csr_der() when the signature is copied to the buffer
3252 without checking whether there is enough space in the destination. The
3256 * Added support for CMAC for AES and 3DES and AES-CMAC-PRF-128, as defined by
3257 NIST SP 800-38B, RFC-4493 and RFC-4615.
3259 is functioning correctly.
3261 scripts, which is also now called by all.sh.
3265 * Added a configuration file config-no-entropy.h that configures the subset of
3277 when GCM is used. Found by udf2457. #441
3278 * Fix for key exchanges based on ECDH-RSA or ECDH-ECDSA which weren't
3280 * Fix for out-of-tree builds using CMake. Found by jwurzer, and fix based on
3289 builds where the configuration MBEDTLS_PEM_WRITE_C is not defined. Found
3293 subramanyam-c. #622
3300 Found by subramanyam-c. #626
3308 * Removed self-tests from the basic-built-test.sh script, and added all
3309 missing self-tests to the test suites, to ensure self-tests are only
3312 * Added support for a Yotta specific configuration file -
3318 net.c. For consistency, the corresponding header file, net.h, is marked as
3323 = mbed TLS 2.3.0 branch released 2016-06-28
3332 mbedtls_rsa_rsaes_oaep_decrypt. It is not triggerable remotely in
3341 arguments where the same (in-place doubling). Found and fixed by Janos
3360 * Fix test in ssl-opt.sh that does not run properly with valgrind
3364 * On ARM platforms, when compiling with -O0 with GCC, Clang or armcc5,
3366 the need to pass -fomit-frame-pointer to avoid a build error with -O0.
3370 * Fix non-compliance server extension handling. Extensions for SSLv3 are now
3373 = mbed TLS 2.2.1 released 2016-01-05
3385 * Fix over-restrictive length limit in GCM. Found by Andreas-N. #362
3393 datagram if a single record in a datagram is unexpected, instead only
3397 = mbed TLS 2.2.0 released 2015-11-04
3400 * Fix potential double free if mbedtls_ssl_conf_psk() is called more than
3404 mbedtls_x509_crt_parse_path() is passed a path longer than 2GB. Cannot be
3415 * Experimental support for EC J-PAKE as defined in Thread 1.0.0.
3418 block. (Potential uses include EAP-TLS and Thread.)
3421 * Self-signed certificates were not excluded from pathlen counting,
3424 * Fix build error with configurations where ECDHE-PSK is the only key
3426 * Fix build error with configurations where RSA, RSA-PSK, ECDH-RSA or
3427 ECHD-ECDSA if the only key exchange. Multiple reports. #310
3428 * Fixed a bug causing some handshakes to fail due to some non-fatal alerts
3429 not being properly ignored. Found by mancha and Kasom Koht-arsa, #308
3432 minimum key size for end-entity certificates with RSA keys. Found by
3442 * Improved performance of mbedtls_ecp_muladd() when one of the scalars is 1
3443 or -1.
3445 = mbed TLS 2.1.2 released 2015-10-06
3448 * Added fix for CVE-2015-5291 to prevent heap corruption due to buffer
3451 * Fix potential double-free if mbedtls_ssl_set_hs_psk() is called more than
3456 mbedtls_pk_parse_key(file)() when the password is > 129 bytes.
3468 buffer is 512MB or larger on 32-bit platforms. Found by Guido Vranken,
3470 * Fix potential double-free if mbedtls_conf_psk() is called repeatedly on
3489 = mbed TLS 2.1.1 released 2015-09-17
3492 * Add countermeasure against Lenstra's RSA-CRT attack for PKCS#1 v1.5
3494 https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/
3495 * Fix possible client-side NULL pointer dereference (read) when the client
3498 afl-fuzz.)
3502 * Fix off-by-one error in parsing Supported Point Format extension that
3509 connection, if cookie verification is available
3513 MBEDTLS_ERR_SSL_CLIENT_RECONNECT - it is then possible to start a new
3516 = mbed TLS 2.1.0 released 2015-09-04
3524 * Fix build error with CMake and pre-4.5 versions of GCC (found by Hugo
3532 * Fix compile error with armcc 5 with --gnu option.
