Lines Matching +full:ipv4 +full:- +full:config +full:- +full:causing +full:- +full:fallback +full:- +full:to +full:- +full:tcp

3 = Mbed TLS 3.5.2 branch released 2024-01-26
7      could be sufficient for an attacker to recover the plaintext. A local
8      attacker or a remote attacker who is close to the victim on the network
9      might have precise enough timing measurements to exploit this. It requires
10      the attacker to send a large number of messages for decryption. For
13    * Fix a failure to validate input when writing x509 extensions lengths which
14      could result in an integer overflow, causing a zero-length buffer to be
15      allocated to hold the extension. The extension would then be copied into
16      the buffer, causing a heap buffer overflow.
18 = Mbed TLS 3.5.1 branch released 2023-11-06
21    *  Mbed TLS is now released under a dual Apache-2.0 OR GPL-2.0-or-later
28 = Mbed TLS 3.5.0 branch released 2023-10-05
31    * Mbed TLS 3.4 introduced support for omitting the built-in implementation
32      of ECDSA and/or EC J-PAKE when those are provided by a driver. However,
33      there was a flaw in the logic checking if the built-in implementation, in
34      that it failed to check if all the relevant curves were supported by the
35      accelerator. As a result, it was possible to declare no curves as
36      accelerated and still have the built-in implementation compiled out.
37      Starting with this release, it is necessary to declare which curves are
39      considered not accelerated, and the built-in implementation of the curves
55      IMPORT, EXPORT, GENERATE, DERIVE. The goal is to have a finer detail about
71      been called. Previously (in 3.3), this was restricted to a few modules,
73      entropy module was not covered which meant an external RNG had to be
74      provided - these limitations are lifted in this version. A new set of
76      to check for availability of hash algorithms, regardless of whether
77      they're provided by a built-in implementation, a driver or both. See
78      docs/driver-only-builds.md.
79    * When a PSA driver for ECDH is present, it is now possible to disable
80      MBEDTLS_ECDH_C in the build in order to save code size. For TLS 1.2
81      key exchanges based on ECDH(E) to work, this requires
83      TLS 1.2 (ECDHE-ECDSA key exchange) are not supported in those builds yet,
85    * When all of ECDH, ECDSA and EC J-PAKE are either disabled or provided by
86      a driver, it is possible to disable MBEDTLS_ECP_C (and MBEDTLS_BIGNUM_C
88      algorithms in PSA, with some limitations. See docs/driver-only-builds.txt
92    * Add support for server-side TLS version negotiation. If both TLS 1.2 and
104      parameters from RFC 7919. This includes a built-in implementation based
107    * It is now possible to generate certificates with SubjectAltNames.
115    * Add function mbedtls_oid_from_numeric_string() to parse an OID from a
116      string to a DER-encoded mbedtls_asn1_buf.
117    * Add SHA-3 family hash functions.
118    * Add support to restrict AES to 128-bit keys in order to save code size.
120      used to enable this feature.
123      Aarch64, gcc -Os and CCM, GCM and XTS benefit the most.
124      On Aarch64, uplift is typically around 20 - 110%.
125      When compiling with gcc -Os on Aarch64, AES-XTS improves
127    * Add support for PBKDF2-HMAC through the PSA API.
130      or DH) were introduced in order to have finer accuracy in defining the
133      - DERIVE is only available for ECC keys, not for RSA or DH ones.
134      - implementations are free to enable more than what it was strictly
139      and the ephemeral or psk-ephemeral key exchange mode are enabled.
143    * Reduce syscalls to time() during certificate verification.
144    * Allow MBEDTLS_CONFIG_FILE and MBEDTLS_USER_CONFIG_FILE to be set by
146    * Add getter (mbedtls_ssl_cache_get_timeout()) to access
148    * Add getter (mbedtls_ssl_get_hostname()) to access
150    * Add getter (mbedtls_ssl_conf_get_endpoint()) to access
152    * Support for "opaque" (PSA-held) ECC keys in the PK module has been
153      extended: it is now possible to use mbedtls_pk_write_key_der(),
159    * Add a possibility to generate CSR's with RCF822 and directoryName subtype
161    * Add support for PBKDF2-CMAC through the PSA API.
163      using CPU-accelerated AES (e.g., Arm Crypto Extensions), this option
164      disables the plain C implementation and the run-time detection for the
184      review the size of the output buffer passed to this function, and note
186      to the new functions mbedtls_pkcs5_pbes2_ext() or mbedtls_pkcs12_pbe_ext()
191      (notably recent versions of Clang and IAR) could produce non-constant
193      has access to precise timing measurements.
194    * Updates to constant-time C code so that compilers are less likely to use
196      timing. (Clang has been seen to do this.) Also introduce assembly
197      implementations for 32- and 64-bit Arm and for x86 and x86-64, which are
198      guaranteed not to use conditional instructions.
205      null-cipher cipher suites. Credit to OSS-Fuzz.
207      In TLS 1.3, all configurations are affected except PSK-only ones, and
212      Credit to OSS-Fuzz.
217      than all built-in ones and RSA is disabled.
219    * Add missing md.h includes to some of the external programs from
221      was sufficient for a particular program to work, it would only print
228      MBEDTLS_ECDSA_VERIFY_ALT, causing ecdsa verify to fail. Fixes #7498.
231    * Fix the J-PAKE driver interface for user and peer to accept any values
232      (previously accepted values were limited to "client" or "server").
234      M-class CPUs (Cortex-M0, Cortex-M0+, Cortex-M1, Cortex-M23,
238      way to detect the crypto extensions required. A warning is still issued.
247      mode of operation due to the input not being multiple of block size.
252      example TF-M configuration in configs/ from building cleanly:
257      one of the key exchange modes using ephemeral keys to a server that
264    * Fix x509 certificate generation to conform to RFC 5480 / RFC 5758 when
267    * Fix a potential corruption of the passed-in IV when mbedtls_aes_crypt_cbc()
269    * Fix compile failure due to empty enum in cipher_wrap.c, when building
273    * Don't try to include MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE when
277      mbedtls_x509_san_other_name struct. The type-id of the otherName was not
278      copied to the struct. This meant that the struct had incomplete
284      enabled, where some low-level modules required by requested PSA crypto
290      error code on failure. Before, they returned 1 to indicate failure in
293    * Fix the build with CMake when Everest or P256-m is enabled through
298      compiling with gcc, clang or armclang and -O0.
300      to avoid accidental misuse.
301    * Use heap memory to allocate DER encoded RSA private key.
304    * Update Windows code to use BCryptGenRandom and wcslen, and
310      to psa_crypto_driver_wrappers_no_static.c.
311    * When using CBC with the cipher module, the requirement to call
316 = Mbed TLS 3.4.1 branch released 2023-08-04
322    * Update test data to avoid failures of unit tests after 2023-08-07.
324 = Mbed TLS 3.4.0 branch released 2023-03-28
327    * The default priority order of TLS 1.3 cipher suites has been modified to
334      mbedtls_x509write_crt_set_serial_raw(). The goal here is to remove any
336    * PSA to mbedtls error translation is now unified in psa_util.h,
339      optionally providing file-specific error pairs. Please see psa_util.h for
344      Syntax, as defined in RFC 2315. Currently, support is limited to the
346      - Only the signed-data content type, version 1 is supported.
347      - Only DER encoding is supported.
348      - Only a single digest algorithm per message is supported.
349      - Certificates must be in X.509 format. A message must have either 0
351      - There is no support for certificate revocation lists.
352      - The authenticated and unauthenticated attribute fields of SignerInfo
354      Many thanks to Daniel Axtens, Nayna Jain, and Nick Child from IBM for
355      contributing this feature, and to Demi-Marie Obenour for contributing
359    * Improvements to use of unaligned and byte-swapped memory, reducing code
370    * Add parsing of V3 extensions (key usage, Netscape cert-type,
373      configuration-independent files. This allows them to be generated when
377    * Add an interruptible version of sign and verify hash to the PSA interface,
384    * When a PSA driver for ECDSA is present, it is now possible to disable
385      MBEDTLS_ECDSA_C in the build in order to save code size. For PK, X.509
386      and TLS to fully work, this requires MBEDTLS_USE_PSA_CRYPTO to be enabled.
390    * Add a driver dispatch layer for EC J-PAKE, enabling alternative
391      implementations of EC J-PAKE through the driver entry points.
394    * Add support to include the SubjectAltName extension to a CSR.
395    * Add support for AES with the Armv8-A Cryptographic Extension on
396      64-bit Arm. A new configuration option, MBEDTLS_AESCE_C, can
397      be used to enable this feature. Run-time detection is supported
399    * When a PSA driver for EC J-PAKE is present, it is now possible to disable
400      MBEDTLS_ECJPAKE_C in the build in order to save code size. For the
401      corresponding TLS 1.2 key exchange to work, MBEDTLS_USE_PSA_CRYPTO needs
402      to be enabled.
404      to read non-public fields for padding mode and hash id from
406    * AES-NI is now supported with Visual Studio.
407    * AES-NI is now supported in 32-bit builds, or when MBEDTLS_HAVE_ASM
410      gcc -m32 -msse2 -maes -mpclmul). (Generic x86 builds with GCC-like
411      compilers still require MBEDTLS_HAVE_ASM and a 64-bit target.)
412    * It is now possible to use a PSA-held (opaque) password with the TLS 1.2
417    * Use platform-provided secure zeroization function where possible, such as
420    * Fix a potential heap buffer overread in TLS 1.3 client-side when
422    * Add support for AES with the Armv8-A Cryptographic Extension on 64-bit
423      Arm, so that these systems are no longer vulnerable to timing side-channel
427      builds that couldn't compile the GCC-style assembly implementation
428      (most notably builds with Visual Studio), leaving them vulnerable to
429      timing side-channel attacks. There is now an intrinsics-based AES-NI
430      implementation as a fallback for when the assembly one cannot be used.
437      causing generate_errors.pl to error out resulting in a build failure.
441      ticket timestamps (typically timestamps in milliseconds) compared to the
442      Mbed TLS ticket timestamps (in seconds) to compute a ticket age smaller
448      be toggled with config.py.
454      forbidden by the standard (RFC5280 - section 4.1.2.2) and now it's being
464      certificate parsing, but only on subsequent calls to
467      possible to verify RSA PSS signatures with the pk module, which was
469    * Fix bug in conversion from OID to string in
472    * Reject OIDs with overlong-encoded subidentifiers when converting
473      them to a string.
477      have the most-significant bit set in their last byte.
478    * Silence warnings from clang -Wdocumentation about empty \retval
482    * Fix an unused-variable warning in TLS 1.3-only builds if
486    * Allow setting user and peer identifiers for EC J-PAKE operation
493    * Fix TLS 1.3 session resumption when the established pre-shared key is
494      384 bits long. That is the length of pre-shared keys created under a
505    * Mixed-endian systems are explicitly not supported any more.
508      signatures. This aligns the behaviour with MBEDTLS_USE_PSA_CRYPTO to
511      visualc/VS2010 to visualc/VS2013 as we do not support building with versions
512      older than 2013. Update the solution file to specify VS2013 as a minimum.
514      - now it accepts the serial number in 2 different formats: decimal and
516      - "serial" is used for the decimal format and it's limted in size to
518      - "serial_hex" is used for the hex format; max length here is
523      https://mbed-tls.readthedocs.io/en/latest/kb/how-to/rewrite-branch-for-coding-style/
524    * Changed the default MBEDTLS_ECP_WINDOW_SIZE from 6 to 2.
526      RSA decryption performance has changed lately due to security fixes.
527      To fix the performance degradation when using default values the
528      window was reduced from 6 to 2, a value that gives the best or close
529      to best results when tested on Cortex-M4 and Intel i7.
531      MBEDTLS_SHA512_USE_A64_CRYPTO_*, it is no longer necessary to specify
535 = Mbed TLS 3.3.0 branch released 2022-12-14
541      RFC 9146, which is not interoperable with the draft-05 version.
542      If you need to communicate with peers that use earlier versions of
543      Mbed TLS, then you need to define MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT
544      to 1, but then you won't be able to communicate with peers that use the
545      standard (non-draft) version.
546      If you need to interoperate with both classes of peers with the
554      addition to jinja2. The official list of required Python modules is
569    * Expose the EC J-PAKE functionality through the Draft PSA PAKE Crypto API.
570      Only the ECC primitive with secp256r1 curve and SHA-256 hash algorithm
573      built-in implementation present, but only in some configurations.
574      - RSA OAEP and PSS (PKCS#1 v2.1), PKCS5, PKCS12 and EC J-PAKE now use
576      - PEM parsing of encrypted files now uses MD-5 from PSA when (and only
580      Note that some modules are not able to use hashes from PSA yet, including
581      the entropy module. As a consequence, for now the only way to build with
582      all hashes only provided by drivers (no built-in hash) is to use
586      As a consequence, they now work in configurations where the built-in
588      provided by PSA drivers. (See previous entry for limitation on RSA-PSS
590    * Add support for opaque keys as the private keys associated to certificates
592    * Add the LMS post-quantum-safe stateful-hash asymmetric signature scheme.
593      Signature verification is production-ready, but generation is for testing
595      (LMS_SHA256_M32_H10), meaning that each private key can be used to sign
599    * Add the LM-OTS post-quantum-safe one-time signature scheme, which is
601      be used to sign one message so is impractical for most circumstances.
602    * Mbed TLS now supports TLS 1.3 key establishment via pre-shared keys.
603      The pre-shared keys can be provisioned externally or via the ticket
621    * The TLS 1.2 EC J-PAKE key exchange can now use the PSA Crypto API.
632    * Add an ad-hoc key derivation function handling EC J-PAKE to PMS
633      calculation that can be used to derive the session secret in TLS 1.2,
634      as described in draft-cragie-tls-ecjpake-01. This can be achieved by
641    * Fix an issue where an adversary with access to precise enough information
644      victim performing a single private-key operation if the window size used
646      Wenjian HE, Sharad Sinha, and Wei ZHANG. See "Cache Side-channel Attacks
647      and Defenses of the Sliding Window Algorithm in TEEs" - Design, Automation
651    * Refactor mbedtls_aes_context to support shallow-copying. Fixes #2147.
652    * Fix an issue with in-tree CMake builds in releases with GEN_FILES
654      it could be turned into a symbolic link to itself.
655    * Fix a long-standing build failure when building x86 PIC code with old
657      recommend upgrading to a more recent compiler instead. Fixes #1910.
658    * Fix support for little-endian Microblaze when MBEDTLS_HAVE_ASM is defined.
