1 GNU TLS NEWS -- History of user-visible changes. -*- outline -*-
2 Copyright (C) 2004, 2005, 2006, 2007, 2008 Simon Josefsson
3 Copyright (C) 2000, 2001, 2002, 2003, 2004 Nikos Mavrogiannopoulos
4 See the end for copying conditions.
6 * Version 2.3.13 (unreleased)
8 ** libgnutls [OpenPGP]: Make OpenPGP handshakes work again.
10 ** API and ABI modifications:
11 No changes since last version.
13 * Version 2.3.12 (released 2008-06-04)
15 ** Merge gnutls_with_netconf branch.
17 *** libgnutls [PSK]: New API to retrieve PSK identity hint in client.
18 The function is gnutls_psk_client_get_hint.
20 *** libgnutls [PSK]: New API to set PSK identity hint in server.
21 The function is gnutls_psk_set_server_credentials_hint.
23 *** libgnutls [PSK]: Support server key exchange with PSK identity hint.
24 In the client, the message is parsed and the application can use
25 gnutls_psk_client_get_hint to retrieve the hint. In the server, the
26 message is sent if the application has specified a PSK identity hint
27 using gnutls_psk_set_server_credentials_hint.
29 *** libgnutls [PSK]: Support Netconf PSK key derivation.
30 The function gnutls_psk_netconf_derive_key supports the PSK key
31 derivation as specified in draft-ietf-netconf-tls-02.txt. New self
34 *** psktool: Support new --netconf-hint to generate PSK key from password.
35 Uses the Netconf algorithm to derive PSK key from password.
37 *** gnutls-serv: Support new --pskhint parameter to set PSK identity hint.
39 *** gnutls-cli: Always support PSK modes, through a callback.
40 The callback will derive a PSK key using Netconf algorithm. It will
41 print the PSK identity hint to help the user.
43 *** New PSK example client and server.
44 See doc/examples/ex-client-psk.c and doc/examples/ex-serv-psk.c.
46 ** libgnutls: Fix gnutls_x509_crl_set_version on arm platforms.
47 The code didn't work properly on platforms where 'char' is unsigned,
48 when you set version 0. Reported by Laurence Withers
50 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2825>.
52 ** libgnutls-openssl: added RAND_pseudo_bytes API.
53 Patch from Robert Millan <rmh@aybabtu.com>.
55 ** API and ABI modifications:
56 RAND_pseudo_bytes: ADDED to libgnutls-openssl.
57 gnutls_psk_client_get_hint: ADDED.
58 gnutls_psk_set_server_credentials_hint: ADDED.
59 gnutls_psk_netconf_derive_key: ADDED
61 * Version 2.3.11 (released 2008-05-20)
63 ** Fix flaw in fix for GNUTLS-SA-2008-1-3.
64 The flaw would result in incorrectly terminated sessions with the
65 error "Decryption has failed" when the server sends a small packet
66 (typically when the session is closed). Reported by Andreas Metzler
67 <ametzler@downhill.at.eu.org> in
68 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2807>.
70 ** Don't use gnulib headers when building C++ library.
71 Fixes builds under Windows.
73 ** Make umask a requirement.
74 We don't know of any system that lacks it, even GNU CoreUtils use it
77 ** Update gnulib files.
78 Fixes a problem where it pulled in a replacement for memcmp under
79 MinGW, which caused the C++ example to fail to build.
81 ** API and ABI modifications:
82 No changes since last version.
84 * Version 2.3.10 (released 2008-05-19)
86 ** Added wide wildcard hostname matching.
87 Tiny patch by Jean-Philippe Garcia Ballester.
89 ** Fix three security vulnerabilities. [GNUTLS-SA-2008-1]
90 Thanks to CERT-FI for finding the bugs and providing detailed reports,
91 which allowed the bugs to be reproduced and fixed easily. Patches
92 developed by Simon Josefsson and Nikos Mavrogiannopoulos. Any updates
93 with more details about these vulnerabilities will be added to
94 <http://www.gnu.org/software/gnutls/security.html>
96 *** [GNUTLS-SA-2008-1-1]
97 *** libgnutls: Fix crash when sending invalid server name.
98 The crash can be triggered remotely before authentication, which can
99 lead to a Daniel of Service attack to disable the server. The bug
100 cause gnutls to store more session resumption data than what was
101 allocated for, thus overwriting unallocated memory.
103 *** [GNUTLS-SA-2008-1-2]
104 *** libgnutls: Fix crash when sending repeated client hellos.
105 The crash can be triggered remotely before authentication, which can
106 lead to a Daniel of Service attack to disable the server. The bug
107 triggers a null-pointer dereference.
109 *** [GNUTLS-SA-2008-1-3]
110 *** libgnutls: Fix crash in cipher padding decoding for invalid record lengths.
111 The crash can be triggered remotely before authentication, which can
112 lead to a Daniel of Service attack to disable the server. The bug
113 cause gnutls to read memory beyond the end of the received record.
115 ** libgnutlsxx: Updated API according to patches from Eduardo
116 Villanueva Che (discussion at
117 <http://lists.gnu.org/archive/html/gnutls-devel/2007-02/msg00017.html>)
119 ** Use umask to restrict permissions to owner before creating a file.
121 ** API and ABI modifications:
122 No changes since last version.
124 * Version 2.3.9 (released 2008-05-16)
126 ** libgnutls: Fix build failures if SRP/OpenPGP is disabled.
127 Based on report and tiny patches from
128 <jared.jennings.ctr@eglin.af.mil>, see
129 <https://savannah.gnu.org/support/index.php?106342>.
131 ** libgnutls: Translation fixes.
133 ** gnutls-cli: Fix so that PSK authentication works.
134 Also improve manual to give example for gnutls-cli PSK authentication.
136 ** certtool: Encrypting a private key now require a confirmed password.
137 Before './certtool -k -8' would merely ask for a password once.
138 Reported by Daniel 'NebuchadnezzaR' Dehennin
139 <nebuchadnezzar@asgardr.info> see
140 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=364287>.
142 ** certtool: When writing private keys to files, change permissions of file.
143 Now the file which the private key is saved to is chmod'ed 0600.
144 Reported by martin f krafft <madduck@debian.org> see
145 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=373169>.
147 ** guile: Fix -fgnu89-inline test.
149 ** Removed --enable-profile-mode.
150 The code linked gnutls with the libfc project (Function Check) which
151 appears to have been stalled since around 2002.
153 ** Clean up header file checks by ./configure.
155 ** Update of gnulib files.
157 ** API and ABI modifications:
158 No changes since last version.
160 * Version 2.3.8 (released 2008-04-29)
162 ** libgnutls: Increase default handshake packet size limit to 48kb.
163 The old limit was 16kb and some servers send huge list of trusted CAs,
164 thus running into the limit. FYI, applications can further increase
165 this limit using gnutls_handshake_set_max_packet_length. Thanks to
166 Marc Haber <mh+debian-bugs@zugschlus.de> and "Marc F. Clemente"
167 <marc@mclemente.net> for reporting and providing test servers.
169 ** libgnutls: Add new error code: GNUTLS_E_HANDSHAKE_TOO_LARGE
170 Returned when the handshake data size is too large. Before
171 GNUTLS_E_MEMORY_ERROR was used, which could be confused with other
174 ** libgnutls: Hide definitions in crypto.h.
175 We have decided that the APIs defined in crypto.h are not stable
176 enough for v2.4, so don't use any of those functions.
178 ** gnutls-cli: exit when hostname doesn't match certificate.
179 Use --insecure to avoid hostname comparison.
181 ** certtool: --inder and --outder replaced by --inraw and --outraw.
182 The reason is to align terminology with OpenPGP, which doesn't use
183 DER. The old parameters will continue to work for some time.
185 ** doc: Add section 'Index of new symbols in 2.4.0' to the GTK-DOC manual.
187 ** doc: Many cosmetic fixes, to silence (most) gtk-doc warnings.
189 ** Mingw32: Revert libgcrypt vasprintf work-around added in last release.
190 Use libgcrypt 1.4.1 or later when building on MinGW32, it removes the
191 vasprintf symbol from the libgcrypt library which caused problems.
193 ** Update of gnulib files.
195 ** tests: New self-test of crypto.h RNG code tests/crypto_rng.
197 ** API and ABI modifications:
198 GNUTLS_E_HANDSHAKE_TOO_LARGE: ADDED.
200 * Version 2.3.7 (released 2008-04-21)
202 ** opencdk now properly sets the key usage bits into openpgp keys.
204 ** gnutls-cli: Fix crash on TLS handshake failures.
205 Reported by "Marc F. Clemente" <marc@mclemente.net> in Debian BTS #466477.
206 This is similar to <http://bugs.debian.org/429183>.
208 ** certtool: with --generate-request and newly generated keys, print the key.
210 ** Build fixes for MinGW.
211 Missing rpl_fseeko symbol in lib/opencdk/. Better checks for linking
212 with -lws2_32 when needed. Use ASCII only isprint() when printing
213 X.509 certificate information, to avoid non-ASCII but printable
214 characters. Thanks to Massimo Gaspari <massimo.gaspari@alice.it> for
217 ** Update internal copy of libtasn1 to version 1.4.
219 ** API and ABI modifications:
220 No changes since last version.
222 * Version 2.3.6 (released 2008-04-17)
224 ** Make gnutls_x509_crq_sign2 set certificate request version if not set.
225 ** Improve documentation for gnutls_x509_crq_sign2.
226 Based on report from "John Brooks" <aspecialj@gmail.com> in
227 <http://permalink.gmane.org/gmane.network.gnutls.general/1154>.
229 ** tests/pathlen: run diff without parameters to improve portability.
230 Based on HPUX build hints in
231 <http://hpux.cs.utah.edu/hppd/cgi-bin/wwwtar?/hpux/Gnu/gnutls-2.3.4/gnutls-2.3.4-src-11.11.tar.gz+gnutls-2.3.4/HPUX.Install+text>.
233 ** Don't use %e specifier with strftime, it doesn't work under Windows.
234 Reported by Massimo Gaspari <massimo.gaspari@alice.it> in
235 <http://permalink.gmane.org/gmane.network.gnutls.general/1170>.
237 ** Remove all uses of gnutls_alloca/gnutls_afree.
238 Use normal gnutls_malloc instead. One reason is increased portability
239 to Windows, the other is that several of the uses may be unsafe
240 because the size of data allocated could be large. Reported by
241 Massimo Gaspari <massimo.gaspari@alice.it> in
242 <http://permalink.gmane.org/gmane.network.gnutls.general/1170>.
244 ** Build Guile code with -fgnu89-inline only when supported.
245 Reported by Kris Karas <ktk@enterprise.bidmc.harvard.edu> in
246 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2708>.
248 ** Several GTK-DOC related fixes.
250 ** Clean up OpenCDK related code.
251 GnuTLS now requires its internal OpenCDK code rather than the external
252 GPL library OpenCDK. Unfortunately, we don't have resources to
253 maintain an external library (help welcome).
255 ** API and ABI modifications:
256 No changes since last version.
258 * Version 2.3.5 (released 2008-04-14)
260 ** Build fix for MinGW and --disable-shared.
261 Reported by Massimo Gaspari <massimo.gaspari@alice.it> in
262 <http://permalink.gmane.org/gmane.network.gnutls.general/1145>.
264 ** Document how to generate CRLs.
265 Suggested by "Rainer Gerhards" <rgerhards@gmail.com>.
267 ** Documented the --priority option to gnutls-cli and gnutls-serv.
269 ** Several minor fixes in the OpenPGP interface.
270 Thanks to Daniel Kahn Gillmor.
272 ** Fix fopen file descriptor leak in PSK server code.
273 Thanks to Laurence Withers <l@lwithers.me.uk>, see
274 <http://lists.gnu.org/archive/html/gnutls-devel/2008-04/msg00002.html>.
276 ** Translations files not stored directly in git to avoid merge conflicts.
278 ** New APIs to let applications replace the RNG used.
279 Update all RNG callers in the code to use the new interface.
281 ** Guile code now built with -fgnu89-inline to fix inline semantic problem.
283 ** Update gnulib files.
285 ** API and ABI modifications:
286 gnutls_crypto_rnd_register: ADDED
287 gnutls_rnd_level_t: ADDED
288 GNUTLS_RND_KEY: ADDED, gnutls_rnd_level_t member
289 GNUTLS_RND_RANDOM: ADDED, gnutls_rnd_level_t member
290 GNUTLS_RND_NONCE: ADDED, gnutls_rnd_level_t member
291 gnutls_crypto_rnd_st: ADDED
292 GNUTLS_DIG_SHA224: ADDED
293 GNUTLS_SIGN_RSA_SHA224: ADDED
294 gnutls_openpgp_crt_get_auth_subkey: MODIFIED
296 * Version 2.3.4 (released 2008-03-19)
298 ** Finish renaming of gnutls_certificate_export_x509_cas etc.
299 They weren't renamed in the public header file.
301 ** Added functions to register a cipher/mac/digest. This allows to
302 override the included ones.
304 ** Fix a bunch of compiler warnings.
306 ** API and ABI modifications:
307 gnutls_crypto_cipher_st: ADDED
308 gnutls_crypto_mac_st: ADDED
309 gnutls_crypto_digest_st: ADDED
310 gnutls_crypto_cipher_register: ADDED
311 gnutls_crypto_mac_register: ADDED
312 gnutls_crypto_digest_register: ADDED
313 GNUTLS_E_CRYPTO_ALREADY_REGISTERED: ADDED
315 * Version 2.3.3 (released 2008-03-10)
317 ** Fix build failure in libextra/gnutls_extra.c that needed opencdk.h.
318 Reported by Roman Bogorodskiy <novel@FreeBSD.org>.
320 ** No longer compiled using -D_REENTRANT -D_THREAD_SAFE.
321 We could not find any modern justification for enabling these flags by
322 default. If you know of some platform that needs one of the flags to
323 work properly, please let us know. (Actually introduced in v2.3.0 but
324 not documented until now.)
326 ** Importing many CA certificates are now considerably faster.
327 This affect gnutls_certificate_set_x509_trust_mem,
328 gnutls_certificate_set_x509_trust, and
329 gnutls_certificate_set_x509_trust_file. The complexity was reduced
330 from O(2*n^2) to O(n). When adding 206 files containing 408
331 certificates, using gnutls_certificate_set_x509_trust_file, the time
332 dropped from 40 seconds to 0.3 seconds. Thanks to Edgar Fuß for code
333 to trigger the problem. See also
334 <http://blog.josefsson.org/2008/02/27/real-world-performance-tuning-with-callgrind/>.
336 ** Clarify documentation for gnutls_x509_crt_set_subject_alternative_name
337 ** to be explicit that it takes zero terminated data.
339 ** gnutls-cli --print-cert now print PKCS#3 format Diffie-Hellman parameters.
341 ** Documentation fixes for the GTK-DOC manual.
343 ** Fix compilation error related to __FUNCTION__ on some systems.
344 Reported by Tim Mooney, see
345 <https://savannah.gnu.org/support/?106267>.
347 ** Updated translations.
349 ** Update gnulib files.
351 ** API and ABI modifications:
352 gnutls_hex2bin: MODIFIED, uses size_t instead of int for string length,
353 and char* instead of void* for output buffer.
355 * Version 2.3.2 (released 2008-02-26)
357 ** Fix srcdir!=objdir failure in openpgpself test.
359 ** Improved API documentation output from GTK-DOC.
361 ** Added gnutls_x509_dn_export(). Patch by Joe Orton.
363 ** Renamed gnutls_certificate_export_x509_cas and friends.
364 See <http://lists.gnu.org/archive/html/gnutls-devel/2008-02/msg00043.html>.
366 ** Internal header files cleanup.
368 ** API and ABI modifications:
369 gnutls_certificate_export_x509_cas: RENAMED to gnutls_certificate_get_x509_cas
370 gnutls_certificate_export_x509_crls: RENAMED to gnutls_certificate_get_x509_crls
371 gnutls_certificate_export_openpgp_keyring: RENAMED to gnutls_certificate_get_openpgp_keyring
372 gnutls_x509_dn_export: ADDED
374 * Version 2.3.1 (released 2008-02-21)
376 ** OpenPGP support merged into libgnutls and is now licensed under LGPL.
377 The included copy of OpenCDK has been stripped down and re-licensed
380 ** Cipher priority string handling now handle strings that starts with NULL.
381 Thanks to Laurence Withers <l@lwithers.me.uk>.
383 ** gnutls-cli: When -d is used, also prints RNG information from libgcrypt.
385 ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported
388 ** Increased the default certificate verification chain limits and allowed
389 for checks without limitation.
391 ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name()
392 and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary
393 strings and return the proper size.
395 ** Add section 'On Record Padding' to the manual.
396 This collects all problems related to record padding with
397 Nokia/Sony-Ericsson phones that we know about.
399 ** Several improvements in the OpenPGP authentication.
400 Now subkeys can be used for authentication, according to
401 draft-mavrogiannopoulos-rfc5081bis-00.txt.
403 ** certtool can print information on OpenPGP certificates and keys.
405 ** Added gnutls_x509_dn_import/init/deinit() to access raw DER DN.
408 ** Added gnutls_certificate_export_x509_cas and other functions to
409 export elements from the certificate credentials structure. Based on
410 suggestion from Joe Orton.
413 Clarify that srp_base64 is not the same as normal base64.
415 ** Fix non-portable use of brace expansion in makefiles.
417 ** API and ABI modifications:
418 gnutls_certificate_export_x509_cas: ADDED
419 gnutls_certificate_export_x509_crls: ADDED
420 gnutls_certificate_export_openpgp_keyring: ADDED
421 gnutls_openpgp_keyid_t: ADDED, instead of hard-coded 'unsigned char[8]'.
422 gnutls_openpgp_crt_get_key_id: ADDED, obsoletes gnutls_openpgp_crt_get_id.