3537 * Fix missing -static-libgcc when building shared libraries for Windows
3546 * Fix -Wshadow warnings (found by hnrkp) (#240)
3548 SSL_MAX_CONTENT_LEN or higher - not triggerrable remotely (found by
3556 * It is now possible to #include a user-provided configuration file at the
3559 * When verifying a certificate chain, if an intermediate certificate is
3560 trusted, no later cert is checked. (suggested by hannes-landeholm)
3567 = mbed TLS 2.0.0 released 2015-07-13
3574 * New server-side implementation of session tickets that rotate keys to
3580 * Introduced a concept of presets for SSL security-relevant configuration
3588 Migration helpers scripts/rename.pl and include/mbedtls/compat-1.3.h are
3589 provided. Full list of renamings in scripts/data_files/rename-1.3-2.0.txt
3591 mbedtls_cipher_info_t.key_length -> key_bitlen
3592 mbedtls_cipher_context_t.key_length -> key_bitlen
3593 mbedtls_ecp_curve_info.size -> bit_size
3598 mbedtls_ssl_init() -> mbedtls_ssl_setup()
3599 mbedtls_ccm_init() -> mbedtls_ccm_setkey()
3600 mbedtls_gcm_init() -> mbedtls_gcm_setkey()
3601 mbedtls_hmac_drbg_init() -> mbedtls_hmac_drbg_seed(_buf)()
3602 mbedtls_ctr_drbg_init() -> mbedtls_ctr_drbg_seed()
3608 (see rename.pl and compat-1.3.h above) and their first argument's type
3611 additional callback for read-with-timeout).
3630 mbedtls_x509_crt_verify() (flags, f_vrfy -> needs to be updated)
3631 mbedtls_ssl_conf_verify() (f_vrfy -> needs to be updated)
3632 * The following functions changed prototype to avoid an in-out length
3648 * test_ca_list (from certs.h) is renamed to test_cas_pem and is only
3649 available if POLARSSL_PEM_PARSE_C is defined (it never worked without).
3650 * Test certificates in certs.c are no longer guaranteed to be nul-terminated
3656 * calloc() is now used instead of malloc() everywhere. API of platform
3665 Their 'port' argument type is changed to a string.
3679 * Removed compat-1.2.h (helper for migrating from 1.2 to 1.3).
3683 been removed (compiler is required to support 32-bit operations).
3686 * Removed test program ssl_test, superseded by ssl-opt.sh.
3687 * Removed helper script active-config.pl
3690 * md_init_ctx() is deprecated in favour of md_setup(), that adds a third
3691 argument (allowing memory savings if HMAC is not used)
3693 Semi-API changes (technically public, morally private)
3705 * The default minimum TLS version is now TLS 1.0.
3706 * RC4 is now blacklisted by default in the SSL/TLS layer, and excluded from the
3708 * Support for receiving SSLv2 ClientHello is now disabled by default at
3710 * The default authmode for SSL/TLS clients is now REQUIRED.
3711 * Support for RSA_ALT contexts in the PK layer is now optional. Since is is
3712 enabled in the default configuration, this is only noticeable if using a
3714 * Default DHM parameters server-side upgraded from 1024 to 2048 bits.
3715 * A minimum RSA key size of 2048 bits is now enforced during ceritificate
3717 * Negotiation of truncated HMAC is now disabled by default on server too.
3718 * The following functions are now case-sensitive:
3726 * The minimum MSVC version required is now 2010 (better C99 support).
3728 * Compiler is required to support C99 types such as long long and uint32_t.
3737 * DTLS no longer hard-depends on TIMING_C, but uses a callback interface
3741 * With UDP sockets, it is no longer necessary to call net_bind() again
3746 thread-safe if MBEDTLS_THREADING_C is enabled.
3747 * Reduced ROM fooprint of SHA-256 and added an option to reduce it even
3756 * Add countermeasure against "Lucky 13 strikes back" cache-based attack,
3766 * Add support for id-at-uniqueIdentifier in X.509 names.