659      Contributed by Kazuyuki Kimura to fix #2020.
660    * Use double quotes to include private header file psa_crypto_cipher.h.
674    * Fix a build error due to a missing prototype warning when
685    * Fix compilation errors when trying to build with
686      PSA drivers for AEAD (GCM, CCM, Chacha20-Poly1305).
689      Change mbedtls_x509_get_name() to clean up allocated objects on error.
695      public key. This bug meant that it was possible to verify a
701    * Add a configuration check to exclude optional client authentication
703    * Fix a bug in which mbedtls_x509_crt_info() would produce non-printable
710    * In the bignum module, operations of the form (-A) - (+A) or (-A) - (-A)
724      to OSS-Fuzz. Fixes #6597.
727    * Move some SSL-specific code out of libmbedcrypto where it had been placed
733    * Add the ability to query PSA_WANT_xxx macros to query_compile_time_config.
734    * Calling AEAD tag-specific functions for non-AEAD algorithms (which
735      should not be done - they are documented for use only by AES-GCM and
739 = Mbed TLS 3.2.1 branch released 2022-07-12
742    *  Re-add missing generated file library/psa_crypto_driver_wrappers.c
744 = Mbed TLS 3.2.0 branch released 2022-07-11
774    * Add accessor to obtain ciphersuite id from ssl context.
775    * Add accessors to get members from ciphersuite info.
777    * Add accessor to get the raw buffer pointer from a PEM context.
781    * Add an accessor function to get the configuration associated with
783    * Add a function to access the protocol version from an SSL context in a
784      form that's easy to compare. Fixes #5407.
785    * Add function mbedtls_md_info_from_ctx() to recall the message digest
786      information that was used to set up a message digest context.
790    * Provide mechanism to reset handshake cert list by calling
792    * Add accessor mbedtls_ssl_get_hs_sni() to retrieve SNI from within
797    * Add function mbedtls_timing_get_final_delay() to access the private
800     * Add mbedtls_pk_sign_ext() which allows generating RSA-PSS signatures when
802    * Add function mbedtls_ecp_export() to export ECP key pair parameters.
804    * Add function mbedtls_ssl_is_handshake_over() to enable querying if the SSL
805      Handshake has completed or not, and thus whether to continue calling
807    * Add the function mbedtls_ssl_get_own_cid() to access our own connection id
813      mbedtls_ssl_conf_min_tls_version() that use a single value to specify
815     * Extend the existing PSA_ALG_TLS12_PSK_TO_MS() algorithm to support
816       mixed-PSK. Add an optional input PSA_KEY_DERIVATION_INPUT_OTHER_SECRET
821      Furthermore you may name an additional file to include after the main
823    * Add the function mbedtls_x509_crt_has_ext_type() to access the ext types
825    * Add HKDF-Expand and HKDF-Extract as separate algorithms in the PSA API.
826    * Add support for the ARMv8 SHA-2 acceleration instructions when building
831      first ClientHello was not suitable to the server.
832    * Add support for client-side TLS version negotiation. If both TLS 1.2 and
838      establishment only). See docs/architecture/tls13-support.md for a
841    * Add accessors to configure DN hints for certificate request:
845      now causes most of them to be done using PSA Crypto; see
846      docs/use-psa-crypto.md for the list of exceptions.
850    * Opaque pre-shared keys for TLS, provisioned with
853      for the "mixed" PSK key exchanges as well: ECDHE-PSK, DHE-PSK, RSA-PSK.
854    * cmake now detects if it is being built as a sub-project, and in that case
859      by side in order to illustrate how the operation is performed in PSA.
863    * Zeroize dynamically-allocated buffers used by the PSA Crypto key storage
868    * Add the platform function mbedtls_setbuf() to allow buffering to be
869      disabled on stdio files, to stop secrets loaded from said files being
872    * Fix a potential heap buffer overread in TLS 1.2 server-side when
879      or a man-in-the-middle could cause a DTLS server to read up to 255 bytes
883      and possibly up to 571 bytes with a custom cookie check function.
886       client or server could cause an MbedTLS server or client to overread up
887       to 64 kBytes of data and potentially overread the input buffer by that
895      client or server to be able to authenticate itself through a certificate
896      to an Mbed TLS TLS 1.3 server or client while it does not own a proper
897      certificate to do so.
901      pattern for PSA_WANT_xxx symbols. Previously you had to specify
909      enabled and an ECDHE-ECDSA or ECDHE-RSA key exchange was used, the
910      client would fail to check that the curve selected by the server for
913      according to its configuration. Fixes #5291.
919    * Fix API violation in mbedtls_md_process() test by adding a call to
922      to catch bad uses of time.h.
923    * Fix a race condition in out-of-source builds with CMake when generated data
928      potentially leading to corrupted alert messages being sent in case
929      the function needs to be re-called after initially returning
932      MBEDTLS_DEBUG_C, DTLS handshakes using CID would crash due to a null
936      documentation stated that the `allowed_pks` field applies to signatures
937      only, but in fact it does apply to the public key type of the end entity
947      MBEDTLS_ECDH_LEGACY_CONTEXT caused the program not to run. Fixes #4901 and
950      been received yet when we first try to fetch it.
953    * Add mbedtls_x509_dn_get_next function to return the next relative DN in
954      an X509 name, to allow walking the name list. Fixes #5431.
957      and other special characters, conforming to RFC 1779. Fixes #769.
959    * Fix check_config.h to check that we have MBEDTLS_SSL_KEEP_PEER_CERTIFICATE
963    * Fix a TLS 1.3 handshake failure when the first attempt to send the client
975      non-compliant. This could not lead to a buffer overflow. In particular,
985      make to break on a clean checkout. Fixes #5340.
986    * Work around an MSVC ARM64 compiler bug causing incorrect behaviour
988    * Removed the prompt to exit from all windows build programs, which was causing
994      driver descriptions. For the time being, to customize this file,
995      see docs/proposed/psa-driver-wrappers-codegen-migration-guide.md
996    * Return PSA_ERROR_INVALID_ARGUMENT if the algorithm passed to one-shot
1001    * Assume source files are in UTF-8 when using MSVC with CMake.
1004    * cmake: Use GnuInstallDirs to customize install directories
1014 = mbed TLS 3.1.0 branch released 2021-12-17
1018      Alternative GCM implementations are expected to verify
1019      the length of the provided output buffers and to return the
1026      POSIX/Unix-like platforms.
1029    * Sign-magnitude and one's complement representations for signed integers are
1048      supported on GCC-like compilers and on MSVC and can be configured through
1052      MBEDTLS_CHECK_RETURN_WARNING to get warnings for other functions. This
1054      extended to other modules in the future.
1057    * Add support for CCM*-no-tag cipher to the PSA.
1058      Currently only 13-byte long IV's are supported.
1059      For decryption a minimum of 16-byte long input is expected.
1060      These restrictions may be subject to change.
1062    * Add functions to get the IV and block size from cipher_info structs.
1063    * Add functions to check if a cipher supports variable IV or key size.
1064    * Add the internal implementation of and support for CCM to the PSA multipart
1067      protocol. See docs/architecture/tls13-support.md for the definition of
1071      to select the 1.3 version of the protocol to establish a TLS connection.
1075    * Zeroize several intermediate variables used to calculate the expected
1079      man-in-the-middle to inject fake ciphertext into a DTLS connection.
1088    * Fix a double-free that happened after mbedtls_ssl_set_session() or
1091      and mbedtls_ssl_free() would cause an internal session buffer to
1096    * The GNU makefiles invoke python3 in preference to python except on Windows.
1097      The check was accidentally not performed when cross-compiling for Windows
1109    * Fix mbedtls_cipher_crypt: AES-ECB when MBEDTLS_USE_PSA_CRYPTO is enabled.
1110    * Failures of alternative implementations of AES or DES single-block
1114      where this function cannot fail, or full-module replacements with
1119    * Fix compile-time or run-time errors in PSA
1123      psa_aead_finish() and psa_aead_verify() does not apply to the built-in
1125    * Move GCM's update output buffer length verification from PSA AEAD to
1126      the built-in implementation of the GCM.
1127      The requirement for output buffer size to be equal or greater then
1128      input buffer size is valid only for the built-in implementation of GCM.
1135      PSA_ALG_RSA_PSS_ANY_SALT to accept any salt length. Fixes #4946.
1143      not to list other shared libraries they need.
1151      pkcs12 functions when the password is empty. Fix the documentation to
1152      better describe the inputs to these functions and their possible values.
1162       oversight during the run-up to the release of Mbed TLS 3.0.
1163       The fields were never intended to be public.
1164    * Implement multi-part CCM API.
1165      The multi-part functions: mbedtls_ccm_starts(), mbedtls_ccm_set_lengths(),
1173      to set a callback, but was deemed unnecessary as it was yet another define
1174      to remember when writing tests, or test configurations. Fixes #4653.
1175    * Improve the performance of base64 constant-flow code. The result is still
1176      slower than the original non-constant-flow implementation, but much faster
1177      than the previous constant-flow implementation. Fixes #4814.
1178    * Ignore plaintext/ciphertext lengths for CCM*-no-tag operations.
1182      ChaCha20-Poly1305 is invalid, and not just unsupported.
1184      containing various functions meant to resist timing side channel attacks.
1189    * The generated configuration-independent files are now automatically
1190      generated by the CMake build system on Unix-like systems. This is not
1191      yet supported when cross-compiling.
1193 = Mbed TLS 3.0.0 branch released 2021-07-07
1202      https://mbed-tls.readthedocs.io/en/latest/kb/how-to/add-entropy-sources-to-entropy-pool/ for
1204    * Add missing const attributes to API functions.
1205    * Remove helpers for the transition from Mbed TLS 1.3 to Mbed TLS 2.0: the
1206      header compat-1.3.h and the script rename.pl.
1208      Transfer keys and certificates embedded in the library to the test
1209      component. This contributes to minimizing library API and discourages
1215      which have also been renamed to ecp_internal_alt.h and rsa_alt_helpers.h
1219      were not meant to be used in application code have been moved out of
1225    * Drop support for TLS record-level compression (MBEDTLS_ZLIB_SUPPORT).
1227    * Drop support for single-DES ciphersuites.
1229    * Update AEAD output size macros to bring them in line with the PSA Crypto
1231      key type used, as well as the key bit-size in the case of
1246      when outputting a SHA-384 or SHA-224 hash into a buffer of exactly
1248    * Remove the MBEDTLS_TEST_NULL_ENTROPY config option. Fixes #4388.
1249    * The interface of the GCM module has changed to remove restrictions on
1250      how the input to multipart operations is broken down. mbedtls_gcm_finish()
1254      call to mbedtls_gcm_update(), but alternative implementations activated
1255      by MBEDTLS_GCM_ALT may delay partial blocks to the next call to
1257      no longer pass the associated data to mbedtls_gcm_starts(), but to the
1260    * Replace MBEDTLS_SHA512_NO_SHA384 config option with MBEDTLS_SHA384_C.
1261      This separates config option enabling the SHA384 algorithm from option
1264      This separates config option enabling the SHA224 algorithm from option
1267      session-ID based session resumption) has changed to that of
1268      a key-value store with keys being session IDs and values
1281      which allows to mark an extension as critical. Fixes #4055.
1282    * For multi-part AEAD operations with the cipher module, calling
1284      was unclear on this point, and this function happened to never do
1286      possible to skip calling it, which is no longer supported.
1287    * The option MBEDTLS_ECP_FIXED_POINT_OPTIM use pre-computed comb tables
1299      key. To use an RSA key with PSS or OAEP, call mbedtls_rsa_set_padding()
1324      Raw keys and IVs are no longer passed to the callback.
1329      context are now connection-specific.
1331      length parameter to be the size of the hash input. For RSA signatures
1338    * Implement one-shot cipher functions, psa_cipher_encrypt and
1339      psa_cipher_decrypt, according to the PSA Crypto API 1.0.0
1341    * Direct access to fields of structures declared in public headers is no
1350    * Enable by default the functionalities which have no reason to be disabled.
1351      They are: ARIA block cipher, CMAC mode, elliptic curve J-PAKE library and
1352      Key Wrapping mode as defined in NIST SP 800-38F. Fixes #4036.
1362      bear this in mind and do not add them to backported code.
1364      release, some configuration-independent files are now generated at build
1369    * Refresh the minimum supported versions of tools to build the
1375      compile-time option, which was off by default. Users should not trust
1376      certificates signed with SHA-1 due to the known attacks against SHA-1.
1377      If needed, SHA-1 certificates can still be verified by using a custom
1385      https://lists.trustedfirmware.org/pipermail/mbed-tls/2020-April/000024.html
1389      compile-time option. This option has been inactive for a long time.
1392    * Remove the following deprecated functions and constants of hex-encoded
1410      CBC record splitting, fallback SCSV, and the ability to configure
1418    * The RSA module no longer supports private-key operations with the public
1420    * Remove the MBEDTLS_SSL_DTLS_BADMAC_LIMIT config.h option. Fixes #4403.
1435    * Remove MBEDTLS_ECDH_LEGACY_CONTEXT config option since this was purely for
1440    * Remove the  MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION config.h
1441      option. The mbedtls_x509_crt_parse_der_with_ext_cb() is the way to go for
1444      MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE config.h options and let the code
1457      MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT config option. Users are better served by
1458      using a CCM-8 ciphersuite than a CBC ciphersuite with truncated HMAC.
1460    * Remove the compile-time option
1464    * Add mbedtls_rsa_rsassa_pss_sign_ext() function allowing to generate a
1465      signature with a specific salt length. This function allows to validate
1468    * Added support for built-in driver keys through the PSA opaque crypto
1469      driver interface. Refer to the documentation of
1472    * The multi-part GCM interface (mbedtls_gcm_update() or
1473      mbedtls_cipher_update()) no longer requires the size of partial inputs to
1475    * The multi-part GCM interface now supports chunked associated data through
1476      multiple calls to mbedtls_gcm_update_ad().
1482      See docs/architecture/alternative-implementations.md for the remaining
1485      query the size of the modulus in a Diffie-Hellman context.
1487      Diffie-Hellman context.
1488    * Use the new function mbedtls_ecjpake_set_point_format() to select the
1495    * Fix a bias in the generation of finite-field Diffie-Hellman-Merkle (DHM)
1504    * Fix an issue where an adversary with access to precise enough information
1507      victim performing a single private-key operation. Found and reported by
1509    * Fix an issue where an adversary with access to precise enough timing
1510      information (typically, a co-located process) could recover a Curve25519
1512      observing the victim performing the corresponding private-key operation.