423 gnutls_openpgp_crt_get_revoked_status: ADDED
424 gnutls_openpgp_crt_get_subkey_count: ADDED
425 gnutls_openpgp_crt_get_subkey_idx: ADDED
426 gnutls_openpgp_crt_get_subkey_revoked_status: ADDED
427 gnutls_openpgp_crt_get_subkey_pk_algorithm: ADDED
428 gnutls_openpgp_crt_get_subkey_creation_time: ADDED
429 gnutls_openpgp_crt_get_subkey_expiration_time: ADDED
430 gnutls_openpgp_crt_get_subkey_id: ADDED
431 gnutls_openpgp_crt_get_subkey_usage: ADDED
432 gnutls_openpgp_privkey_get_fingerprint: ADDED
433 gnutls_openpgp_privkey_get_key_id: ADDED
434 gnutls_openpgp_privkey_get_subkey_count: ADDED
435 gnutls_openpgp_privkey_get_subkey_idx: ADDED
436 gnutls_openpgp_privkey_get_subkey_revoked_status: ADDED
437 gnutls_openpgp_privkey_get_revoked_status: ADDED
438 gnutls_openpgp_privkey_get_subkey_pk_algorithm: ADDED
439 gnutls_openpgp_privkey_get_subkey_expiration_time: ADDED
440 gnutls_openpgp_privkey_get_subkey_id: ADDED
441 gnutls_openpgp_privkey_get_subkey_creation_time: ADDED
442 gnutls_openpgp_crt_get_subkey_pk_dsa_raw: ADDED
443 gnutls_openpgp_crt_get_subkey_pk_rsa_raw: ADDED
444 gnutls_openpgp_crt_get_pk_dsa_raw: ADDED
445 gnutls_openpgp_crt_get_pk_rsa_raw: ADDED
446 gnutls_openpgp_privkey_export_subkey_dsa_raw: ADDED
447 gnutls_openpgp_privkey_export_subkey_rsa_raw: ADDED
448 gnutls_openpgp_privkey_export_dsa_raw: ADDED
449 gnutls_openpgp_privkey_export_rsa_raw: ADDED
450 gnutls_openpgp_privkey_export: ADDED
451 gnutls_certificate_set_openpgp_key_file2: ADDED
452 gnutls_certificate_set_openpgp_key_mem2: ADDED
453 gnutls_x509_dn_init: ADDED
454 gnutls_x509_dn_import: ADDED
455 gnutls_x509_dn_deinit: ADDED
456 GNUTLS_E_OPENPGP_SUBKEY_ERROR: ADDED
457 gnutls_hex2bin: ADDED
458 GNUTLS_CRT_PRINT_FULL: ADDED, same as old GNUTLS_X509_CRT_FULL.
459 GNUTLS_CRT_PRINT_ONELINE: ADDED, same as old GNUTLS_X509_CRT_ONELINE.
460 GNUTLS_CRT_PRINT_UNSIGNED_FULL: ADDED, same as
461 old GNUTLS_X509_CRT_UNSIGNED_FULL.
463 * Version 2.3.0 (released 2008-01-08)
465 ** LZO compression is now disabled by default.
466 The reason is that LZO compression is not standardized in TLS. If you
467 wish to experiment with it, you will have to supply --with-lzo when
468 invoking ./configure. The internal copy of minilzo is no longer
469 included with GnuTLS, so you will need to install liblzo or liblzo2 on
470 your system to have --with-lzo to be effective.
472 ** More than one server name field is now sent to the server properly.
473 Thanks to mark.phillips@virgin.net.
475 ** Fixes the post_client_hello_function(). The extensions are now parsed
476 in a callback friendly way.
478 ** Fix for certificate selection in servers with certificate callbacks.
480 ** Updated translations.
482 ** Update gnulib files.
484 ** API and ABI modifications:
485 No changes since last version.
487 * Version 2.2.5 (released 2008-05-19)
489 ** Fix flaw in fix for GNUTLS-SA-2008-1-3.
490 The flaw would result in incorrectly terminated sessions with the
491 error "Decryption has failed" when the server sends a small packet
492 (typically when the session is closed). Reported by Andreas Metzler
493 <ametzler@downhill.at.eu.org> in
494 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2807>.
496 ** API and ABI modifications:
497 No changes since last version.
499 * Version 2.2.4 (released 2008-05-19)
501 ** Fix three security vulnerabilities. [GNUTLS-SA-2008-1]
502 Thanks to CERT-FI for finding the bugs and providing detailed reports,
503 which allowed the bugs to be reproduced and fixed easily. Patches
504 developed by Simon Josefsson and Nikos Mavrogiannopoulos. Any updates
505 with more details about these vulnerabilities will be added to
506 <http://www.gnu.org/software/gnutls/security.html>
508 *** [GNUTLS-SA-2008-1-1]
509 *** libgnutls: Fix crash when sending invalid server name.
510 The crash can be triggered remotely before authentication, which can
511 lead to a Daniel of Service attack to disable the server. The bug
512 cause gnutls to store more session resumption data than what was
513 allocated for, thus overwriting unallocated memory.
515 *** [GNUTLS-SA-2008-1-2]
516 *** libgnutls: Fix crash when sending repeated client hellos.
517 The crash can be triggered remotely before authentication, which can
518 lead to a Daniel of Service attack to disable the server. The bug
519 triggers a null-pointer dereference.
521 *** [GNUTLS-SA-2008-1-3]
522 *** libgnutls: Fix crash in cipher padding decoding for invalid record lengths.
523 The crash can be triggered remotely before authentication, which can
524 lead to a Daniel of Service attack to disable the server. The bug
525 cause gnutls to read memory beyond the end of the received record.
527 ** API and ABI modifications:
528 No changes since last version.
530 * Version 2.2.3 (released 2008-05-06)
532 ** Increase default handshake packet size limit to 48kb.
533 The old limit was 16kb and some servers send huge list of trusted CAs,
534 thus running into the limit. FYI, applications can further increase
535 this limit using gnutls_handshake_set_max_packet_length. Thanks to
536 Marc Haber <mh+debian-bugs@zugschlus.de> and "Marc F. Clemente"
537 <marc@mclemente.net> for reporting and providing test servers.
539 ** Fix compilation error related to __FUNCTION__ on some systems.
540 Reported by Tim Mooney, see
541 <https://savannah.gnu.org/support/?106267>.
543 ** Documented the --priority option to gnutls-cli and gnutls-serv.
545 ** Fix fopen file descriptor leak in PSK server code.
546 Thanks to Laurence Withers <l@lwithers.me.uk>, see
547 <http://lists.gnu.org/archive/html/gnutls-devel/2008-04/msg00002.html>.
549 ** Build Guile code with -fgnu89-inline only when supported.
550 Reported by Kris Karas <ktk@enterprise.bidmc.harvard.edu> in
551 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2708>.
553 ** Make Camellia encryption work.
554 Reported by Yoshisato YANAGISAWA <yanagisawa@csg.is.titech.ac.jp> in
555 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2746>.
557 ** API and ABI modifications:
558 No changes since last version.
560 * Version 2.2.2 (released 2008-02-21)
562 ** Cipher priority string handling now handle strings that starts with NULL.
563 Thanks to Laurence Withers <l@lwithers.me.uk>.
565 ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported
568 ** Increased the default certificate verification chain limits and allowed
569 for checks without limitation.
571 ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name()
572 and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary
573 strings and return the proper size.
575 ** API and ABI modifications:
576 No changes since last version.
578 * Version 2.2.1 (released 2008-01-17)
580 ** Prevent linking libextra against previously installed libgnutls.
581 Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see
582 <http://bugs.gentoo.org/show_bug.cgi?id=202269>.
584 ** Fixes the post_client_hello_function(). The extensions are now parsed
585 in a callback friendly way.
587 ** Fix for certificate selection in servers with certificate callbacks.
589 ** API and ABI modifications:
590 No changes since last version.
592 * Version 2.2.0 (released 2007-12-14)
594 ** Update internal copy of libtasn1 to version 1.2.
596 ** Certtool --verify-chain now handle inputs larger than 64kb.
597 This fixes the self-test "rsa-md5-collision" under MinGW+Wine with
598 recent versions of libgcrypt. The problem was that Wine with the
599 libgcrypt RNG generates huge amounts of debugging output.
601 ** Translation updates.
602 Added Dutch translation. Updated Polish and Swedish translation.
604 ** Major changes compared to the v2.0 branch:
606 *** SRP support aligned with newly published RFC 5054.
608 *** OpenPGP support aligned with newly published RFC 5081.
610 *** Support for DSA2 keys.
612 *** Support for Camellia cipher.
614 *** Support for Opaque PRF Input extension.
616 *** PKCS#8 parser now handle DSA keys.
618 *** Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc.
619 Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier
620 versions, such as 2.01 which is included with GnuTLS, is available
621 under GPLv2 or later. If this incompatibility causes problems, we
622 recommend you to disable LZO using --without-lzo. LZO compression is
623 not a standard TLS compression algorithm, so the impact should be
626 *** Functions for disabling record protocol padding.
627 Works around bugs on Nokia/Ericsson phones.
629 *** New functions gnutls_priority_set() for setting cipher priorities easily.
630 Priorities like "COMPAT" also enables other work arounds, such as
633 *** Other minor improvements and bug fixes.
635 ** Backwards incompatible API/ABI changes in GnuTLS 2.2
636 To adapt to changes in the TLS extension specifications for OpenPGP
637 and SRP, the GnuTLS API had to be modified. This means breaking the
638 API and ABI backwards compatibility. That is something we try to
639 avoid unless it is necessary. We decided to also remove the already
640 deprecated stub functions for X.509 to XML conversion and TLS
641 authorization (see below) when we had the opportunity.
643 Generally, most applications does not need to be modified. Just
644 re-compile them against the latest GnuTLS release, and it should work
647 Applications that use the OpenPGP or SRP features needs to be
648 modified. Below is a list of the modified APIs and discussion of what
649 the minimal things you need to modify in your application to make it
650 work with GnuTLS 2.2.
652 Note that GnuTLS 2.2 also introduces new APIs -- such as
653 gnutls_set_priority() that is superior to
654 gnutls_set_default_priority() -- that you may want to start using.
655 However, using those new APIs is not required to use GnuTLS 2.2 since
656 the old functions continue are still supported. This text only
657 discuss what you minimally have to modify.
659 *** XML related changes
660 The function `gnutls_x509_crt_to_xml' has been removed. It has been
661 deprecated and only returned an error code since GnuTLS version
662 1.2.11. Nobody has complained, so users doesn't seem to miss the
663 functionality. We don't know of any other library to convert X.509
664 certificates into XML format, but we decided (long ago) that GnuTLS
665 isn't the right place for this kind of functionality. If you want
666 help to find some other library to use here, please explain and
667 discuss your use case on help-gnutls@gnu.org.
669 *** TLS Authorization related changes
670 Everything related to TLS authorizations have been removed, they were
671 only stub functions that returned an error code:
673 GNUTLS_SUPPLEMENTAL_AUTHZ_DATA
674 gnutls_authz_data_format_type_t
675 gnutls_authz_recv_callback_func
676 gnutls_authz_send_callback_func
678 gnutls_authz_send_x509_attr_cert
679 gnutls_authz_send_saml_assertion
680 gnutls_authz_send_x509_attr_cert_url
681 gnutls_authz_send_saml_assertion_url
683 *** SRP related changes
684 The callback gnutls_srp_client_credentials_function has a new
685 prototype, and its semantic has changed. You need to rewrite the
686 callback, see the updated function documentation and SRP example code
687 (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more
690 The alert codes GNUTLS_A_MISSING_SRP_USERNAME and
691 GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP
692 specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is
693 used. There are #define's to map the old names to the new. You may
694 run into problems if you have a switch-case with cases for both SRP
695 alerts, since they are now mapped to the same value. The solution is
696 to drop the SRP alerts from such switch cases, as they are now
697 deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY.
699 *** OpenPGP related changes
700 The function `gnutls_certificate_set_openpgp_keyserver' have been
701 removed. There is no replacement functionality inside GnuTLS. If you
702 need keyserver functionality, consider using the GnuPG tools.
704 All functions, types, and error codes related to OpenPGP trustdb
705 format have been removed. The trustdb format is a non-standard
706 GnuPG-specific format, and we recommend you to use key rings instead.
707 The following have been removed:
709 gnutls_certificate_set_openpgp_trustdb
710 gnutls_openpgp_trustdb_init
711 gnutls_openpgp_trustdb_deinit
712 gnutls_openpgp_trustdb_import
713 gnutls_openpgp_key_verify_trustdb
714 gnutls_openpgp_trustdb_t
715 GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED
717 The following functions has an added parameter of the (new) type
718 `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data
719 (binary or base64). The functions are:
720 gnutls_certificate_set_openpgp_key_file
721 gnutls_certificate_set_openpgp_key_mem
722 gnutls_certificate_set_openpgp_keyring_mem
723 gnutls_certificate_set_openpgp_keyring_file
725 To improve terminology and align with the X.509 interface, some
726 functions have been renamed. Compatibility mappings exists. The old
727 and new names of the affected functions and types are:
730 gnutls_openpgp_key_t gnutls_openpgp_crt_t
731 gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t
732 gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t
733 GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT
734 GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT
735 gnutls_openpgp_key_init gnutls_openpgp_crt_init
736 gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit
737 gnutls_openpgp_key_import gnutls_openpgp_crt_import
738 gnutls_openpgp_key_export gnutls_openpgp_crt_export
739 gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage
740 gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint
741 gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm
742 gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name
743 gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version
744 gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time
745 gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time
746 gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id
747 gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname
748 gnutls_openpgp_send_key gnutls_openpgp_send_cert
750 ** API and ABI modifications:
751 No changes since last version.
753 * Version 2.1.8 (released 2007-12-10)
755 ** The GPL version has been changed from version 2 to version 3.
756 This affects the self-tests, command-line tools, the libgnutls-extra
757 library, the relevant guile parts, and the build environment.
759 ** Added gnutls_x509_crt_get_subject_alt_name2().
761 ** Corrected a segfault when setting an empty gnutls_priority_t
762 at gnutls_priority_set().
764 ** Use gettext 0.17 which updates m4/lib-*.m4 macros.
765 Fixes a problem with spurious -L/usr/lib additions.
767 ** API and ABI modifications:
768 gnutls_x509_crt_get_subject_alt_name2: ADD.
770 * Version 2.1.7 (released 2007-11-29)
772 ** PKCS #8 parser can now encode/decode DSA keys.
774 ** Updated gnutls_set_default_priority2() now renamed to
775 gnutls_priority_set() and gnutls_priority_set_direct() which
776 accept a string to indicate preferences of ciphersuite parameters.
778 ** gnutls-cli and gnutls-serv now have a --priority option to set
781 ** The gnutls_*_convert_priority() functions were deprecated by
782 the gnutls_priority_set() and gnutls_priority_set_direct().
784 ** Internal copy of OpenCDK upgraded to version 0.6.6.
786 ** API and ABI modifications:
787 gnutls_priority_init: ADD.
788 gnutls_priority_deinit: ADD.
789 gnutls_priority_set: ADD.
790 gnutls_priority_set_direct: ADD.
791 gnutls_set_default_priority2: RENAMED to gnutls_priority_set_direct()
792 gnutls_mac_convert_priority: REMOVED
793 gnutls_compression_convert_priority: REMOVED
794 gnutls_protocol_convert_priority: REMOVED
795 gnutls_kx_convert_priority: REMOVED
796 gnutls_cipher_convert_priority: REMOVED
797 gnutls_certificate_type_convert_priority: REMOVED
798 gnutls_set_default_priority: UNDEPRECATED
799 gnutls_set_default_priority_export: UNDEPRECATED
801 ** Undocumented API and ABI modifications earlier in the 2.1.x series:
802 GNUTLS_CIPHER_UNKNOWN: ADD.
803 GNUTLS_CIPHER_CAMELLIA_128_CBC: ADD.
804 GNUTLS_CIPHER_CAMELLIA_256_CBC: ADD.
805 GNUTLS_KX_UNKNOWN: ADD.
806 GNUTLS_COMP_UNKNOWN: ADD.
807 GNUTLS_CRT_UNKNOWN: ADD.
808 gnutls_mac_get_id: ADD.
809 gnutls_compression_get_id: ADD.
810 gnutls_cipher_get_id: ADD.
811 gnutls_kx_get_id: ADD.
812 gnutls_protocol_get_id: ADD.
813 gnutls_certificate_type_get_id: ADD.
814 gnutls_handshake_post_client_hello_func: ADD.
815 gnutls_certificate_send_x509_rdn_sequence: ADD prototype to gnutls.h.in.
817 * Version 2.1.6 (released 2007-11-15)
819 ** Corrected bug in decompression of expanded compression data.
821 ** Added the --to-p8 option to certtool to convert private keys
824 ** Introduced the GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR error code.
826 ** gnutls_certificate_set_x509_key_* can now read PKCS #8 unencrypted
829 ** Fixed GNUTLS_E_UNKNOWN_ALGORITHM vs GNUTLS_E_UNKNOWN_HASH_ALGORITHM.
830 During the 2.1.x series the GNUTLS_E_UNKNOWN_HASH_ALGORITHM error code
831 was renamed to GNUTLS_E_UNKNOWN_ALGORITHM, unfortunately without being
832 documented. This caused some problems (e.g., debian #450854). To
833 avoid backwards compatibility problems, this release revert this
834 change, so that GNUTLS_E_UNKNOWN_HASH_ALGORITHM works just like it has
835 done in GnuTLS 2.0.x and earlier, and add a new error code
836 GNUTLS_E_UNKNOWN_ALGORITHM.
838 ** Fixes several gtk-doc warnings.
840 ** API and ABI modifications:
841 GNUTLS_E_UNKNOWN_ALGORITHM: CHANGED.
842 GNUTLS_E_UNKNOWN_HASH_ALGORITHM: CHANGED.
843 GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR: ADD.
845 * Version 2.1.5 (released 2007-11-01)
847 ** Fix PKCS#3 parameter export problem.
849 ** Improve certtool queries, they now print the default value.
853 ** Update gnulib files.
855 ** API and ABI modifications:
856 No changes since last version.
858 * Version 2.1.4 (released 2007-10-27)
860 ** Added the --v1 option to certtool, to allow generating X.509
861 version 1 certificates.
863 ** certtool: Add option --disable-quick-random to enable the old behaviour
864 of using /dev/random to generate keys.
866 ** Added priority functions that accept strings.
868 ** Added gnutls_set_default_priority2() which accepts a flag to indicate
869 priorities preferences.
871 ** Added gnutls_record_disable_padding() to allow servers talking to
872 buggy clients that complain if the TLS 1.0 record protocol padding is
875 ** Introduced gnutls_session_enable_compatibility_mode() to allow enabling
876 all supported compatibility options (like disabling padding).
878 ** The gnutls_certificate_set_openpgp_* functions were modified to include
879 the format. This makes the interface consistent with the x509 functions.
881 ** Internal copy of OpenCDK upgraded to version 0.6.5.
883 ** Update gnulib files.