3772 cross-compilation easier (thanks to Alon Bar-Lev).
3773 * The benchmark program also prints heap usage for public-key primitives
3775 * New script ecc-heap.sh helps measuring the impact of ECC parameters on
3778 reduced configurations (PSK-CCM and NSA suite B).
3787 * Fix bug in entropy.c when THREADING_C is also enabled that caused
3791 * Fix bug in ssl_mail_client when password is longer that username (found
3795 * mpi_size() and mpi_msb() would segfault when called on an mpi that is
3801 ssl_write() is called before the handshake is finished (introduced in
3810 * Fix potential unintended sign extension in asn1_get_len() on 64-bit
3817 * Add missing dependency on SHA-256 in some x509 programs (reported by
3827 * Enabling POLARSSL_NET_C without POLARSSL_HAVE_IPV6 is deprecated.
3828 * compat-1.2.h and openssl.h are deprecated.
3829 * Adjusting/overriding CFLAGS and LDFLAGS with the make build system is now
3830 more flexible (warning: OFLAGS is not used any more) (see the README)
3831 (contributed by Alon Bar-Lev).
3834 * Move from SHA-1 to SHA-256 in example programs using signatures
3837 "minimize" others (eg use stddef.h if only size_t is needed).
3842 = mbed TLS 1.3.10 released 2015-02-09
3844 * NULL pointer dereference in the buffer-based allocator when the buffer is
3845 full and polarssl_free() is called (found by Mark Hasemeyer)
3846 (only possible if POLARSSL_MEMORY_BUFFER_ALLOC_C is enabled, which it is
3848 * Fix remotely-triggerable uninitialised pointer dereference caused by
3849 crafted X.509 certificate (TLS server is not affected if it doesn't ask for a
3851 * Fix remotely-triggerable memory leak caused by crafted X.509 certificates
3852 (TLS server is not affected if it doesn't ask for a client certificate)
3855 (TLS server is not affected if it doesn't ask for a client certificate)
3858 Bleichenbacher-style attack in the RSA and RSA-PSK key exchanges
3862 * Add support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv).
3863 * Add support for Extended Master Secret (draft-ietf-tls-session-hash).
3864 * Add support for Encrypt-then-MAC (RFC 7366).
3867 * Add compile-time option POLARSSL_X509_MAX_INTERMEDIATE_CA to limit the
3869 * Support for renegotiation can now be disabled at compile-time
3870 * Support for 1/n-1 record splitting, a countermeasure against BEAST.
3871 * Certificate selection based on signature hash, preferring SHA-1 over SHA-2
3872 for pre-1.2 clients when multiple certificates are available.
3881 * Stack buffer overflow if ctr_drbg_update() is called with too large
3882 add_len (found by Jean-Philippe Aumasson) (not triggerable remotely).
3889 * Fix potential failure in ECDSA signatures when POLARSSL_ECP_MAX_BITS is a
3898 issue with some servers when a zero-length extension was sent. (Reported
3900 * On a 0-length input, base64_encode() did not correctly set output length
3906 * Blind RSA private operations even when POLARSSL_RSA_NO_CRT is defined.
3907 * ssl_set_own_cert() now returns an error on key-certificate mismatch.
3910 * A specific error is now returned when there are ciphersuites in common
3911 but none of them is usable due to external factors such as no certificate
3913 * It is now possible to disable negotiation of truncated HMAC server-side
3919 = PolarSSL 1.3.9 released 2014-10-20
3923 * Remotely-triggerable memory leak when parsing some X.509 certificates
3924 (server is not affected if it doesn't ask for a client certificate)
3926 * Remotely-triggerable memory leak when parsing crafted ClientHello
3933 * Fix net_accept() regarding non-blocking sockets (found by Luca Pesce).
3935 * Fix warnings from Clang's scan-build (contributed by Alfred Klomp).
3938 * Remove non-existent file from VS projects (found by Peter Vaskovic).
3939 * ssl_read() could return non-application data records on server while
3941 * Server-initiated renegotiation would fail with non-blocking I/O if the
3944 with non-blocking I/O.