1518      lead to the seed file corruption in case if the path to the seed file is
1519      equal to MBEDTLS_PLATFORM_STD_NV_SEED_FILE. Contributed by Victor
1523      to create is not valid, bringing them in line with version 1.0.0 of the
1525    * Add printf function attributes to mbedtls_debug_print_msg to ensure we
1530    * Fix a bug in ECDSA that would cause it to fail when the hash is all-bits
1535      mbedtls_mpi_read_string() was called on "-0", or when
1541    * In a TLS client, enforce the Diffie-Hellman minimum parameter size
1543      minimum size was rounded down to the nearest multiple of 8.
1545      defined to specific values.  If the code is used in a context
1548      be adequate to build Mbed TLS.
1552    * The cipher suite TLS-RSA-WITH-CAMELLIA-256-GCM-SHA384 was not available
1553      when SHA-1 was disabled and was offered when SHA-1 was enabled but SHA-384
1555    * Do not offer SHA384 cipher suites when SHA-384 is disabled. Fixes #4499.
1557      Arm Cortex-M. Fixes #4530.
1559      directive in a header and a missing initialization in the self-test.
1560    * Fix a missing initialization in the Camellia self-test, affecting
1562    * Restore the ability to configure PSA via Mbed TLS options to support RSA
1564      is not defined PSA will no longer attempt to use mbedtls_rsa_gen_key().
1567      (when the encrypt-then-MAC extension is not in use) with some ALT
1568      implementations of the underlying hash (SHA-1, SHA-256, SHA-384), causing
1569      the affected side to wrongly reject valid messages. Fixes #4118.
1570    * Remove outdated check-config.h check that prevented implementing the
1579      could notably be triggered by setting the TLS debug level to 3 or above
1582    * psa_verify_hash() was relying on implementation-specific behavior of
1583      mbedtls_rsa_rsassa_pss_verify() and was causing failures in some _ALT
1589      A=0 represented with 0 limbs. Up to and including Mbed TLS 2.26, this bug
1593      Credit to OSS-Fuzz. Fixes #4641.
1598      read-only lifetime. The persistence level PSA_KEY_PERSISTENCE_READ_ONLY
1604    * Fix which alert is sent in some cases to conform to the
1608    * Correct (change from 12 to 13 bytes) the value of the macro describing the
1613    * Add extra printf compiler warning flags to builds.
1615    * Alternative implementations of CMAC may now opt to not support 3DES as a
1619    * Remove configs/config-psa-crypto.h, which no longer had any intended
1639    * Add CMake package config generation for CMake projects consuming Mbed TLS.
1640    * config.h has been split into build_info.h and mbedtls_config.h
1641      build_info.h is intended to be included from C code directly, while
1642      mbedtls_config.h is intended to be edited by end users wishing to
1646    * A config file version symbol, MBEDTLS_CONFIG_VERSION was introduced.
1647      Defining it to a particular value will ensure that Mbed TLS interprets
1648      the config file in a way that's compatible with the config file format
1652    * Various changes to which alert and/or error code may be returned
1659 = mbed TLS 2.26.0 branch released 2021-03-08
1662    * Renamed the PSA Crypto API output buffer size macros to bring them in line
1665      in bits rather than bytes, with an additional flag to indicate if the
1666      size may have been rounded up to a whole number of bytes.
1667    * Renamed the PSA Crypto API AEAD tag length macros to bring them in line
1688    * Automatic fallback to a software implementation of ECP when
1691    * The PSA crypto subsystem can now be configured to use less static RAM by
1704      minimum MAC or tag length thanks to the new wildcards
1713      length, or when the entropy module uses SHA-256 and CTR_DRBG uses AES-256.
1714      In such cases, a random nonce was necessary to achieve the advertised
1719      |A| - |B| where |B| is larger than |A| and has more limbs (so the
1725      mbedtls_pk_write_key_pem(). If MBEDTLS_MPI_MAX_SIZE is set to an odd
1726      value the function might fail to write a private RSA keys of the largest
1733      making access aceess to them use constant flow code.
1736    * Fix use-after-scope error in programs/ssl/ssl_client2.c and ssl_server2.c
1747      fail. Such a double-free was not safe when MBEDTLS_THREADING_C was
1749    * Fix a resource leak in a bad-arguments case of mbedtls_rsa_gen_key()
1752    * Fixes a bug where, if the library was configured to include support for
1758      used to validate digital signatures on certificates and MUST mark the
1759      extension as critical in such certificates." Previous to this change,
1760      the extension was always marked as non-critical. This was fixed by
1764    * A new library C file psa_crypto_client.c has been created to contain
1770 = mbed TLS 2.25.0 branch released 2020-12-11
1773    * The numerical values of the PSA Crypto API macros have been updated to
1774      conform to version 1.0.0 of the specification.
1780      as they have no way to check if the output buffer is large enough.
1782      mbedtls_cipher_auth_decrypt_ext() instead. Credit to OSS-Fuzz and
1786    * Update the minimum required CMake version to 2.8.12.  This silences a
1796      these new functions always append the tag to the ciphertext, and include
1803    * Add support for ECB to the PSA cipher API.
1807      This is currently non-standard behaviour, but expected to make it into a
1809    * Add MBEDTLS_TARGET_PREFIX CMake variable, which is prefixed to the mbedtls,
1811      external CMake projects that include this one to avoid CMake target name
1814    * Add support for DTLS-SRTP as defined in RFC 5764. Contributed by Johan
1816    * In the PSA API, it is no longer necessary to open persistent keys:
1818      identical to psa_key_id_t instead of being platform-defined. This bridges
1819      the last major gap to compliance with the PSA Cryptography specification
1832      of up to 15 bytes, with consequences ranging up to arbitrary code
1834    * Limit the size of calculations performed by mbedtls_mpi_exp_mod to
1835      MBEDTLS_MPI_MAX_SIZE to prevent a potential denial of service when
1836      generating Diffie-Hellman key pairs. Credit to OSS-Fuzz.
1840      are implemented. This could cause failures or the silent use of non-random
1842      obtain entropy, or due to an internal failure (which, for Mbed TLS's own
1843      CTR_DRBG or HMAC_DRBG, can only happen due to a misconfiguration).
1846      description part of the cert to the real signature. This meant that a
1847      NULL algorithm parameters entry would look identical to an array of REAL
1848      (size zero) to the library and thus the certificate would be considered
1852      Many thanks to guidovranken who found this issue via differential fuzzing
1857      functions to erase sensitive data from memory. Reported by
1867    * Fix rsa_prepare_blinding() to retry when the blinding value is not
1872    * Use socklen_t on Android and other POSIX-compliant system
1873    * Fix the build when the macro _GNU_SOURCE is defined to a non-empty value.
1876      sizes (instead of PSA_ERROR_BAD_STATE in some cases) to make the
1882    * Fix psa_generate_key() returning an error when asked to generate
1884    * Fix psa_key_derivation_output_key() to allow the output of a combined key
1885      agreement and subsequent key derivation operation to be used as a key
1890    * Fix an off-by-one error in the additional data length check for
1891      CCM, which allowed encryption with a non-standard length field.
1894      MBEDTLS_MODE_ECB to 0, since ECB mode ciphers don't use IVs.
1898    * psa_set_key_id() now also sets the lifetime to persistent for keys located
1900    * Attempting to create a volatile key with a non-zero key identifier now
1903    * Attempting to create or register a key with a key identifier in the vendor
1908      (an error condition) and the second operand was aliased to the result.
1909    * Fix a case in elliptic curve arithmetic where an out-of-memory condition
1926    * The PSA persistent storage format is updated to always store the key bits
1929      specification (docs/architecture/mbed-crypto-storage-specification.md).
1932      but spurious and misleading since it looked like a mistaken attempt to
1933      zeroize the pointed-to buffer. Reported by Antonio de la Piedra, CEA
1936 = mbed TLS 2.24.0 branch released 2020-09-01
1939    * In the PSA API, rename the types of elliptic curve and Diffie-Hellman
1940      group families to psa_ecc_family_t and psa_dh_family_t, in line with the
1943      PSA_ECC_CURVE_xxx renamed to PSA_ECC_FAMILY_xxx
1944      PSA_DH_GROUP_xxx renamed to PSA_DH_FAMILY_xxx
1945      PSA_KEY_TYPE_GET_CURVE renamed to to PSA_KEY_TYPE_ECC_GET_FAMILY
1946      PSA_KEY_TYPE_GET_GROUP renamed to PSA_KEY_TYPE_DH_GET_FAMILY
1954    * The new function mbedtls_ecp_write_key() exports private ECC keys back to
1957      -Wformat-signedness, and fix the code that causes signed-one-bit-field
1958      and sign-compare warnings. Contributed by makise-homura (Igor Molchanov)
1965      subjecAltName extension is present, the expected name was compared to any
1967      attacker could for example impersonate a 4-bytes or 16-byte domain by
1968      getting a certificate for the corresponding IPv4 or IPv6 (this would
1969      require the attacker to control that IP address, though). Similar attacks
1973      its revocationDate was in the past according to the local clock if
1976      MBEDTLS_HAVE_TIME_DATE, an attacker able to control the local clock (for
1983      Encrypt-then-Mac extension, use constant code flow memory access patterns
1984      to extract and check the MAC. This is an improvement to the existing
1986      effective against network-based attackers, but less so against local
1988      if they have access to fine-grained measurements. In particular, this
1992    * Fix side channel in RSA private key operations and static (finite-field)
1993      Diffie-Hellman. An adversary with precise enough timing and memory access
1995      enclave) could bypass an existing counter-measure (base blinding) and
1997    * Fix a 1-byte buffer overread in mbedtls_x509_crl_parse_der().
1998      Credit to OSS-Fuzz for detecting the problem and to Philippe Antoine
2000    * Zeroising of plaintext buffers in mbedtls_ssl_read() to erase unused
2007    * Use local labels in mbedtls_padlock_has_support() to fix an invalid symbol
2012      Montgomery keys in little-endian as defined by RFC7748. Contributed by
2015      curves. Raised by signpainter in #941 and by Taiki-San in #1412. This
2017    * Fix self-test failure when the only enabled short Weierstrass elliptic
2029    * Only pass -Wformat-signedness to versions of GCC that support it. Reported
2032      previously could lead to stack overflow on constrained devices.
2036    * Update copyright notices to use Linux Foundation guidance. As a result,
2039      eliminates the need for the lines declaring the files to be part of
2041    * Add the command line parameter key_pwd to the ssl_client2 and ssl_server2
2042      example applications which allows to provide a password for the key file
2044      these applications with password-protected key files. Analogously but for
2045      ssl_server2 only, add the command line parameter key_pwd2 which allows to
2049 = mbed TLS 2.23.0 branch released 2020-07-01
2053      key lifetimes to encode a persistence level and the location. Although C
2055      psa_register_se_driver() must be modified to pass the driver's location
2062      high- and low-level error codes, complementing mbedtls_strerror()
2066    * The new utility programs/ssl/ssl_context_info prints a human-readable
2072      a solution to #3241.
2073    * Pass the "certificate policies" extension to the callback supplied to
2076    * Added support to entropy_poll for the kern.arandom syscall supported on
2083      Ming-Wei Shih, Prasun Gera, Taesoo Kim and Hyesoon Kim (Georgia Institute
2090      f_rng argument. An attacker with access to precise enough timing and
2094    * Fix issue in Lucky 13 counter-measure that could make it ineffective when
2096      macros). This would cause the original Lucky 13 attack to be possible in
2097      those configurations, allowing an active network attacker to recover
2106      pathLenConstraint basic constraint value is equal to INT_MAX.
2108      behavior, so this is unlikely to be exploitable anywhere. #3192
2110      due to shadowed variable. Contributed by Sander Visser in #3310.
2114      mbedtls_gcc_group_to_psa(). This allows the pk.c module to link separately
2126    * Set _POSIX_C_SOURCE to at least 200112L in C99 code. Reported in #3420 and
2130    * Fix false positive uninitialised variable reported by cpp-check.
2139      clean of -Wformat-signedness warnings. Contributed by Kenneth Soerensen
2148    * Unify the example programs termination to call mbedtls_exit() instead of
2149      using a return command. This has been done to enable customization of the
2151    * Fix mbedtls_x509_dn_gets to escape non-ASCII characters as "?".
2157      buffer is not large enough to hold the ClientHello.
2163      `MBEDTLS_CTR_DRBG_C` or `MBEDTLS_HMAC_DRBG_C` for some side-channel
2172 = mbed TLS 2.22.0 branch released 2020-04-14
2179      mbedtls_ssl_get_input_max_frag_len() to be more precise about which max
2184      (RFC 6347 section 4.2.8): an attacker able to send forged UDP packets to
2185      the server could cause it to drop established associations with
2187      happen when MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE was enabled in config.h
2189    * Fix side channel in ECC code that allowed an adversary with access to
2191      untrusted operating system attacking a secure enclave) to fully recover
2193      Billy Brumley and Cesar Pereida Garcia. CVE-2020-10932
2215      mbedtls_ssl_get_input_max_frag_len() to ensure that a sufficient input
2219 = mbed TLS 2.21.0 branch released 2020-02-20
2225    * Deprecate for MBEDTLS_PKCS11_C, the wrapper around the pkcs11-helper
2226      library which allows TLS authentication to use keys stored in a
2232      probability (of the order of 2^-n where n is the bitsize of the curve)
2236    * To avoid a side channel vulnerability when parsing an RSA private key,
2240      ARMmbed/mbed-crypto#352
2243    * The new build option MBEDTLS_SHA512_NO_SHA384 allows building SHA-512
2244      support without SHA-384.
2253      PSA_ECC_CURVE_SECP_R1 with 256 bits is P256R1). ARMmbed/mbed-crypto#330
2256    * Fix an unchecked call to mbedtls_md() in the x509write module.
2259    * Fix some false-positive uninitialized variable warnings in X.509. Fix
2260      contributed by apple-ihack-geek in #2663.
2262      a cryptographic accelerator fails. ARMmbed/mbed-crypto#345
2263    * Fix a bug in mbedtls_pk_parse_key() that would cause it to accept some
2265      keys. Found by Catena cyber using oss-fuzz (issue 20467).
2266    * Fix a bug in mbedtls_pk_parse_key() that would cause it to
2269 = mbed TLS 2.20.0 branch released 2020-01-15
2272    * The initial seeding of a CTR_DRBG instance makes a second call to the
2273      entropy function to obtain entropy for a nonce if the entropy size is less
2274      than 3/2 times the key size. In case you want to disable the extra call to
2275      grab entropy, you can call mbedtls_ctr_drbg_set_nonce_len() to force the
2276      nonce length to 0.