885 ** API and ABI modifications:
886 gnutls_certificate_set_openpgp_key_mem: MODIFIED
887 gnutls_certificate_set_openpgp_key_file: MODIFIED
888 gnutls_certificate_set_openpgp_keyring_mem: MODIFIED
889 gnutls_certificate_set_openpgp_keyring_file: MODIFIED
890 gnutls_set_default_priority: DEPRECATED
891 gnutls_set_default_priority_export: DEPRECATED
892 gnutls_set_default_priority2: ADDED
893 gnutls_session_enable_compatibility_mode: ADDED
894 gnutls_record_disable_padding: ADDED
895 gnutls_mac_convert_priority: ADDED
896 gnutls_compression_convert_priority: ADDED
897 gnutls_protocol_convert_priority: ADDED
898 gnutls_kx_convert_priority: ADDED
899 gnutls_cipher_convert_priority: ADDED
900 gnutls_certificate_type_convert_priority: ADDED
901 gnutls_openpgp_key_t: RENAMED to gnutls_openpgp_crt_t
902 gnutls_openpgp_key_status_t: RENAMED to gnutls_openpgp_crt_status_t
903 gnutls_openpgp_send_key: RENAMED to gnutls_openpgp_send_cert
904 gnutls_openpgp_key_init: RENAMED to gnutls_openpgp_crt_init
905 gnutls_openpgp_key_import: RENAMED to gnutls_openpgp_crt_import
906 gnutls_openpgp_key_export: RENAMED to gnutls_openpgp_crt_export
907 gnutls_openpgp_key_check_hostname: RENAMED to gnutls_openpgp_crt_check_hostname
908 gnutls_openpgp_key_get_creation_time: RENAMED to gnutls_openpgp_crt_get_creation_time
909 gnutls_openpgp_key_get_expiration_time: RENAMED to gnutls_openpgp_crt_get_expiration_time
910 gnutls_openpgp_key_get_fingerprint: RENAMED to gnutls_openpgp_crt_get_fingerprint
911 gnutls_openpgp_key_get_version: RENAMED to gnutls_openpgp_crt_get_version
912 gnutls_openpgp_key_get_pk_algorithm: RENAMED to gnutls_openpgp_crt_get_pk_algorithm
913 gnutls_openpgp_key_get_name: RENAMED to gnutls_openpgp_crt_get_name
914 gnutls_openpgp_key_deinit: RENAMED to gnutls_openpgp_crt_deinit
915 gnutls_openpgp_key_get_id: RENAMED to gnutls_openpgp_crt_get_id
916 gnutls_openpgp_key_get_key_usage: RENAMED to gnutls_openpgp_crt_get_key_usage
917 gnutls_openpgp_key_verify_ring: RENAMED to gnutls_openpgp_crt_verify_ring
918 gnutls_openpgp_key_verify_self: RENAMED to gnutls_openpgp_crt_verify_self
920 * Version 2.1.3 (released 2007-10-17)
922 ** TLS authorization support removed.
923 This technique may be patented in the future, and it is not of crucial
924 importance for the Internet community. After deliberation we have
925 concluded that the best thing we can do in this situation is to
926 encourage society not to adopt this technique. We have decided to
927 lead the way with our own actions.
929 ** Re-enabled the 256 bit ciphers in the default priorities.
931 ** Corrected bugs in openpgp key verification using a keyring (both in
934 ** API and ABI modifications:
935 gnutls_certificate_set_openpgp_keyserver: REMOVED
936 gnutls_authz_data_format_type_t,
937 gnutls_authz_recv_callback_func,
938 gnutls_authz_send_callback_func,
940 gnutls_authz_send_x509_attr_cert,
941 gnutls_authz_send_saml_assertion,
942 gnutls_authz_send_x509_attr_cert_url,
943 gnutls_authz_send_saml_assertion_url: REMOVED.
944 GNUTLS_SUPPLEMENTAL_USER_MAPPING_DATA: ADDED. To avoid that the
945 gnutls_supplemental_data_format_type_t enum type becomes empty.
947 * Version 2.1.2 (released 2007-10-14)
949 ** Removed all the trustdb code from openpgp authentication.
950 We now use only the well-specified keyrings.
952 ** The 256 bit ciphers are not enabled in the default priorities.
954 ** Added support for DSA2 using libgcrypt 1.3.0.
956 ** certtool: Fixed data corruption when using --outder.
958 ** Removed all the xml related stubs and functions.
960 ** Added capability to set a callback after the client hello is received
961 by the server in order to adjust parameters before the handshake.
963 ** SRP was corrected to adhere to the latest draft (published soon as RFC)
965 ** Corrected bug which did not allow a server to run without supporting
968 ** Updated the DN parser which now prints wrongly decoded values as hex
971 ** certtool: Add option --quick-random.
972 For generating low security test credentials.
974 ** API and ABI modifications:
975 gnutls_x509_crt_to_xml: REMOVED
976 gnutls_openpgp_key_to_xml: REMOVED
977 gnutls_openpgp_key_verify_trustdb: REMOVED
978 gnutls_openpgp_trustdb_init: REMOVED
979 gnutls_openpgp_trustdb_deinit: REMOVED
980 gnutls_openpgp_trustdb_import: REMOVED
981 gnutls_certificate_set_openpgp_trustdb: REMOVED
982 gnutls_srp_client_credentials_function: CHANGED
983 gnutls_handshake_set_post_client_hello_function: ADDED
984 gnutls_mac_get_key_size: ADDED
985 GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED: DEPRECATED.
986 GNUTLS_A_MISSING_SRP_USERNAME: DEPRECATED
987 GNUTLS_A_UNKNOWN_SRP_USERNAME: DEPRECATED
989 * Version 2.1.1 (released 2007-09-24)
991 ** Added support for Camellia cipher, thanks to Yoshisato YANAGISAWA.
992 Camellia is only enabled in GnuTLS if the installed libgcrypt has been
993 compiled with Camellia support. See the libgcrypt documentation on
994 how to enable it. Unconditionally disable it using the configure
995 option --disable-camellia. Fixes #1.
997 ** Properly document in the NEWS file the API change in the last release.
999 ** API and ABI modifications:
1000 No changes since last version.
1002 * Version 2.1.0 (released 2007-09-20)
1004 ** Support for draft-rescorla-tls-opaque-prf-input-00.txt.
1005 The support is disabled by default. Since no value has been allocated
1006 by the IANA for this extension yet, you will need to provide one
1007 yourself by invoking './configure --enable-opaque-prf-input=42'.
1010 ** Example code: Fix compilation flaw under MinGW.
1012 ** API and ABI modifications:
1013 gnutls_oprfi_callback_func: ADD, new typedef function prototype.
1014 gnutls_oprfi_enable_client: ADD, new function.
1015 gnutls_oprfi_enable_server: ADD, new function.
1017 * Version 2.0.4 (released 2007-11-16)
1019 ** Corrected bug in decompression of expanded compression data.
1021 ** API and ABI modifications:
1022 No changes since last version.
1024 * Version 2.0.3 (released 2007-11-10)
1026 ** This version backports several fixes from the 2.1.x branch.
1028 ** Fixed PKCS #3 parameter export.
1030 ** Added gnutls_record_disable_padding() to allow servers talking to
1031 buggy clients that complain if the TLS 1.0 record protocol padding is
1034 ** Introduced gnutls_session_enable_compatibility_mode() to allow enabling
1035 all supported compatibility options (like disabling padding).
1037 ** Corrected bug which did not allow a server to run without supporting
1040 ** API and ABI modifications:
1041 gnutls_session_enable_compatibility_mode: ADDED
1042 gnutls_record_disable_padding: ADDED
1044 * Version 2.0.2 (released 2007-10-17)
1046 ** TLS authorization support removed.
1047 This technique may be patented in the future, and it is not of crucial
1048 importance for the Internet community. After deliberation we have
1049 concluded that the best thing we can do in this situation is to
1050 encourage society not to adopt this technique. We have decided to
1051 lead the way with our own actions.
1053 ** certtool: Fixed data corruption when using --outder.
1055 ** Fix configure-time Guile detection.
1057 ** API and ABI modifications:
1058 GNUTLS_SUPPLEMENTAL_USER_MAPPING_DATA: ADDED. To avoid that the
1059 gnutls_supplemental_data_format_type_t enum type becomes empty.
1061 * Version 2.0.1 (released 2007-09-20)
1063 ** New directory doc/credentials/ with test credentials.
1064 This collects the test credentials from the web page and from src/.
1065 The script gnutls-http-serv has also been moved to that directory.
1067 ** Update SRP extension type and cipher suite with official IANA values.
1068 This breaks backwards compatibility with SRP in older versions of
1069 GnuTLS, but this is intentional to speed up the adoption of the
1070 official values. The old values we used were incorrect.
1072 ** Guile: Fix `x509-certificate-dn-oid'
1074 ** API and ABI modifications:
1075 No changes since last version.
1077 * Version 2.0.0 (released 2007-09-04)
1079 ** Included copy of Libtasn1 upgraded to version 1.1.
1081 ** Disable building of some examples if anonymous ciphers are disabled.
1083 ** Don't build examples for disabled features.
1085 ** API and ABI modifications:
1086 No changes since last version.
1088 * Version 1.7.19 (released 2007-08-27)
1090 ** Fix gnutls_error_is_fatal so that positive "errors" are non-critical.
1091 This solves connection problems in mutt, see
1092 <http://bugs.debian.org/439640>.
1094 ** Update gnulib files.
1095 In particular, the getpass module -- with its dependencies on getline,
1096 getdelim, fseeko etc -- where moved from the lgl/ (used by the core
1097 library) directory to the gl/ directory (only used by the command line
1098 tools). The reason is that getpass is now only used by the
1099 command-line tools, and reducing the number of gnulib modules linked
1100 to the core library helps portability and reduces size.
1104 ** Disable building of PGP examples if PGP is disabled.
1106 ** Included copy of OpenCDK upgraded to version 0.6.4.
1108 ** API and ABI modifications:
1109 No changes since last version.
1111 * Version 1.7.18 (released 2007-08-16)
1113 ** Install images for the info manual.
1114 This has a side effect of renaming the images. See
1115 <http://thread.gmane.org/gmane.comp.tex.texinfo.bugs/3533> for
1116 discussions on the approach chosen.
1118 ** Fix pointer mix to variables of different size.
1119 Patch extracted from
1120 <http://cvs.fedora.redhat.com/viewcvs/devel/gnutls/gnutls-1.6.3-incompat-pointers.patch?rev=1.1&view=auto>.
1122 ** Fix warnings during build.
1123 Thanks to Andreas Metzler <ametzler@downhill.at.eu.org>.
1125 ** API and ABI modifications:
1126 No changes since last version.
1128 * Version 1.7.17 (released 2007-08-15)
1130 ** New functions to perform external signing.
1131 Set the signing callback function (of the gnutls_sign_func prototype)
1132 using the gnutls_sign_callback_set function. In the callback, you may
1133 find the new functions gnutls_x509_privkey_sign_hash and
1134 gnutls_openpgp_privkey_sign_hash useful. A new function
1135 gnutls_sign_callback_get is also added, to retrieve the function
1136 pointer. Thanks to "Alon Bar-Lev" <alon.barlev@gmail.com> for
1137 comments and testing.
1139 ** New self test of client and server authenticated X.509 TLS sessions.
1140 See tests/x509self.c and tests/x509signself.c. The latter also tests
1141 the new external signing callback interface.
1143 ** New errors GNUTLS_E_APPLICATION_ERROR_MIN..GNUTLS_E_APPLICATION_ERROR_MAX.
1144 These two actually describe the outer limits of a range of error codes
1145 reserved to the application. All of the errors are treated as fatal
1146 by the library (it has to since it doesn't know the semantics of the
1147 error codes). This can be useful in callbacks, to signal some
1148 application-specific error condition, which will usually eventually
1149 cause some gnutls API to return the same error code as the callback,
1150 which then can be inspected by the application. Note that error codes
1153 ** gnutls_set_default_priority now disable TLS 1.2 by default.
1154 The RFC is not released yet, and we're approaching a major release so
1155 let's not enable it just yet.
1157 ** Fix namespace so that gnutls_*_t is used consistently.
1158 Before, many places in the GnuTLS code used the old deprecated type
1159 names without the '_t' suffix.
1161 ** Build fixes for Guile code.
1162 Patch from Ludovic Courtes <ludovic.courtes@laas.fr>.
1164 ** More documentation fixes.
1165 In particular, the section headings were modified for casing. By
1166 Ludovic Courtes <ludovic.courtes@laas.fr>.
1168 ** Updated Polish and Swedish translations.
1169 Thanks to Jakub Bogusz <qboosh@pld-linux.org> and Daniel Nylander
1170 <po@danielnylander.se>.
1172 ** API and ABI modifications:
1173 gnutls_sign_func: ADD, new type for sign callback.
1174 gnutls_sign_callback_set: ADD, new function to set sign callback.
1175 gnutls_sign_callback_get: ADD, new function to retrieve sign callback.
1176 gnutls_x509_privkey_sign_hash,
1177 gnutls_openpgp_privkey_sign_hash: ADD, new functions useful in sign callback.
1178 GNUTLS_E_APPLICATION_ERROR_MIN,
1179 GNUTLS_E_APPLICATION_ERROR_MAX: ADD, new CPP #defines for error codes.
1181 * Version 1.7.16 (released 2007-08-07)
1183 ** Fix sanity checks and return values in certificate selection.
1184 In some cases, GnuTLS omitted to report suitable error codes when no
1185 suitable certificate was found.
1187 ** Fix gnutls-cli starttls EOF on Mac OS X.
1188 Thanks to Hal Eden <n.mavrogiannopoulos@gmail.com>.
1190 ** Documentation fixes.
1191 In particular, the section headings were modified for casing. By
1192 Ludovic Courtes <ludovic.courtes@laas.fr>.
1194 ** Update gnulib files.
1196 ** API and ABI modifications:
1197 No changes since last version.
1199 * Version 1.7.15 (released 2007-07-02)
1201 ** Fix self-tests key-id under mingw32.
1203 ** Test that the Guile header files are recent enough to work.
1204 Before we just tested that the command line tool 'guile' was recent
1205 enough, which may not be sufficient if you still have an old
1206 libguile.h header installed.
1208 ** Guile bindings are now installed under $prefix by default.
1209 Use --without-guile-site-dir to install it under $pkgdatadir/site/
1210 where $pkgdatadir is as returned by "guile-config info pkgdatadir".
1211 Use --with-guile-site-dir=/your/own/path to specify the path manually.
1212 The default, --with-guile-site-dir, will install the Guile bindings
1213 under $datadir/guile/site. There is a new section 'Guile
1214 Preparations' in the manual that discuss these issues.
1216 ** Fix run-time library path ordering in linking the Guile bindings.
1218 ** Improved manual on downloading, installing, getting help, bug reports etc.
1219 Suggested by Ludovic Courtès <ludovic.courtes@laas.fr>.
1221 ** Add Malay message translations.
1222 Thanks to Sharuzzaman Ahmat Raslan <sharuzzaman@myrealbox.com>.
1224 ** API and ABI modifications:
1225 No changes since last version.
1227 * Version 1.7.14 (released 2007-06-26)
1229 ** Don't enable Guile bindings unless we have Guile 1.8 or later.
1230 Patch from Ludovic Courtès <ludovic.courtes@laas.fr>.
1232 ** Fix memory leak during DSA signature verification.
1233 Patch from Ludovic Courtès <ludovic.courtes@laas.fr>.
1235 ** Fix crash in gnutls-cli when TLS handshake fails.
1236 Reported by Marc Haber <mh+debian-bugs@zugschlus.de> and Andreas
1237 Metzler <ametzler@downhill.at.eu.org> via Debian BTS #429183, see
1238 <http://bugs.debian.org/429183>.
1240 ** Minor OpenPGP fixes in stream_to_datum.
1241 Patch from Timo Schulz <twoaday@freakmail.de> and Ludovic Courtès
1242 <ludovic.courtes@laas.fr>.
1244 ** Fix off-by-one in TLS 1.2 handshake.
1245 Patch from Ludovic Courtès <ludovic.courtes@laas.fr>.
1247 ** Minor Guile binding self-test cleanup.
1248 Patch from Ludovic Courtès <ludovic.courtes@laas.fr>.
1250 ** Update gnulib files.
1252 ** API and ABI modifications:
1253 No changes since last version.
1255 * Version 1.7.13 (released 2007-06-11)
1257 ** OpenCDK copy updated to version 0.6.3.
1259 ** Build fixes for GnuTLS Guile bindings.
1260 Patch from Ludovic Courtès <ludovic.courtes@laas.fr>.
1262 ** Build fix for GTK-DOC manual.
1264 ** Update gnulib files.
1266 ** API and ABI modifications:
1267 No changes since last version.
1269 * Version 1.7.12 (released 2007-06-08)
1271 ** Guile bindings for GnuTLS have been included.
1272 Contributed by Ludovic Courtès <ludovic.courtes@laas.fr>. There is a
1273 new chapter 'Guile Bindings' in the manual.
1275 ** Have PKCS8 parser return better error codes.
1276 Reported by Nate Nielsen <nielsen-list@memberwebs.com>, see
1277 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-May/001653.html> and
1278 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-May/001654.html>.
1280 ** Fix mem leak for sessions with client authentication via certificates.
1281 Reported by Andrew W. Nosenko <andrew.w.nosenko@gmail.com>, see
1282 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-April/001539.html>.
1285 Reported by Dennis Vshivkov <walrus@amur.ru>, see
1286 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=333050>. Added
1287 self-test tests/parse_ca.c to test regressions.
1289 ** Fix build failures related to missing images in manual.
1290 Reported by Andreas Metzler <ametzler@downhill.at.eu.org>.
1292 ** Update gnulib files.
1294 ** API and ABI modifications:
1295 No changes since last version.
1297 * Version 1.7.11 (released 2007-05-26)
1299 ** Include opencdk.h in the release.
1300 Reported by Roman Bogorodskiy <novel@FreeBSD.org>.
1302 ** API and ABI modifications:
1303 No changes since last version.
1305 * Version 1.7.10 (released 2007-05-25)
1307 ** New API functions to extract DER encoded X.509 Subject/Issuer DN.
1308 Suggested by Nate Nielsen <nielsen-list@memberwebs.com>.
1310 ** Update of gnulib files.
1312 ** GnuTLS is now developed in GIT instead of CVS.
1313 See <http://repo.or.cz/w/gnutls.git> for a public repository.
1315 ** API and ABI modifications:
1316 gnutls_x509_crt_get_raw_issuer_dn: ADD.
1317 gnutls_x509_crt_get_raw_dn: ADD.
1319 * Version 1.7.9 (released 2007-05-12)
1321 ** X.509 certificates are preferred over OpenPGP keys.
1322 This is a change in the semantics of gnutls_set_default_priority.
1324 ** The included copy of OpenCDK has been updated to 0.6.1.
1325 There has been some API changes in OpenCDK, and the GnuTLS layer have
1326 been modified as well. Note that while there are API/ABI incompatible
1327 changes in OpenCDK, this does not influence GnuTLS's API/ABI because
1328 its API/ABI have not changed. From this version on, GnuTLS requires
1329 OpenCDK 0.6.0 or later.
1331 ** Fix build failure caused by missing doc/gnutls-logo.pdf.
1333 ** Change certtool's default serial number from 0 to a time-based value.
1335 ** Fix X.509 signing with RSA-PKCS#1 to set a NULL parameters fields.
1336 Before, we remove the parameters field, which resulted in a slightly
1337 different DER encoding which in turn caused signature verification
1338 failures of GnuTLS-generated RSA certificates in some other
1339 implementations (e.g., GnuPG 2.x's gpgsm). Depending on which RFCs
1340 you read, this may or may not be correct, but our new behaviour appear
1341 to be consistent with other widely used implementations.
