Import mbedtls-2.16.0
Imports mbedTLS 2.16.0 from https://github.com/ARMmbed/mbedtls.git
commit fb1972db23da ("Merge pull request #544 from ARMmbed/version-2.16")
(tag mbedtls-2.16.0).
Certain files will never be needed and are thus removed (reducing number
of lines to almost 50%):
rm -f circle.yml CMakeLists.txt DartConfiguration.tcl Makefile
rm -f .gitignore .travis.yml .pylint
rm -f include/.gitignore include/CMakeLists.txt library/.gitignore
rm -f library/CMakeLists.txt library/Makefile
rm -rf .git .github doxygen configs programs scripts tests visualc yotta
This is a complete overwrite of previous code so earlier changes in the
branch import/mbedtls-2.6.1 will be added on top of this commit to bring
the changes forward.
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
diff --git a/lib/libmbedtls/mbedtls/ChangeLog b/lib/libmbedtls/mbedtls/ChangeLog
index 904eb93..be28645 100644
--- a/lib/libmbedtls/mbedtls/ChangeLog
+++ b/lib/libmbedtls/mbedtls/ChangeLog
@@ -1,11 +1,856 @@
mbed TLS ChangeLog (Sorted per branch, date)
-= mbed TLS 2.6.1 branch released 2017-10-08
+= mbed TLS 2.16.0 branch released 2018-12-21
+
+Features
+ * Add a new config.h option of MBEDTLS_CHECK_PARAMS that enables validation
+ of parameters in the API. This allows detection of obvious misuses of the
+ API, such as passing NULL pointers. The API of existing functions hasn't
+ changed, but requirements on parameters have been made more explicit in
+ the documentation. See the corresponding API documentation for each
+ function to see for which parameter values it is defined. This feature is
+ disabled by default. See its API documentation in config.h for additional
+ steps you have to take when enabling it.
+
+API Changes
+ * The following functions in the random generator modules have been
+ deprecated and replaced as shown below. The new functions change
+ the return type from void to int to allow returning error codes when
+ using MBEDTLS_<MODULE>_ALT for the underlying AES or message digest
+ primitive. Fixes #1798.
+ mbedtls_ctr_drbg_update() -> mbedtls_ctr_drbg_update_ret()
+ mbedtls_hmac_drbg_update() -> mbedtls_hmac_drbg_update_ret()
+ * Extend ECDH interface to enable alternative implementations.
+ * Deprecate error codes of the form MBEDTLS_ERR_xxx_INVALID_KEY_LENGTH for
+ ARIA, CAMELLIA and Blowfish. These error codes will be replaced by
+ the more generic per-module error codes MBEDTLS_ERR_xxx_BAD_INPUT_DATA.
+ * Additional parameter validation checks have been added for the following
+ modules - AES, ARIA, Blowfish, CAMELLIA, CCM, GCM, DHM, ECP, ECDSA, ECDH,
+ ECJPAKE, SHA, Chacha20 and Poly1305, cipher, pk, RSA, and MPI.
+ Where modules have had parameter validation added, existing parameter
+ checks may have changed. Some modules, such as Chacha20 had existing
+ parameter validation whereas other modules had little. This has now been
+ changed so that the same level of validation is present in all modules, and
+ that it is now optional with the MBEDTLS_CHECK_PARAMS flag which by default
+ is off. That means that checks which were previously present by default
+ will no longer be.
+
+New deprecations
+ * Deprecate mbedtls_ctr_drbg_update and mbedtls_hmac_drbg_update
+ in favor of functions that can return an error code.
Bugfix
+ * Fix for Clang, which was reporting a warning for the bignum.c inline
+ assembly for AMD64 targets creating string literals greater than those
+ permitted by the ISO C99 standard. Found by Aaron Jones. Fixes #482.
+ * Fix runtime error in `mbedtls_platform_entropy_poll()` when run
+ through qemu user emulation. Reported and fix suggested by randombit
+ in #1212. Fixes #1212.
+ * Fix an unsafe bounds check when restoring an SSL session from a ticket.
+ This could lead to a buffer overflow, but only in case ticket authentication
+ was broken. Reported and fix suggested by Guido Vranken in #659.
+ * Add explicit integer to enumeration type casts to example program
+ programs/pkey/gen_key which previously led to compilation failure
+ on some toolchains. Reported by phoenixmcallister. Fixes #2170.
+ * Fix double initialization of ECC hardware that made some accelerators
+ hang.
+ * Clarify documentation of mbedtls_ssl_set_own_cert() regarding the absence
+ of check for certificate/key matching. Reported by Attila Molnar, #507.
+
+= mbed TLS 2.14.1 branch released 2018-11-30
+
+Security
+ * Fix timing variations and memory access variations in RSA PKCS#1 v1.5
+ decryption that could lead to a Bleichenbacher-style padding oracle
+ attack. In TLS, this affects servers that accept ciphersuites based on
+ RSA decryption (i.e. ciphersuites whose name contains RSA but not
+ (EC)DH(E)). Discovered by Eyal Ronen (Weizmann Institute), Robert Gillham
+ (University of Adelaide), Daniel Genkin (University of Michigan),
+ Adi Shamir (Weizmann Institute), David Wong (NCC Group), and Yuval Yarom
+ (University of Adelaide, Data61). The attack is described in more detail
+ in the paper available here: http://cat.eyalro.net/cat.pdf CVE-2018-19608
+ * In mbedtls_mpi_write_binary(), don't leak the exact size of the number
+ via branching and memory access patterns. An attacker who could submit
+ a plaintext for RSA PKCS#1 v1.5 decryption but only observe the timing
+ of the decryption and not its result could nonetheless decrypt RSA
+ plaintexts and forge RSA signatures. Other asymmetric algorithms may
+ have been similarly vulnerable. Reported by Eyal Ronen, Robert Gillham,
+ Daniel Genkin, Adi Shamir, David Wong and Yuval Yarom.
+ * Wipe sensitive buffers on the stack in the CTR_DRBG and HMAC_DRBG
+ modules.
+
+API Changes
+ * The new functions mbedtls_ctr_drbg_update_ret() and
+ mbedtls_hmac_drbg_update_ret() are similar to mbedtls_ctr_drbg_update()
+ and mbedtls_hmac_drbg_update() respectively, but the new functions
+ report errors whereas the old functions return void. We recommend that
+ applications use the new functions.
+
+= mbed TLS 2.14.0 branch released 2018-11-19
+
+Security
+ * Fix overly strict DN comparison when looking for CRLs belonging to a
+ particular CA. This previously led to ignoring CRLs when the CRL's issuer
+ name and the CA's subject name differed in their string encoding (e.g.,
+ one using PrintableString and the other UTF8String) or in the choice of
+ upper and lower case. Reported by Henrik Andersson of Bosch GmbH in issue
+ #1784.