2287      these variables can be used to recover the last round key. To follow best
2288      practice and to limit the impact of buffer overread vulnerabilities (like
2289      Heartbleed) we need to zeroize them before exiting the function.
2296      to have only large prime factors), and then, by brute force, recover the
2299      timings on the comparison in the key generation enabled the attacker to
2300      learn leading bits of the ephemeral key used during ECDSA signatures and to
2312      to achieve the security strength defined by NIST SP 800-90A. You can
2314    * Add ENUMERATED tag support to the ASN.1 module. Contributed by
2315      msopiha-linaro in ARMmbed/mbed-crypto#307.
2318    * In the PSA API, forbid zero-length keys. To pass a zero-length input to a
2321    * Rename psa_asymmetric_sign() to psa_sign_hash() and
2322      psa_asymmetric_verify() to psa_verify_hash().
2332      unsupported algorithm. Fixes ARMmbed/mbed-crypto#254.
2333    * Fix mbedtls_asn1_get_int to support any number of leading zeros. Credit
2334      to OSS-Fuzz for finding a bug in an intermediate version of the fix.
2335    * Fix mbedtls_asn1_get_bitstring_null to correctly parse bitstrings of at
2342    * Remove the technical possibility to define custom mbedtls_md_info
2346    * Variables containing error codes are now initialized to an error code
2347      rather than success, so that coding mistakes or memory corruption tends to
2348      cause functions to return this error code rather than a success. There are
2350      merely a robustness improvement. ARMmbed/mbed-crypto#323
2351    * Remove a useless call to mbedtls_ecp_group_free(). Contributed by
2352      Alexander Krizhanovsky in ARMmbed/mbed-crypto#210.
2354      Lloyd and Fortanix Inc in ARMmbed/mbed-crypto#277.
2356      Alexander Krizhanovsky in ARMmbed/mbed-crypto#308.
2358 = mbed TLS 2.19.1 branch released 2019-09-16
2361    * Declare include headers as PUBLIC to propagate to CMake project consumers
2363    * Add nss_keylog to ssl_client2 and ssl_server2, enabling easier analysis of
2372    * Fix some false-positive uninitialized variable warnings in crypto. Fix
2373      contributed by apple-ihack-geek in #2663.
2375 = mbed TLS 2.19.0 branch released 2019-09-06
2383      as an ASN.1 INTEGER, which caused the size of the key to leak
2384      about 1 bit of information on average and could cause the value to be
2386    * The deterministic ECDSA calculation reused the scheme's HMAC-DRBG to
2394      mbedtls_ssl_session_load() to allow serializing a session, for example to
2395      store it in non-volatile storage, and later using it for TLS session
2397    * Add a new API function mbedtls_ssl_check_record() to allow checking that
2400      The feature is enabled at compile-time by MBEDTLS_SSL_RECORD_CHECKING
2403      (https://project-everest.github.io/). It can be enabled at compile time
2406      (32-bit and 64-bit) using GCC, Clang or Visual Studio. Contributed by
2414    * Add DER-encoded test CRTs to library/certs.c, allowing
2415      the example programs ssl_server2 and ssl_client2 to be run
2421      mbedtls_ecdh_can_do() on each result to check whether each algorithm is
2423    * The new function mbedtls_ecdsa_sign_det_ext() is similar to
2435      lead to successful parsing of ill-formed X.509 CRTs. Fixes #2437.
2436    * Fix multiple X.509 functions previously returning ASN.1 low-level error
2437      codes to always wrap these codes into X.509 high level error codes before
2439    * Fix to allow building test suites with any warning that detects unused
2441    * Fix typo in net_would_block(). Fixes #528 reported by github-monoculture.
2453      in mbedtls_x509write_crt_der() to 2Kb. Reported by soccerGB in #2631.
2455    * Update test certificates that were about to expire. Reported by
2457    * Fix the build on ARMv5TE in ARM mode to not use assembly instructions
2461      This could previously lead to segmentation faults in builds using an
2462      address-sanitizer and enabling but not using MBEDTLS_ECP_RESTARTABLE.
2465    * Improve code clarity in x509_crt module, removing false-positive
2468    * Fix bug in endianness conversion in bignum module. This lead to
2473    * Replace multiple uses of MD2 by SHA-256 in X.509 test suite. Fixes #821.
2474    * Make it easier to define MBEDTLS_PARAM_FAILED as assert (which config.h
2477    * Add a Dockerfile and helper scripts (all-in-docker.sh, basic-in-docker.sh,
2478      docker-env.sh) to simplify running test suites on a Linux host. Contributed
2480    * Add `reproducible` option to `ssl_client2` and `ssl_server2` to enable
2483    * Extended .gitignore to ignore Visual Studio artifacts. Fixed by ConfusedSushi.
2484    * Adds fuzz targets, especially for continuous fuzzing with OSS-Fuzz.
2490 = mbed TLS 2.18.1 branch released 2019-07-12
2500 = mbed TLS 2.18.0 branch released 2019-06-11
2505    * It is now possible to use NIST key wrap mode via the mbedtls_cipher API.
2507    * Add the Wi-SUN Field Area Network (FAN) device extended key usage.
2509    * It is now possible to perform RSA PKCS v1.5 signatures with RIPEMD-160 digest.
2511    * Extend the MBEDTLS_SSL_EXPORT_KEYS to export the handshake randbytes,
2512      and the used tls-prf.
2513    * Add public API for tls-prf function, according to requested enum.
2522    * Add support for draft-05 of the Connection ID extension, as specified
2523      in https://tools.ietf.org/html/draft-ietf-tls-dtls-connection-id-05.
2524      The Connection ID extension allows to keep DTLS connections beyond the
2526      to the DTLS record header. This identifier can be used to associated an
2528      changed its IP or port. The feature is enabled at compile-time by setting
2529      MBEDTLS_SSL_DTLS_CONNECTION_ID (disabled by default), and at run-time
2534    * Extend the MBEDTLS_SSL_EXPORT_KEYS to export the handshake randbytes,
2535      and the used tls-prf.
2536    * Add public API for tls-prf function, according to requested enum.
2545    * Fix 1-byte buffer overflow in mbedtls_mpi_write_string() when
2546      used with negative inputs. Found by Guido Vranken in #2404. Credit to
2547      OSS-Fuzz.
2553    * Add psa_util.h to test/cpp_dummy_build to fix build_default_make_gcc_and_cxx.
2556      public macro MBEDTLS_X509_ID_FLAG. This could lead to invalid evaluation
2561    * Set the next sequence of the subject_alt_name to NULL when deleting
2563      Credit to OSS-Fuzz.
2566    * Server's RSA certificate in certs.c was SHA-1 signed. In the default
2567      mbedTLS configuration only SHA-2 signed certificates are accepted.
2569      client programs to fail at the peer's certificate verification
2570      due to an unacceptable hash signature. The certificate has been
2571      updated to one that is SHA-256 signed. Fix contributed by
2577    * Add test for minimal value of MBEDTLS_MPI_WINDOW_SIZE to all.sh.
2579    * Change wording in the `mbedtls_ssl_conf_max_frag_len()`'s documentation to
2582 = mbed TLS 2.17.0 branch released 2019-03-19
2586      which allows copy-less parsing of DER encoded X.509 CRTs,
2589    * Add a new function mbedtls_asn1_write_named_bitstring() to write ASN.1
2591    * Add MBEDTLS_REMOVE_3DES_CIPHERSUITES to allow removing 3DES ciphersuites
2598    * Allow to opt in to the removal the API mbedtls_ssl_get_peer_cert()
2599      for the benefit of saving RAM, by disabling the new compile-time
2608      belongs to a different group from the first. Before, if an application
2609      passed keys that belonged to different group, the first key's data was
2610      interpreted according to the second group, which could lead to either
2620      previously lead to a stack overflow on constrained targets.
2625    * Remove the mbedtls namespacing from the header file, to fix a "file not found"
2627    * Fix signed-to-unsigned integer conversion warning
2632      (e.g. config.h.bak). Fixed by Peter Kolbus (Garmin) #2407.
2636      extensions in CSRs and CRTs that caused these bitstrings to not be encoded
2649    * Provide an abstraction of vsnprintf to allow alternative implementations
2653      Previously, this could lead to functionally incorrect assembly being
2659    * Fix configuration queries in ssl-opt.h. #2030
2660    * Ensure that ssl-opt.h can be run in OS X. #2029
2661    * Re-enable certain interoperability tests in ssl-opt.sh which had previously
2666 = mbed TLS 2.16.0 branch released 2018-12-21
2669    * Add a new config.h option of MBEDTLS_CHECK_PARAMS that enables validation
2674      function to see for which parameter values it is defined. This feature is
2675      disabled by default. See its API documentation in config.h for additional
2676      steps you have to take when enabling it.
2681      the return type from void to int to allow returning error codes when
2684      mbedtls_ctr_drbg_update() -> mbedtls_ctr_drbg_update_ret()
2685      mbedtls_hmac_drbg_update() -> mbedtls_hmac_drbg_update_ret()
2686    * Extend ECDH interface to enable alternative implementations.
2689      the more generic per-module error codes MBEDTLS_ERR_xxx_BAD_INPUT_DATA.
2691      modules - AES, ARIA, Blowfish, CAMELLIA, CCM, GCM, DHM, ECP, ECDSA, ECDH,
2713      This could lead to a buffer overflow, but only in case ticket authentication
2715    * Add explicit integer to enumeration type casts to example program
2716      programs/pkey/gen_key which previously led to compilation failure
2723  = mbed TLS 2.15.1 branch released 2018-11-30
2726     * Update the Mbed Crypto submodule to version 0.1.0b2.
2728  = mbed TLS 2.15.0 branch released 2018-11-23
2731     * Add an experimental build option, USE_CRYPTO_SUBMODULE, to enable use of
2733     * Add an experimental configuration option, MBEDTLS_PSA_CRYPTO_C, to enable
2738     * Add unit tests for AES-GCM when called through mbedtls_cipher_auth_xxx()
2741 = mbed TLS 2.14.1 branch released 2018-11-30
2745      decryption that could lead to a Bleichenbacher-style padding oracle
2752      in the paper available here: http://cat.eyalro.net/cat.pdf  CVE-2018-19608
2765      mbedtls_hmac_drbg_update_ret() are similar to mbedtls_ctr_drbg_update()
2770 = mbed TLS 2.14.0 branch released 2018-11-19
2773    * Fix overly strict DN comparison when looking for CRLs belonging to a
2774      particular CA. This previously led to ignoring CRLs when the CRL's issuer
2781      space and a PSK-(EC)DHE ciphersuite was used, this allowed an attacker
2782      to trigger a memory access up to 64KiB beyond the incoming message buffer,
2783      potentially leading to an application crash or information disclosure.
2784    * Fix mbedtls_mpi_is_prime() to use more rounds of probabilistic testing. The
2786      adversary to construct non-primes that would be erroneously accepted as
2790      For example, the number of rounds was enough to securely generate RSA key
2791      pairs or Diffie-Hellman parameters, but was insufficient to validate
2792      Diffie-Hellman parameters properly.
2798      some configurable amount of operations. This is intended to be used in
2799      constrained, single-threaded systems where ECC is time consuming and can
2802      configured by mbedtls_ecp_set_max_ops() at runtime. It applies to the new
2804      yet), and to existing functions in ECDH and SSL (currently only
2805      implemented client-side, for ECDHE-ECDSA ciphersuites in TLS 1.2,
2807    * Add support for Arm CPU DSP extensions to accelerate asymmetric key
2811    * Extend RSASSA-PSS signature to allow a smaller salt size. Previously, PSS
2813      an error if this was not possible. Now the salt size may be up to two bytes
2814      shorter. This allows the library to support all hash and signature sizes
2815      that comply with FIPS 186-4, including SHA-512 with a 1024-bit key.
2816    * Add support for 128-bit keys in CTR_DRBG. Note that using keys shorter
2817      than 256 bits limits the security of generated material to 128 bits.
2835      Miller-Rabin rounds.
2839      application leading to a memory leak in case both
2847      which lead to accepting properly authenticated but improperly
2848      padded records in case of CBC ciphersuites using Encrypt-then-MAC.
2857    * Change the default string format used for various X.509 DN attributes to
2858      UTF8String. Previously, the use of the PrintableString format led to
2859      wildcards and non-ASCII characters being unusable in some DN attributes.
2861      Thomas-Dee.
2865      Reported by ole-de and ddhome2006. Fixes #882, #1642 and #1706.
2873    * Change the dtls_client and dtls_server samples to work by default over
2874      IPv6 and optionally by a build option over IPv4.
2875    * Change the use of Windows threading to use Microsoft Visual C++ runtime
2876      calls, rather than Win32 API calls directly. This is necessary to avoid
2880      string format (mostly PrintableString), which could lead to CRTs being
2885      Thomas-Dee.
2887      Fixes #517 reported by github-monoculture.
2888    * Add MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR flag to mbedtls_mpi_gen_prime() and
2889      use it to reduce error probability in RSA key generation to levels mandated
2890      by FIPS-186-4.
2892 = mbed TLS 2.13.1 branch released 2018-09-06
2896      whose implementation should behave as a thread-safe version of gmtime().
2897      This allows users to configure such an implementation at compile time when
2899      MBEDTLS_PLATFORM_GMTIME_R_ALT. At this stage Mbed TLS is only able to
2906 = mbed TLS 2.13.0 branch released 2018-08-31
2909    * Fix an issue in the X.509 module which could lead to a buffer overread
2911      input (extensions length field equal to 0), an illegal read of one byte
2917      with the peer, as well as by a new per-connection MTU option, set using
2919    * Add support for auto-adjustment of MTU to a safe value during the
2924    * Add support for buffering out-of-order handshake messages in DTLS.
2926      compile-time constant MBEDTLS_SSL_DTLS_MAX_BUFFERING defined
2927      in mbedtls/config.h.
2930    * Add function mbedtls_ssl_set_datagram_packing() to configure
2935      failure in the function could lead to other buffers being leaked.
2941      This improves compliance to RFC 4492, and as a result, solves
2945    * Fix potential use-after-free in mbedtls_ssl_get_max_frag_len()
2947    * Fix a bug that caused SSL/TLS clients to incorrectly abort the handshake
2949      without providing a list of CAs. This was due to an overly strict bounds
2956      (found by Catena cyber using oss-fuzz)
2968    * Add support for buffering of out-of-order handshake messages.