1343 ** Fix mem leaks in gnutls_x509_crt_print.
1345 ** API and ABI modifications:
1346 No changes since last version.
1348 * Version 1.7.8 (released 2007-04-16)
1350 ** Added examples for the authorization extension.
1351 See doc/examples/ex-client-authz.c and doc/examples/ex-serv-authz.c.
1353 ** The examples only use gnutls_set_default_priority().
1354 The exception is when DH_ANON is needed.
1356 ** Improve gnutls_set_default_priority() priorities.
1357 The new approach is for it to try and negotiate all secure and
1358 standard mechanisms available. Currently, DH_ANON ciphersuites and
1359 LZO compressions are not enabled by default, because they are,
1360 respectively, insecure and non-standardized. Note that TLS 1.2 will
1361 not be enabled by default in non-experimental release until it has
1362 been approved by the IETF.
1364 ** gnutls-cli and gnutls-serv now uses the library's default priorities.
1365 This means that to get DH_ANON and LZO compression, you'll need to
1366 specify that manually using '--kx anon' or '--comp lzo'.
1368 ** Minor fixes to the human display format of X.509 certificates.
1370 ** New APIs to extract Distinguished Name's from X.509 certificates.
1371 Based on patch from Howard Chu <hyc@symas.com>.
1373 ** Improved library searching for opencdk.
1374 It will now add the appropriate -R or -Wl,-rpath flags as necessary.
1375 The deprecated opencdk.m4 is no longer used.
1377 ** New APIs to list supported algorithms in the library.
1378 The APIs are gnutls_cipher_list, gnutls_mac_list,
1379 gnutls_compression_list, gnutls_protocol_list,
1380 gnutls_certificate_type_list, gnutls_kx_list, and
1381 gnutls_cipher_suite_info. Suggested by Howard Chu <hyc@symas.com>.
1383 ** The gnutls_x509_crt_get_key_id API now handle non-RSA/DSA keys.
1385 ** New configure option --disable-tls-authorization to disable tls-authz.
1387 ** Fix prototype for `gnutls_psk_set_client_credentials'.
1388 The last parameter was renamed from 'flags' to 'format' and the type
1389 changed from 'unsigned int' to 'gnutls_psk_key_flags' (an enum type),
1390 which shouldn't cause any ABI changes. Reported by ludo@chbouib.org
1393 ** Fix allocation in gnutls_certificate_set_openpgp_key.
1394 Tiny patch from ludo@chbouib.org (Ludovic Courtès).
1396 ** API and ABI modifications:
1397 gnutls_x509_dn_t: ADD.
1398 gnutls_x509_ava_st: ADD.
1399 gnutls_x509_crt_get_subject,
1400 gnutls_x509_crt_get_issuer: ADD.
1401 gnutls_x509_dn_get_rdn_ava: ADD.
1402 gnutls_cipher_list: ADD.
1403 gnutls_mac_list: ADD.
1404 gnutls_compression_list: ADD.
1405 gnutls_protocol_list: ADD.
1406 gnutls_certificate_type_list: ADD.
1407 gnutls_kx_list: ADD.
1408 gnutls_cipher_suite_info: ADD.
1410 * Version 1.7.7 (released 2007-02-22)
1412 ** Support for supplemental handshake messages and authorization data.
1413 Supplemental data is described in RFC 4680 and the authorization
1414 extensions in draft-housley-tls-authz-extns-07.
1416 ** Support for authorization data in gnutls-cli and gnutls-serv.
1417 New parameters --authz-x509-attr-cert and --authz-saml-assertion.
1419 ** Fix for gnutls_x509_crt_check_hostname.
1420 Before it would have reported that the certificate matched a hostname
1421 when it did not have any dNSName or any CN field. Report and tiny
1422 patch from "Richard W.M. Jones" <rjones@redhat.com>.
1424 ** New self test for RFC 2818 comparison in gnutls_x509_crt_check_hostname.
1425 Tests regressions of the bug, and several other features.
1427 ** GnuTLS now matches URI's with IP Addresses against iPAddress SAN's.
1428 Before there were no support for iPAddress SAN's during comparison.
1430 ** New API to print information about CRL's.
1431 The function is gnutls_x509_crl_print.
1433 ** New API to extract signature value from CRL's.
1434 The function is gnutls_x509_crl_get_signature.
1436 ** Support for directoryName Subject Alternative Name's.
1437 The gnutls_x509_crt_get_subject_alt_name function returns the DN as a
1438 string in the provided buffer.
1440 ** Internal improvements to certtool.
1441 It uses gnutls_x509_crl_print to print CRL information. It uses some
1442 more gnulib modules to simplify error handling.
1444 ** API and ABI modifications:
1445 GNUTLS_HANDSHAKE_SUPPLEMENTAL: ADD, new gnutls_handshake_description_t element.
1446 gnutls_supplemental_data_format_type_t: ADD.
1447 gnutls_authz_data_format_type_t: ADD.
1448 gnutls_supplemental_get_name: ADD.
1449 gnutls_authz_recv_callback_func,
1450 gnutls_authz_send_callback_func: ADD, callback prototypes.
1451 gnutls_authz_enable: ADD.
1452 gnutls_authz_send_x509_attr_cert,
1453 gnutls_authz_send_saml_assertion,
1454 gnutls_authz_send_x509_attr_cert_url,
1455 gnutls_authz_send_saml_assertion_url: ADD.
1456 GNUTLS_SAN_DN: ADD, new gnutls_x509_subject_alt_name_t element.
1457 gnutls_x509_crl_print: ADD.
1458 gnutls_x509_crl_get_signature: ADD.
1460 * Version 1.7.6 (released 2007-02-12)
1462 ** Support for 'otherName' Subject Alternative Names.
1463 The existing API gnutls_x509_crt_get_subject_alt_name may now return
1464 the new type GNUTLS_SAN_OTHERNAME together with the otherName value.
1465 To find out the otherName OID (necessary for proper parsing of the
1466 value), use the new API gnutls_x509_crt_get_subject_alt_othername_oid.
1467 For known OIDs, gnutls_x509_crt_get_subject_alt_othername_oid will
1468 return "virtual" SAN values, e.g., GNUTLS_SAN_OTHERNAME_XMPP to
1469 simplify OID matching. Suggested by Matthias Wimmer <m@tthias.eu>.
1471 ** Certtool can print otherName SAN values for certificates.
1472 For known otherName OIDs (currently only id-on-xmppAddr as defined by
1473 RFC 3920), it will also print the name.
1475 ** Fix TLS 1.2 RSA signing in servers.
1476 Before it used the old-style MD5+SHA1 signature, but the TLS
1477 signatures should be normal PKCS#1 signatures. FYI, we use and
1478 require that DigestInfo parameters are present and NULL for TLS 1.2.
1480 ** Add APIs to access X.509 extensions sequentially.
1481 The existing APIs gnutls_x509_crt_get_extension_oid() and
1482 gnutls_x509_crt_get_extension_by_oid() does not permit callers to
1483 inspect the extensions in the order defined by the certificate.
1485 ** Add API to extract signature value from X.509 certificates.
1486 The function is gnutls_x509_crt_get_signature.
1488 ** Fix crash when generating proxy certificates in batch mode.
1489 If you don't specify a proxy policy in batch mode, it will use
1492 ** Add API to print information about X.509 certificates.
1493 The function is gnutls_x509_crt_print.
1495 ** Certtool uses the new API gnutls_x509_crt_print to print certificate info.
1496 One consequence of this is that the output syntax has changed
1497 slightly. Some more fields are printed.
1501 ** API and ABI modifications:
1502 gnutls_x509_crt_print: ADD
1503 gnutls_certificate_print_formats_t: ADD, new enum.
1504 gnutls_x509_crt_get_signature: ADD.
1505 gnutls_x509_crt_get_extension_data: ADD.
1506 gnutls_x509_crt_get_extension_info: ADD.
1507 gnutls_x509_crt_get_subject_alt_othername_oid: ADD.
1508 GNUTLS_SAN_OTHERNAME: ADD, new gnutls_x509_subject_alt_name_t element.
1509 GNUTLS_SAN_OTHERNAME_XMPP: ADD, new gnutls_x509_subject_alt_name_t element.
1511 * Version 1.7.5 (released 2007-02-06)
1513 ** Servers won't negotiate SRP RSA/DSS cipher suites if no SRP credential
1516 ** Default behaviour for the gnutls-cli and gnutls-serv tools improved.
1518 ** Fix --list output for gnutls-cli and gnutls-serv.
1519 Mention TLS1.2, SHA512 etc.
1521 ** Manual contains new section on setting up a test HTTP server.
1522 A server set up following those descriptions are available online via
1523 <http://www.gnutls.org/server.html>.
1525 ** Update of gnulib files.
1527 ** API and ABI modifications:
1528 No changes since last version.
1530 * Version 1.7.4 (released 2007-02-05)
1532 ** Support for RSA signing using SHA-256/384/512.
1533 A new self test "sha2" tries to build a long X.509 certificate chain
1534 testing all new hashes.
1536 ** The gnutls-serv tool now use static DH parameters if none are supplied.
1538 ** Discuss proxy certificates in the manual.
1540 ** Improve bibliographical citations in the manual.
1542 ** Update of gnulib files.
1544 ** Fix certtool template handling of pathLenConstraints.
1545 It now defaults to -1 instead of 0, which causes the field to be
1546 missing unless the template specify it.
1548 ** API and ABI modifications:
1551 GNUTLS_MAC_SHA512: New gnutls_mac_algorithm_t values.
1554 GNUTLS_DIG_SHA512: New gnutls_digest_algorithm_t values.
1555 GNUTLS_SIGN_RSA_SHA256,
1556 GNUTLS_SIGN_RSA_SHA384,
1557 GNUTLS_SIGN_RSA_SHA512: New gnutls_sign_algorithm_t values.
1559 * Version 1.7.3 (released 2007-02-01)
1561 ** New option to certtool: --generate-proxy.
1562 This will generate a Proxy Certificate from an end entity certificate.
1563 Proxy Certificates are documented in RFC 3820. You will need to
1564 specify the proxy certificate's private key with --load-privkey, the
1565 user certificate with --load-certificate and the private key used to
1566 sign the new proxy certificate with --load-ca-privkey. Certtool will
1567 query for proxy path length and the policy language OID. Currently
1568 only OIDs that have an empty policy are supported (which includes the
1569 two OIDs defined by RFC 3820).
1571 ** Certtool --certificate-info now prints information for Proxy Certificates.
1572 Before the proxy extension was just printed as DER encoded data.
1574 ** New APIs to set proxy subject names and get/set proxy cert extension.
1576 ** Fix parsing of pathLenConstraints in BasicConstraints with missing cA.
1578 ** Added self-test to test for regressions of pathLenConstraint bug.
1579 Incidentally, this also test (some) other regressions or changes in
1580 the output from certtool --certificate-info.
1582 ** When certtool generates CA certificates, pressing enter on the path
1583 ** length constraint query will now remove the field.
1584 Before it set the path length constraint to 0, which is a rather poor
1587 ** Certtool now print times in UTC when printing certificate/CRL info.
1589 ** Add better fix to work around C++ compiler bug on Mac OS X.
1590 Reported and tiny patch provided by Matthias Scheler <tron@NetBSD.org>.
1592 ** Fix import of ASCII armored OpenPGP keys.
1593 Patch by ludovic.courtes@laas.fr (Ludovic Courtès).
1595 ** Update of gnulib files.
1597 ** API and ABI modifications:
1598 gnutls_x509_crt_set_proxy_dn: ADD.
1599 gnutls_x509_crt_set_proxy: ADD.
1600 gnutls_x509_crt_get_proxy: ADD.
1602 * Version 1.7.2 (released 2007-01-14)
1604 ** Certtool now print the value of the pathLenConstraints field for certs.
1606 ** Certtool now query for path length constraints when generating CA certs.
1607 For batch uses, the certtool configuration name is "path_len".
1608 Suggested by Sascha Ziemann <sascha.ziemann@secunet.com>.
1610 ** Add new API to get/set pathLenConstraint in the Basic Constraints.
1611 The new functions gnutls_x509_crt_get_basic_constraints and
1612 gnutls_x509_crt_set_basic_constraints provide a superset of the
1613 functionality in the old gnutls_x509_crt_get_ca_status and
1614 gnutls_x509_crt_set_ca_status (respectively), but the old functions
1615 will continue to be supported.
1617 ** Add new API in OpenCDK to extract public/secret OpenPGP key to S-expr.
1618 The functions are cdk_pubkey_to_sexp and cdk_seckey_to_sexp. A proper
1619 OpenCDK release with this patch will be made soon, which should bump
1620 the OpenCDK version number. Patch by Mario Lenz <mario.lenz@gmx.net>.
1622 ** Certtool --to-p12 can now store more than one certificate in the blob.
1623 Before it could only store one certificate, but now it will read and
1624 store as many certificate there are from the --load-certificate file.
1625 Suggested by Sascha Ziemann <sascha.ziemann@secunet.com>.
1627 ** Clean up separation of gnutls and gnutls-extra for OpenPGP.
1628 In particular, the OpenPGP function variables are no longer part of
1629 the exported libgnutls interface, and no header files from
1630 libgnutls-extra (GPL) are needed by libgnutls (LGPL). The variables
1631 were never intended for non-internal purposes, and thus this does not
1632 imply a change in the external API/ABI.
1634 ** Print URL to gaa when missing, and fix srcdir!=builddir for GAA files.
1635 Reported by ludovic.courtes@laas.fr (Ludovic Courtès).
1637 ** GnuTLS no longer uses -mms-bitfields --enable-runtime-pseudo-reloc.
1638 Before these parameters were set to make GnuTLS build under mingw32,
1639 however, they appear to no longer be necessary.
1641 ** A minor fix to the C++ library to make it build.
1642 Reported by Pavlov Konstantin <thresh@altlinux.ru>.
1644 ** Update of gnulib files.
1646 ** API and ABI modifications:
1647 gnutls_x509_crt_get_basic_constraints: ADD.
1648 gnutls_x509_crt_set_basic_constraints: ADD.
1649 cdk_pubkey_to_sexp: ADD (in opencdk).
1650 cdk_seckey_to_sexp: ADD (in opencdk).
1652 * Version 1.7.1 (released 2006-12-28)
1654 ** TLS 1.2 server side fix.
1655 The Certificate Request sent did not contain the list of supported
1656 hashes field, thus violating the protocol. It will now contain an
1657 empty list. Reported by ludovic.courtes@laas.fr (Ludovic Courtès).
1659 ** TLS 1.2 DSA signature verification fix.
1660 Reported by ludovic.courtes@laas.fr (Ludovic Courtès).
1662 ** Fix the list of trusted CAs that server's send to clients.
1663 Before, the list contained issuer DN's instead of subject DN's of the
1664 trusted CAs. Reported by Max Kellermann <max@duempel.org>.
1666 ** Fix gnutls_certificate_set_x509_crl to initialize the CRL before using it.
1667 Also added a self-test in tests/certificate_set_x509_crl.c to test the
1668 function. Reported by Max Kellermann <max@duempel.org>.
1670 ** Encode UID fields in DN's as DirectoryString.
1671 Before GnuTLS encoded and parsed UID fields as IA5String. This was
1672 incorrect, it should have used DirectoryString. Now it will use
1673 DirectoryString for the UID field, but for backwards compatibility it
1674 will also accept IA5String UID's. Reported by Max Kellermann
1677 ** Improve out-of-sourcedir builds from CVS.
1678 Reported by ludovic.courtes@laas.fr (Ludovic Courtès).
1680 ** Bootstrap tools changed.
1681 We now require autoconf 2.61, automake 1.10, and gettext 0.16, when
1682 building GnuTLS from CVS. Libtool 1.5.22 is used.
1684 ** Fixed a syntax error in lib/gnutls.asn.
1685 Reported by Paul Millar <p.millar@physics.gla.ac.uk>.
1687 ** Added German translation of GnuTLS messages.
1689 ** Update of gnulib files.
1691 ** API and ABI modifications:
1692 No changes since last version.
1694 * Version 1.7.0 (released 2006-11-29)
1696 ** The default protocol priority try TLS 1.1 and TLS 1.2 too.
1697 The details is that the protocol priority set by
1698 `gnutls_set_default_priority' has been changed from TLS 1.0 and SSL
1699 3.0 to TLS 1.2, TLS 1.1, TLS 1.0 and SSL 3.0.
1701 ** Preliminary support for TLS 1.2.
1702 The client has been successfully tested against
1703 https://www.mikestoolbox.org:4433/.
1705 ** Anonself test now print a lot of debugging info, including TLS version.
1707 ** Doc fixes in OpenCDK, to avoid some gtk-doc warnings.
1709 ** Update of gnulib files.
1711 ** API and ABI modifications:
1712 GNUTLS_TLS1_2: New gnutls_protocol_t enum member.
1714 *** Pulled up from stable 1.6.x branch:
1716 ** Fix ./configure failure with non-GCC compilers.
1717 This fixes the following error message:
1718 configure: error: conditional "HAVE_LD_OUTPUT_DEF" was never defined.
1719 Reported by "Michael C. Vergallen" <mvergall@telenet.be>.
1721 * Version 1.6.3 (released 2007-05-26)
1723 ** New API functions to extract DER encoded X.509 Subject/Issuer DN.
1724 Suggested by Nate Nielsen <nielsen-list@memberwebs.com>. Backported
1725 from the 1.7.x branch, see
1726 <http://lists.gnu.org/archive/html/help-gnutls/2007-05/msg00029.html>.
1728 ** Have PKCS8 parser return better error codes.
1729 Reported by Nate Nielsen <nielsen-list@memberwebs.com>, see
1730 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-May/001653.html> and
1731 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-May/001654.html>.
1733 ** Fix mem leak for sessions with client authentication via certificates.
1734 Reported by Andrew W. Nosenko <andrew.w.nosenko@gmail.com>, see
1735 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-April/001539.html>.
1737 ** Fix building of 'tlsia' self test.
1738 Earlier some gcc are known to build tlsia linking to
1739 $prefix/lib/libgnutls-extra.so rather than the libgnutls-extra.so in
1740 the build directory, even though command line parameters look OK.
1741 Changing order of some parameters fixes it.
1743 ** API and ABI modifications:
1744 gnutls_x509_crt_get_raw_issuer_dn: ADD.
1745 gnutls_x509_crt_get_raw_dn: ADD.
1747 * Version 1.6.2 (released 2007-04-18)
1749 ** Fix X.509 signing with RSA-PKCS#1 to set a NULL parameters fields.
1750 Before, we remove the parameters field, which resulted in a slightly
1751 different DER encoding which in turn caused signature verification
1752 failures of GnuTLS-generated RSA certificates in some other
1753 implementations (e.g., GnuPG 2.x's gpgsm). Depending on which RFCs
1754 you read, this may or may not be correct, but our new behaviour appear
1755 to be consistent with other widely used implementations.