3952 * Ciphersuites using SHA-256 or SHA-384 now require TLS 1.x (there is no
3953 standard defining how to use SHA-2 with SSL 3.0).
3954 * Ciphersuites using RSA-PSK key exchange new require TLS 1.x (the spec is
3957 RSA is disabled, larger if POLARSSL_MPI_MAX_SIZE is larger.
3966 = PolarSSL 1.3.8 released 2014-07-11
3975 * Support for parsing and verifying RSASSA-PSS signatures in the X.509
3982 * Add server-side enforcement of sent renegotiation requests
3985 ciphersuites to use and save some memory if the list is small.
3988 * Add LINK_WITH_PTHREAD option in CMake for explicit linking that is
4000 * Enforce alignment in the buffer allocator even if buffer is not aligned
4001 * Remove less-than-zero checks on unsigned numbers
4013 rejected with CBC-based ciphersuites and TLS >= 1.1
4015 to 32 bytes with CBC-based ciphersuites and TLS >= 1.1
4018 * Restore ability to locally trust a self-signed cert that is not a proper
4024 * Fix off-by-one error in parsing Supported Point Format extension that
4026 * Fix possible miscomputation of the premaster secret with DHE-PSK key
4035 = PolarSSL 1.3.7 released on 2014-05-02
4039 * version_check_feature() added to check for compile-time options at
4040 run-time
4047 * AES-NI now compiles with "old" assemblers too
4063 big-endian platform when size was not an integer number of limbs
4070 = PolarSSL 1.3.6 released on 2014-04-11
4082 * pk_verify() now returns a specific error code when the signature is valid
4091 This affects certificates in the user-supplied chain except the top
4092 certificate. If the user-supplied chain contains only one certificates,
4093 it is not affected (ie, its notAfter date is properly checked).
4107 * Fix compile errors when POLARSSL_ERROR_STRERROR_BC is undefined (found by
4111 * dhm_parse_dhm() (hence dhm_parse_dhmfile()) did not set dhm->len.
4112 * Calling pk_debug() on an RSA-alt key would segfault.
4113 * pk_get_size() and pk_get_len() were off by a factor 8 for RSA-alt keys.
4119 = PolarSSL 1.3.5 released on 2014-03-26
4121 * HMAC-DRBG as a separate module
4125 * Ability to force the entropy module to use SHA-256 as its basis
4127 * Testing script ssl-opt.sh added for testing 'live' ssl option
4135 now thread-safe if POLARSSL_THREADING_C defined
4146 "triple handshake" attack when authentication mode is 'optional' (the
4147 attack was already impossible when authentication is required).
4151 * Possible remotely-triggered out-of-bounds memory access fixed (found by
4158 * Fixed testing with out-of-source builds using cmake
4159 * Fixed version-major intolerance in server
4160 * Fixed CMake symlinking on out-of-source builds
4163 * Bignum's MIPS-32 assembly was used on MIPS-64, causing chaos. (Found by
4167 * Fixed bug with session tickets and non-blocking I/O in the unlikely case
4180 = PolarSSL 1.3.4 released on 2014-01-27
4183 * Support for RIPEMD-160
4199 = PolarSSL 1.3.3 released on 2013-12-31
4205 * Support for ECDH-RSA and ECDH-ECDSA key exchanges and ciphersuites
4207 * AES-NI support for AES, AES-GCM and AES key scheduling
4208 * SSL Pthread-based server example added (ssl_pthread_server)
4215 * More constant-time checks in the RSA module
4222 * Fixed bug in mpi_set_bit() on platforms where t_uint is wider than int
4223 * Fixed X.509 hostname comparison (with non-regular characters)
4236 * Possible remotely-triggered out-of-bounds memory access fixed (found by
4239 = PolarSSL 1.3.2 released on 2013-11-04
4243 * Support for Camellia-GCM mode and ciphersuites
4246 * Padding checks in cipher layer are now constant-time
4247 * Value comparisons in SSL layer are now constant-time
4260 * Server-side initiated renegotiations send HelloRequest
4262 = PolarSSL 1.3.1 released on 2013-10-15
4265 * Support for ECDHE-PSK key-exchange and ciphersuites
4266 * Support for RSA-PSK key-exchange and ciphersuites
4272 * config.h is more script-friendly
4284 = PolarSSL 1.3.0 released on 2013-10-01
4289 (ECDHE-based ciphersuites)
4291 (ECDSA-based ciphersuites)
4293 * PSK and DHE-PSK based ciphersuites added
4295 * Buffer-based memory allocator added (no malloc() / free() / HEAP usage)
4302 * Support for zeros-and-length (ANSI X.923) padding, one-and-zeros
4303 (ISO/IEC 7816-4) padding and zero padding in the cipher layer
4316 * Introduced separate SSL Ciphersuites module that is based on
4318 * Internals for SSL module adapted to have separate IV pointer that is
4332 * Also compiles / runs without time-based functions (!POLARSSL_HAVE_TIME)
4344 (found by Cyril Arnaud and Pierre-Alain Fouque)
4347 = Version 1.2.14 released 2015-05-??