2969    * Add warnings to the documentation of the HKDF module to reduce the risk
2973 = mbed TLS 2.12.0 branch released 2018-07-25
2976    * Fix a vulnerability in TLS ciphersuites based on CBC and using SHA-384,
2977      in (D)TLS 1.0 to 1.2, that allowed an active network attacker to
2984      or CCM instead of CBC, using hash sizes other than SHA-384, or using
2985      Encrypt-then-Mac (RFC 7366) were not affected. The vulnerability was
2986      caused by a miscalculation (for SHA-384) in a countermeasure to the
2989    * Fix a vulnerability in TLS ciphersuites based on CBC, in (D)TLS 1.0 to
2990      1.2, that allowed a local attacker, able to execute code on the local
2991      machine as well as manipulate network packets, to partially recover the
2997      instead of CBC or using Encrypt-then-Mac (RFC 7366) were not affected.
2999    * Add a counter-measure against a vulnerability in TLS ciphersuites based
3000      on CBC, in (D)TLS 1.0 to 1.2, that allowed a local attacker, able to
3002      to partially recover the plaintext of messages under some conditions (see
3005      Encrypt-then-Mac (RFC 7366) were not affected. Found by Kenny Paterson,
3009    * Add new crypto primitives from RFC 7539: stream cipher Chacha20, one-time
3010      authenticator Poly1305 and AEAD construct Chacha20-Poly1305. Contributed
3012    * Add support for CHACHA20-POLY1305 ciphersuites from RFC 7905.
3013    * Add platform support for the Haiku OS. (https://www.haiku-os.org).
3021      NIST SP 800-38F algorithms KW and KWP and by RFC 3394 and RFC 5649.
3030    * Clarify documentation for mbedtls_ssl_write() to include 0 as a valid
3038    * Added length checks to some TLS parsing functions. Found and fixed by
3048      CBC based ciphersuite is used together with Encrypt-then-MAC. Previously,
3050      to the connection being terminated. Seen most often with OpenSSL using
3053    * Fix ssl_client2 example to send application data with 0-length content
3054      when the request_size argument is set to 0 as stated in the documentation.
3058    * Fix build using -std=c99. Fixed by Nick Wilson.
3062      zero-length messages when using TLS 1.2. Contributed by Espressif Systems.
3063    * Change the default behaviour of mbedtls_hkdf_extract() to return an error
3064      when calling with a NULL salt and non-zero salt_len. Contributed by
3066    * Change the shebang line in Perl scripts to look up perl in the PATH.
3068    * Allow overriding the time on Windows via the platform-time abstraction.
3070    * Use gmtime_r/gmtime_s for thread-safety. Fixed by Nick Wilson.
3072 = mbed TLS 2.11.0 branch released 2018-06-18
3075    * Add additional block mode, OFB (Output Feedback), to the AES module and
3077    * Implement the HMAC-based extract-and-expand key derivation function
3080    * Add support for the XTS block cipher mode with AES (AES-XTS).
3082    * In TLS servers, support offloading private key operations to an external
3083      cryptoprocessor. Private key operations can be asynchronous to allow
3084      non-blocking operation of the TLS server stack.
3087    * Fix the cert_write example to handle certificates signed with elliptic
3089    * Fix for redefinition of _WIN32_WINNT to avoid overriding a definition
3096    * Changed CMake defaults for IAR to treat all compiler warnings as errors.
3097    * Changed the Clang parameters used in the CMake build files to work for
3101 = mbed TLS 2.10.0 branch released 2018-06-06
3105      (RFC 6209). Disabled by default, see MBEDTLS_ARIA_C in config.h
3112      point of view. mbedtls_platform_zeroize() needs to be regularly tested
3113      against compilers to ensure that calls to it are not removed from the
3115      Therefore, mbedtls_platform_zeroize() is moved to the platform module to
3119    * Fix an issue with MicroBlaze support in bn_mul.h which was causing the
3120      build to fail. Found by zv-io. Fixes #1651.
3123    * Support TLS testing in out-of-source builds using cmake. Fixes #1193.
3127 = mbed TLS 2.9.0 branch released 2018-04-30
3130    * Fix an issue in the X.509 module which could lead to a buffer overread
3131      during certificate validation. Additionally, the issue could also lead to
3132      unnecessary callback checks being made or to some validation checks to be
3134      would require a non DER-compliant certificate to be correctly signed by a
3135      trusted CA, or a trusted CA with a non DER-compliant certificate. Found by
3138      function which led to an arbitrary overread of the message buffer. The
3143    * Fix a client-side bug in the validation of the server's ciphersuite choice
3144      which could potentially lead to the client accepting a ciphersuite it didn't
3146      chosen by the server. This could lead to corruption of internal data
3150    * Add an option, MBEDTLS_AES_FEWER_TABLES, to dynamically compute smaller AES
3159    * Extend the public API with the function of mbedtls_net_poll() to allow user
3160      applications to wait for a network context to become ready before reading
3162    * Add function mbedtls_ssl_check_pending() to the public API to allow
3163      a check for whether more more data is pending to be processed in the
3165      This function is necessary to determine when it is safe to idle on the
3166      underlying transport in case event-driven IO is used.
3171    * Add missing dependencies in test suites that led to build failures
3172      in configurations that omit certain hashes or public-key algorithms.
3182      unable to parse keys which had only the optional parameters field of the
3187    * Fix overriding and ignoring return values when parsing and writing to
3189    * Restrict usage of error code MBEDTLS_ERR_SSL_WANT_READ to situations
3190      where data needs to be fetched from the underlying transport in order
3191      to make progress. Previously, this error code was also occasionally
3193      further messages could potentially already be pending to be processed
3194      in the internal buffers; these cases led to deadlocks when event-driven
3197      function which leads to a potential one byte overread of the message
3199    * Fix invalid buffer sizes passed to zlib during record compression and
3201    * Fix the soversion of libmbedcrypto to match the soversion of the
3203      version 2.7.1 to reflect breaking changes in that release, but the
3211      public-key algorithms. Includes contributions by Gert van Dijk.
3230    * Add an option in the Makefile to support ar utilities where the operation
3231      letter must not be prefixed by '-', such as LLVM. Found and fixed by
3241      HMAC functions with non-HMAC ciphersuites. Independently contributed
3244      FIPS 186-4. Contributed by Jethro Beekman. #1380
3248      not need to copy the declarations, and ensures that they will have the
3252 = mbed TLS 2.8.0 branch released 2018-03-16
3255    * The truncated HMAC extension now conforms to RFC 6066. This means
3259      prior versions of Mbed TLS. To restore the old behavior, enable
3261      config.h. Found by Andreas Walz (ivESK, Offenburg University of
3269    * Verify results of RSA private key operations to defend
3275    * Fix CRL parsing to reject CRLs containing unsupported critical
3282      uses PBKDF2-SHA2, such as OpenSSL 1.1. Submitted by Antonio Quartulli,
3293    * Fix test_suite_pk to work on 64-bit ILP32 systems. #849
3294    * Fix mbedtls_x509_crt_profile_suiteb, which used to reject all certificates
3314      that could cause a key exchange to fail on valid data.
3316      could cause a key exchange to fail on valid data.
3319    * Fix a 1-byte heap buffer overflow (read-only) during private key parsing.
3327    * MD functions deprecated in 2.7.0 are no longer inline, to provide
3333 = mbed TLS 2.7.0 branch released 2018-02-03
3338      sending a malicious application packet could be used to selectively corrupt
3339      6 bytes on the peer's heap, which could potentially lead to crash or remote
3341      both TLS and DTLS. CVE-2018-0488
3342    * Fix a buffer overflow in RSA-PSS verification when the hash was too large
3343      for the key size, which could potentially lead to crash or remote code
3345      Qualcomm Technologies Inc. CVE-2018-0487
3346    * Fix buffer overflow in RSA-PSS verification when the unmasked data is all
3349      64 KiB to the address of the SSL buffer and causing a wrap around.
3352      config and the application data buffer passed to mbedtls_ssl_write
3356      was independently reported by Tim Nordell via e-mail and by Florin Petriuc
3359    * Add a provision to prevent compiler optimizations breaking the time
3363    * Set PEM buffer to zero before freeing it, to avoid decoded private keys
3364      being leaked to memory after release.
3365    * Fix dhm_check_range() failing to detect trivial subgroups and potentially
3367    * Make mbedtls_mpi_read_binary() constant-time with respect to the input
3369      sake of saving memory, but potentially leading to slight timing
3373    * Fix a potential heap buffer over-read in ALPN extension parsing
3374      (server-side). Could result in application crash, but only if an ALPN
3377      to RFC 3526 containing parameters generated in a nothing-up-my-sleeve
3384    * New unit tests for timing. Improve the self-test to be more robust
3385      when run on a heavily-loaded machine.
3392      MBEDTLS_ECDSDA_GENKEY_AT in config.h.
3398      MBEDTLS_ECDH_GEN_PUBLIC_ALT in config.h.
3404    * Add mechanism to provide alternative implementation of the DHM module.
3407    * Extend RSA interface by multiple functions allowing structure-
3410      up RSA contexts from partial key material and having them completed to the
3411      needs of the implementation automatically. This allows to setup private RSA
3414    * The configuration option MBEDTLS_RSA_ALT can be used to define alternative
3418      The new functions change the return type from void to int to allow
3420      mbedtls_<MODULE>_starts() -> mbedtls_<MODULE>_starts_ret()
3421      mbedtls_<MODULE>_update() -> mbedtls_<MODULE>_update_ret()
3422      mbedtls_<MODULE>_finish() -> mbedtls_<MODULE>_finish_ret()
3423      mbedtls_<MODULE>_process() -> mbedtls_internal_<MODULE>_process()
3426    * Deprecate usage of RSA primitives with non-matching key-type
3429      Users are advised to use the extended RSA API instead.
3445    * Fix ssl_parse_record_header() to silently discard invalid DTLS records
3451      renegotiated handshakes would only accept signatures using SHA-1
3452      regardless of the peer's preferences, or fail if SHA-1 was disabled.
3453    * Fix leap year calculation in x509_date_is_valid() to ensure that invalid
3456    * Fix some invalid RSA-PSS signatures with keys of size 8N+1 that were
3458    * Fix out-of-memory problem when parsing 4096-bit PKCS8-encrypted RSA keys.
3465      If a call to one of the functions of the cryptographic primitive modules
3467      mbedtls_pem_read_buffer() causing it to return invalid values. Found by
3469    * Include configuration file in md.h, to fix compilation warnings.
3471    * Correct extraction of signature-type from PK instance in X.509 CRT and CSR
3472      writing routines that prevented these functions to work with alternative
3475      non-v3 CRT's.
3477    * Fix net_would_block() to avoid modification by errno through fcntl() call.
3480      MBEDTLS_SSL_RENEGOTIATION is disabled. Found by erja-gp.
3483    * Fix word size check in in pk.c to not depend on MBEDTLS_HAVE_INT64.
3485    * Add size-checks for record and handshake message content, securing
3486      fragile yet non-exploitable code-paths.
3494      RSA test suite where the failure of CTR DRBG initialization lead to
3504    * Fix the entropy.c module to not call mbedtls_sha256_starts() or
3506    * Fix the entropy.c module to ensure that mbedtls_sha256_init() or
3508      structure. Do not assume that zeroizing a context is a correct way to
3515    * Extend cert_write example program by options to set the certificate version
3522    * Only run AES-192 self-test if AES-192 is available. Fixes #963.
3525    * Update all internal usage of deprecated message digest functions to the
3533    * Add explicit warnings for the use of MD2, MD4, MD5, SHA-1, DES and ARC4
3536 = mbed TLS 2.6.0 branch released 2017-08-10
3539    * Fix authentication bypass in SSL/TLS: when authmode is set to optional,
3543      triggered remotely from either side. (With authmode set to 'required'
3551      and the context struct mbedtls_platform_context to perform
3552      platform-specific setup and teardown operations. The macro
3553      MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT allows the functions to be overridden
3555      some embedded environments to provide a means of initialising underlying
3559    * Reverted API/ABI breaking changes introduced in mbed TLS 2.5.1, to make the
3564    * Certificate verification functions now set flags to -1 in case the full
3565      chain was not verified due to an internal error (including in the verify
3567    * With authmode set to optional, the TLS handshake is now aborted if the
3568      verification of the peer's certificate failed due to an overlong chain or
3575      to #if defined(MBEDTLS_THREADING_C) as the library cannot assume they will
3579    * Add MBEDTLS_MPI_CHK to check for error value of mbedtls_mpi_fill_random.
3581    * Fix conditional preprocessor directives in bignum.h to enable 64-bit
3585      to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
3589      to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
3593      constructed certificates to bypass the certificate verification check.
3594    * Fix a call to the libc function time() to call the platform abstraction
3600    * Added config.h option MBEDTLS_NO_UDBL_DIVISION, to prevent the use of
3601      64-bit division. This is useful on embedded platforms where 64-bit division
3604      accelerator code in the library leaves concurrency handling to the
3607      config-no-entropy.h to reduce the RAM footprint.
3612 = mbed TLS 2.5.1 released 2017-06-21
3615    * Fixed unlimited overread of heap-based buffer in mbedtls_ssl_read().
3616      The issue could only happen client-side with renegotiation enabled.
3619      back to the server or to a third party). Can be triggered remotely.
3620    * Removed SHA-1 and RIPEMD-160 from the default hash algorithms for
3621      certificate verification. SHA-1 can be turned back on with a compile-time
3623    * Fixed offset in FALLBACK_SCSV parsing that caused TLS server to fail to
3625    * Tighten parsing of RSA PKCS#1 v1.5 signatures, to avoid a
3626      potential Bleichenbacher/BERserk-style attack.
3631      and with GCC using the -Wpedantic compilation option.
3632    * Fix insufficient support for signature-hash-algorithm extension,
3635      when sending the alert failed. The fix makes sure not to hide the error
3638      peer after sending a fatal alert to refuse a renegotiation attempt.
3639      Previous behaviour was to keep processing data even after the alert has
3643    * Fix implementation of mbedtls_ssl_parse_certificate() to not annihilate
3644      fatal errors in authentication mode MBEDTLS_SSL_VERIFY_OPTIONAL and to
3646    * Fix bug that caused the modular inversion function to accept the invalid
3647      modulus 1 and therefore to hang. Found by blaufish. #641.