1757 ** Regenerate the PKIX ASN.1 syntax tree.
1758 For some reason, after changing the ASN.1 type of ldap-UID in the last
1759 release, the generated C file built from the ASN.1 schema was not
1760 refreshed. This can cause problems when reading/writing UID
1761 components inside X.500 Distinguished Names. Reported by devel
1762 <dev001@pas-world.com>.
1764 ** Updated translations.
1766 ** API and ABI modifications:
1767 No changes since last version.
1769 * Version 1.6.1 (released 2006-12-28)
1771 ** Fix the list of trusted CAs that server's send to clients.
1772 Before, the list contained issuer DN's instead of subject DN's of the
1773 trusted CAs. Reported by Max Kellermann <max@duempel.org>.
1775 ** Fix gnutls_certificate_set_x509_crl to initialize the CRL before using it.
1776 Reported by Max Kellermann <max@duempel.org>.
1778 ** Encode UID fields in DN's as DirectoryString.
1779 Before GnuTLS encoded and parsed UID fields as IA5String. This was
1780 incorrect, it should have used DirectoryString. Now it will use
1781 DirectoryString for the UID field, but for backwards compatibility it
1782 will also accept IA5String UID's. Reported by Max Kellermann
1785 ** Fix ./configure failure with non-GCC compilers.
1786 This fixes the following error message:
1787 configure: error: conditional "HAVE_LD_OUTPUT_DEF" was never defined.
1788 Reported by "Michael C. Vergallen" <mvergall@telenet.be>.
1790 ** API and ABI modifications:
1791 No changes since last version.
1793 * Version 1.6.0 (released 2006-11-17)
1795 ** No changes since 1.5.5.
1796 The major changes compared to the 1.4.x branch are:
1798 *** A GnuTLS C++ library is part of the official distribution.
1799 Currently there are no examples or documentation, but hopefully this
1800 will change. See gnutlsxx.h for the API.
1802 *** Windows is a supported platform.
1803 There are, however, two know bugs. One is related to select() in
1804 command line tools (not, nota bene, in the library), the other is a
1805 problem with libgcrypt that causes delays. Help is needed to resolve
1806 those issues, so we feel we can't delay the release because of this.
1808 *** New APIs for custom push/pull function error reporting.
1809 The new APIs are gnutls_transport_set_errno and
1810 gnutls_transport_set_global_errno. See the release notes for version
1811 1.5.4 for more information.
1813 *** Self tests are run under valgrind, if available. See --disable-valgrind.
1815 * Version 1.5.5 (released 2006-11-16)
1817 ** Correctly bump shared library version after adding new APIs.
1818 This was forgotten in the last release.
1820 ** Fix unsigned vs signed problem in ex-x509-info.c example.
1821 Reported by Tim Kosse <tim.kosse@filezilla-project.org>.
1823 ** Fix the rsa-md5-collision self test to work for MinGW+Wine.
1825 ** Update of gnulib files.
1827 ** API and ABI modifications:
1828 No changes since last version.
1830 * Version 1.5.4 (released 2006-11-07)
1832 ** New API functions to set errno in push/pull functions.
1833 Under Windows, setting the errno variable in a push/pull replacement
1834 may end up setting the wrong errno variable, and GnuTLS send/recv
1835 functions become confused about the real errno returned from a failed
1836 push/pull function. Therefor, we have added two APIs to set the errno
1837 variable used by GnuTLS. The APIs can also help to keep things
1838 thread-safe, by avoiding potentially global variables. Typically,
1839 instead of setting errno in your push/pull function, you will call one
1840 of these functions. It is recommended to use
1841 gnutls_transport_set_errno, but if you don't have the session variable
1842 easily accessible in the push/pull replacement function, you can use
1843 gnutls_transport_set_global_errno. Suggested by Tim Kosse
1844 <tim.kosse@filezilla-project.org>.
1846 void gnutls_transport_set_errno (gnutls_session_t session, int err);
1847 void gnutls_transport_set_global_errno (int err);
1849 ** When calling `recv' or `send' Windows errors are handled properly.
1850 The Windows recv/send functions doesn't use errno, and GnuTLS now use
1851 WSAGetLastError to access the error condition instead.
1853 ** Several OpenPGP API fixes.
1854 All suggested by ludovic.courtes@laas.fr (Ludovic Courtès). The most
1855 important fix is to change the return value of
1856 gnutls_openpgp_privkey_get_pk_algorithm and
1857 gnutls_openpgp_key_get_pk_algorithm from 'int' to
1858 'gnutls_pk_algorithm_t', which is an enum type (and thus API/ABI
1859 compatible with 'int').
1861 ** When a GnuTLS server receive a SSLv2 Client Hello for an unknown TLS
1862 ** version, try to negotiate the highest version support by the GnuTLS server,
1863 ** instead of the lowest.
1864 Reported by <Pasi.Eronen@nokia.com>.
1866 ** Replace old constructs with use of gnulib modules.
1867 For example, we can now assume unistd.h, sys/stat.h, sys/socket.h in
1868 the code. If the headers doesn't exist on the target system, gnulib
1869 will make sure its replacement header files are used instead.
1871 ** Fix SOVERSION computation for *.def files.
1872 This fixes build errors similar to "No rule to make target
1873 `libgnutls-`expr', needed by `all-am'." when building for Windows.
1875 ** gnutls_check-version uses strverscmp from gnulib.
1877 ** Update of gnulib files.
1879 ** API and ABI modifications:
1880 gnutls_transport_set_errno: ADD
1881 gnutls_transport_set_global_errno: ADD
1883 * Version 1.5.3 (released 2006-10-26)
1885 ** Add new self-test of RSA-MD5 signature chains.
1886 Note that we already, since GnuTLS 1.2.9, reject RSA-MD5 signatures
1887 when verifying X.509 chains. The code is in tests/rsa-md5-collision/
1888 and is based on the work by Marc Stevens et al, see
1889 <http://www.win.tue.nl/hashclash/TargetCollidingCertificates/>.
1891 ** Re-factor self tests.
1893 ** The include copy of Libtasn1 is updated to version 0.3.7.
1895 ** The included copy of OpenCDK is updated to version 0.5.11.
1897 ** Fix the filename of the *.def file on Windows after library version bump.
1899 ** Separated the gnulib directory into one for LGPL modules and one for GPL.
1900 This allows the GPL'd part of GnuTLS to take advantage of the GPL'd
1901 gnulib modules. Earlier we could only use the LGPL'ed module from
1902 gnulib, because two gnulib directories in the same project didn't
1905 ** API and ABI modifications:
1906 No changes since last version.
1908 * Version 1.5.2 (released 2006-10-03)
1910 ** Decrement the shared library version back to 13 (as in the 1.4.x branch).
1911 Note that if you installed 1.5.0 or 1.5.1, they will have a higher
1912 shared library version than this version, so you'll have to remove
1913 them and possibly relink your applications. The reason for this is
1914 that no API/ABI changes have been made since the 1.4.x branch, and
1915 that incrementing the shared library version was a mistake. Reported
1916 by Andreas Metzler <ametzler@downhill.at.eu.org>.
1918 ** Fix off-by-one error when computing length to malloc.
1919 The code is used by gnutls_openpgp_add_keyring_file and
1920 gnutls_openpgp_add_keyring_mem. Reported by "Adam Langley"
1921 <agl@imperialviolet.org>.
1923 ** Add version script for the GnuTLS C++ library.
1924 Reported by Andreas Metzler <ametzler@downhill.at.eu.org>.
1926 ** Fix the C++ compiler detection logic.
1927 Reported by Andreas Metzler <ametzler@downhill.at.eu.org>.
1929 ** Update of gnulib files.
1931 ** API and ABI modifications:
1932 No changes since last version.
1934 * Version 1.5.1 (released 2006-09-21)
1936 ** Fix PKCS#1 verification to avoid a variant of Bleichenbacher's
1937 ** Crypto 06 rump session attack.
1938 In particular, we check that the digestAlgorithm.parameters field is
1939 missing or empty, to avoid that it can contain "garbage" that may be
1940 used to alter the numeric properties of the signature. See
1941 <http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html> (which is
1942 not exactly the same as the problem we fix here). Reported by Yutaka
1943 OIWA <y.oiwa@aist.go.jp>.
1945 See GNUTLS-SA-2006-4 on http://www.gnutls.org/security.html for more
1946 up to date information.
1948 ** Add self test to test for above flaw.
1950 ** Fix gnutls-cli-debug regarding resume support detection.
1951 Earlier, if the session-id from the server had a length of 0, it would
1952 indicate the the server supports resumption, which isn't the case.
1953 Reported by Kataja Kai <kai.kataja@op.fi>.
1955 ** Fix building of examples on FreeBSD by including netinet/in.h.
1956 Reported by Roman Bogorodskiy <novel@FreeBSD.org>.
1958 ** Fix certtool bug that caused the private key to not be loaded when
1959 generating a certificate with --load-request, which in turn triggered
1960 another unrelated bug in gnutls_x509_crt_sign2 (also fixed). Reported
1961 by Sascha Ziemann <sascha.ziemann@secunet.com>.
1963 ** gnutls-cli and gnutls-serv works on Windows.
1964 The problem was the select() call that doesn't work on file
1965 descriptors (stdin) on Windows. We borrowed some code from plibc to
1966 solve this. It appears to be somewhat unreliable though.
1968 ** Autoconf 2.60 is now used.
1970 ** API and ABI modifications:
1971 No changes since last version.
1973 * Version 1.5.0 (released 2006-08-13)
1975 ** Change SRP and Cert-Type extensions to match IANA registry.
1977 ** Fixed bug in OpenPGP authentication handshake.
1979 ** Improvements for building under MinGW.
1980 Provides internal inet_ntop and inet_pton functions and arpa/inet.h
1981 header. Calls WSAStartup and WSACleanup in gnutls_global_init and
1982 gnutls_global_deinit, respectively. Loads getaddrinfo and getnameinfo
1983 at run-time from ws2_32.dll, and falls back on a simple replacement if
1984 it is not available. Builds the library with -mms-bitfields
1985 -Wl,--enable-runtime-pseudo-reloc. Links with --output-def, to
1986 create *.def files, which are installed.
1988 ** The examples now (conditionally) include config.h and link to gnulib.
1989 No other source changes were necessary, so the examples should
1990 continue to be possible to use stand-alone without any autoconf or
1993 ** Added C++ header "gnutlsxx.h" and library "libgnutlsxx".
1994 You may unconditionally disable it with --disable-cxx. See
1995 includes/gnutls/gnutlsxx.h and lib/gnutlsxx.cpp for the
1998 ** Made command line tool '--version' behave according to GNU Standards.
1999 This enables 'make distcheck' to succeed.
2001 ** OpenCDK updated to 0.5.9 to fix some problems with OpenPGP support.
2003 ** Make --without-included-libtasn1 work.
2004 Reported by Daniel Black <dragonheart@gentoo.org>.
2006 ** Fix a crash (strcmp() on a NULL value) in the certificate verification logic.
2007 See http://www.gnu.org/software/gnutls/security.html regardging
2008 GNUTLS-SA-2006-2 for more up to date information. Reported by
2009 satyakumar <satyam_kkd@hyd.hellosoft.com>.
2011 ** API and ABI modifications:
2012 No changes since last version.
2014 * Version 1.4.5 (released 2006-11-06)
2016 ** When a GnuTLS server receive a SSLv2 Client Hello for an unknown TLS
2017 ** version, try to negotiate the highest version support by the GnuTLS server,
2018 ** instead of the lowest.
2019 Reported by <Pasi.Eronen@nokia.com>.
2021 ** Fix typo in doc/examples/ex-serv-pgp.c.
2022 Reported by Adam Langley" <agl@imperialviolet.org>.
2024 ** API and ABI modifications:
2025 No changes since last version.
2027 * Version 1.4.4 (released 2006-09-12)
2029 ** Relax the test that caught signatures that exploit the variant of
2030 ** Bleichenbacher's Crypto 06 rump session attack on our
2031 ** verification logic flaw.
2032 In particular, we now permit the digestAlgorithm.parameters field to
2033 be present but empty, whereas in 1.4.3 we actually checked that the
2036 ** Revert the removal of debug information for the GNUTLS-SA-2006-3 problem.
2037 The messages are only printed in debug mode, which is not recommended
2038 for normal use, and thus logging this situation cannot be abused as an
2039 oracle in typical recommended situations.
2041 ** API and ABI modifications:
2042 No changes since last version.
2044 * Version 1.4.3 (released 2006-09-08)
2046 ** Fix PKCS#1 verification to avoid a variant of Bleichenbacher's
2047 ** Crypto 06 rump session attack.
2048 In particular, we check that the digestAlgorithm.parameters field is
2049 empty, to avoid that it can contain "garbage" that may be used to
2050 alter the numeric properties of the signature. See
2051 <http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html> (which is
2052 not exactly the same as the problem we fix here). Reported by Yutaka
2053 OIWA <y.oiwa@aist.go.jp>.
2055 See GNUTLS-SA-2006-4 on http://www.gnutls.org/security.html for more
2056 up to date information.
2058 ** Fix PKCS#1 decryption to avoid Bleichenbacher's Crypto 98 attack.
2059 See <http://www.bell-labs.com/user/bleichen/papers/pkcs.ps.gz>.
2060 Reported by Werner Koch <wk@gnupg.org>.
2062 See GNUTLS-SA-2006-3 on http://www.gnutls.org/security.html for more
2063 up to date information.
2065 ** Fix crash in gnutls_x509_crt_sign2 if passed a NULL issuer_key.
2067 ** API and ABI modifications:
2068 No changes since last version.
2070 * Version 1.4.2 (released 2006-08-12)
2072 ** Fix a crash (strcmp() on a NULL value) in the certificate verification logic.
2073 This can happen if you call gnutls_certificate_verify_peers2 and have
2074 a certain mix of local CA certificates and the peer send special
2075 certificates, that together trigger certain behaviour. It is not
2076 known at this point whether the crash can be triggered without the
2077 special local CA certificate, and thus turn this into a remote crash
2078 of clients that verify server certificates when they talk to a server
2079 with the special server certificate. See GNUTLS-SA-2006-2 on
2080 http://www.gnu.org/software/gnutls/security.html for more up to date
2081 information. Reported by satyakumar <satyam_kkd@hyd.hellosoft.com>.
2083 ** Change SRP and Cert-Type extensions to match IANA registry.
2085 ** OpenCDK updated to 0.5.9 to fix some problems with OpenPGP support.
2087 ** Make --without-included-libtasn1 work.
2088 Reported by Daniel Black <dragonheart@gentoo.org>.
2090 ** API and ABI modifications:
2091 No changes since last version.
2093 * Version 1.4.1 (released 2006-06-14)
2095 ** Replaced inactive ifdefs to enable openpgp support in test programs.
2097 ** Fixed bug in OpenPGP authentication handshake.
2099 ** Fixed typographical in man pages.
2101 ** Build fixes of the manual.
2103 ** Added Swedish translation.
2105 ** API and ABI modifications:
2106 No changes since last version.
2108 * Version 1.4.0 (released 2006-05-15)
2110 ** Remove GnuTLS 0.8.x compatibility functions.
2112 ** The libgcrypt RNG is initialized in gnutls_global_init().
2114 ** TLS/IA API changes from Emile van Bergen.
2115 A dummy credential structure is not needed now, if you wish to use the
2116 low-level TLS/IA API, simply call gnutls_ia_enable to enable TLS/IA on
2119 ** The self-tests are now run under valgrind, if it is installed.
2121 ** Libtasn1 is updated to 0.3.4, and that version is now required.
2123 ** The command line tools now use getaddrinfo and support IPv6.
2125 ** API and ABI modifications:
2126 _gnutls_x509_get_raw_crt_activation_time,
2127 _gnutls_x509_get_raw_crt_expiration_time: Removed.
2128 gnutls_ia_require_inner_phase: Removed, replaced by gnutls_ia_enable.
2129 gnutls_ia_enable: Added.
2131 * Version 1.3.5 (released 2006-03-08)
2133 ** Error messages are now translated using GNU Gettext.
2135 ** The function gnutls_x509_crt_to_xml now return an internal error.
2136 This means that the code to convert X.509 certificates to XML format
2137 does not work any more. The reason is that the function called
2138 libtasn1 internal functions. It seems unclean for libtasn1 to export
2139 the APIs needed here. Instead it would be better to implement XML
2140 support inside libtasn1 properly. If you need this functionality
2141 strongly, please consider looking into implementing this suggested
2142 approach instead. As a workaround, you may also modify lib/x509/xml.c
2143 (change '#if 1' to '#if 0') and build using --with-included-libtasn1.
2145 ** Libraries are now built with libtool's -no-undefined.
2146 This helps producing libraries for Windows using mingw32.
2148 ** Doc fixes to explain that gnutls_record_send can block.
2150 ** Libtasn1 0.3.1 or later is now required.
2151 The include copy has been updated too.
2153 ** gnutls-cli can now recognize services and port numbers with the -p option.
2155 ** API and ABI modifications:
2156 No changes since last version.
2158 * Version 1.3.4 (released 2006-02-09)
2160 ** Fix read of out bounds bug in DER parser.
2161 Reported by Evgeny Legerov <admin@gleg.net>, and debugging help from
2162 Protover SSL. Libtasn1 0.2.18 is now required, which contains the
2163 previous bug fix. The included libtasn1 version in GnuTLS has been
2166 ** Fixed bug in non-blocking gnutls_bye(). gnutls_record_send() will no
2167 longer invalidate a session if the underlying send fails, but it will
2168 prevent future writes. That is to allow reading the already received data.
2169 Patches and bug reports by Yoann Vandoorselaere <yoann@prelude-ids.org>
2171 ** Corrected bugs in gnutls_certificate_set_x509_crl() and
2172 gnutls_certificate_set_x509_trust(), that caused memory corruption if
2173 more than one certificates were added. Report and patch by Max Kellermann.
2175 ** Fix build problems of OpenCDK on AIX.
2176 Thanks to "Heiden, John" <JHeiden@UTNet.UToledo.Edu>.
2178 ** API and ABI modifications:
2179 No changes since last version.
2181 * Version 1.3.3 (released 2006-01-12)
2183 ** New API to access the TLS master secret.
2184 When possible, you should use the TLS PRF functions instead.
2185 Suggested by Jouni Malinen <jkmaline@cc.hut.fi>.
2187 ** Improved handling when multiple libraries use GnuTLS at the same time.
2188 Now gnutls_global_init() can be called multiple times, and
2189 gnutls_global_deinit() will only deallocate the structure when it has
2190 been called as many times as gnutls_global_init() was called.
2192 ** Added a self test of TLS resume functionality.
2194 ** Fix crash in TLS resume code, caused by TLS/IA changes.