+ * Fix a flawed bounds check in server PSK hint parsing. In case the
+ incoming message buffer was placed within the first 64KiB of address
+ space and a PSK-(EC)DHE ciphersuite was used, this allowed an attacker
+ to trigger a memory access up to 64KiB beyond the incoming message buffer,
+ potentially leading to an application crash or information disclosure.
+ * Fix mbedtls_mpi_is_prime() to use more rounds of probabilistic testing. The
+ previous settings for the number of rounds made it practical for an
+ adversary to construct non-primes that would be erroneously accepted as
+ primes with high probability. This does not have an impact on the
+ security of TLS, but can matter in other contexts with numbers chosen
+ potentially by an adversary that should be prime and can be validated.
+ For example, the number of rounds was enough to securely generate RSA key
+ pairs or Diffie-Hellman parameters, but was insufficient to validate
+ Diffie-Hellman parameters properly.
+ See "Prime and Prejudice" by by Martin R. Albrecht and Jake Massimo and
+ Kenneth G. Paterson and Juraj Somorovsky.
+
+Features
+ * Add support for temporarily suspending expensive ECC computations after
+ some configurable amount of operations. This is intended to be used in
+ constrained, single-threaded systems where ECC is time consuming and can
+ block other operations until they complete. This is disabled by default,
+ but can be enabled by MBEDTLS_ECP_RESTARTABLE at compile time and
+ configured by mbedtls_ecp_set_max_ops() at runtime. It applies to the new
+ xxx_restartable functions in ECP, ECDSA, PK and X.509 (CRL not supported
+ yet), and to existing functions in ECDH and SSL (currently only
+ implemented client-side, for ECDHE-ECDSA ciphersuites in TLS 1.2,
+ including client authentication).
+ * Add support for Arm CPU DSP extensions to accelerate asymmetric key
+ operations. On CPUs where the extensions are available, they can accelerate
+ MPI multiplications used in ECC and RSA cryptography. Contributed by
+ Aurelien Jarno.
+ * Extend RSASSA-PSS signature to allow a smaller salt size. Previously, PSS
+ signature always used a salt with the same length as the hash, and returned
+ an error if this was not possible. Now the salt size may be up to two bytes
+ shorter. This allows the library to support all hash and signature sizes
+ that comply with FIPS 186-4, including SHA-512 with a 1024-bit key.
+ * Add support for 128-bit keys in CTR_DRBG. Note that using keys shorter
+ than 256 bits limits the security of generated material to 128 bits.
+
+API Changes
+ * Add a common error code of `MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED` for
+ a feature that is not supported by underlying alternative
+ implementations implementing cryptographic primitives. This is useful for
+ hardware accelerators that don't implement all options or features.
+
+New deprecations
+ * All module specific errors following the form
+ MBEDTLS_ERR_XXX_FEATURE_UNAVAILABLE that indicate a feature is not
+ supported are deprecated and are now replaced by the new equivalent
+ platform error.
+ * All module specific generic hardware acceleration errors following the
+ form MBEDTLS_ERR_XXX_HW_ACCEL_FAILED that are deprecated and are replaced
+ by the equivalent plaform error.
+ * Deprecate the function mbedtls_mpi_is_prime() in favor of
+ mbedtls_mpi_is_prime_ext() which allows specifying the number of
+ Miller-Rabin rounds.
+
+Bugfix
+ * Fix wrong order of freeing in programs/ssl/ssl_server2 example
+ application leading to a memory leak in case both
+ MBEDTLS_MEMORY_BUFFER_ALLOC_C and MBEDTLS_MEMORY_BACKTRACE are set.
+ Fixes #2069.
+ * Fix a bug in the update function for SSL ticket keys which previously
+ invalidated keys of a lifetime of less than a 1s. Fixes #1968.
+ * Fix failure in hmac_drbg in the benchmark sample application, when
+ MBEDTLS_THREADING_C is defined. Found by TrinityTonic, #1095
+ * Fix a bug in the record decryption routine ssl_decrypt_buf()
+ which lead to accepting properly authenticated but improperly
+ padded records in case of CBC ciphersuites using Encrypt-then-MAC.
+ * Fix memory leak and freeing without initialization in the example
+ program programs/x509/cert_write. Fixes #1422.
+ * Ignore IV in mbedtls_cipher_set_iv() when the cipher mode is
+ MBEDTLS_MODE_ECB. Found by ezdevelop. Fixes #1091.
+ * Zeroize memory used for buffering or reassembling handshake messages
+ after use.
+ * Use `mbedtls_platform_zeroize()` instead of `memset()` for zeroization
+ of sensitive data in the example programs aescrypt2 and crypt_and_hash.
+ * Change the default string format used for various X.509 DN attributes to
+ UTF8String. Previously, the use of the PrintableString format led to
+ wildcards and non-ASCII characters being unusable in some DN attributes.
+ Reported by raprepo in #1860 and by kevinpt in #468. Fix contributed by
+ Thomas-Dee.
+ * Fix compilation failure for configurations which use compile time
+ replacements of standard calloc/free functions through the macros
+ MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_FREE_MACRO.
+ Reported by ole-de and ddhome2006. Fixes #882, #1642 and #1706.
+
+Changes
+ * Removed support for Yotta as a build tool.
+ * Add tests for session resumption in DTLS.
+ * Close a test gap in (D)TLS between the client side and the server side:
+ test the handling of large packets and small packets on the client side
+ in the same way as on the server side.
+ * Change the dtls_client and dtls_server samples to work by default over
+ IPv6 and optionally by a build option over IPv4.
+ * Change the use of Windows threading to use Microsoft Visual C++ runtime
+ calls, rather than Win32 API calls directly. This is necessary to avoid
+ conflict with C runtime usage. Found and fixed by irwir.
+ * Remember the string format of X.509 DN attributes when replicating
+ X.509 DNs. Previously, DN attributes were always written in their default
+ string format (mostly PrintableString), which could lead to CRTs being
+ created which used PrintableStrings in the issuer field even though the
+ signing CA used UTF8Strings in its subject field; while X.509 compliant,
+ such CRTs were rejected in some applications, e.g. some versions of
+ Firefox, curl and GnuTLS. Reported in #1033 by Moschn. Fix contributed by
+ Thomas-Dee.
+ * Improve documentation of mbedtls_ssl_get_verify_result().
+ Fixes #517 reported by github-monoculture.
+ * Add MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR flag to mbedtls_mpi_gen_prime() and
+ use it to reduce error probability in RSA key generation to levels mandated
+ by FIPS-186-4.
+
+= mbed TLS 2.13.1 branch released 2018-09-06
+
+API Changes
+ * Extend the platform module with an abstraction mbedtls_platform_gmtime_r()
+ whose implementation should behave as a thread-safe version of gmtime().
+ This allows users to configure such an implementation at compile time when
+ the target system cannot be deduced automatically, by setting the option
+ MBEDTLS_PLATFORM_GMTIME_R_ALT. At this stage Mbed TLS is only able to
+ automatically select implementations for Windows and POSIX C libraries.