3651    * Fix a numerical underflow leading to stack overflow in mpi_read_file()
3655    * Send fatal alerts in more cases. The previous behaviour was to skip
3657    * Clarify ECDSA documentation and improve the sample code to avoid
3659      by Jean-Philippe Aumasson.
3661 = mbed TLS 2.5.0 branch released 2017-05-17
3667    * Add exponent blinding to RSA private operations as a countermeasure
3668      against side-channel attacks like the cache attack described in
3675      This involved exposing parts of the internal interface to enable
3678    * Add a new configuration option to 'mbedtls_ssl_config' to enable
3685      void to int to allow returning error codes when using MBEDTLS_AES_ALT,
3687      mbedtls_aes_decrypt() -> mbedtls_internal_aes_decrypt()
3688      mbedtls_aes_encrypt() -> mbedtls_internal_aes_encrypt()
3691    * Remove macros from compat-1.3.h that correspond to deleted items from most
3695    * Add checks in the PK module for the RSA functions on 64-bit systems.
3697      without these checks the type cast could lead to data loss. Found by Guido
3700 = mbed TLS 2.4.2 branch released 2017-03-08
3703    * Add checks to prevent signature forgeries for very large messages while
3704      using RSA through the PK module in 64-bit systems. The issue was caused by
3705      some data loss when casting a size_t to an unsigned int value in the
3707      mbedtls_pk_sign(). Found by Jean-Philippe Aumasson.
3714      CertificateVerify messages, to prevent SLOTH attacks against TLS 1.2.
3719      and potentially could lead to remote code execution on some platforms.
3721      team. #569 CVE-2017-2784
3726      MBEDTLS_X509_BADCERT_NOT_TRUSTED and MBEDTLS_X509_BADCERT_EXPIRED, to be
3729    * Fix the redefinition of macro ssl_set_bio to an undefined symbol
3730      mbedtls_ssl_set_bio_timeout in compat-1.3.h, by removing it.
3731      Found by omlib-lin. #673
3733      x509_csr.c that are reported when building mbed TLS with a config.h that
3741      the input string in PEM format to extract the different components. Found
3744      cause buffer bound checks to be bypassed. Found by Eyal Itkin.
3746      cause buffer bound checks to be bypassed. Found by Eyal Itkin.
3748      cause buffer bound checks to be bypassed. Found by Eyal Itkin.
3750      cause buffer bound checks to be bypassed. Found by Eyal Itkin.
3752      Li/Yueh-Hsun Lin, KNOX Security, Samsung Research America.
3754      by missing calls to mbedtls_pem_free() in cases when a
3757    * Fixed the templates used to generate project and solution files for Visual
3758      Studio 2015 as well as the files themselves, to remove a build warning
3763      number to write in hexadecimal is negative and requires an odd number of
3768 = mbed TLS 2.4.1 branch released 2016-12-13
3771    * Update to CMAC test data, taken from - NIST Special Publication 800-38B -
3775 = mbed TLS 2.4.0 branch released 2016-10-17
3779      with RFC-5116 and could lead to session key recovery in very long TLS
3780      sessions. "Nonce-Disrespecting Adversaries Practical Forgery Attacks on GCM in
3781      TLS" - H. Bock, A. Zauner, S. Devlin, J. Somorovsky, P. Jovanovic.
3784      mbedtls_x509write_csr_der() when the signature is copied to the buffer
3789    * Added support for CMAC for AES and 3DES and AES-CMAC-PRF-128, as defined by
3790      NIST SP 800-38B, RFC-4493 and RFC-4615.
3791    * Added hardware entropy selftest to verify that the hardware entropy source
3793    * Added a script to print build environment info for diagnostic use in test
3795    * Added the macro MBEDTLS_X509_MAX_FILE_PATH_LEN that enables the user to
3798    * Added a configuration file config-no-entropy.h that configures the subset of
3800    * Added the macro MBEDTLS_ENTROPY_MIN_HARDWARE in config.h. This allows users
3801      to configure the minimum number of bytes for entropy sources using the
3805    * Fix for platform time abstraction to avoid dependency issues where a build
3807      configuration consistency checks to check_config.h
3808    * Fix dependency issue in Makefile to allow parallel builds.
3811    * Fix for key exchanges based on ECDH-RSA or ECDH-ECDSA which weren't
3813    * Fix for out-of-tree builds using CMake. Found by jwurzer, and fix based on
3819    * Fixed pthread implementation to avoid unintended double initialisations
3824    * Fix mbedtls_x509_get_sig() to update the ASN1 type in the mbedtls_x509_buf
3826      subramanyam-c. #622
3833      Found by subramanyam-c. #626
3841    * Removed self-tests from the basic-built-test.sh script, and added all
3842      missing self-tests to the test suites, to ensure self-tests are only
3844    * Added support for 3 and 4 byte lengths to mbedtls_asn1_write_len().
3845    * Added support for a Yotta specific configuration file -
3849    * Renamed source file library/net.c to library/net_sockets.c to avoid
3852      deprecated, and its contents moved to net_sockets.h.
3853    * Changed the strategy for X.509 certificate parsing and validation, to no
3856 = mbed TLS 2.3.0 branch released 2016-06-28
3861    * Fix potential integer overflow to buffer overflow in
3864    * Fix a potential integer underflow to buffer overread in
3874      arguments where the same (in-place doubling). Found and fixed by Janos
3876    * Fix potential build failures related to the 'apidoc' target, introduced
3880      ECDSA was disabled in config.h . The leak didn't occur by default.
3881    * Fix an issue that caused valid certificates to be rejected whenever an
3885      buffer after DER certificates to be included in the raw representation.
3889    * Fix issue that caused a crash if invalid curves were passed to
3893    * Fix test in ssl-opt.sh that does not run properly with valgrind
3894    * Fix unchecked calls to mmbedtls_md_setup(). Fix by Brian Murray. #502
3897    * On ARM platforms, when compiling with -O0 with GCC, Clang or armcc5,
3899      the need to pass -fomit-frame-pointer to avoid a build error with -O0.
3903    * Fix non-compliance server extension handling. Extensions for SSLv3 are now
3906 = mbed TLS 2.2.1 released 2016-01-05
3909    * Fix potential double free when mbedtls_asn1_store_named_data() fails to
3912    * Disable MD5 handshake signatures in TLS 1.2 by default to prevent the
3914      SLOTH paper do not apply to any version of mbed TLS or PolarSSL).
3918    * Fix over-restrictive length limit in GCM. Found by Andreas-N. #362
3919    * Fix bug in certificate validation that caused valid chains to be rejected
3930 = mbed TLS 2.2.0 released 2015-11-04
3948    * Experimental support for EC J-PAKE as defined in Thread 1.0.0.
3950    * Added a key extraction callback to accees the master secret and key
3951      block. (Potential uses include EAP-TLS and Thread.)
3954    * Self-signed certificates were not excluded from pathlen counting,
3957    * Fix build error with configurations where ECDHE-PSK is the only key
3959    * Fix build error with configurations where RSA, RSA-PSK, ECDH-RSA or
3960      ECHD-ECDSA if the only key exchange. Multiple reports. #310
3961    * Fixed a bug causing some handshakes to fail due to some non-fatal alerts
3962      not being properly ignored. Found by mancha and Kasom Koht-arsa, #308
3964      size/curve against the profile. Before that, there was no way to set a
3965      minimum key size for end-entity certificates with RSA keys. Found by
3967    * Fix failures in MPI on Sparc(64) due to use of bad assembly code.
3971      certificates to be rejected by some applications, including OS X
3976      or -1.
3978 = mbed TLS 2.1.2 released 2015-10-06
3981    * Added fix for CVE-2015-5291 to prevent heap corruption due to buffer
3984    * Fix potential double-free if mbedtls_ssl_set_hs_psk() is called more than
3994      string of close to or larger than 1GB to exploit; on 64 bit machines, would
3995      require reading a string of close to or larger than 2^62 bytes.
4001      buffer is 512MB or larger on 32-bit platforms. Found by Guido Vranken,
4003    * Fix potential double-free if mbedtls_conf_psk() is called repeatedly on
4008      unless you allow third parties to pick trust CAs for client auth.
4017    * Added checking of hostname length in mbedtls_ssl_set_hostname() to ensure
4019    * Fixed paths for check_config.h in example config files. (Found by bachp)
4022 = mbed TLS 2.1.1 released 2015-09-17
4025    * Add countermeasure against Lenstra's RSA-CRT attack for PKCS#1 v1.5
4027      https://securityblog.redhat.com/2015/09/02/factoring-rsa-keys-with-tls-perfect-forward-secrecy/
4028    * Fix possible client-side NULL pointer dereference (read) when the client
4029      tries to continue the handshake after it failed (a misuse of the API).
4031      afl-fuzz.)
4035    * Fix off-by-one error in parsing Supported Point Format extension that
4036      caused some handshakes to fail.
4039    * Made X509 profile pointer const in mbedtls_ssl_conf_cert_profile() to allow
4043      (MBEDTLS_SSL_DTLS_HELLO_VERIFY defined in config.h, and usable cookie
4046      MBEDTLS_ERR_SSL_CLIENT_RECONNECT - it is then possible to start a new
4049 = mbed TLS 2.1.0 released 2015-09-04
4053    * Primary open source license changed to Apache 2.0 license.
4057    * Fix build error with CMake and pre-4.5 versions of GCC (found by Hugo
4061    * Fix bug in CMake lists that caused libmbedcrypto.a not to be installed
4063    * Fix bug in Makefile that caused libmbedcrypto and libmbedx509 not to be
4065    * Fix compile error with armcc 5 with --gnu option.
4066    * Fix bug in Makefile that caused programs not to be installed correctly
4070    * Fix missing -static-libgcc when building shared libraries for Windows
4074    * Fix bug in mbedtls_ssl_conf_default() that caused the default preset to
4077      result trying to unlock an unlocked mutex on invalid input (found by
4079    * Fix -Wshadow warnings (found by hnrkp) (#240)
4081      SSL_MAX_CONTENT_LEN or higher - not triggerrable remotely (found by
4089    * It is now possible to #include a user-provided configuration file at the
4090      end of the default config.h by defining MBEDTLS_USER_CONFIG_FILE on the
4093      trusted, no later cert is checked. (suggested by hannes-landeholm)
4095    * Prepend a "thread identifier" to debug messages (issue pointed out by
4097    * Add mbedtls_ssl_get_max_frag_len() to query the current maximum fragment
4100 = mbed TLS 2.0.0 released 2015-07-13
4104    * Ability to override core functions from MDx, SHAx, AES and DES modules
4106      ability to override the whole module.
4107    * New server-side implementation of session tickets that rotate keys to
4113    * Introduced a concept of presets for SSL security-relevant configuration
4118      You now need to link to all of them if you use TLS for example.
4119    * All public identifiers moved to the mbedtls_* or MBEDTLS_* namespace.
4120      Some names have been further changed to make them more consistent.
4121      Migration helpers scripts/rename.pl and include/mbedtls/compat-1.3.h are
4122      provided. Full list of renamings in scripts/data_files/rename-1.3-2.0.txt
4124      mbedtls_cipher_info_t.key_length -> key_bitlen
4125      mbedtls_cipher_context_t.key_length -> key_bitlen
4126      mbedtls_ecp_curve_info.size -> bit_size
4131      mbedtls_ssl_init() -> mbedtls_ssl_setup()
4132      mbedtls_ccm_init() -> mbedtls_ccm_setkey()
4133      mbedtls_gcm_init() -> mbedtls_gcm_setkey()
4134      mbedtls_hmac_drbg_init() -> mbedtls_hmac_drbg_seed(_buf)()
4135      mbedtls_ctr_drbg_init()  -> mbedtls_ctr_drbg_seed()
4136      Note that for mbedtls_ssl_setup(), you need to be done setting up the
4140      ssl_legacy_renegotiation()) have been renamed to mbedtls_ssl_conf_xxx()
4141      (see rename.pl and compat-1.3.h above) and their first argument's type
4142      changed from ssl_context to ssl_config.
4144      additional callback for read-with-timeout).
4155      place of mbedtls_ssl_conf_session_tickets() to enable session tickets.
4163      mbedtls_x509_crt_verify() (flags, f_vrfy -> needs to be updated)
4164      mbedtls_ssl_conf_verify() (f_vrfy -> needs to be updated)
4165    * The following functions changed prototype to avoid an in-out length
4172      changed type to "mbedtls_net_context *".
4180      mbedtls_x509write_crt_set_key_usage() changed from int to unsigned.
4181    * test_ca_list (from certs.h) is renamed to test_cas_pem and is only
4183    * Test certificates in certs.c are no longer guaranteed to be nul-terminated
4187      length parameter to include the terminating null byte for PEM input.
4188    * Signature of mpi_mul_mpi() changed to make the last argument unsigned
4191      (Thanks to Mansour Moufid for helping with the replacement.)
4192    * Change SSL_DISABLE_RENEGOTIATION config.h flag to SSL_RENEGOTIATION
4193      (support for renegotiation now needs explicit enabling in config.h).
4195      in config.h
4196    * net_connect() and net_bind() have a new 'proto' argument to choose
4197      between TCP and UDP, using the macros NET_PROTO_TCP or NET_PROTO_UDP.
4198      Their 'port' argument type is changed to a string.
4212    * Removed compat-1.2.h (helper for migrating from 1.2 to 1.3).
4216      been removed (compiler is required to support 32-bit operations).
4219    * Removed test program ssl_test, superseded by ssl-opt.sh.
4220    * Removed helper script active-config.pl
4226 Semi-API changes (technically public, morally private)
4227    * Renamed a few headers to include _internal in the name. Those headers are
4228      not supposed to be included by users.
4232    * Removed sig_oid2 and rename sig_oid1 to sig_oid in x509_crt and x509_crl.
4233    * x509_crt.key_usage changed from unsigned char to unsigned int.
4246      custom config.h
4247    * Default DHM parameters server-side upgraded from 1024 to 2048 bits.
4251    * The following functions are now case-sensitive:
4261    * Compiler is required to support C99 types such as long long and uint32_t.
4270    * DTLS no longer hard-depends on TIMING_C, but uses a callback interface
4274    * With UDP sockets, it is no longer necessary to call net_bind() again
4279      thread-safe if MBEDTLS_THREADING_C is enabled.
4280    * Reduced ROM fooprint of SHA-256 and added an option to reduce it even
4286    * With authmode set to SSL_VERIFY_OPTIONAL, verification of keyUsage and
4289    * Add countermeasure against "Lucky 13 strikes back" cache-based attack,
4295    * Add x509_crt_verify_info() to display certificate verification results.