2196 ** Documentation fixes about thread unsafety, prompted by
2197 ** discussion with bryanh@giraffe-data.com (Bryan Henderson).
2198 In particular, gnutls_global_init() and gnutls_global_deinit() are not
2199 thread safe. Careful callers may want to protect the call using a
2200 mutex. The problem could also be ignored, which would cause a memory
2201 leak under rare conditions when two threads invoke the function
2202 roughly at the same time.
2204 ** Add 'const' keywords in various places, from Frediano ZIGLIO.
2206 ** The code was indented again, including the external header files.
2208 ** API and ABI modifications:
2209 New functions to retrieve the master secret value:
2210 gnutls_session_get_master_secret
2212 Add a 'const' keyword to existing API:
2213 gnutls_x509_crq_get_challenge_password
2215 * Version 1.3.2 (released 2005-12-15)
2217 ** GnuTLS now support TLS Inner application (TLS/IA).
2218 This is per draft-funk-tls-inner-application-extension-01. This
2219 functionality is added to libgnutls-extra, so it is licensed under the
2220 GNU General Public License.
2222 ** New APIs to access the TLS Pseudo-Random-Function (PRF).
2223 The PRF is used by some protocols building on TLS, such as EAP-PEAP
2224 and EAP-TTLS. One function to access the raw PRF and one to access
2225 the PRF seeded with the client/server random fields are provided.
2226 Suggested by Jouni Malinen <jkmaline@cc.hut.fi>.
2228 ** New APIs to acceess the client and server random fields in a session.
2229 These fields can be useful by protocols using TLS. Note that these
2230 fields are typically used as input to the TLS PRF, and if this is your
2231 intended use, you should use the TLS PRF API that use the
2232 client/server random field directly. Suggested by Jouni Malinen
2233 <jkmaline@cc.hut.fi>.
2235 ** Internal type cleanups.
2236 The uint8, uint16, uint32 types have been replaced by uint8_t,
2237 uint16_t, uint32_t. Gnulib is used to guarantee the presence of
2238 correct types on platforms that lack them. The uint type have been
2239 replaced by unsigned.
2241 ** API and ABI modifications:
2242 New functions to invoke the TLS Pseudo-Random-Function (PRF):
2246 New functions to retrieve the session's client and server random values:
2247 gnutls_session_get_server_random
2248 gnutls_session_get_client_random
2250 New function, to perform TLS/IA handshake:
2253 New function to decide whether to do a TLS/IA handshake:
2254 gnutls_ia_handshake_p
2256 New functions to allocate a TLS/IA credential:
2257 gnutls_ia_allocate_client_credentials
2258 gnutls_ia_free_client_credentials
2259 gnutls_ia_allocate_server_credentials
2260 gnutls_ia_free_server_credentials
2262 New functions to handle the AVP callback:
2263 gnutls_ia_set_client_avp_function
2264 gnutls_ia_set_client_avp_ptr
2265 gnutls_ia_get_client_avp_ptr
2266 gnutls_ia_set_server_avp_function
2267 gnutls_ia_set_server_avp_ptr
2268 gnutls_ia_get_server_avp_ptr
2270 New functions, to toggle TLS/IA application phases:
2271 gnutls_ia_require_inner_phase
2273 New function to mix session keys with inner secret:
2274 gnutls_ia_permute_inner_secret
2276 Low-level API (used internally by gnutls_ia_handshake):
2277 gnutls_ia_endphase_send
2281 New functions that can be used after successful TLS/IA negotiation:
2282 gnutls_ia_generate_challenge
2283 gnutls_ia_extract_inner_secret
2285 Enum type with TLS/IA modes:
2288 Enum type with TLS/IA packet types:
2291 Enum values for TLS/IA alerts:
2292 GNUTLS_A_INNER_APPLICATION_FAILURE
2293 GNUTLS_A_INNER_APPLICATION_VERIFICATION
2295 New error codes, to signal when an application phase has finished:
2296 GNUTLS_E_WARNING_IA_IPHF_RECEIVED
2297 GNUTLS_E_WARNING_IA_FPHF_RECEIVED
2299 New error code to signal TLS/IA verify failure:
2300 GNUTLS_E_IA_VERIFY_FAILED
2302 * Version 1.3.1 (released 2005-12-08)
2304 ** Support for DHE-PSK cipher suites has been added.
2305 This method offers perfect forward secrecy.
2307 ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to
2308 Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>.
2310 ** Corrected a bug in certtool for 64 bit machines. Reported
2311 by Max Kellermann <max@duempel.org>.
2313 ** New function to set a X.509 private key and certificate pairs, and/or
2314 CRLs, from an PKCS#12 file, suggested by Emile van Bergen
2315 <emile@e-advies.nl>.
2317 The integrity of the PKCS#12 file is protected through a password
2318 based MAC; public-key based signatures for integrity protection are
2319 not supported. PKCS#12 bags may be encrypted using password derived
2320 symmetric keys, public-key based encryption is not supported. The
2321 PKCS#8 keys may be encrypted using passwords. The API use the same
2322 password for all operations. We believe that any more flexibility
2323 create too much complexity that would hurt overall security, but may
2324 add more PKCS#12 related APIs if real-world experience indicate
2327 ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys,
2328 reported by Emile van Bergen <emile@e-advies.nl>.
2329 This will enable "certtool -k -8" to parse those keys.
2331 ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords.
2332 Use "certtool -p -8" and press press enter at the prompt. Earlier,
2333 certtool would have encrypted the key using an empty password.
2335 ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys.
2336 Earlier it would have prompted the user for it, even if --password was
2339 ** Added self test of PKCS#8 parsing.
2340 Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and
2341 pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in
2344 ** API and ABI modifications:
2345 New function to set X.509 credentials from a PKCS#12 file:
2346 gnutls_certificate_set_x509_simple_pkcs12_file
2348 New gnutls_kx_algorithm_t enum type:
2351 New API to return session data (basically same as gnutls_session_get_data):
2352 gnutls_session_get_data2
2354 New API to set PSK Diffie-Hellman parameters:
2355 gnutls_psk_set_server_dh_params
2357 * Version 1.3.0 (2005-11-15)
2359 ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added.
2360 This add several new APIs, see below. Read the updated manual for
2361 more information. A new self test "pskself" has been added, that will
2362 test this functionality.
2364 ** The session resumption data are now system independent.
2366 ** The code has been re-indented to conform to the GNU coding style.
2368 ** Removed the RIPEMD ciphersuites.
2370 ** Added a discussion of the internals of gnutls in manual.
2372 ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin.
2374 ** Remove trailing comma in enums, for IBM C v6, from Albert Chin.
2376 ** Make sure config.h is included first in a few files, from Albert Chin.
2378 ** Don't use C++ comments ("//") as they are invalid, from Albert Chin.
2380 ** Don't install SRP programs and man pages if --disable-srp-authentication,
2383 ** API and ABI modifications:
2384 New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK
2386 New gnutls_credentials_type_t credential type:
2389 New credential types:
2390 gnutls_psk_server_credentials_t
2391 gnutls_psk_client_credentials_t
2393 New functions to allocate PSK credentials:
2394 gnutls_psk_allocate_client_credentials
2395 gnutls_psk_free_client_credentials
2396 gnutls_psk_free_server_credentials
2397 gnutls_psk_allocate_server_credentials
2399 New enum type for PSK key flags:
2400 gnutls_psk_key_flags
2402 New function prototypes for credential callback:
2403 gnutls_psk_client_credentials_function
2404 gnutls_psk_server_credentials_function
2406 New function to set PSK username and key:
2407 gnutls_psk_set_client_credentials
2409 New function to set PSK passwd file:
2410 gnutls_psk_set_server_credentials_file
2412 New function to extract PSK user in server:
2413 gnutls_psk_server_get_username
2415 New functions to set PSK callback:
2416 gnutls_psk_set_server_credentials_function
2417 gnutls_psk_set_client_credentials_function
2419 Use size_t instead of int for output size parameter:
2420 gnutls_srp_base64_encode
2421 gnutls_srp_base64_decode
2423 * Version 1.2.11 (2006-05-11)
2424 - The function gnutls_x509_crt_to_xml is not supported any more, and
2425 return an internal error. The reason is that the function called
2426 internal libtasn1 functions which are no longer exported from
2428 - Updated libtasn1 requirement to 0.3.4 and refreshed internal mintiasn1.
2429 - Updated gnulib compatibility files.
2430 - Fixed _gnutls_x509_get_raw_crt_expiration_time and
2431 _gnutls_x509_get_raw_crt_activation_time to return (time_t)-1 on errors.
2432 - API and ABI modifications:
2433 No changes since last version.
2435 * Version 1.2.10 (2006-02-09)
2436 - Fix read out bounds bug in DER parser. Reported by Evgeny Legerov
2437 <admin@gleg.net>, and debugging help from Protover SSL.
2438 - Libtasn1 0.2.18 is now required (contains the previous bug fix).
2439 The included version has been updated too.
2440 - Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to
2441 Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>.
2442 - Corrected a bug in certtool for 64 bit machines. Reported
2443 by Max Kellermann <max@duempel.org>.
2444 - Corrected bugs in gnutls_certificate_set_x509_crl() and
2445 gnutls_certificate_set_x509_trust(), that caused memory corruption if
2446 more than one certificates were added. Report and patch by Max Kellermann.
2447 - Fixed bug in non-blocking gnutls_bye(). gnutls_record_send() will no
2448 longer invalidate a session if the underlying send fails, but it will
2449 prevent future writes. That is to allow reading the already received data.
2450 Patches and bug reports by Yoann Vandoorselaere <yoann@prelude-ids.org>
2452 * Version 1.2.9 (2005-11-07)
2453 - Documentation was updated and improved.
2454 - RSA-MD2 is now supported for verifying digital signatures.
2455 - Due to cryptographic advances, verifying untrusted X.509
2456 certificates signed with RSA-MD2 or RSA-MD5 will now fail with a
2457 GNUTLS_CERT_INSECURE_ALGORITHM verification output. For
2458 applications that must remain interoperable, you can use the
2459 GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 or GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5
2460 flags when verifying certificates. Naturally, this is not
2461 recommended default behaviour for applications. To enable the
2462 broken algorithms, call gnutls_certificate_set_verify_flags with the
2463 proper flag, to change the verification mode used by
2464 gnutls_certificate_verify_peers2.
2465 - Make it possible to send empty data through gnutls_record_send,
2466 to align with the send(2) API.
2467 - Some changes in the certificate receiving part of handshake to prevent
2468 some possible errors with non-blocking servers.
2469 - Added numeric version symbols to permit simple CPP-based feature
2470 tests, suggested by Daniel Stenberg <daniel@haxx.se>.
2471 - The (experimental) low-level crypto alternative to libgcrypt used
2472 earlier (Nettle) has been replaced with crypto code from gnulib.
2473 This leads to easier re-use of these components in other projects,
2474 leading to more review and simpler maintenance. The new configure
2475 parameter --with-builtin-crypto replace the old --with-nettle, and
2476 must be used if you wish to enable this functionality. See README
2477 under "Experimental" for more information. Internally, GnuTLS has
2478 been updated to use the new "Generic Crypto" API in gl/gc.h. The
2479 API is similar to the old crypto/gc.h, because the gnulib code were
2480 based on GnuTLS's gc.h.
2481 - Fix compiler warning in the "anonself" self test.
2482 - API and ABI modifications:
2483 gnutls_x509_crt_list_verify: Added 'const' to prototype in <gnutls/x509.h>.
2484 This doesn't reflect a change in behaviour,
2485 so we don't break backwards compatibility.
2486 GNUTLS_MAC_MD2: New gnutls_mac_algorithm_t value.
2487 GNUTLS_DIG_MD2: New gnutls_digest_algorithm_t value.
2488 GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2,
2489 GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5: New gnutls_certificate_verify_flags values.
2491 gnutls_x509_crt_list_verify,
2492 gnutls_x509_crt_verify, or
2493 gnutls_certificate_set_verify_flags.
2494 GNUTLS_CERT_INSECURE_ALGORITHM: New gnutls_certificate_status_t value,
2495 used when broken signature algorithms
2496 is used (currently RSA-MD2/MD5).
2497 LIBGNUTLS_VERSION_MAJOR,
2498 LIBGNUTLS_VERSION_MINOR,
2499 LIBGNUTLS_VERSION_PATCH,
2500 LIBGNUTLS_VERSION_NUMBER: New CPP symbols, indicating the GnuTLS
2501 version number, can be used for feature existence
2504 * Version 1.2.8 (2005-10-07)
2505 - Libgcrypt 1.2.2 is required to fix a bug for forking GnuTLS servers.
2506 - Don't install the auxilliary libexamples library used by the
2507 examples in doc/examples/ on "make install", report and tiny patch
2508 from Thomas Klausner <tk@giga.or.at>.
2509 - If you pass a X.509 CA or PGP trust database to the command line
2510 tool, it will now abort the connection if the server certificate
2511 validation fails. Use the parameter --insecure to continue even
2512 after certificate validation failures. Inspired from discussion
2513 with Alexander Kotelnikov <sacha@myxomop.com>.
2514 - The test for socklen_t has been moved to gnulib.
2515 - Link failures for duplicate or missing "program_name" symbol has been fixed,
2516 patch from Martin Lambers <marlam@marlam.de>.
2517 - The command line tool and the examples no longer uses mmap or bzero,
2518 to make them more portable, patch from Martin Lambers
2520 - Made the PKCS #12 API handle null passwords. Based on patch by
2521 Anton Altaparmakov <aia21@cam.ac.uk>.
2522 - The GTK-DOC manual should build with current released tools.
2523 (But a copy of the output is included, so the tools are not required.)
2524 - The inet_ntop function is now used through gnulib.
2525 - API and ABI modifications:
2526 No changes since last version.
2528 * Version 1.2.7 (2005-09-09)
2529 - The GNUTLS and GNUTLS-EXTRA libraries are now built with versioned symbols.
2530 - Certtool now complains when reading out-of-range X.509 serial
2531 numbers, suggested by Fran <e_agf@yahoo.es>.
2532 - Certtool now uses the readline library (when available) when reading
2533 X.509 serial numbers.
2534 - Fixed build problems in getpass on uClibc and Mingw32 platforms.
2535 - Fixed compile warning regarding socklen_t on Mingw32, reported by
2536 Martin Lambers <marlam@marlam.de>.
2537 - Fixed examples in doc/examples/, suggested by Fran <e_agf@yahoo.es>.
2538 - Gnulib is now used for the core library, enabling future code cleanups.
2539 - The gnutls-cli tool now use gnutls_certificate_verify_peers2,
2540 suggested by Daniel Stenberg <daniel@haxx.se>.
2541 - Doc fixes for gnutls_transport_set_push and gnutls_transport_set_pull.
2542 - Minilibtasn1 is now 0.2.17 (removed optional use of C99 macros).
2543 - Disable zlib support if zlib.h is not present.
2544 - A number of internal cleanups.
2545 - API and ABI modifications:
2546 No changes since last version.
2548 * Version 1.2.6 (2005-07-16)
2549 - MiniLZO updated to version 2.01 and moved to separate directory.
2550 - Collision between system LZO header files and MiniLZO header file
2551 fixed, reported by Matthias Urlichs <smurf@smurf.noris.de>.
2552 - Will now test for liblzo functionality in liblzo2 too, reported by
2553 Thomas Klausner <tk@giga.or.at>.
2554 - Minilibtasn1 is now 0.2.14 (no code changes).
2555 - Some code changes to avoid GTK-DOC warnings.
2556 - API and ABI modifications:
2557 No changes since last version.
2559 * Version 1.2.5 (2005-07-03)
2560 - More builddir != srcdir fixes, reported by Mike Castle
2561 <dalgoda@ix.netcom.com>.
2562 - Fixed off-by-one bug in the size parameter of gnutls_x509_crt_get*_dn,
2563 reported by Adam Langley <alangley@gmail.com>.
2564 - Corrected some stuff in minilzo detection. Pointed out by
2566 - MiniLZO updated to version 2.00.
2567 - gnutls_x509_crt_list_import now accept a DER formatted CRL.
2568 - API and ABI modifications:
2569 No changes since last version.
2571 * Version 1.2.4 (2005-05-28)
2572 - Corrected some bugs that could affect 64 bit systems.
2573 - Some corrections in the header files to include the prototype
2574 of memmem properly (affected 64 bit systems). Report and patch
2575 by Yoann Vandoorselaere <yoann@prelude-ids.org>.
2576 - Introduced the --fix-key option to certtool, which can be used to
2577 regenerate the (optional) parameters in a private key. It should
2578 be used together with --key-info.
2579 - Corrected a bug in certificate chain verification that could lead
2580 to marking a trusted chain as non trusted, if the last certificate in
2581 the chain was a self signed one.
2582 - Gnulib portability files were updated.
2583 - License were updated to reflect new FSF address.
2584 - API and ABI modifications:
2585 No changes since last version.
2587 * Version 1.2.3 (2005-04-28)
2588 - Corrected bug in record packet parsing that could lead
2589 to a denial of service attack.
2590 - Corrected bug in RSA key export. Previously exported keys
2591 can be fixed using certtool. Use certtool -k <infile >outfile
2592 - API and ABI modifications:
2593 gnutls_x509_privkey_fix(): Add.
2595 * Version 1.2.2 (2005-04-25)
2596 - gnutls_error_to_alert() now considers
2597 GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET.
2598 - Fixed error in session resuming that could cause a crash in a session.
2599 - Fixed pkcs12 friendly name and local key identifier decoding.
2600 - Internal cleanups, removed duplicate typedef/struct definitions,
2601 and made source code include external include file, to check
2602 function prototypes during compile time.
2603 - API and ABI modifications:
2604 No changes since last version. At least not intentional, but due
2605 to the include header changes, there may be inadvertant changes,
2606 please let us know if you find any.
2608 * Version 1.2.1 (2005-04-04)
2609 - gnutls_bye() will no longer fail when RDWR is used and application
2610 data are available for reading.
2611 - Added more strict checks for the SRP parameters (g,n), when they
2612 are not in the included list.
2613 - Added warning to certtool when MD5 is being used for digital
2615 - Optimizations ("-O2 -finline-functions") are not enabled by default,
2616 instead the standard autoconf defaults are used. Use `./configure
2617 CFLAGS="-O2 -finline-functions"' to get the old optimizations.
2618 - Added the option --get-dh-params to certtool, in order to get the
2619 parameters included in the library primes and generators.
2620 - Improved the semantics of GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, to
2621 allow only trusted Version 1 CAs and introduced
2622 GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT which has the old semantics.
2623 - Nettle self tests now build properly, reported by Pierre
2624 <pierre42d@9online.fr>.
2625 - Eliminated some memory leaks in DHE and RSA-EXPORT cipher suites.
2626 Reported by Yoann Vandoorselaere <yoann@prelude-ids.org>.
2627 - If the library has been compiled with features disabled, a warning is
2628 issued during the compilation of any program.