+
+Bugfix
+ * Fix build failures on platforms where only gmtime() is available but
+ neither gmtime_r() nor gmtime_s() are present. Fixes #1907.
+
+= mbed TLS 2.13.0 branch released 2018-08-31
+
+Security
+ * Fix an issue in the X.509 module which could lead to a buffer overread
+ during certificate extensions parsing. In case of receiving malformed
+ input (extensions length field equal to 0), an illegal read of one byte
+ beyond the input buffer is made. Found and analyzed by Nathan Crandall.
+
+Features
+ * Add support for fragmentation of outgoing DTLS handshake messages. This
+ is controlled by the maximum fragment length as set locally or negotiated
+ with the peer, as well as by a new per-connection MTU option, set using
+ mbedtls_ssl_set_mtu().
+ * Add support for auto-adjustment of MTU to a safe value during the
+ handshake when flights do not get through (RFC 6347, section 4.1.1.1,
+ last paragraph).
+ * Add support for packing multiple records within a single datagram,
+ enabled by default.
+ * Add support for buffering out-of-order handshake messages in DTLS.
+ The maximum amount of RAM used for this can be controlled by the
+ compile-time constant MBEDTLS_SSL_DTLS_MAX_BUFFERING defined
+ in mbedtls/config.h.
+
+API Changes
+ * Add function mbedtls_ssl_set_datagram_packing() to configure
+ the use of datagram packing (enabled by default).
+
+Bugfix
+ * Fix a potential memory leak in mbedtls_ssl_setup() function. An allocation
+ failure in the function could lead to other buffers being leaked.
+ * Fixes an issue with MBEDTLS_CHACHAPOLY_C which would not compile if
+ MBEDTLS_ARC4_C and MBEDTLS_CIPHER_NULL_CIPHER weren't also defined. #1890
+ * Fix a memory leak in ecp_mul_comb() if ecp_precompute_comb() fails.
+ Fix contributed by Espressif Systems.
+ * Add ecc extensions only if an ecc based ciphersuite is used.
+ This improves compliance to RFC 4492, and as a result, solves
+ interoperability issues with BouncyCastle. Raised by milenamil in #1157.
+ * Replace printf with mbedtls_printf in the ARIA module. Found by
+ TrinityTonic in #1908.
+ * Fix potential use-after-free in mbedtls_ssl_get_max_frag_len()
+ and mbedtls_ssl_get_record_expansion() after a session reset. Fixes #1941.
+ * Fix a bug that caused SSL/TLS clients to incorrectly abort the handshake
+ with TLS versions 1.1 and earlier when the server requested authentication
+ without providing a list of CAs. This was due to an overly strict bounds
+ check in parsing the CertificateRequest message,
+ introduced in Mbed TLS 2.12.0. Fixes #1954.
+ * Fix a miscalculation of the maximum record expansion in
+ mbedtls_ssl_get_record_expansion() in case of ChachaPoly ciphersuites,
+ or CBC ciphersuites in (D)TLS versions 1.1 or higher. Fixes #1913, #1914.
+ * Fix undefined shifts with negative values in certificates parsing
+ (found by Catena cyber using oss-fuzz)
+ * Fix memory leak and free without initialization in pk_encrypt
+ and pk_decrypt example programs. Reported by Brace Stout. Fixes #1128.
+ * Remove redundant else statement. Raised by irwir. Fixes #1776.
+
+Changes
+ * Copy headers preserving timestamps when doing a "make install".
+ Contributed by xueruini.
+ * Allow the forward declaration of public structs. Contributed by Dawid
+ Drozd. Fixes #1215 raised by randombit.
+ * Improve compatibility with some alternative CCM implementations by using
+ CCM test vectors from RAM.
+ * Add support for buffering of out-of-order handshake messages.
+ * Add warnings to the documentation of the HKDF module to reduce the risk
+ of misusing the mbedtls_hkdf_extract() and mbedtls_hkdf_expand()
+ functions. Fixes #1775. Reported by Brian J. Murray.
+
+= mbed TLS 2.12.0 branch released 2018-07-25
+
+Security
+ * Fix a vulnerability in TLS ciphersuites based on CBC and using SHA-384,
+ in (D)TLS 1.0 to 1.2, that allowed an active network attacker to
+ partially recover the plaintext of messages under some conditions by
+ exploiting timing measurements. With DTLS, the attacker could perform
+ this recovery by sending many messages in the same connection. With TLS
+ or if mbedtls_ssl_conf_dtls_badmac_limit() was used, the attack only
+ worked if the same secret (for example a HTTP Cookie) has been repeatedly
+ sent over connections manipulated by the attacker. Connections using GCM
+ or CCM instead of CBC, using hash sizes other than SHA-384, or using
+ Encrypt-then-Mac (RFC 7366) were not affected. The vulnerability was
+ caused by a miscalculation (for SHA-384) in a countermeasure to the
+ original Lucky 13 attack. Found by Kenny Paterson, Eyal Ronen and Adi
+ Shamir.
+ * Fix a vulnerability in TLS ciphersuites based on CBC, in (D)TLS 1.0 to
+ 1.2, that allowed a local attacker, able to execute code on the local
+ machine as well as manipulate network packets, to partially recover the
+ plaintext of messages under some conditions by using a cache attack
+ targetting an internal MD/SHA buffer. With TLS or if
+ mbedtls_ssl_conf_dtls_badmac_limit() was used, the attack only worked if
+ the same secret (for example a HTTP Cookie) has been repeatedly sent over
+ connections manipulated by the attacker. Connections using GCM or CCM
+ instead of CBC or using Encrypt-then-Mac (RFC 7366) were not affected.
+ Found by Kenny Paterson, Eyal Ronen and Adi Shamir.
+ * Add a counter-measure against a vulnerability in TLS ciphersuites based
+ on CBC, in (D)TLS 1.0 to 1.2, that allowed a local attacker, able to
+ execute code on the local machine as well as manipulate network packets,
+ to partially recover the plaintext of messages under some conditions (see
+ previous entry) by using a cache attack targeting the SSL input record
+ buffer. Connections using GCM or CCM instead of CBC or using
+ Encrypt-then-Mac (RFC 7366) were not affected. Found by Kenny Paterson,
+ Eyal Ronen and Adi Shamir.
+
+Features
+ * Add new crypto primitives from RFC 7539: stream cipher Chacha20, one-time
+ authenticator Poly1305 and AEAD construct Chacha20-Poly1305. Contributed
+ by Daniel King.
+ * Add support for CHACHA20-POLY1305 ciphersuites from RFC 7905.
+ * Add platform support for the Haiku OS. (https://www.haiku-os.org).
+ Contributed by Augustin Cavalier.