4353 client to crash the server remotely if client authentication is enabled
4355 * Add countermeasure against "Lucky 13 strikes back" cache-based attack,
4363 * Fix potential unintended sign extension in asn1_get_len() on 64-bit
4366 = Version 1.2.13 released 2015-02-16
4371 * Fix remotely-triggerable uninitialised pointer dereference caused by
4372 crafted X.509 certificate (TLS server is not affected if it doesn't ask
4374 * Fix remotely-triggerable memory leak caused by crafted X.509 certificates
4375 (TLS server is not affected if it doesn't ask for a client certificate)
4378 (TLS server is not affected if it doesn't ask for a client certificate)
4381 (TLS server is not affected if it doesn't ask for a client certificate).
4386 * Stack buffer overflow if ctr_drbg_update() is called with too large
4387 add_len (found by Jean-Philippe Aumasson) (not triggerable remotely).
4397 issue with some servers when a zero-length extension was sent. (Reported
4399 * On a 0-length input, base64_encode() did not correctly set output length
4403 * Blind RSA private operations even when POLARSSL_RSA_NO_CRT is defined.
4405 * Add compile-time option POLARSSL_X509_MAX_INTERMEDIATE_CA to limit the
4407 = Version 1.2.12 released 2014-10-24
4410 * Remotely-triggerable memory leak when parsing some X.509 certificates
4411 (server is not affected if it doesn't ask for a client certificate).
4418 with non-blocking I/O.
4422 * Fix net_accept() regarding non-blocking sockets (found by Luca Pesce).
4423 * ssl_read() could return non-application data records on server while
4425 * Fix warnings from Clang's scan-build (contributed by Alfred Klomp).
4434 = Version 1.2.11 released 2014-07-11
4451 "triple handshake" attack when authentication mode is optional (the
4452 attack was already impossible when authentication is required).
