### Changes between 3.1 and 3.2 [xx XXX xxxx]
+ * Added client side support for QUIC
+
+ *Hugo Landau*
+
+ * Added SHA256/192 algorithm support.
+
+ *Fergus Dall*
+
+ * Provide a new configure option `no-http` that can be used to disable HTTP
+ support.
+
+ *Vladimír Kotal*
+
+ * TLS round-trip time calculation was added by a Brigham Young University
+ Capstone team partnering with Sandia National Laboratories. A new function
+ in ssl_lib titled SSL_get_handshake_rtt will calculate and retrieve this
+ value.
+
+ *Jairus Christensen*
+
+ * Added the "-quic" option to s_client to enable connectivity to QUIC servers.
+ QUIC requires the use of ALPN, so this must be specified via the "-alpn"
+ option. Use of the "advanced" s_client command command via the "-adv" option
+ is recommended.
+
+ *Matt Caswell*
+
+ * Reworked the Fix for the Timing Oracle in RSA Decryption ([CVE-2022-4304]).
+ The previous fix for this timing side channel turned out to cause
+ a severe 2-3x performance regression in the typical use case
+ compared to 3.0.7. The new fix uses existing constant time
+ code paths, and restores the previous performance level while
+ fully eliminating all existing timing side channels.
+ The fix was developed by Bernd Edlinger with testing support
+ by Hubert Kario.
+
+ *Bernd Edlinger*
+
+ * Added an "advanced" command mode to s_client. Use this with the "-adv"
+ option. The old "basic" command mode recognises certain letters that must
+ always appear at the start of a line and cannot be escaped. The advanced
+ command mode enables commands to be entered anywhere and there is an
+ escaping mechanism. After starting s_client with "-adv" type "{help}"
+ to show a list of available commands.
+
+ *Matt Caswell*
+
+ * Add Raw Public Key (RFC7250) support. Authentication is supported
+ by matching keys against either local policy (TLSA records synthesised
+ from the expected keys) or DANE (TLSA records obtained by the
+ application from DNS). TLSA records will also match the same key in
+ the server certificate, should RPK use not happen to be negotiated.
+
+ *Todd Short*
+
* Added EC_GROUP_to_params which creates an OSSL_PARAM array
from a given EC_GROUP.
*Hugo Landau*
- * The `SSL_CERT_PATH` and `SSL_CERT_URI` environment variables are introduced.
- `SSL_CERT_URI` can be used to specify a URI for a root certificate store. The
- `SSL_CERT_PATH` environment variable specifies a delimiter-separated list of
- paths which are searched for root certificates.
-
- The existing `SSL_CERT_DIR` environment variable is deprecated.
- `SSL_CERT_DIR` was previously used to specify either a delimiter-separated
- list of paths or an URI, which is ambiguous. Setting `SSL_CERT_PATH` causes
- `SSL_CERT_DIR` to be ignored for the purposes of determining root certificate
- directories, and setting `SSL_CERT_URI` causes `SSL_CERT_DIR` to be ignored
- for the purposes of determining root certificate stores.
-
- *Hugo Landau*
-
* Support for loading root certificates from the Windows certificate store
has been added. The support is in the form of a store which recognises the
- URI string of `org.openssl.winstore://`. This store is enabled by default and
- can be disabled using the new compile-time option `no-winstore`.
+ URI string of `org.openssl.winstore://`. This URI scheme currently takes no
+ arguments. This store is built by default and can be disabled using the new
+ compile-time option `no-winstore`. This store is not currently used by
+ default and must be loaded explicitly using the above store URI. It is
+ expected to be loaded by default in the future.
*Hugo Landau*
*Hubert Kario*
+ * Support for Argon2d, Argon2i, Argon2id KDFs has been added along with
+ basic thread pool implementation for select platforms.
+
+ *Čestmír Kalina*
+
OpenSSL 3.1
-----------
-### Changes between 3.0 and 3.1.0 [xx XXX xxxx]
+### Changes between 3.1.0 and 3.1.1 [xx XXX xxxx]
+
+ * Mitigate for the time it takes for `OBJ_obj2txt` to translate gigantic
+ OBJECT IDENTIFIER sub-identifiers to canonical numeric text form.
+
+ OBJ_obj2txt() would translate any size OBJECT IDENTIFIER to canonical
+ numeric text form. For gigantic sub-identifiers, this would take a very
+ long time, the time complexity being O(n^2) where n is the size of that
+ sub-identifier. ([CVE-2023-2650])
+
+ To mitigitate this, `OBJ_obj2txt()` will only translate an OBJECT
+ IDENTIFIER to canonical numeric text form if the size of that OBJECT
+ IDENTIFIER is 586 bytes or less, and fail otherwise.