+ * Make the receive and transmit buffers independent sizes, for situations
+ where the outgoing buffer can be fixed at a smaller size than the incoming
+ buffer, which can save some RAM. If buffer lengths are kept equal, there
+ is no functional difference. Contributed by Angus Gratton, and also
+ independently contributed again by Paul Sokolovsky.
+ * Add support for key wrapping modes based on AES as defined by
+ NIST SP 800-38F algorithms KW and KWP and by RFC 3394 and RFC 5649.
+
+Bugfix
+ * Fix the key_app_writer example which was writing a leading zero byte which
+ was creating an invalid ASN.1 tag. Found by Aryeh R. Fixes #1257.
+ * Fix compilation error on C++, because of a variable named new.
+ Found and fixed by Hirotaka Niisato in #1783.
+ * Fix "no symbols" warning issued by ranlib when building on Mac OS X. Fix
+ contributed by tabascoeye.
+ * Clarify documentation for mbedtls_ssl_write() to include 0 as a valid
+ return value. Found by @davidwu2000. #839
+ * Fix a memory leak in mbedtls_x509_csr_parse(), found by catenacyber,
+ Philippe Antoine. Fixes #1623.
+ * Remove unused headers included in x509.c. Found by Chris Hanson and fixed
+ by Brendan Shanks. Part of a fix for #992.
+ * Fix compilation error when MBEDTLS_ARC4_C is disabled and
+ MBEDTLS_CIPHER_NULL_CIPHER is enabled. Found by TrinityTonic in #1719.
+ * Added length checks to some TLS parsing functions. Found and fixed by
+ Philippe Antoine from Catena cyber. #1663.
+ * Fix the inline assembly for the MPI multiply helper function for i386 and
+ i386 with SSE2. Found by László Langó. Fixes #1550
+ * Fix namespacing in header files. Remove the `mbedtls` namespacing in
+ the `#include` in the header files. Resolves #857
+ * Fix compiler warning of 'use before initialisation' in
+ mbedtls_pk_parse_key(). Found by Martin Boye Petersen and fixed by Dawid
+ Drozd. #1098
+ * Fix decryption for zero length messages (which contain all padding) when a
+ CBC based ciphersuite is used together with Encrypt-then-MAC. Previously,
+ such a message was wrongly reported as an invalid record and therefore lead
+ to the connection being terminated. Seen most often with OpenSSL using
+ TLS 1.0. Reported by @kFYatek and by Conor Murphy on the forum. Fix
+ contributed by Espressif Systems. Fixes #1632
+ * Fix ssl_client2 example to send application data with 0-length content
+ when the request_size argument is set to 0 as stated in the documentation.
+ Fixes #1833.
+ * Correct the documentation for `mbedtls_ssl_get_session()`. This API has
+ deep copy of the session, and the peer certificate is not lost. Fixes #926.
+ * Fix build using -std=c99. Fixed by Nick Wilson.
+
+Changes
+ * Fail when receiving a TLS alert message with an invalid length, or invalid
+ zero-length messages when using TLS 1.2. Contributed by Espressif Systems.
+ * Change the default behaviour of mbedtls_hkdf_extract() to return an error
+ when calling with a NULL salt and non-zero salt_len. Contributed by
+ Brian J Murray
+ * Change the shebang line in Perl scripts to look up perl in the PATH.
+ Contributed by fbrosson.
+ * Allow overriding the time on Windows via the platform-time abstraction.
+ Fixed by Nick Wilson.
+ * Use gmtime_r/gmtime_s for thread-safety. Fixed by Nick Wilson.
+
+= mbed TLS 2.11.0 branch released 2018-06-18
+
+Features
+ * Add additional block mode, OFB (Output Feedback), to the AES module and
+ cipher abstraction module.
+ * Implement the HMAC-based extract-and-expand key derivation function
+ (HKDF) per RFC 5869. Contributed by Thomas Fossati.
+ * Add support for the CCM* block cipher mode as defined in IEEE Std. 802.15.4.
+ * Add support for the XTS block cipher mode with AES (AES-XTS).
+ Contributed by Aorimn in pull request #414.
+ * In TLS servers, support offloading private key operations to an external
+ cryptoprocessor. Private key operations can be asynchronous to allow
+ non-blocking operation of the TLS server stack.
+
+Bugfix
+ * Fix the cert_write example to handle certificates signed with elliptic
+ curves as well as RSA. Fixes #777 found by dbedev.
+ * Fix for redefinition of _WIN32_WINNT to avoid overriding a definition
+ used by user applications. Found and fixed by Fabio Alessandrelli.
+ * Fix compilation warnings with IAR toolchain, on 32 bit platform.
+ Reported by rahmanih in #683
+ * Fix braces in mbedtls_memory_buffer_alloc_status(). Found by sbranden, #552.
+
+Changes
+ * Changed CMake defaults for IAR to treat all compiler warnings as errors.
+ * Changed the Clang parameters used in the CMake build files to work for
+ versions later than 3.6. Versions of Clang earlier than this may no longer
+ work. Fixes #1072
+
+= mbed TLS 2.10.0 branch released 2018-06-06
+
+Features
+ * Add support for ARIA cipher (RFC 5794) and associated TLS ciphersuites
+ (RFC 6209). Disabled by default, see MBEDTLS_ARIA_C in config.h
+
+API Changes
+ * Extend the platform module with a util component that contains
+ functionality shared by multiple Mbed TLS modules. At this stage
+ platform_util.h (and its associated platform_util.c) only contain
+ mbedtls_platform_zeroize(), which is a critical function from a security
+ point of view. mbedtls_platform_zeroize() needs to be regularly tested
+ against compilers to ensure that calls to it are not removed from the
+ output binary as part of redundant code elimination optimizations.
+ Therefore, mbedtls_platform_zeroize() is moved to the platform module to
+ facilitate testing and maintenance.
+
+Bugfix
+ * Fix an issue with MicroBlaze support in bn_mul.h which was causing the
+ build to fail. Found by zv-io. Fixes #1651.
+
+Changes
+ * Support TLS testing in out-of-source builds using cmake. Fixes #1193.
+ * Fix redundant declaration of mbedtls_ssl_list_ciphersuites. Raised by
+ TrinityTonic. #1359.
+
+= mbed TLS 2.9.0 branch released 2018-04-30
+
+Security
+ * Fix an issue in the X.509 module which could lead to a buffer overread
+ during certificate validation. Additionally, the issue could also lead to
+ unnecessary callback checks being made or to some validation checks to be
+ omitted. The overread could be triggered remotely, while the other issues
+ would require a non DER-compliant certificate to be correctly signed by a
+ trusted CA, or a trusted CA with a non DER-compliant certificate. Found by
+ luocm. Fixes #825.
+ * Fix the buffer length assertion in the ssl_parse_certificate_request()
+ function which led to an arbitrary overread of the message buffer. The
+ overreads could be caused by receiving a malformed message at the point
+ where an optional signature algorithms list is expected when the signature
+ algorithms section is too short. In builds with debug output, the overread
+ data is output with the debug data.