2629 - API and ABI modifications:
2630 gnutls_x509_crt_list_import(): Add
2631 gnutls_x509_crq_get_attribute_by_oid(): Add.
2632 gnutls_x509_crq_set_attribute_by_oid(): Add
2633 gnutls_x509_crt_set_extension_by_oid(): Add.
2634 GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT: Modify semantics.
2635 GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT: Add, old behaviour.
2637 * Version 1.2.0 (2005-01-27)
2638 - Added the definitions and OIDs for the RIPEMD-160 hash algorithm.
2639 - Introduced gnutls_x509_crt_sign2(), gnutls_x509_crq_sign2() and
2640 gnutls_x509_crl_sign2().
2641 - Fixed license header in source code files.
2643 * Version 1.1.23 (2005-01-18)
2644 - It is now possible to generate PKCS#12 structures without private
2645 keys using "certtool --to-p12", suggested by Fabian Fagerholm
2647 - Certtool now prints information for the RSA and DSA parameters of
2648 certificates and private keys.
2649 - Corrected the write of CRL distribution points.
2650 - The certificate chain verification function now checks certificates
2651 in the reverse order to minimize the spent resources.
2652 - Corrected several bugs found by Marcin Garski <mgarski@post.pl>
2653 - The functions gnutls_x509_crl_get_issuer_dn, gnutls_x509_crq_get_dn,
2654 gnutls_x509_crt_get_issuer_dn, gnutls_x509_crt_get_dn, and
2655 gnutls_x509_rdn_get now set *sizeof_buf to the buffer length that is
2656 required, instead of the string length. That is, the value has been
2657 incremented by 1 to account for the terminating zero. Reported by
2658 Martin Lambers <marlam@web.de>.
2659 - Debug output shouldn't crash on platforms that doesn't handle NULL
2660 printf %s values. Reported by Michael.Ringe@aachen.utimaco.de.
2661 - Sync included copy of libtasn1 with version 0.2.13.
2662 - Client X.509 authenticated connections via gnutls-cli should now work again.
2664 * Version 1.1.22 (2004-11-04)
2665 - Replace GNU LD version script with Libtool -export-symbols-regex,
2666 from Joe Orton <joe@manyfish.co.uk>.
2667 - Documentation improvements.
2668 - Code indented using 'indent -i4 -kr'.
2669 - The API manual is included in Devhelp format. (Was in last release too,
2670 but the NEWS entry was forgotten.)
2671 - The OpenSSL compatibility code now use the internal crypto interface.
2672 - Added simple self test of OpenSSL compatibility library.
2673 - Internally, libtool convenience libraries are used.
2674 - Cleanups to configure.ac.
2676 * Version 1.1.21 (2004-10-27)
2677 - Print DN of certificates with unknown characters in them, but in hexform
2679 - Added second precision to the X.509 parsing and generation functions.
2680 - Corrected bug in _gnutls_x509_get_dn_oid(), and returns the
2682 - Add parameter --la-file to libgnutls-config and libgnutls-extra-config,
2683 tiny patch contributed by Joe Orton <joe@manyfish.co.uk>.
2684 - Add pkg-config meta files, suggested by Stéphane LOEUILLET
2685 <stephane.loeuillet@tiscali.fr>.
2686 - Fix memory initializaion bug in gnutls_certificate_set_x509_trust,
2687 tiny patch by Aleix Conchillo Flaque <aleix@member.fsf.org>.
2688 - Add self test of PKCS#12 functionality in "certtool", based on test
2689 vectors from Joe Orton <joe@manyfish.co.uk>.
2690 - Fix library order in libgnutls*-config --libs output, to permit
2691 static linking, reported by Yoann Vandoorselaere
2692 <yoann@prelude-ids.org>.
2694 * Version 1.1.20 (2004-10-12)
2695 - Fix compile problem in gl/getpass.c on some systems.
2697 * Version 1.1.19 (2004-10-07)
2698 - Fix memory leak in gnutls_certificate_verify_peers and
2699 gnutls_certificate_free_credentials, report and patch by Simon
2700 Posnjak <simon.posnjak@cetrtapot.si>.
2701 - Fix crash in `certtool --to-p12 --load-privkey foo', i.e. exporting
2702 a key and no certificate to PKCS#12.
2703 - Fix objdir != srcdir builds, reported by "Gerrit P. Haase"
2704 <gp@familiehaase.de>.
2705 - Fixes faulty getpass implementation in libextra/opencdk/, reported
2706 by Yoann Vandoorselaere <yoann@prelude-ids.org>.
2707 - Uses memmem instead of strnstr in lib/.
2708 - Using more GNULib portability files, although not yet inside lib/.
2709 - Added gnutls_certificate_verify_peers to gnutls/compat.h.
2710 Nikos deprecated gnutls_certificate_verify_peers in favor of
2711 gnutls_certificate_verify_peers2 earlier in the 1.1 branch.
2712 - Improvements to the manual.
2713 - Add new example "ex-rfc2818" for certificate verification, from Nikos.
2714 - Known bug: the library require snprintf. This has not yet been
2715 fixed, but will be handled via GNULib later on.
2717 * Version 1.1.18 (2004-08-24)
2718 - Corrected handling of certificate with dates after year 2038.
2719 - Corrected DER decoder which could incorrectly treat input as BER and fail.
2720 - Correct certtool --smime-to-p7 end of line character handling.
2721 - Added example client and server for anonymous authentication.
2722 - Added self test that tests anonymous TLS client and server.
2723 - Added self tests of Nettle and generic crypto layer.
2724 - Added API reference manual in HTML format in doc/reference/ using GTK-DOC.
2725 Online version at <http://www.gnu.org/software/gnutls/reference/>.
2726 - Assume C89 or better; removed checks for size_t, ptrdiff_t and time_t.
2727 - Man pages for API functions are included.
2729 * Version 1.1.17 (2004-08-18)
2730 - Bug fix of padding string in RSA PKCS#1 v1.5 type 2 encryption,
2731 reported by Robey Pointer <robey@danger.com>.
2732 - Generic crypto interface for secret key ciphers, hashes and randomness added.
2733 See section "Experimental" within section "COMPILATION ISSUES" in README.
2734 - Removed length limit on passwords read by 'certtool'.
2735 - Documentation fixes.
2737 * Version 1.1.16 (2004-08-15)
2738 - Fix missing gnulib linker parameter when building certtool.
2739 - Add gnulib module 'progname', needed by module 'error'.
2740 - Improve building with srcdir != objdir.
2742 * Version 1.1.15 (2004-08-15)
2743 - Certtool has simplistic --smime-to-p7 to translate RFC 2633 messages into
2745 - Ported to Mac OS X / Darwin.
2746 - Ported to FreeBSD.
2748 * Version 1.1.14 (2004-08-09)
2749 - Documentation converted to Texinfo format.
2750 - Bug fix of test suite.
2751 - Configure now print build information, used by Autobuild.
2753 * Version 1.1.13 (2004-08-05)
2754 - Added simple self test suite.
2756 * Version 1.1.12 (2004-08-02)
2757 - Updated the SRP authentication to conform to the
2758 latest (yet unreleased) draft. Unfortunately this breaks
2759 compatibility with previous versions.
2760 - Changed the makefiles to be more portable.
2761 - SRP ciphersuites were moved to the gnutls library.
2762 - Added some default limits in the verification of certificate
2763 chains, to avoid denial of service attacks. Also added
2764 gnutls_certificate_set_verify_limits() to override them.
2765 Issue pointed out by Patrik Hornik <patrik@hornik.sk>.
2766 - Added gnutls_certificate_verify_peers2().
2768 * Version 1.1.11 (2004-07-16)
2769 - Added the '_t' suffix to all exported symbols.
2770 - Fixed bug in RSA encryption, report and patch by Martijn Koster
2771 <mak@greenhills.co.uk>.
2772 - Corrected a bug in certificate verification. Pointed out by
2773 Yoann Vandoorselaere <yoann@prelude-ids.org>
2774 - Added the GNUTLS_VERIFY_DO_NOT_ALLOW_SAME flags to the
2775 verification functions.
2776 - The ephemeral DH and RSA parameters are no longer stored in the
2778 - Do not free the SRP (prime and generator) parameters obtained from the
2779 callback if they are the static ones defined in extra.h
2780 - Eliminated some memory leaks. Reported by Yoann Vandoorselaere.
2782 * Version 1.1.10 (2004-06-12)
2783 - Added gnutls_sign_algorithm_get_name() and gnutls_pk_algorithm_get_name()
2784 - Corrected bug in TLS renegotiation.
2785 - Corrected bug in OpenPGP key loading using a callback.
2786 - gnutls-srpcrypt was renamed to srptool
2787 - Allow handshake requests by the client.
2788 - Automatically disable certificate types that do not have corresponding
2790 - Added gnutls_auth_client_get_type() and gnutls_auth_server_get_type()
2791 - Opencdk library is being included if not found.
2792 - certtool can now add ip address SAN extension.
2793 - certtool has now support for more X.520 DN attribute types.
2794 - Better handling of EOF in gnutls_record_recv().
2795 - _gnutls_deinit() is no longer used. Sessions are not
2796 automatically removed any more, on abnormal termination.
2797 - Corrected session resuming in SRP ciphersuites.
2798 - Updated to conform to the latest srp draft (draft-ietf-tls-srp-07)
2799 - Added new functions to allow access to the ephemeral
2800 Diffie Hellman parameters.
2801 - Added the functions gnutls_x509_crt_get_pk_rsa_raw() and
2802 gnutls_x509_crt_get_pk_dsa_raw() to retrieve parameters from certificates.
2803 - Added the functions gnutls_dh_get_group(), gnutls_dh_get_pubkey() and
2804 gnutls_rsa_export_get_pubkey() to retrieve parameters of the DH or
2805 RSA-EXPORT key exchange.
2806 - Some fixes in the session resuming code.
2807 - Added gnutls_openpgp_keyring_check_id().
2809 * Version 1.1.9 (2004-04-14)
2810 - Added support for authority key identifier and the extended key usage
2811 X.509 extension fields. The certtoool was updated to support them.
2812 - The RC2 cipher is no more included. The one in libgcrypt is now used.
2813 - Added batch support to certtool. Now it can use templates.
2815 * Version 1.1.8 (2004-04-07)
2816 - Implemented all the tests for the SRP group parameters in
2817 client side. This may lead to incompatibility with very
2819 - Corrected bug in RSA parameters handling which could cause
2821 - Optimized the copying of rsa_params.
2823 * Version 1.1.7 (2004-03-29)
2824 - Added gnutls_certificate_set_params_function() and
2825 gnutls_anon_set_params_function() that set the RSA or DH
2826 parameters using a callback.
2827 - Added functions gnutls_rsa_params_cpy(), gnutls_dh_params_cpy()
2828 and gnutls_x509_privkey_cpy().
2829 - Corrected a compilation issue when opencdk was installed in a
2830 non standard directory.
2831 - Deprecated: gnutls_srp_server_set_select_function(),
2832 gnutls_certificate_client_set_select_function(), gnutls_srp_server_set_select_function().
2834 * Version 1.1.6 (2004-02-24)
2835 - Several bug fixes, by Arne Thomassen.
2836 - Fixed a bug where 'server name' extension was always sent.
2838 * Version 1.1.5 (2004-01-06)
2839 - Added the gnutls_sign_algorithm type.
2841 * Version 1.1.4 (2004-01-04)
2842 - Improved gnutls-cli's SRP behaviour in SRP ciphersuites.
2843 If they are of highest priority then the abbreviated handshake
2845 - Removed all references of missing files.
2846 - Changed handshake behaviour to send the lowest TLS version
2847 when an unsupported version was advertized. The current behaviour
2848 is to send the maximum version we support.
2849 - Corrected problem printing the DC attributes in a DN.
2851 * Version 1.1.3 (2003-12-30)
2852 - Implemented TLS 1.1 (and also obsoleted the TLS 1.0 CBC protection
2855 * Version 1.1.2 (2003-12-28)
2856 - Added CRL verification functionality to certtool.
2857 - Corrected the CRL distribution point extension handling.
2859 * Version 1.1.1 (2003-12-26)
2860 - Added PKCS #7 support to certtool utility.
2861 - Added support for reading and generating CRL distribution
2862 points extensions in certificates.
2863 - Added support for generating CRLs in the library and the
2865 - Added support for the Subject Key ID PKIX extension.
2867 * Version 1.1.0 (2003-12-21)
2868 - The error codes GNUTLS_E_NO_TEMPORARY_DH_PARAMS and GNUTLS_E_NO_TEMPORARY_RSA_PARAMS
2869 are no longer returned by the handshake function. Ciphersuites that
2870 require temporary parameters are removed when such parameters do not exist.
2871 - Added the callbacks gnutls_certificate_client_retrieve_function() and
2872 gnutls_certificate_server_retrieve_function(), to allow a client or a server
2873 to specify certificates for the handshake without storing them to the
2874 credentials structure.
2875 - Added support for generating and exporting DSA private keys.
2876 - Added gnutls_x509_crt_set_key_usage() and certtool can now set the
2877 certificate's key usage.
2878 - Added gnutls_openpgp_key_get_key_usage().
2880 * Version 1.0.25 (2005-04-27)
2881 - Corrected bug in record packet parsing that could lead
2882 to a denial of service attack.
2883 - Corrected bug in RSA key export.
2885 * Version 1.0.24 (2005-01-18)
2886 - Corrected several bugs found by Marcin Garski <mgarski@post.pl>
2888 * Version 1.0.23 (2004-11-13)
2889 - Replace GNU LD version script with Libtool -export-symbols-regex,
2890 from Joe Orton <joe@manyfish.co.uk>.
2891 - Copy libtasn1 has been updated to version 0.2.11.
2892 - Corrected the write of CRL distribution points.
2893 - It is now possible to generate PKCS#12 structures without private
2894 keys using "certtool --to-p12", suggested by Fabian Fagerholm
2897 * Version 1.0.22 (2004-10-28)
2898 - Print DN of certificates with unknown characters in them, but in hexform
2900 - Corrected bug in _gnutls_x509_get_dn_oid(), and returns the
2902 - Added second precision to the X.509 parsing functions.
2903 - Add parameter --la-file to libgnutls-config and libgnutls-extra-config,
2904 tiny patch contributed by Joe Orton <joe@manyfish.co.uk>.
2905 - Add pkg-config meta files, suggested by Stéphane LOEUILLET
2906 <stephane.loeuillet@tiscali.fr>.
2907 - Fix memory initializaion bug in gnutls_certificate_set_x509_trust,
2908 tiny patch by Aleix Conchillo Flaque <aleix@member.fsf.org>.
2909 - Fix certtool --password for PKCS #12, back ported from 1.1.x branch.
2910 - Fix library order in libgnutls*-config --libs output, to permit
2911 static linking, reported by Yoann Vandoorselaere
2912 <yoann@prelude-ids.org>.
2914 * Version 1.0.21 (2004-10-07)
2915 - Fix memory leak in gnutls_certificate_verify_peers and
2916 gnutls_certificate_free_credentials, report and patch by Simon
2917 Posnjak <simon.posnjak@cetrtapot.si>.
2918 - Fix crash in `certtool --to-p12 --load-privkey foo', i.e. exporting
2919 a key and no certificate to PKCS#12.
2920 - Fix objdir != srcdir builds, reported by "Gerrit P. Haase"
2921 <gp@familiehaase.de>.
2922 - Avoid redefining getpass if system already has it, reported by
2923 Yoann Vandoorselaere <yoann@prelude-ids.org>.
2924 - Add new example "ex-rfc2818" for certificate verification, from Nikos.
2925 - Known bug: the library require snprintf.
2927 * Version 1.0.20 (2004-08-18)
2928 - Bug fix of padding string in RSA PKCS#1 v1.5 type 2 encryption,
2929 reported by Robey Pointer <robey@danger.com>.
2931 * Version 1.0.19 (2004-08-09)
2932 - Bug fix of test suite.
2934 * Version 1.0.18 (2004-08-05)
2935 - Added simple self test suite.
2937 * Version 1.0.17 (2004-08-02)
2938 - Updated the SRP authentication to conform to the
2939 latest (yet unreleased) draft. Unfortunately this breaks
2940 compatibility with previous versions.
2941 - Changed the makefiles to be more portable.
2942 - Added some default limits in the verification of certificate
2943 chains, to avoid denial of service attacks. Also added
2944 gnutls_certificate_set_verify_limits() to override them.
2945 Issue pointed out by Patrik Hornik <patrik@hornik.sk>.
2946 - Added gnutls_certificate_verify_peers2().
2948 * Version 1.0.16 (2004-07-10)
2949 - Do not free the SRP (prime and generator) parameters obtained from the
2950 callback if they are the static ones defined in extra.h.
2951 - Eliminated some memory leaks. Reported by Yoann Vandoorselaere.
2952 - Some fixes in the makefiles.
2954 * Version 1.0.15 (2004-06-29)
2955 - Fixed bug in RSA encryption, report and patch by Martijn Koster
2956 <mak@greenhills.co.uk>.
2957 - Corrected a bug in certificate verification. Pointed out by
2958 Yoann Vandoorselaere <yoann@prelude-ids.org>.
2960 * Version 1.0.14 (2004-06-12)
2961 - Automatically disable certificate types that do not have corresponding
2963 - Updates in the documentation.
2964 - certtool can now add ip address SAN extension.
2965 - certtool has now support for more X.520 DN attribute types.
2966 - Opencdk library is being included if not found.
2967 - Added gnutls_openpgp_keyring_check_id().
2968 - Corrected a serious bug in the included libtasn1 library.
2969 - Corrected session resuming in SRP ciphersuites.
2970 - Updated to conform to the latest srp draft (draft-ietf-tls-srp-07)
2971 - Added the functions gnutls_x509_crt_get_pk_rsa_raw() and
2972 gnutls_x509_crt_get_pk_dsa_raw() to retrieve parameters from certificates.
2973 - Some fixes in the session resuming code.
2975 * Version 1.0.13 (2004-04-29)
2976 - Some complilation fixes.
2977 - Added the --xml parameter to the certtool utility.
2979 * Version 1.0.12 (2004-04-23)
2980 - Corrected bug in OpenPGP key loading using a callback.
2981 - Renamed gnutls-srpcrypt to srptool
2982 - Allow handshake requests by the client.
2983 * Things backported from the development branch:
2984 - Added support for authority key identifier and the extended key usage
2985 X.509 extension fields. The certtoool was updated to support them.
2986 - Added batch support to certtool. Now it can use templates.
2987 - The RC2 cipher is no more included. The one in libgcrypt is now used.
2989 * Version 1.0.11 (2004-04-17)
2990 - Added gnutls_sign_algorithm_get_name() and gnutls_pk_algorithm_get_name()
2991 - Corrected bug in TLS renegotiation.