4462 * Fixed X.509 hostname comparison (with non-regular characters)
4475 * Fixed testing with out-of-source builds using cmake
4476 * Fixed version-major intolerance in server
4477 * Fixed CMake symlinking on out-of-source builds
4478 * Bignum's MIPS-32 assembly was used on MIPS-64, causing chaos. (Found by
4493 big-endian platform when size was not an integer number of limbs
4504 = Version 1.2.10 released 2013-10-07
4506 * Changed RSA blinding to a slower but thread-safe version
4513 = Version 1.2.9 released 2013-10-01
4526 (found by Cyril Arnaud and Pierre-Alain Fouque)
4528 = Version 1.2.8 released 2013-06-19
4532 * Centralized module option values in config.h to allow user-defined
4555 * x509parse_crtpath() is now reentrant and uses more portable stat()
4557 * Fixed values for 2-key Triple DES in cipher layer
4562 PEM-encoded certificates has been fixed (found by Jack Lloyd)
4564 = Version 1.2.7 released 2013-04-13
4569 * Default Blowfish keysize is now 128-bits
4576 = Version 1.2.6 released 2013-03-11
4579 * Corrected GCM counter incrementation to use only 32-bits instead of
4580 128-bits (found by Yawning Angel)
4581 * Fixes for 64-bit compilation with MS Visual Studio
4591 * Re-added handling for SSLv2 Client Hello when the define
4592 POLARSSL_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO is set
4603 = Version 1.2.5 released 2013-02-02
4605 * Allow enabling of dummy error_strerror() to support some use-cases
4608 * Sending of security-relevant alert messages that do not break
4616 = Version 1.2.4 released 2013-01-25
4628 = Version 1.2.3 released 2012-11-26
4632 = Version 1.2.2 released 2012-11-24
4636 * During verify trust-CA is only checked for expiration and CRL presence
4642 = Version 1.2.1 released 2012-11-20
4644 * Depth that the certificate verify callback receives is now numbered
4645 bottom-up (Peer cert depth is 0)
4651 Pégourié-Gonnard)
4653 Pégourié-Gonnard)
4656 = Version 1.2.0 released 2012-10-31
4662 * Added support for multi-domain certificates through the X509 Subject
4689 * Fixed const-correctness mpi_get_bit()
4693 to not match CN if subjectAltName extension is present (Closes ticket #56)
4694 * Cipher layer cipher_mode_t POLARSSL_MODE_CFB128 is renamed to
4724 = Version 1.1.8 released on 2013-10-01
4730 * Potential buffer-overflow for ssl_read_record() (independently found by
4735 = Version 1.1.7 released on 2013-06-19
4744 * Fixed values for 2-key Triple DES in cipher layer
4749 PEM-encoded certificates has been fixed (found by Jack Lloyd)
4751 = Version 1.1.6 released on 2013-03-11
4756 * Allow enabling of dummy error_strerror() to support some use-cases
4767 = Version 1.1.5 released on 2013-01-16
4778 Pégourié-Gonnard)
4780 Pégourié-Gonnard)
4791 = Version 1.1.4 released on 2012-05-31
4797 = Version 1.1.3 released on 2012-04-29
4801 = Version 1.1.2 released on 2012-04-26
4808 Frama-C team at CEA LIST)
4812 = Version 1.1.1 released on 2012-01-23
4816 * Fixed issues with Intel compiler on 64-bit systems (Closes ticket #50)
4820 = Version 1.1.0 released on 2011-12-22
4822 * Added ssl_session_reset() to allow better multi-connection pools of
4823 SSL contexts without needing to set all non-connection-specific
4830 * Added CTR_DRBG based on AES-256-CTR (NIST SP 800-90) random generator
4839 * Inceased maximum size of ASN1 length reads to 32-bits.
4843 So now there is a module that is controlled with POLARSSL_ASN1_PARSE_C.
4844 * Changed the defined key-length of DES ciphers in cipher.h to include the
4849 trade-off
4858 encountering a parse-error. Beware that the meaning of return values has
4863 * Fixed faulty HMAC-MD2 implementation. Found by dibac. (Closes
4869 * Fixed incorrect behaviour in case of RSASSA-PSS with a salt length
4871 * If certificate serial is longer than 32 octets, serial number is now
4878 = Version 1.0.0 released on 2011-07-27
4891 = Version 0.99-pre5 released on 2011-05-26
4912 is now done with a PLUS instead of an OR as error codes
4918 ssl_read() returns 0 if a POLARSSL_ERR_SSL_CONN_EOF is received
4924 = Version 0.99-pre4 released on 2011-04-01
4927 for the RSAES-OAEP and RSASSA-PSS operations.