+ * Fix a client-side bug in the validation of the server's ciphersuite choice
+ which could potentially lead to the client accepting a ciphersuite it didn't
+ offer or a ciphersuite that cannot be used with the TLS or DTLS version
+ chosen by the server. This could lead to corruption of internal data
+ structures for some configurations.
+
+Features
+ * Add an option, MBEDTLS_AES_FEWER_TABLES, to dynamically compute smaller AES
+ tables during runtime, thereby reducing the RAM/ROM footprint by ~6KiB.
+ Suggested and contributed by jkivilin in pull request #394.
+ * Add initial support for Curve448 (RFC 7748). Only mbedtls_ecp_mul() and
+ ECDH primitive functions (mbedtls_ecdh_gen_public(),
+ mbedtls_ecdh_compute_shared()) are supported for now. Contributed by
+ Nicholas Wilson in pull request #348.
+
+API Changes
+ * Extend the public API with the function of mbedtls_net_poll() to allow user
+ applications to wait for a network context to become ready before reading
+ or writing.
+ * Add function mbedtls_ssl_check_pending() to the public API to allow
+ a check for whether more more data is pending to be processed in the
+ internal message buffers.
+ This function is necessary to determine when it is safe to idle on the
+ underlying transport in case event-driven IO is used.
+
+Bugfix
+ * Fix a spurious uninitialized variable warning in cmac.c. Fix independently
+ contributed by Brian J Murray and David Brown.
+ * Add missing dependencies in test suites that led to build failures
+ in configurations that omit certain hashes or public-key algorithms.
+ Fixes #1040.
+ * Fix C89 incompatibility in benchmark.c. Contributed by Brendan Shanks.
+ #1353
+ * Add missing dependencies for MBEDTLS_HAVE_TIME_DATE and
+ MBEDTLS_VERSION_FEATURES in some test suites. Contributed by
+ Deomid Ryabkov. Fixes #1299, #1475.
+ * Fix the Makefile build process for building shared libraries on Mac OS X.
+ Fixed by mnacamura.
+ * Fix parsing of PKCS#8 encoded Elliptic Curve keys. Previously Mbed TLS was
+ unable to parse keys which had only the optional parameters field of the
+ ECPrivateKey structure. Found by Jethro Beekman, fixed in #1379.
+ * Return the plaintext data more quickly on unpadded CBC decryption, as
+ stated in the mbedtls_cipher_update() documentation. Contributed by
+ Andy Leiserson.
+ * Fix overriding and ignoring return values when parsing and writing to
+ a file in pk_sign program. Found by kevlut in #1142.
+ * Restrict usage of error code MBEDTLS_ERR_SSL_WANT_READ to situations
+ where data needs to be fetched from the underlying transport in order
+ to make progress. Previously, this error code was also occasionally
+ returned when unexpected messages were being discarded, ignoring that
+ further messages could potentially already be pending to be processed
+ in the internal buffers; these cases led to deadlocks when event-driven
+ I/O was used. Found and reported by Hubert Mis in #772.
+ * Fix buffer length assertions in the ssl_parse_certificate_request()
+ function which leads to a potential one byte overread of the message
+ buffer.
+ * Fix invalid buffer sizes passed to zlib during record compression and
+ decompression.
+ * Fix the soversion of libmbedcrypto to match the soversion of the
+ maintained 2.7 branch. The soversion was increased in Mbed TLS
+ version 2.7.1 to reflect breaking changes in that release, but the
+ increment was missed in 2.8.0 and later releases outside of the 2.7 branch.
+
+Changes
+ * Remove some redundant code in bignum.c. Contributed by Alexey Skalozub.
+ * Support cmake builds where Mbed TLS is a subproject. Fix contributed
+ independently by Matthieu Volat and Arne Schwabe.
+ * Improve testing in configurations that omit certain hashes or
+ public-key algorithms. Includes contributions by Gert van Dijk.
+ * Improve negative testing of X.509 parsing.
+ * Do not define global mutexes around readdir() and gmtime() in
+ configurations where the feature is disabled. Found and fixed by Gergely
+ Budai.
+ * Harden the function mbedtls_ssl_config_free() against misuse, so that it
+ doesn't leak memory if the user doesn't use mbedtls_ssl_conf_psk() and
+ instead incorrectly manipulates the configuration structure directly.
+ Found and fix submitted by junyeonLEE in #1220.
+ * Provide an empty implementation of mbedtls_pkcs5_pbes2() when
+ MBEDTLS_ASN1_PARSE_C is not enabled. This allows the use of PBKDF2
+ without PBES2. Fixed by Marcos Del Sol Vives.
+ * Add the order of the base point as N in the mbedtls_ecp_group structure
+ for Curve25519 (other curves had it already). Contributed by Nicholas
+ Wilson #481
+ * Improve the documentation of mbedtls_net_accept(). Contributed by Ivan
+ Krylov.
+ * Improve the documentation of mbedtls_ssl_write(). Suggested by
+ Paul Sokolovsky in #1356.
+ * Add an option in the Makefile to support ar utilities where the operation
+ letter must not be prefixed by '-', such as LLVM. Found and fixed by
+ Alex Hixon.
+ * Allow configuring the shared library extension by setting the DLEXT
+ environment variable when using the project makefiles.
+ * Optimize unnecessary zeroing in mbedtls_mpi_copy. Based on a contribution
+ by Alexey Skalozub in #405.
+ * In the SSL module, when f_send, f_recv or f_recv_timeout report
+ transmitting more than the required length, return an error. Raised by
+ Sam O'Connor in #1245.
+ * Improve robustness of mbedtls_ssl_derive_keys against the use of
+ HMAC functions with non-HMAC ciphersuites. Independently contributed
+ by Jiayuan Chen in #1377. Fixes #1437.
+ * Improve security of RSA key generation by including criteria from
+ FIPS 186-4. Contributed by Jethro Beekman. #1380
+ * Declare functions in header files even when an alternative implementation
+ of the corresponding module is activated by defining the corresponding
+ MBEDTLS_XXX_ALT macro. This means that alternative implementations do
+ not need to copy the declarations, and ensures that they will have the
+ same API.
+ * Add platform setup and teardown calls in test suites.
+
+= mbed TLS 2.8.0 branch released 2018-03-16
+
+Default behavior changes
+ * The truncated HMAC extension now conforms to RFC 6066. This means
+ that when both sides of a TLS connection negotiate the truncated
+ HMAC extension, Mbed TLS can now interoperate with other
+ compliant implementations, but this breaks interoperability with
+ prior versions of Mbed TLS. To restore the old behavior, enable
+ the (deprecated) option MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT in
+ config.h. Found by Andreas Walz (ivESK, Offenburg University of
+ Applied Sciences).