4299    * Add support for id-at-uniqueIdentifier in X.509 names.
4302    * Add an option to use macros instead of function pointers in the platform
4305      cross-compilation easier (thanks to Alon Bar-Lev).
4306    * The benchmark program also prints heap usage for public-key primitives
4308    * New script ecc-heap.sh helps measuring the impact of ECC parameters on
4311      reduced configurations (PSK-CCM and NSA suite B).
4312    * Add config flag POLARSSL_DEPRECATED_WARNING (off by default) to produce
4314    * Add config flag POLARSSL_DEPRECATED_REMOVED (off by default) to produce
4319    * Fix compile error with PLATFORM_EXIT_ALT (thanks to Rafał Przywara).
4321      entropy_free() to crash (thanks to Rafał Przywara).
4336    * Fix bug in pk_parse_key() that caused some valid private EC keys to be
4343    * Fix potential unintended sign extension in asn1_get_len() on 64-bit
4347      POLARSSL_SSL_SSESSION_TICKETS where both enabled in config.h (introduced
4350    * Add missing dependency on SHA-256 in some x509 programs (reported by
4352    * Fix bug related to ssl_set_curves(): the client didn't check that the
4361    * compat-1.2.h and openssl.h are deprecated.
4364      (contributed by Alon Bar-Lev).
4367    * Move from SHA-1 to SHA-256 in example programs using signatures
4371    * Change #include lines in test files to use double quotes instead of angle
4375 = mbed TLS 1.3.10 released 2015-02-09
4377    * NULL pointer dereference in the buffer-based allocator when the buffer is
4381    * Fix remotely-triggerable uninitialised pointer dereference caused by
4384    * Fix remotely-triggerable memory leak caused by crafted X.509 certificates
4390    * Fix timing difference that could theoretically lead to a
4391      Bleichenbacher-style attack in the RSA and RSA-PSK key exchanges
4395    * Add support for FALLBACK_SCSV (draft-ietf-tls-downgrade-scsv).
4396    * Add support for Extended Master Secret (draft-ietf-tls-session-hash).
4397    * Add support for Encrypt-then-MAC (RFC 7366).
4398    * Add function pk_check_pair() to test if public and private keys match.
4400    * Add compile-time option POLARSSL_X509_MAX_INTERMEDIATE_CA to limit the
4402    * Support for renegotiation can now be disabled at compile-time
4403    * Support for 1/n-1 record splitting, a countermeasure against BEAST.
4404    * Certificate selection based on signature hash, preferring SHA-1 over SHA-2
4405      for pre-1.2 clients when multiple certificates are available.
4408    * Add ssl_set_arc4_support() to make it easier to disable RC4 at runtime
4415      add_len (found by Jean-Philippe Aumasson) (not triggerable remotely).
4426    * Fix assembly selection for MIPS64 (thanks to James Cowgill).
4428      to a failed verification (found by Fredrik Axelsson).
4431      issue with some servers when a zero-length extension was sent. (Reported
4433    * On a 0-length input, base64_encode() did not correctly set output length
4437    * Use deterministic nonces for AEAD ciphers in TLS by default (possible to
4438      switch back to random with POLARSSL_SSL_AEAD_RANDOM_IV in config.h).
4440    * ssl_set_own_cert() now returns an error on key-certificate mismatch.
4442    * debug_print_buf() now prints a text view in addition to hexadecimal.
4444      but none of them is usable due to external factors such as no certificate
4446    * It is now possible to disable negotiation of truncated HMAC server-side
4452 = PolarSSL 1.3.9 released 2014-10-20
4456    * Remotely-triggerable memory leak when parsing some X.509 certificates
4459    * Remotely-triggerable memory leak when parsing crafted ClientHello
4466    * Fix net_accept() regarding non-blocking sockets (found by Luca Pesce).
4468    * Fix warnings from Clang's scan-build (contributed by Alfred Klomp).
4471    * Remove non-existent file from VS projects (found by Peter Vaskovic).
4472    * ssl_read() could return non-application data records on server while
4474    * Server-initiated renegotiation would fail with non-blocking I/O if the
4477      with non-blocking I/O.
4485    * Ciphersuites using SHA-256 or SHA-384 now require TLS 1.x (there is no
4486      standard defining how to use SHA-2 with SSL 3.0).
4487    * Ciphersuites using RSA-PSK key exchange new require TLS 1.x (the spec is
4488      ambiguous on how to encode some packets with SSL 3.0).
4493    * POLARSSL_MPI_MAX_SIZE now defaults to 1024 in order to allow 8192 bits
4499 = PolarSSL 1.3.8 released 2014-07-11
4502      It was possible to crash the server (and client) using crafted messages
4506    * Add CCM module and cipher mode to Cipher Layer
4508    * Support for parsing and verifying RSASSA-PSS signatures in the X.509
4511    * Add example config.h for PSK with CCM, optimized for low RAM usage.
4512    * Optimize for RAM usage in example config.h for NSA Suite B profile.
4513    * Add POLARSSL_REMOVE_ARC4_CIPHERSUITES to allow removing RC4 ciphersuites
4515    * Add server-side enforcement of sent renegotiation requests
4517    * Add SSL_CIPHERSUITES config.h flag to allow specifying a list of
4518      ciphersuites to use and save some memory if the list is small.
4523    * Migrate zeroizing of data to polarssl_zeroize() instead of memset()
4534    * Remove less-than-zero checks on unsigned numbers
4535    * Stricter check on SSL ClientHello internal sizes compared to actual packet
4546      rejected with CBC-based ciphersuites and TLS >= 1.1
4548      to 32 bytes with CBC-based ciphersuites and TLS >= 1.1
4549    * Restore ability to use a v1 cert as a CA if trusted locally. (This had
4551    * Restore ability to locally trust a self-signed cert that is not a proper
4557    * Fix off-by-one error in parsing Supported Point Format extension that
4558      caused some handshakes to fail.
4559    * Fix possible miscomputation of the premaster secret with DHE-PSK key
4560      exchange that caused some handshakes to fail with other implementations.
4563    * Fix base64_decode() to return and check length correctly (in case of
4565    * Fix mpi_write_string() to write "00" as hex output for empty MPI (found
4568 = PolarSSL 1.3.7 released on 2014-05-02
4570    * debug_set_log_mode() added to determine raw or full logging
4571    * debug_set_threshold() added to ignore messages over threshold level
4572    * version_check_feature() added to check for compile-time options at
4573      run-time
4580    * AES-NI now compiles with "old" assemblers too
4593    * rsa_check_pubkey() now allows an E up to N
4594    * On OpenBSD, use arc4random_buf() instead of rand() to prevent warnings
4596      big-endian platform when size was not an integer number of limbs
4603 = PolarSSL 1.3.6 released on 2014-04-11
4607    * Add option 'use_dev_random' to gen_key application
4617    * Use UTC time to check certificate validity.
4624      This affects certificates in the user-supplied chain except the top
4625      certificate. If the user-supplied chain contains only one certificates,
4642    * oid_get_numeric_string() used to truncate the output without returning an
4644    * dhm_parse_dhm() (hence dhm_parse_dhmfile()) did not set dhm->len.
4645    * Calling pk_debug() on an RSA-alt key would segfault.
4646    * pk_get_size() and pk_get_len() were off by a factor 8 for RSA-alt keys.
4650      stored in RAM due to missing 'const's (found by Gergely Budai).
4652 = PolarSSL 1.3.5 released on 2014-03-26
4654    * HMAC-DRBG as a separate module
4655    * Option to set the Curve preference order (disabled by default)
4657    * Ability to provide alternate timing implementation
4658    * Ability to force the entropy module to use SHA-256 as its basis
4660    * Testing script ssl-opt.sh added for testing 'live' ssl option
4668      now thread-safe if POLARSSL_THREADING_C defined
4669    * Improvements to the CMake build system, contributed by Julian Ospald.
4672    * Revamped the compat.sh interoperatibility script to include support for
4675    * Improvements to tests/Makefile, contributed by Oden Eriksson.
4678    * Forbid change of server certificate during renegotiation to prevent
4684    * Possible remotely-triggered out-of-bounds memory access fixed (found by
4688    * ecp_gen_keypair() does more tries to prevent failure because of
4691    * Fixed testing with out-of-source builds using cmake
4692    * Fixed version-major intolerance in server
4693    * Fixed CMake symlinking on out-of-source builds
4696    * Bignum's MIPS-32 assembly was used on MIPS-64, causing chaos. (Found by
4700    * Fixed bug with session tickets and non-blocking I/O in the unlikely case
4711    * x509_get_current_time() uses localtime_r() to prevent thread issues
4713 = PolarSSL 1.3.4 released on 2014-01-27
4716    * Support for RIPEMD-160
4732 = PolarSSL 1.3.3 released on 2013-12-31
4735    * Support for adhering to client ciphersuite order preference
4738    * Support for ECDH-RSA and ECDH-ECDSA key exchanges and ciphersuites
4740    * AES-NI support for AES, AES-GCM and AES key scheduling
4741    * SSL Pthread-based server example added (ssl_pthread_server)
4748    * More constant-time checks in the RSA module
4756    * Fixed X.509 hostname comparison (with non-regular characters)
4769    * Possible remotely-triggered out-of-bounds memory access fixed (found by
4772 = PolarSSL 1.3.2 released on 2013-11-04
4774    * PK tests added to test framework
4776    * Support for Camellia-GCM mode and ciphersuites
4779    * Padding checks in cipher layer are now constant-time
4780    * Value comparisons in SSL layer are now constant-time
4787    * Prevent possible alignment warnings on casting from char * to 'aligned *'
4788    * Misc fixes and additions to dependency checks
4792    * Defines to handle UEFI environment under MSVC
4793    * Server-side initiated renegotiations send HelloRequest
4795 = PolarSSL 1.3.1 released on 2013-10-15
4798    * Support for ECDHE-PSK key-exchange and ciphersuites
4799    * Support for RSA-PSK key-exchange and ciphersuites
4805    * config.h is more script-friendly
4817 = PolarSSL 1.3.0 released on 2013-10-01
4822     (ECDHE-based ciphersuites)
4824     (ECDSA-based ciphersuites)
4825    * Ability to specify allowed ciphersuites based on the protocol version.
4826    * PSK and DHE-PSK based ciphersuites added
4828    * Buffer-based memory allocator added (no malloc() / free() / HEAP usage)
4835    * Support for zeros-and-length (ANSI X.923) padding, one-and-zeros
4836      (ISO/IEC 7816-4) padding and zero padding in the cipher layer
4844      the same host (Not to be confused with SNI!)
4847    * Ability to enable / disable SSL v3 / TLS 1.0 / TLS 1.1 / TLS 1.2
4851    * Internals for SSL module adapted to have separate IV pointer that is
4853    * Moved all OID functionality to a separate module. RSA function
4858    * Ability to disable server_name extension (RFC 6066)
4859    * Renamed error_strerror() to the less conflicting polarssl_strerror()
4860      (Ability to keep old as well with POLARSSL_ERROR_STRERROR_BC)
4861    * SHA2 renamed to SHA256, SHA4 renamed to SHA512 and functions accordingly
4865    * Also compiles / runs without time-based functions (!POLARSSL_HAVE_TIME)
4876    * RSA blinding on CRT operations to counter timing attacks
4877      (found by Cyril Arnaud and Pierre-Alain Fouque)
4880 = Version 1.2.14 released 2015-05-??
4883    * Fix potential invalid memory read in the server, that allows a client to
4886      client to crash the server remotely if client authentication is enabled
4888    * Add countermeasure against "Lucky 13 strikes back" cache-based attack,
4896    * Fix potential unintended sign extension in asn1_get_len() on 64-bit
4899 = Version 1.2.13 released 2015-02-16
4900 Note: Although PolarSSL has been renamed to mbed TLS, no changes reflecting
4904    * Fix remotely-triggerable uninitialised pointer dereference caused by
4907    * Fix remotely-triggerable memory leak caused by crafted X.509 certificates
4920      add_len (found by Jean-Philippe Aumasson) (not triggerable remotely).
4925    * Fix assembly selection for MIPS64 (thanks to James Cowgill).
4927      to a failed verification (found by Fredrik Axelsson).
4930      issue with some servers when a zero-length extension was sent. (Reported
4932    * On a 0-length input, base64_encode() did not correctly set output length
4938    * Add compile-time option POLARSSL_X509_MAX_INTERMEDIATE_CA to limit the
4940 = Version 1.2.12 released 2014-10-24
4943    * Remotely-triggerable memory leak when parsing some X.509 certificates
4951      with non-blocking I/O.
4955    * Fix net_accept() regarding non-blocking sockets (found by Luca Pesce).
4956    * ssl_read() could return non-application data records on server while
4958    * Fix warnings from Clang's scan-build (contributed by Alfred Klomp).
4967 = Version 1.2.11 released 2014-07-11
4973    * Improvements to the CMake build system, contributed by Julian Ospald.
4976    * Improvements to tests/Makefile, contributed by Oden Eriksson.
4977    * Use UTC time to check certificate validity.
4979    * Migrate zeroizing of data to polarssl_zeroize() instead of memset()
4983    * Forbid change of server certificate during renegotiation to prevent
4991      It was possible to crash the server (and client) using crafted messages
4995    * Fixed X.509 hostname comparison (with non-regular characters)
5008    * Fixed testing with out-of-source builds using cmake
5009    * Fixed version-major intolerance in server
5010    * Fixed CMake symlinking on out-of-source builds
5011    * Bignum's MIPS-32 assembly was used on MIPS-64, causing chaos. (Found by
5017    * x509_get_current_time() uses localtime_r() to prevent thread issues
5023    * rsa_check_pubkey() now allows an E up to N
5024    * On OpenBSD, use arc4random_buf() instead of rand() to prevent warnings
5026      big-endian platform when size was not an integer number of limbs
5028    * Stricter check on SSL ClientHello internal sizes compared to actual packet
5034    * Fix base64_decode() to return and check length correctly (in case of
5037 = Version 1.2.10 released 2013-10-07
5039    * Changed RSA blinding to a slower but thread-safe version
5046 = Version 1.2.9 released 2013-10-01
5051    * Fixed potential memory leak when failing to resume a session
5058    * RSA blinding on CRT operations to counter timing attacks
5059      (found by Cyril Arnaud and Pierre-Alain Fouque)
5061 = Version 1.2.8 released 2013-06-19
5065    * Centralized module option values in config.h to allow user-defined
5073    * Added mechanism to provide alternative implementations for all
5075      config.h)
5089    * Fixed bignum.c and bn_mul.h to support Thumb2 and LLVM compiler
5090    * Fixed values for 2-key Triple DES in cipher layer
5094    * A possible DoS during the SSL Handshake, due to faulty parsing of
5095      PEM-encoded certificates has been fixed (found by Jack Lloyd)
5097 = Version 1.2.7 released 2013-04-13
5099    * Ability to specify allowed ciphersuites based on the protocol version.