+
+ The basis for this restriction is [RFC 2578 (STD 58), section 3.5]. OBJECT
+ IDENTIFIER values, which stipulates that OBJECT IDENTIFIERS may have at
+ most 128 sub-identifiers, and that the maximum value that each sub-
+ identifier may have is 2^32-1 (4294967295 decimal).
+
+ For each byte of every sub-identifier, only the 7 lower bits are part of
+ the value, so the maximum amount of bytes that an OBJECT IDENTIFIER with
+ these restrictions may occupy is 32 * 128 / 7, which is approximately 586
+ bytes.
+
+ *Richard Levitte*
+
+ * Multiple algorithm implementation fixes for ARM BE platforms.
+
+ *Liu-ErMeng*
+
+ * Added a -pedantic option to fipsinstall that adjusts the various
+ settings to ensure strict FIPS compliance rather than backwards
+ compatibility.
+
+ *Paul Dale*
+
+ * Fixed buffer overread in AES-XTS decryption on ARM 64 bit platforms which
+ happens if the buffer size is 4 mod 5 in 16 byte AES blocks. This can
+ trigger a crash of an application using AES-XTS decryption if the memory
+ just after the buffer being decrypted is not mapped.
+ Thanks to Anton Romanov (Amazon) for discovering the issue.
+ ([CVE-2023-1255])
+
+ *Nevine Ebeid*
+
+ * Add FIPS provider configuration option to disallow the use of
+ truncated digests with Hash and HMAC DRBGs (q.v. FIPS 140-3 IG D.R.).
+ The option '-no_drbg_truncated_digests' can optionally be
+ supplied to 'openssl fipsinstall'.
+
+ *Paul Dale*
+
+ * Corrected documentation of X509_VERIFY_PARAM_add0_policy() to mention
+ that it does not enable policy checking. Thanks to David Benjamin for
+ discovering this issue.
+ ([CVE-2023-0466])
+
+ *Tomáš Mráz*
+
+ * Fixed an issue where invalid certificate policies in leaf certificates are
+ silently ignored by OpenSSL and other certificate policy checks are skipped
+ for that certificate. A malicious CA could use this to deliberately assert
+ invalid certificate policies in order to circumvent policy checking on the
+ certificate altogether.
+ ([CVE-2023-0465])
+
+ *Matt Caswell*
+
+ * Limited the number of nodes created in a policy tree to mitigate
+ against CVE-2023-0464. The default limit is set to 1000 nodes, which
+ should be sufficient for most installations. If required, the limit
+ can be adjusted by setting the OPENSSL_POLICY_TREE_NODES_MAX build
+ time define to a desired maximum number of nodes or zero to allow
+ unlimited growth.
+ ([CVE-2023-0464])
+
+ *Paul Dale*
+
+### Changes between 3.0 and 3.1.0 [14 Mar 2023]
+
+ * Add FIPS provider configuration option to enforce the
+ Extended Master Secret (EMS) check during the TLS1_PRF KDF.
+ The option '-ems-check' can optionally be supplied to
+ 'openssl fipsinstall'.
+
+ *Shane Lontis*
* The FIPS provider includes a few non-approved algorithms for
backward compatibility purposes and the "fips=yes" property query
* Alternate chains certificate forgery
- During certificate verfification, OpenSSL will attempt to find an
+ During certificate verification, OpenSSL will attempt to find an
alternative certificate chain if the first attempt to build such a chain
fails. An error in the implementation of this logic can mean that an
attacker could cause certain checks on untrusted certificates to be
3. Check DSA/ECDSA signatures use DER.
- Reencode DSA/ECDSA signatures and compare with the original received
+ Re-encode DSA/ECDSA signatures and compare with the original received
signature. Return an error if there is a mismatch.
This will reject various cases including garbage after signature
* Add additional DigestInfo checks.
- Reencode DigestInto in DER and check against the original when
+ Re-encode DigestInto in DER and check against the original when
verifying RSA signature: this will reject any improperly encoded
DigestInfo structures.
<!-- Links -->
+[RFC 2578 (STD 58), section 3.5]: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
+[CVE-2023-2650]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-2650
+[CVE-2023-1255]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-1255
+[CVE-2023-0466]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0466
+[CVE-2023-0465]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0465
+[CVE-2023-0464]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0464
[CVE-2023-0401]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0401
[CVE-2023-0286]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0286
[CVE-2023-0217]: https://www.openssl.org/news/vulnerabilities.html#CVE-2023-0217
projects / thirdparty / openssl.git / blobdiff