+
+Security
+ * Fix implementation of the truncated HMAC extension. The previous
+ implementation allowed an offline 2^80 brute force attack on the
+ HMAC key of a single, uninterrupted connection (with no
+ resumption of the session).
+ * Verify results of RSA private key operations to defend
+ against Bellcore glitch attack.
+ * Fix a buffer overread in ssl_parse_server_key_exchange() that could cause
+ a crash on invalid input.
+ * Fix a buffer overread in ssl_parse_server_psk_hint() that could cause a
+ crash on invalid input.
+ * Fix CRL parsing to reject CRLs containing unsupported critical
+ extensions. Found by Falko Strenzke and Evangelos Karatsiolis.
+
+Features
+ * Extend PKCS#8 interface by introducing support for the entire SHA
+ algorithms family when encrypting private keys using PKCS#5 v2.0.
+ This allows reading encrypted PEM files produced by software that
+ uses PBKDF2-SHA2, such as OpenSSL 1.1. Submitted by Antonio Quartulli,
+ OpenVPN Inc. Fixes #1339
+ * Add support for public keys encoded in PKCS#1 format. #1122
+
+New deprecations
+ * Deprecate support for record compression (configuration option
+ MBEDTLS_ZLIB_SUPPORT).
+
+Bugfix
+ * Fix the name of a DHE parameter that was accidentally changed in 2.7.0.
+ Fixes #1358.
+ * Fix test_suite_pk to work on 64-bit ILP32 systems. #849
+ * Fix mbedtls_x509_crt_profile_suiteb, which used to reject all certificates
+ with flag MBEDTLS_X509_BADCERT_BAD_PK even when the key type was correct.
+ In the context of SSL, this resulted in handshake failure. Reported by
+ daniel in the Mbed TLS forum. #1351
+ * Fix Windows x64 builds with the included mbedTLS.sln file. #1347
+ * Fix setting version TLSv1 as minimal version, even if TLS 1
+ is not enabled. Set MBEDTLS_SSL_MIN_MAJOR_VERSION
+ and MBEDTLS_SSL_MIN_MINOR_VERSION instead of
+ MBEDTLS_SSL_MAJOR_VERSION_3 and MBEDTLS_SSL_MINOR_VERSION_1. #664
+ * Fix compilation error on Mingw32 when _TRUNCATE is defined. Use _TRUNCATE
+ only if __MINGW32__ not defined. Fix suggested by Thomas Glanzmann and
+ Nick Wilson on issue #355
+ * In test_suite_pk, pass valid parameters when testing for hash length
+ overflow. #1179
+ * Fix memory allocation corner cases in memory_buffer_alloc.c module. Found
+ by Guido Vranken. #639
+ * Log correct number of ciphersuites used in Client Hello message. #918
+ * Fix X509 CRT parsing that would potentially accept an invalid tag when
+ parsing the subject alternative names.
+ * Fix a possible arithmetic overflow in ssl_parse_server_key_exchange()
+ that could cause a key exchange to fail on valid data.
+ * Fix a possible arithmetic overflow in ssl_parse_server_psk_hint() that
+ could cause a key exchange to fail on valid data.
+ * Don't define mbedtls_aes_decrypt and mbedtls_aes_encrypt under
+ MBEDTLS_DEPRECATED_REMOVED. #1388
+ * Fix a 1-byte heap buffer overflow (read-only) during private key parsing.
+ Found through fuzz testing.
+
+Changes
+ * Fix tag lengths and value ranges in the documentation of CCM encryption.
+ Contributed by Mathieu Briand.
+ * Fix typo in a comment ctr_drbg.c. Contributed by Paul Sokolovsky.
+ * Remove support for the library reference configuration for picocoin.
+ * MD functions deprecated in 2.7.0 are no longer inline, to provide
+ a migration path for those depending on the library's ABI.
+ * Clarify the documentation of mbedtls_ssl_setup.
+ * Use (void) when defining functions with no parameters. Contributed by
+ Joris Aerts. #678
+
+= mbed TLS 2.7.0 branch released 2018-02-03
+
+Security
+ * Fix a heap corruption issue in the implementation of the truncated HMAC
+ extension. When the truncated HMAC extension is enabled and CBC is used,
+ sending a malicious application packet could be used to selectively corrupt
+ 6 bytes on the peer's heap, which could potentially lead to crash or remote
+ code execution. The issue could be triggered remotely from either side in
+ both TLS and DTLS. CVE-2018-0488
+ * Fix a buffer overflow in RSA-PSS verification when the hash was too large
+ for the key size, which could potentially lead to crash or remote code
+ execution. Found by Seth Terashima, Qualcomm Product Security Initiative,
+ Qualcomm Technologies Inc. CVE-2018-0487
+ * Fix buffer overflow in RSA-PSS verification when the unmasked data is all
+ zeros.
+ * Fix an unsafe bounds check in ssl_parse_client_psk_identity() when adding
+ 64 KiB to the address of the SSL buffer and causing a wrap around.
+ * Fix a potential heap buffer overflow in mbedtls_ssl_write(). When the (by
+ default enabled) maximum fragment length extension is disabled in the
+ config and the application data buffer passed to mbedtls_ssl_write
+ is larger than the internal message buffer (16384 bytes by default), the
+ latter overflows. The exploitability of this issue depends on whether the
+ application layer can be forced into sending such large packets. The issue
+ was independently reported by Tim Nordell via e-mail and by Florin Petriuc
+ and sjorsdewit on GitHub. Fix proposed by Florin Petriuc in #1022.
+ Fixes #707.
+ * Add a provision to prevent compiler optimizations breaking the time
+ constancy of mbedtls_ssl_safer_memcmp().
+ * Ensure that buffers are cleared after use if they contain sensitive data.
+ Changes were introduced in multiple places in the library.
+ * Set PEM buffer to zero before freeing it, to avoid decoded private keys
+ being leaked to memory after release.
+ * Fix dhm_check_range() failing to detect trivial subgroups and potentially
+ leaking 1 bit of the private key. Reported by prashantkspatil.
+ * Make mbedtls_mpi_read_binary() constant-time with respect to the input
+ data. Previously, trailing zero bytes were detected and omitted for the
+ sake of saving memory, but potentially leading to slight timing
+ differences. Reported by Marco Macchetti, Kudelski Group.
+ * Wipe stack buffer temporarily holding EC private exponent
+ after keypair generation.
+ * Fix a potential heap buffer over-read in ALPN extension parsing
+ (server-side). Could result in application crash, but only if an ALPN
+ name larger than 16 bytes had been configured on the server.
+ * Change default choice of DHE parameters from untrustworthy RFC 5114
+ to RFC 3526 containing parameters generated in a nothing-up-my-sleeve
+ manner.
+
+Features
+ * Allow comments in test data files.
+ * The selftest program can execute a subset of the tests based on command
+ line arguments.
+ * New unit tests for timing. Improve the self-test to be more robust
+ when run on a heavily-loaded machine.