4942 platform (32-bit / 64-bit) (Fixes ticket #19, found by Mads
4946 * Fixed proper handling of RSASSA-PSS verification with variable
4949 = Version 0.99-pre3 released on 2011-02-28
4950 This release replaces version 0.99-pre2 which had possible copyright issues.
4975 * Fixed a possible Man-in-the-Middle attack on the
4979 = Version 0.99-pre1 released on 2011-01-30
4981 Note: Most of these features have been donated by Fox-IT
4998 libpkcs11-helper library
5006 with the generic cipher layer and is better naming
5009 = Version 0.14.0 released on 2010-08-16
5013 * Added compile-time and run-time version information
5033 = Version 0.13.1 released on 2010-03-24
5038 = Version 0.13.0 released on 2010-03-21
5049 * X509 signature algorithm determination is now
5054 * Added reset function for HMAC context as speed-up
5055 for specific use-cases
5066 = Version 0.12.1 released on 2009-10-04
5077 = Version 0.12.0 released on 2009-07-28
5081 Base64, MPI, SHA-family, MD-family, HMAC-SHA-family,
5082 Camellia, DES, 3-DES, RSA PKCS#1, XTEA, Diffie-Hellman
5087 this is mind when checking for errors.
5098 * Fixed HMAC-MD2 by modifying md2_starts(), so that the
5119 * Fixed Camellia and XTEA for 64-bit Windows systems.
5121 = Version 0.11.1 released on 2009-05-17
5122 * Fixed missing functionality for SHA-224, SHA-256, SHA384,
5123 SHA-512 in rsa_pkcs1_sign()
5125 = Version 0.11.0 released on 2009-05-03
5129 * Added support for SHA-224, SHA-256, SHA-384 and SHA-512
5139 * Made definition of net_htons() endian-clean for big endian
5143 * Fixed an off-by-one buffer allocation in ssl_set_hostname()
5148 * Fixed compatibility of XTEA and Camellia on a 64-bit system
5151 = Version 0.10.0 released on 2009-01-12
5163 = Version 0.9 released on 2008-03-16
5169 be sent twice in non-blocking mode when send returns EAGAIN
5172 * Added user-defined callback debug function (Krystian Kolodziej)
5178 output data is non-aligned by falling back to the software
5179 implementation, as VIA Nehemiah cannot handle non-aligned buffers
5181 Robson-Garth; some x509write.c fixes by Pascal Vizeli, thanks to
5188 string is passed as the CN (bug reported by spoofy)
5190 * Updated rsa_check_privkey() to verify that (D*E) = 1 % (P-1)*(Q-1)
5195 * Fixed a critical denial-of-service with X.509 cert. verification:
5198 * Added test vectors for: AES-CBC, AES-CFB, DES-CBC and 3DES-CBC,
5199 HMAC-MD5, HMAC-SHA1, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512
5200 * Fixed HMAC-SHA-384 and HMAC-SHA-512 (thanks to Josh Sinykin)
5203 as the Klima-Pokorny-Rosa extension of Bleichenbacher's attack
5204 * Updated rsa_gen_key() so that ctx->N is always nbits in size
5208 = Version 0.8 released on 2007-10-20
5216 * Added user-defined callbacks for handling I/O and sessions
5220 * Added AES-CFB mode of operation, contributed by chmike
5224 * Updated ssl_read() to skip 0-length records from OpenSSL
5226 * Fixed a bug in mpi_read_binary() on 64-bit platforms
5233 = Version 0.7 released on 2007-07-07
5235 * Added support for the MicroBlaze soft-core processor
5237 connections from being established with non-blocking I/O
5241 * Added the SHA-224, SHA-384 and SHA-512 hash functions
5249 = Version 0.6 released on 2007-04-01
5255 * Added multiply assembly code for 64-bit PowerPCs,
5259 * Fixed "long long" compilation issues on IA-64 and PPC64
5260 * Fixed a bug introduced in xyssl-0.5/timing.c: hardclock
5263 = Version 0.5 released on 2007-03-01
5266 * Added (beta) support for non-blocking I/O operations
5269 (thanks to Benjamin Newman), HP-UX, FreeBSD and Solaris
5274 = Version 0.4 released on 2007-02-01
5276 * Added support for Ephemeral Diffie-Hellman key exchange
5287 = Version 0.3 released on 2007-01-01
5289 * Added server-side SSLv3 and TLSv1.0 support
5293 the bignum code is no longer dependent on long long
5298 = Version 0.2 released on 2006-12-01
5309 the Miller-Rabin primality test
5313 who maintains the Debian package :-)
5315 = Version 0.1 released on 2006-11-01