5102    * Default Blowfish keysize is now 128-bits
5103    * Test suites made smaller to accommodate Raspberry Pi
5107    * GCM adapted to support sizes > 2^29
5109 = Version 1.2.6 released 2013-03-11
5112    * Corrected GCM counter incrementation to use only 32-bits instead of
5113      128-bits (found by Yawning Angel)
5114    * Fixes for 64-bit compilation with MS Visual Studio
5120      rsa_pkcs1_sign() and rsa_pkcs1_verify() to separate PKCS#1 v1.5 and
5124    * Re-added handling for SSLv2 Client Hello when the define
5132    * Removed timing differences due to bad padding from
5136 = Version 1.2.5 released 2013-02-02
5138    * Allow enabling of dummy error_strerror() to support some use-cases
5141    * Sending of security-relevant alert messages that do not break
5147      ssl_decrypt_buf() due to badly formatted padding
5149 = Version 1.2.4 released 2013-01-25
5151    * More advanced SSL ciphersuite representation and moved to more dynamic
5153    * Added ssl_handshake_step() to allow single stepping the handshake process
5161 = Version 1.2.3 released 2012-11-26
5165 = Version 1.2.2 released 2012-11-24
5167    * Added p_hw_data to ssl_context for context specific hardware acceleration
5169    * During verify trust-CA is only checked for expiration and CRL presence
5175 = Version 1.2.1 released 2012-11-20
5178      bottom-up (Peer cert depth is 0)
5183    * Allow R and A to point to same mpi in mpi_div_mpi (found by Manuel
5184      Pégourié-Gonnard)
5186      Pégourié-Gonnard)
5189 = Version 1.2.0 released 2012-10-31
5195    * Added support for multi-domain certificates through the X509 Subject
5203    * Added GCM suites to TLS 1.2 (RFC 5288)
5217    * Added option to add minimum accepted SSL/TLS protocol version
5222    * Fixed const-correctness mpi_get_bit()
5224    * Moved out_msg to out_hdr + 32 to support hardware acceleration
5225    * Changed certificate verify behaviour to comply with RFC 6125 section 6.3
5226      to not match CN if subjectAltName extension is present (Closes ticket #56)
5227    * Cipher layer cipher_mode_t POLARSSL_MODE_CFB128 is renamed to
5228      POLARSSL_MODE_CFB, to also handle different block size CFB modes.
5234    * Moved from unsigned long to fixed width uint32_t types throughout code
5235    * Renamed ciphersuites naming scheme to IANA reserved names
5248    * mpi_add_abs() now correctly handles adding short numbers to long numbers
5257 = Version 1.1.8 released on 2013-10-01
5259    * Fixed potential memory leak when failing to resume a session
5263    * Potential buffer-overflow for ssl_read_record() (independently found by
5268 = Version 1.1.7 released on 2013-06-19
5277    * Fixed values for 2-key Triple DES in cipher layer
5281    * A possible DoS during the SSL Handshake, due to faulty parsing of
5282      PEM-encoded certificates has been fixed (found by Jack Lloyd)
5284 = Version 1.1.6 released on 2013-03-11
5289    * Allow enabling of dummy error_strerror() to support some use-cases
5296    * Removed timing differences due to bad padding from
5300 = Version 1.1.5 released on 2013-01-16
5304    * mpi_add_abs() now correctly handles adding short numbers to long numbers
5311      Pégourié-Gonnard)
5312    * Allow R and A to point to same mpi in mpi_div_mpi (found by Manuel
5313      Pégourié-Gonnard)
5324 = Version 1.1.4 released on 2012-05-31
5330 = Version 1.1.3 released on 2012-04-29
5332    * Fixed random MPI generation to not generate more size than requested.
5334 = Version 1.1.2 released on 2012-04-26
5341      Frama-C team at CEA LIST)
5342    * Fixed generation of DHM parameters to correct length (found by Ruslan
5345 = Version 1.1.1 released on 2012-01-23
5349    * Fixed issues with Intel compiler on 64-bit systems (Closes ticket #50)
5353 = Version 1.1.0 released on 2011-12-22
5355    * Added ssl_session_reset() to allow better multi-connection pools of
5356      SSL contexts without needing to set all non-connection-specific
5357      data and pointers again. Adapted ssl_server to use this functionality.
5358    * Added ssl_set_max_version() to allow clients to offer a lower maximum
5359      supported version to a server to help buggy server implementations.
5363    * Added CTR_DRBG based on AES-256-CTR (NIST SP 800-90) random generator
5370    * Fixed rsa_encrypt and rsa_decrypt examples to use public key for
5372    * Inceased maximum size of ASN1 length reads to 32-bits.
5373    * Added an EXPLICIT tag number parameter to x509_get_ext()
5377    * Changed the defined key-length of DES ciphers in cipher.h to include the
5378      parity bits, to prevent mistakes in copying data. (Closes ticket #33)
5379    * Loads of minimal changes to better support WINCE as a build target
5380      (Credits go to Marco Lizza)
5381    * Added POLARSSL_MPI_WINDOW_SIZE definition to allow easier time to memory
5382      trade-off
5385    * Changed the used random function pointer to more flexible format. Renamed
5386      havege_rand() to havege_random() to prevent mistakes. Lots of changes as
5388    * Moved all examples programs to use the new entropy and CTR_DRBG
5389    * Added permissive certificate parsing to x509parse_crt() and
5391      encountering a parse-error. Beware that the meaning of return values has
5396    * Fixed faulty HMAC-MD2 implementation. Found by dibac. (Closes
5400    * Allowed X509 key usage parsing to accept 4 byte values instead of the
5402    * Fixed incorrect behaviour in case of RSASSA-PSS with a salt length
5411 = Version 1.0.0 released on 2011-07-27
5424 = Version 0.99-pre5 released on 2011-05-26
5426    * Added additional Cipher Block Modes to symmetric ciphers
5427      (AES CTR, Camellia CTR, XTEA CBC) including the option to
5431    * A error_strerror function() has been added to translate between
5441      t_int and t_dbl to t_uint and t_udbl in the process
5457 = Version 0.99-pre4 released on 2011-04-01
5460      for the RSAES-OAEP and RSASSA-PSS operations.
5475      platform (32-bit / 64-bit) (Fixes ticket #19, found by Mads
5479    * Fixed proper handling of RSASSA-PSS verification with variable
5482 = Version 0.99-pre3 released on 2011-02-28
5483 This release replaces version 0.99-pre2 which had possible copyright issues.
5487    * Added crl_app program to allow easy reading and
5491    * Parsing of PEM files moved to separate module (Fixes
5492      ticket #13). Also possible to remove PEM support for
5504      to negotiate anonymous connection (Fixes ticket #12,
5508    * Fixed a possible Man-in-the-Middle attack on the
5509      Diffie Hellman key exchange (thanks to Larry Highsmith,
5512 = Version 0.99-pre1 released on 2011-01-30
5514 Note: Most of these features have been donated by Fox-IT
5517    * Improved X509 certificate parsing to include extended
5522    * Improvements to support integration in other
5528          verification to allow external blacklisting
5529        + Additional example programs to show usage
5531      libpkcs11-helper library
5534    * x509parse_time_expired() checks time in addition to
5537      of ssl_session have been renamed to ciphersuites and
5542 = Version 0.14.0 released on 2010-08-16
5546    * Added compile-time and run-time version information
5553      Now using random fuction provided to function and
5556    * Some SSL defines were renamed in order to avoid
5566 = Version 0.13.1 released on 2010-03-24
5571 = Version 0.13.0 released on 2010-03-21
5573    * Added option parsing for host and port selection to
5576    * Added cert_app program to allow easy reading and
5583      in a function to allow easy future expansion
5584    * Changed symmetric cipher functions to
5586    * Changed ARC4 to use separate input/output buffer
5587    * Added reset function for HMAC context as speed-up
5588      for specific use-cases
5591    * Fixed bug resulting in failure to send the last
5599 = Version 0.12.1 released on 2009-10-04
5610 = Version 0.12.0 released on 2009-07-28
5612    * Added CMake makefiles as alternative to regular Makefiles.
5614      Base64, MPI, SHA-family, MD-family, HMAC-SHA-family,
5615      Camellia, DES, 3-DES, RSA PKCS#1, XTEA, Diffie-Hellman
5621    * RSA_RAW renamed to SIG_RSA_RAW for consistency.
5624      to indicate invalid key lengths.
5631    * Fixed HMAC-MD2 by modifying md2_starts(), so that the
5652    * Fixed Camellia and XTEA for 64-bit Windows systems.
5654 = Version 0.11.1 released on 2009-05-17
5655    * Fixed missing functionality for SHA-224, SHA-256, SHA384,
5656      SHA-512 in rsa_pkcs1_sign()
5658 = Version 0.11.0 released on 2009-05-03
5660      input numbers are even and added testcases to check
5662    * Added support for SHA-224, SHA-256, SHA-384 and SHA-512
5672    * Made definition of net_htons() endian-clean for big endian
5676    * Fixed an off-by-one buffer allocation in ssl_set_hostname()
5679    * Added support for CRL revocation to x509parse_verify() and
5681    * Fixed compatibility of XTEA and Camellia on a 64-bit system
5684 = Version 0.10.0 released on 2009-01-12
5685    * Migrated XySSL to PolarSSL
5696 = Version 0.9 released on 2008-03-16
5701     * Fixed a bug in ssl_write() that caused the same payload to
5702       be sent twice in non-blocking mode when send returns EAGAIN
5705     * Added user-defined callback debug function (Krystian Kolodziej)
5711       output data is non-aligned by falling back to the software
5712       implementation, as VIA Nehemiah cannot handle non-aligned buffers
5714       Robson-Garth; some x509write.c fixes by Pascal Vizeli, thanks to
5716     * Fixed x509_get_ext() to accept some rare certificates which have
5722     * Added an option to enable/disable the BN assembly code
5723     * Updated rsa_check_privkey() to verify that (D*E) = 1 % (P-1)*(Q-1)
5725       selftest and benchmark to not test ciphers that have been disabled
5726     * Updated x509parse_cert_info() to correctly display byte 0 of the
5728     * Fixed a critical denial-of-service with X.509 cert. verification:
5729       peer may cause xyssl to loop indefinitely by sending a certificate
5731     * Added test vectors for: AES-CBC, AES-CFB, DES-CBC and 3DES-CBC,
5732       HMAC-MD5, HMAC-SHA1, HMAC-SHA-256, HMAC-SHA-384, and HMAC-SHA-512
5733     * Fixed HMAC-SHA-384 and HMAC-SHA-512 (thanks to Josh Sinykin)
5734     * Modified ssl_parse_client_key_exchange() to protect against
5736       as the Klima-Pokorny-Rosa extension of Bleichenbacher's attack
5737     * Updated rsa_gen_key() so that ctx->N is always nbits in size
5738     * Fixed assembly PPC compilation errors on Mac OS X, thanks to
5741 = Version 0.8 released on 2007-10-20
5743     * Modified the HMAC functions to handle keys larger
5744       than 64 bytes, thanks to Stephane Desneux and gary ng
5745     * Fixed ssl_read_record() to properly update the handshake
5748     * Fixed net_recv(), thanks to Lorenz Schori and Egon Kocjan
5749     * Added user-defined callbacks for handling I/O and sessions
5753     * Added AES-CFB mode of operation, contributed by chmike
5755     * Updated the RSA PKCS#1 code to allow choosing between
5757     * Updated ssl_read() to skip 0-length records from OpenSSL
5758     * Fixed the make install target to comply with *BSD make
5759     * Fixed a bug in mpi_read_binary() on 64-bit platforms
5760     * mpi_is_prime() speedups, thanks to Kevin McLaughlin
5766 = Version 0.7 released on 2007-07-07
5768     * Added support for the MicroBlaze soft-core processor
5770       connections from being established with non-blocking I/O
5774     * Added the SHA-224, SHA-384 and SHA-512 hash functions
5775     * Fixed the net_set_*block routines, thanks to Andreas
5779     * Rewrote README.txt in program/ssl/ca to better explain
5780       how to create a test PKI
5782 = Version 0.6 released on 2007-04-01
5785       time, to reduce the memory footprint on embedded systems
5787       havege_struct for this processor, thanks to David Patiño
5788     * Added multiply assembly code for 64-bit PowerPCs,
5789       thanks to Peking University and the OSU Open Source Lab
5792     * Fixed "long long" compilation issues on IA-64 and PPC64
5793     * Fixed a bug introduced in xyssl-0.5/timing.c: hardclock
5796 = Version 0.5 released on 2007-03-01
5799     * Added (beta) support for non-blocking I/O operations
5802       (thanks to Benjamin Newman), HP-UX, FreeBSD and Solaris
5805       size of 16384 bytes to be rejected
5807 = Version 0.4 released on 2007-02-01
5809     * Added support for Ephemeral Diffie-Hellman key exchange
5811     * Various improvement to the modular exponentiation code
5812     * Rewrote the headers to generate the API docs with doxygen
5815       version was not properly set), thanks to Didier Rebeix
5820 = Version 0.3 released on 2007-01-01
5822     * Added server-side SSLv3 and TLSv1.0 support
5823     * Multiple fixes to enhance the compatibility with g++,
5824       thanks to Xosé Antón Otero Ferreira
5825     * Fixed a bug in the CBC code, thanks to dowst; also,
5827     * Updated rsa_pkcs1_sign to handle arbitrary large inputs
5829       and 486 processors, thanks to Arnaud Cornet
5831 = Version 0.2 released on 2006-12-01
5833     * Updated timing.c to support ARM and MIPS arch
5834     * Updated the MPI code to support 8086 on MSVC 1.5
5836     * Fixed a bug in sha2_hmac, thanks to newsoft/Wenfang Zhang
5840       valid RSA keys to be dismissed (thanks to oldwolf)
5841     * Fixed a bug in mpi_is_prime that caused some primes to fail
5842       the Miller-Rabin primality test
5844     I'd also like to thank Younès Hafri for the CRUX linux port,
5846     who maintains the Debian package :-)
5848 = Version 0.1 released on 2006-11-01