+ * Add alternative implementation support for CCM and CMAC (MBEDTLS_CCM_ALT,
+ MBEDTLS_CMAC_ALT). Submitted by Steven Cooreman, Silicon Labs.
+ * Add support for alternative implementations of GCM, selected by the
+ configuration flag MBEDTLS_GCM_ALT.
+ * Add support for alternative implementations for ECDSA, controlled by new
+ configuration flags MBEDTLS_ECDSA_SIGN_ALT, MBEDTLS_ECDSA_VERIFY_ALT and
+ MBEDTLS_ECDSDA_GENKEY_AT in config.h.
+ The following functions from the ECDSA module can be replaced
+ with alternative implementation:
+ mbedtls_ecdsa_sign(), mbedtls_ecdsa_verify() and mbedtls_ecdsa_genkey().
+ * Add support for alternative implementation of ECDH, controlled by the
+ new configuration flags MBEDTLS_ECDH_COMPUTE_SHARED_ALT and
+ MBEDTLS_ECDH_GEN_PUBLIC_ALT in config.h.
+ The following functions from the ECDH module can be replaced
+ with an alternative implementation:
+ mbedtls_ecdh_gen_public() and mbedtls_ecdh_compute_shared().
+ * Add support for alternative implementation of ECJPAKE, controlled by
+ the new configuration flag MBEDTLS_ECJPAKE_ALT.
+ * Add mechanism to provide alternative implementation of the DHM module.
+
+API Changes
+ * Extend RSA interface by multiple functions allowing structure-
+ independent setup and export of RSA contexts. Most notably,
+ mbedtls_rsa_import() and mbedtls_rsa_complete() are introduced for setting
+ up RSA contexts from partial key material and having them completed to the
+ needs of the implementation automatically. This allows to setup private RSA
+ contexts from keys consisting of N,D,E only, even if P,Q are needed for the
+ purpose or CRT and/or blinding.
+ * The configuration option MBEDTLS_RSA_ALT can be used to define alternative
+ implementations of the RSA interface declared in rsa.h.
+ * The following functions in the message digest modules (MD2, MD4, MD5,
+ SHA1, SHA256, SHA512) have been deprecated and replaced as shown below.
+ The new functions change the return type from void to int to allow
+ returning error codes when using MBEDTLS_<MODULE>_ALT.
+ mbedtls_<MODULE>_starts() -> mbedtls_<MODULE>_starts_ret()
+ mbedtls_<MODULE>_update() -> mbedtls_<MODULE>_update_ret()
+ mbedtls_<MODULE>_finish() -> mbedtls_<MODULE>_finish_ret()
+ mbedtls_<MODULE>_process() -> mbedtls_internal_<MODULE>_process()
+
+New deprecations
+ * Deprecate usage of RSA primitives with non-matching key-type
+ (e.g. signing with a public key).
+ * Direct manipulation of structure fields of RSA contexts is deprecated.
+ Users are advised to use the extended RSA API instead.
+ * Deprecate usage of message digest functions that return void
+ (mbedtls_<MODULE>_starts, mbedtls_<MODULE>_update,
+ mbedtls_<MODULE>_finish and mbedtls_<MODULE>_process where <MODULE> is
+ any of MD2, MD4, MD5, SHA1, SHA256, SHA512) in favor of functions
+ that can return an error code.
+ * Deprecate untrustworthy DHE parameters from RFC 5114. Superseded by
+ parameters from RFC 3526 or the newly added parameters from RFC 7919.
+ * Deprecate hex string DHE constants MBEDTLS_DHM_RFC3526_MODP_2048_P etc.
+ Supserseded by binary encoded constants MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN
+ etc.
+ * Deprecate mbedtls_ssl_conf_dh_param() for setting default DHE parameters
+ from hex strings. Superseded by mbedtls_ssl_conf_dh_param_bin()
+ accepting DHM parameters in binary form, matching the new constants.
+
+Bugfix
+ * Fix ssl_parse_record_header() to silently discard invalid DTLS records
+ as recommended in RFC 6347 Section 4.1.2.7.
+ * Fix memory leak in mbedtls_ssl_set_hostname() when called multiple times.
+ Found by projectgus and Jethro Beekman, #836.
+ * Fix usage help in ssl_server2 example. Found and fixed by Bei Lin.
* Parse signature algorithm extension when renegotiating. Previously,
renegotiated handshakes would only accept signatures using SHA-1
regardless of the peer's preferences, or fail if SHA-1 was disabled.
+ * Fix leap year calculation in x509_date_is_valid() to ensure that invalid
+ dates on leap years with 100 and 400 intervals are handled correctly. Found
+ by Nicholas Wilson. #694
+ * Fix some invalid RSA-PSS signatures with keys of size 8N+1 that were
+ accepted. Generating these signatures required the private key.
+ * Fix out-of-memory problem when parsing 4096-bit PKCS8-encrypted RSA keys.
+ Found independently by Florian in the mbed TLS forum and by Mishamax.
+ #878, #1019.
+ * Fix variable used before assignment compilation warnings with IAR
+ toolchain. Found by gkerrien38.
+ * Fix unchecked return codes from AES, DES and 3DES functions in
+ pem_aes_decrypt(), pem_des_decrypt() and pem_des3_decrypt() respectively.
+ If a call to one of the functions of the cryptographic primitive modules
+ failed, the error may not be noticed by the function
+ mbedtls_pem_read_buffer() causing it to return invalid values. Found by
+ Guido Vranken. #756
+ * Include configuration file in md.h, to fix compilation warnings.
+ Reported by aaronmdjones in #1001
+ * Correct extraction of signature-type from PK instance in X.509 CRT and CSR
+ writing routines that prevented these functions to work with alternative
+ RSA implementations. Raised by J.B. in the Mbed TLS forum. Fixes #1011.
+ * Don't print X.509 version tag for v1 CRT's, and omit extensions for
+ non-v3 CRT's.
+ * Fix bugs in RSA test suite under MBEDTLS_NO_PLATFORM_ENTROPY. #1023 #1024
+ * Fix net_would_block() to avoid modification by errno through fcntl() call.
+ Found by nkolban. Fixes #845.
+ * Fix handling of handshake messages in mbedtls_ssl_read() in case
+ MBEDTLS_SSL_RENEGOTIATION is disabled. Found by erja-gp.
+ * Add a check for invalid private parameters in mbedtls_ecdsa_sign().
+ Reported by Yolan Romailler.
+ * Fix word size check in in pk.c to not depend on MBEDTLS_HAVE_INT64.
+ * Fix incorrect unit in benchmark output. #850
+ * Add size-checks for record and handshake message content, securing
+ fragile yet non-exploitable code-paths.
+ * Fix crash when calling mbedtls_ssl_cache_free() twice. Found by
+ MilenkoMitrovic, #1104
+ * Fix mbedtls_timing_alarm(0) on Unix and MinGW.
+ * Fix use of uninitialized memory in mbedtls_timing_get_timer() when reset=1.
+ * Fix possible memory leaks in mbedtls_gcm_self_test().
+ * Added missing return code checks in mbedtls_aes_self_test().
+ * Fix issues in RSA key generation program programs/x509/rsa_genkey and the
+ RSA test suite where the failure of CTR DRBG initialization lead to
+ freeing an RSA context and several MPI's without proper initialization
+ beforehand.
+ * Fix error message in programs/pkey/gen_key.c. Found and fixed by Chris Xue.
+ * Fix programs/pkey/dh_server.c so that it actually works with dh_client.c.
+ Found and fixed by Martijn de Milliano.
+ * Fix an issue in the cipher decryption with the mode
+ MBEDTLS_PADDING_ONE_AND_ZEROS that sometimes accepted invalid padding.
+ Note, this padding mode is not used by the TLS protocol. Found and fixed by
+ Micha Kraus.
+ * Fix the entropy.c module to not call mbedtls_sha256_starts() or
+ mbedtls_sha512_starts() in the mbedtls_entropy_init() function.
+ * Fix the entropy.c module to ensure that mbedtls_sha256_init() or
+ mbedtls_sha512_init() is called before operating on the relevant context
+ structure. Do not assume that zeroizing a context is a correct way to
+ reset it. Found independently by ccli8 on Github.
+ * In mbedtls_entropy_free(), properly free the message digest context.
+ * Fix status handshake status message in programs/ssl/dtls_client.c. Found
+ and fixed by muddog.
+
+Changes
+ * Extend cert_write example program by options to set the certificate version
+ and the message digest. Further, allow enabling/disabling of authority
+ identifier, subject identifier and basic constraints extensions.
+ * Only check for necessary RSA structure fields in `mbedtls_rsa_private`. In
+ particular, don't require P,Q if neither CRT nor blinding are
+ used. Reported and fix proposed independently by satur9nine and sliai
+ on GitHub.
+ * Only run AES-192 self-test if AES-192 is available. Fixes #963.
+ * Tighten the RSA PKCS#1 v1.5 signature verification code and remove the
+ undeclared dependency of the RSA module on the ASN.1 module.
+ * Update all internal usage of deprecated message digest functions to the
+ new ones with return codes. In particular, this modifies the
+ mbedtls_md_info_t structure. Propagate errors from these functions
+ everywhere except some locations in the ssl_tls.c module.
+ * Improve CTR_DRBG error handling by propagating underlying AES errors.
+ * Add MBEDTLS_ERR_XXX_HW_ACCEL_FAILED error codes for all cryptography
+ modules where the software implementation can be replaced by a hardware
+ implementation.
+ * Add explicit warnings for the use of MD2, MD4, MD5, SHA-1, DES and ARC4
+ throughout the library.
= mbed TLS 2.6.0 branch released 2017-08-10
@@ -113,8 +958,7 @@
Previous behaviour was to keep processing data even after the alert has
been sent.
* Accept empty trusted CA chain in authentication mode
- MBEDTLS_SSL_VERIFY_OPTIONAL.
- Found by jethrogb. #864
+ MBEDTLS_SSL_VERIFY_OPTIONAL. Found by Jethro Beekman. #864
* Fix implementation of mbedtls_ssl_parse_certificate() to not annihilate
fatal errors in authentication mode MBEDTLS_SSL_VERIFY_OPTIONAL and to
reflect bad EC curves within verification result.
@@ -1316,7 +2160,7 @@
issuer_key_identifier, etc)
* Optional blinding for RSA, DHM and EC
* Support for multiple active certificate / key pairs in SSL servers for
- the same host (Not to be confused with SNI!)
+ the same host (Not to be confused with SNI!)
Changes
* Ability to enable / disable SSL v3 / TLS 1.0 / TLS 1.1 / TLS 1.2
@@ -1547,7 +2391,7 @@
PKCS#8 private key formats
* Added mechanism to provide alternative implementations for all
symmetric cipher and hash algorithms (e.g. POLARSSL_AES_ALT in
- config.h)
+ config.h)
* PKCS#5 module added. Moved PBKDF2 functionality inside and deprecated
old PBKDF2 module
@@ -1559,7 +2403,7 @@
* x509parse_crt() now better handles PEM error situations
* ssl_parse_certificate() now calls x509parse_crt_der() directly
instead of the x509parse_crt() wrapper that can also parse PEM
- certificates
+ certificates
* x509parse_crtpath() is now reentrant and uses more portable stat()
* Fixed bignum.c and bn_mul.h to support Thumb2 and LLVM compiler
* Fixed values for 2-key Triple DES in cipher layer
@@ -1717,7 +2561,7 @@
* mpi_exp_mod() now correctly handles negative base numbers (Closes ticket
#52)
* Handle encryption with private key and decryption with public key as per
- RFC 2313
+ RFC 2313
* Handle empty certificate subject names
* Prevent reading over buffer boundaries on X509 certificate parsing
* mpi_add_abs() now correctly handles adding short numbers to long numbers
@@ -1748,7 +2592,7 @@
* x509parse_crt() now better handles PEM error situations
* ssl_parse_certificate() now calls x509parse_crt_der() directly
instead of the x509parse_crt() wrapper that can also parse PEM
- certificates
+ certificates
* Fixed values for 2-key Triple DES in cipher layer
* ssl_write_certificate_request() can handle empty ca_chain
@@ -1829,16 +2673,16 @@
Features
* Added ssl_session_reset() to allow better multi-connection pools of
SSL contexts without needing to set all non-connection-specific
- data and pointers again. Adapted ssl_server to use this functionality.
+ data and pointers again. Adapted ssl_server to use this functionality.
* Added ssl_set_max_version() to allow clients to offer a lower maximum
supported version to a server to help buggy server implementations.
- (Closes ticket #36)
+ (Closes ticket #36)
* Added cipher_get_cipher_mode() and cipher_get_cipher_operation()
introspection functions (Closes ticket #40)
* Added CTR_DRBG based on AES-256-CTR (NIST SP 800-90) random generator
* Added a generic entropy accumulator that provides support for adding
custom entropy sources and added some generic and platform dependent
- entropy sources
+ entropy sources
Changes
* Documentation for AES and Camellia in modes CTR and CFB128 clarified.
@@ -1971,7 +2815,7 @@
* Corrected parsing of UTCTime dates before 1990 and
after 1950
* Support more exotic OID's when parsing certificates
- (found by Mads Kiilerich)
+ (found by Mads Kiilerich)
* Support more exotic name representations when parsing
certificates (found by Mads Kiilerich)
* Replaced the expired test certificates
@@ -2001,7 +2845,7 @@
status, objects and configuration
+ Added verification callback on certificate chain
verification to allow external blacklisting
- + Additional example programs to show usage
+ + Additional example programs to show usage
* Added support for PKCS#11 through the use of the
libpkcs11-helper library