2993 * Version 1.0.10 (2004-04-03)
2994 - Corrected bug in RSA parameters handling which could cause
2996 - Corrected bug in SSL 3.0 authentication.
2998 * Version 1.0.9 (2004-03-29)
2999 - Added gnutls_certificate_set_params_function() and
3000 gnutls_anon_set_params_function() that set the RSA or DH
3001 parameters using a callback.
3002 - Added functions gnutls_rsa_params_cpy(), gnutls_dh_params_cpy()
3003 and gnutls_x509_privkey_cpy().
3004 - Corrected a compilation issue when opencdk was installed in a
3005 non standard directory.
3006 - Documented the changes need in multi-threaded application due
3007 to the new libgcrypt.
3009 * Version 1.0.8 (2004-02-28)
3010 - Corrected bug in mutual certificate authentication in SSL 3.0.
3012 * Version 1.0.7 (2004-02-25)
3013 - Implemented TLS 1.1 (and also obsoleted the TLS 1.0 CBC protection
3015 - Some updates in the documentation.
3017 * Version 1.0.6 (2004-02-12)
3018 * Backported things from the development branch (while maintaining
3019 backwards compatibility):
3020 - Improved gnutls-cli's SRP behaviour in SRP ciphersuites.
3021 If they are of highest priority then the abbreviated handshake
3023 - The error codes GNUTLS_E_NO_TEMPORARY_DH_PARAMS and GNUTLS_E_NO_TEMPORARY_RSA_PARAMS
3024 are no longer returned by the handshake function. Ciphersuites that
3025 require temporary parameters are removed when such parameters do not exist.
3026 - Added the callbacks gnutls_certificate_client_retrieve_function() and
3027 gnutls_certificate_server_retrieve_function(), to allow a client or a server
3028 to specify certificates for the handshake without storing them to the
3029 credentials structure.
3030 - Added support for generating and exporting DSA private keys.
3032 * Version 1.0.5 (2004-02-11)
3033 - Fixed a bug where 'server name' extension was always sent.
3034 * Backported things from the development branch:
3035 - Added CRL verification functionality to certtool.
3036 - Corrected the CRL distribution point extension handling.
3037 - Added PKCS #7 support to certtool utility.
3038 - Added support for reading and generating CRL distribution
3039 points extensions in certificates.
3040 - Added support for generating CRLs in the library and the
3042 - Added support for the Subject Key ID PKIX extension.
3043 - Added the gnutls_sign_algorithm type.
3045 * Version 1.0.4 (2004-01-04)
3046 - Changed handshake behaviour to send the lowest TLS version
3047 when an unsupported version was advertized. The current behaviour
3048 is to send the maximum version we support.
3049 - certtool no longer asks the password in unencrypted private
3051 - The source is now compiled to use the reentrant libc functions.
3053 * Version 1.0.3 (2003-12-21)
3054 - Corrected bug in gnutls_bye() which made it return an error code
3055 of INVALID_REQUEST instead of success.
3056 - Corrected a bug in the GNUTLS_KEY key usage definitions.
3058 * Version 1.0.2 (2003-12-18)
3059 - Corrected a bug in the RSA key generation. This was
3060 generating unusable RSA keys.
3062 * Version 1.0.1 (2003-12-10)
3063 - Some minor fixes in the makefiles. They now include CFLAGS
3064 from libgcrypt or opencdk if installed in a non standard directory.
3065 - Fixed the SRP detection test in gnutls-cli-debug.
3066 - Added gnutls_rsa_params_export_pkcs1() and gnutls_rsa_params_import_pkcs1().
3068 * Version 1.0.0 (2003-12-04)
3069 - Exported the static SRP group parameters.
3070 - Some fixes in the certificate authenticated SRP ciphersuites.
3071 - Improved the support for draft-ietf-tls-srp-05. The two-phase
3072 handshake is now fully supported without any interaction with
3073 the application layer (except for a callback).
3075 * Version 0.9.99 (2003-11-28)
3076 - Some fixes in the gnutls.h header for the gnutls_server_name_set()
3077 and gnutls_server_name_get() prototypes.
3078 - Exported the gnutls_x509_privkey_sign_data(), gnutls_x509_privkey_verify_data()
3079 and gnutls_x509_crt_verify_data().
3080 - Some fixes in the openpgp authentication.
3081 - Removed the Twofish cipher.
3083 * Version 0.9.98 (2003-11-16)
3084 - The openssl compatibility layer was moved to gnutls-openssl
3085 library instead of being included in the gnutls-extra library.
3086 - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04.
3087 - Building with openpgp support is now mandatory.
3088 - gnutls4 compatibility header is no longer included by default in
3090 - gnutls8 function usage yelds a deprecation warning in gcc3.
3091 - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid()
3092 functions have a raw_flag parameter added.
3093 - Added gnutls_x509_*_get_dn_oid() and gnutls_x509_crt_get_extension_oid()
3094 functions which return the available OIDs.
3096 * Version 0.9.97 (2003-11-11)
3097 - The certtool utility can now generate PKCS #12 structures
3098 without specifying a certificate.
3099 - Added capability to read CRLs to certtool.
3100 - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER
3101 to properly set the required buffer size.
3102 - Corrected a bug in libgcrypt detection.
3104 * Version 0.9.96 (2003-11-09)
3105 - Some changes to allow compilation with mingw32.
3106 - Several code cleanups.
3108 * Version 0.9.95 (2003-11-02)
3109 - Improved the verification functions. Added new verification
3110 output flags and removed the unused and redundant ones.
3111 - Improved the OpenPGP key support.
3112 - The prime utility was removed, and its functionality was moved
3115 * Version 0.9.94 (2003-10-30)
3116 - Added manpages for the included programs.
3117 - Documented and improved the certtool utility.
3118 - Added PKCS #12 support to certtool utility.
3120 * Version 0.9.93 (2003-10-26)
3121 - Corrected some compilation issues.
3122 - Improved the certtool command line utility.
3124 * Version 0.9.92 (2003-10-25)
3125 - The RFC2818 hostname verification is now case insensitive.
3126 - Added support for generating X.509 certificates.
3127 - Added the certtool, a tool for generating X.509 certificates
3129 * Version 0.9.91 (2003-10-17)
3130 - Fixed a compilation issue in the openpgp authentication part.
3132 * Version 0.9.90 (2003-10-08)
3133 - Updated the openpgp key API (depends on the unreleased new
3136 * Version 0.9.8 (2003-10-02)
3137 - Updated the SRP implementation to follow the latest draft
3138 (draft-ietf-tls-srp-05).
3139 - Improved the gnutls-cli behaviour in error handling,
3140 and added a check for the peer's hostname.
3141 - Use versioned symbols in the library (where available).
3142 - RIJNDAEL ciphersuites were renamed to AES.
3144 * Version 0.9.7 (2003-08-25)
3145 - The tex files are now included in the distribution.
3146 - The library can now decrypt PKCS #12 files encrypted with
3148 - The missing rfc2818_hostname object is now included.
3149 - Several corrections and bug fixes in the library by
3150 Arne Thomassen <arne@arne-thomassen.de>.
3151 - CR is now allowed in the base64 decoder.
3153 * Version 0.9.6 (2003-06-28)
3154 - Added gnutls_x509_privkey_get_key_id() and gnutls_x509_crt_get_key_id()
3155 functions which return a unique (per public key) ID. These can
3156 be used to check if the private key corresponds to a given certificate.
3157 - Corrections in the TLS layer openpgp certificate packet parser.
3158 - Corrected a bug in the record layer buffering, which affected
3159 the case where external pull function was used. Report and patch
3160 by Sergey Poznyakoff <gray@Mirddin.farlep.net>.
3161 - Corrected a bug in gnutls-srpcrypt where a non allocated variable
3163 - SRP programs are now built by default.
3164 - Added API to read and write to PKCS #12 structures. Prototypes
3166 - The gnutls_transport_ptr type was changed to a pointer type (void*).
3168 * Version 0.9.5 (2003-04-06)
3169 - Several improvements in the PKCS #7 handling
3170 - Eliminated several hard coded constants in MPI parameters.
3172 * Version 0.9.4 (2003-03-28)
3173 - Corrected a parsing error in the Certificate request message.
3174 - Corrected behaviour when a certificate request message is received.
3175 Now a certificate packet is always sent, and in SSL 3.0 cipher suites
3176 a no_certificate alert is sent instead.
3177 - Added functionality to generate PKCS #7 structures (with certificates).
3179 * Version 0.9.3 (2003-03-24)
3180 - Support for MD2 was dropped.
3181 - Improved the error logging functions, by adding a level, and
3182 by allowing debugging messages just by increasing the level.
3183 - The diffie Hellman ciphersuites are now of higher priority than
3185 - The RSA premaster secret version check can no longer be disabled.
3186 - Implemented the counter measure discussed in the paper "Attacking
3187 RSA-based Sessions in SSL/TLS", against the attack described in the
3189 - Added the functions: gnutls_handshake_get_last_in(),
3190 gnutls_handshake_get_last_out().
3191 - The gnutls_certificate_set_rsa_params() was renamed to
3192 gnutls_certificate_set_rsa_export_params().
3193 - Added the new functions: gnutls_certificate_set_x509_key()
3194 gnutls_certificate_set_x509_trust(), gnutls_certificate_set_x509_crl(),
3195 gnutls_x509_crt_export(), gnutls_x509_crl_export().
3196 - Added support for encoding and decoding PKCS #8 2.0 encrypted
3199 * Version 0.9.2 (2003-03-15)
3200 - Some corrections in the memory mapping code (file is unmapped after
3202 - Added support for PKCS#10 certificate requests generation.
3204 * Version 0.9.1 (2003-03-12)
3205 - Corrected a bug in 64 bit architectures, which affected the
3206 serial number calculation in the record layer.
3207 - Added gnutls_certificate_free_keys() which deletes all the
3208 private keys and certificates from the credentials structure.
3209 - Corrected a broken buffer check in _gnutls_io_read_buffered(),
3210 which caused some unexpected packet length errors. Report and patch
3211 by Ian Peters <itp@ximian.com>.
3212 - Added ability to generate RSA keys.
3213 - Increased the maximum parameter size in order to read some large keys
3214 by some CAs. Patch by Ian Peters <itp@ximian.com>.
3215 - Added an strnstr() function and the requirement in some functions to
3216 use null terminated PEM structures is no more.
3217 - Use mmap() if available to read files.
3218 - Fixed a memory leak in SRP code reported by Rupert Kittinger
3219 <r.kittinger@efkon.com>.
3221 * Version 0.9.0 (2003-03-03)
3222 - This version is not binary compatible with the previous ones.
3223 - The library notifies the application on empty and illegal SRP usernames,
3224 so that proper notification (via an alert) is sent to the peer.
3225 - Added ability to send some messages back to the application using
3226 the gnutls_global_set_log_function().
3227 - gnutls_dh_params_generate() and gnutls_rsa_params_generate() now use
3228 gnutls_malloc() to allocate the output parameters.
3229 - Added support for MD2 algorithm in certificate signature verification.
3230 - The RSA and DH parameter generation interface was changed. Added
3231 ability to import and export from and to PKCS3 structures. This
3232 was needed to read parameters generated using the openssl dhparam tool.
3233 - Several changes in the temporary (DH/RSA) parameter codebase. No DH
3234 parameters are now included in the library. Also the credentials structure
3235 can now hold only one temporary parameter of a kind.
3236 - Added a new Certificate, CRL, Private key and PKCS7 structures handling
3237 API, defined in gnutls/x509.h
3238 - Added gnutls_certificate_set_verify_flags() function to allow setting the
3239 verification flags in the credentials structure. They will be used in the
3240 *verify_peers functions.
3241 - Added protection against the new TLS 1.0 record layer timing attack.
3242 - Added support for Certificate revocation lists. Functions defined
3244 - The only functions that were removed are:
3245 gnutls_x509_certificate_to_xml()
3246 gnutls_x509_extract_dn_string()
3247 - Ported to libtasn1 0.2.x
3249 * Version 0.8.1 (2003-01-22)
3250 - Improved the SRP support, to prevent attackers guessing the
3251 available usernames by brute force.
3252 - Improved the SRP detection in gnutls-cli-debug
3253 - Some fixes which now allow compilation.
3255 * Version 0.8.0 (2003-01-20)
3256 - Added gnutls_x509_extract_dn_string() which returns a
3257 distinguished name in a single string.
3258 - Added gnutls_openpgp_extract_key_name_string() which returns
3259 an openpgp user ID in a single string.
3260 - Added gnutls_x509_extract_certificate_ca_status() which returns
3261 the CA status of the given certificate.
3262 - Added SRP-6 support. Follows draft-ietf-tls-srp-04.
3263 - If libtasn1 is not present in the system, it is included in
3264 the main gnutls library.
3265 - If liblzo is present in the system, then the included minilzo
3266 will not be used, and libgnutls-extra will depend on liblzo.
3267 - GNUTLS_E_PARSING_ERROR error code was replaced by GNUTLS_E_BASE64_DECODING_ERROR,
3268 and GNUTLS_E_SRP_PWD_PARSING_ERROR. GNUTLS_E_ASCII_ARMOR_ERROR was also
3269 replaced by GNUTLS_E_BASE64_DECODING_ERROR.
3271 * Version 0.6.0 (2002-12-08)
3272 - Added "gnutls/compat4.h" header. This is included in gnutls.h
3273 to emulate the old 0.4.x API.
3274 - Example programs are now stored in doc/examples/
3275 - Several improvements and updates in the documentation.
3276 - Added the certificate authenticated SRP cipher suites.
3277 - gnutls_x509_extract_certificate_dn_string() was updated to return
3278 an RFC2253 conforming string.
3279 - Added the SRP related functions:
3280 gnutls_srp_verifier()
3281 gnutls_srp_base64_encode()
3282 gnutls_srp_base64_decode()
3283 - Added the function gnutls_srp_set_server_credentials_function()
3284 to allow retrieving SRP parameters from an external backend - other
3285 than password files.
3286 - Added the function gnutls_openpgp_set_recv_key_function()
3287 which can be used to set a callback, to get OpenPGP keys.
3288 - Exported the functions:
3291 which should be used by callback functions.
3292 - Changed the semantics of gnutls_pem_base64_encode_alloc()
3293 and gnutls_pem_base64_decode_alloc(). In the default case
3294 were the gnutls library is used with malloc/realloc/free,
3295 these are binary compatible.
3297 * Version 0.5.11 (2002-11-05)
3298 - Some fixes in 'gnutls-cli' client program to prevent some segmentation
3300 - Example programs found in the documentation can now be generated by
3301 running "make examples" in doc/tex directory.
3302 - Added more descriptive error strings, to gnutls_strerror().
3303 - Documented error codes, and the function reference list is now sorted.
3304 - Optimized buffering code.
3305 - gnutls_x509_extract_certificate_dn_string() was rewritten.
3306 - Added GNUTLS_E_SHORT_MEMORY_BUFFER error code, which is returned in the
3307 case where the memory buffer provided is not long enough.
3308 - Depends on the new OpenCDK 0.3.2.
3310 * Version 0.5.10 (2002-10-13)
3311 - Updated documentation.
3312 - Added server name extension. This allows clients to specify the
3313 name of the server they connect to. Useful to HTTPS.
3314 - Several corrections in the code base, mostly in signed/unsigned,
3317 * Version 0.5.9 (2002-10-10)
3318 - Corrected some code which worked fine in gcc 3.2, but not with any
3320 - Updated 'gnutls-cli' with the '--starttls' option, to allow testing
3321 starttls implementations.
3322 - Added gnutls_x509_extract_key_pk_algorithm() function which extracts
3323 the private key type, of a DER encoded key.
3324 - Added gnutls_x509_extract_certificate_dn_string() which returns the
3325 certificate's distinguished name in a single string.
3326 - Added gnutls_set_default_priority() and gnutls_set_default_export_priority()
3327 functions, to avoid calling all the *_priority() functions if the defaults
3329 - Added int gnutls_x509_check_certificates_hostname() which check whether
3330 the given hostname matches the owner of the given X.509 certificate.
3332 * Version 0.5.8 (2002-09-25)
3333 - Updated documentation.
3334 - Added gnutls_record_get_direction() which replaces the obsolete
3335 gnutls_handshake_get_direction().
3336 - Added function to convert error codes to alert descriptions
3337 - Added LZO compression
3339 * Version 0.5.7 (2002-09-11)
3340 - Some fixes in the memory allocation functions (realloc).
3341 - Improved the string functions used in XML certificate generation.
3342 - Removed dependency on libgdbm.
3343 - Corrected bug in gnutls_dh_params_set() which affected
3344 gnutls_dh_params_deinit().
3345 - Corrected bug in session resuming code in server side.
3347 * Version 0.5.6 (2002-09-06)
3348 - Corrected bugs in SRP implementation, which prevented gnutls
3349 to interoperate with other implementations. (interoperability testing
3350 was done by David Taylor)
3351 - Corrected bug in cert_type extension.
3352 - Corrected extension type checks which used an 8 bit extension size,
3354 - Added versioning in the XML output of certificate functions.
3355 - Removed the X.509 test suite.
3357 * Version 0.5.5 (2002-09-03)
3358 - Updated the SRP implementation to the latest draft. The blowfish
3359 crypt implementation was removed, since the new draft does not allow
3360 other hash algorithms except for the srpsha.
3361 - Renamed all the constructed types in order to have more consistent
3363 - Improved the certificate and key read functions. Now they can read
3364 the certificate and the private key from the same file.
3365 - Updated and corrected documentation.
3367 * Version 0.5.4 (2002-08-27)
3368 - Fixes in TLS 1.0 PRF and SSL3 random functions.
3369 - gnutls_handshake_set_exportable_detection() was obsoleted.
3370 - Added gnutls_openpgp_extract_key_id() which returns the key ID.
3371 - Corrected bug in DHE key exchange
3372 - Added support for temporary RSA keys which are needed for the
3373 export cipher suites.
3374 - Added the TLS_RSA_EXPORT_ARCFOUR_40_MD5 ciphersuite.
3376 * Version 0.5.3 (2002-08-23)
3377 - No changes. Replaces the tarball of 0.5.2 which accidentally contained
3378 code from the unstable branch.
3380 * Version 0.5.2 (2002-08-22)
3381 - Added an error code that is returned in clients which connect
3382 to export only servers. This must be enabled using the
3383 gnutls_handshake_set_exportable_detection() function.
3384 - Updated openssl compatibility layer.
3385 - Added gnutls_handshake_get_direction() function which returns
3386 the state of the handshake when interrupted.
3388 * Version 0.5.1 (2002-07-17)
3389 - Corrected the m4 macros which used <gnutls.h> instead of
3391 - Documentation fixes
3392 - Added gnutls_transport_set_ptr2() function, which accepts two
3393 different pointers, to be used while receiving, and
3395 - Semantic changes in gnutls_record_set_max_size(). The requested
3396 size is now immediately enforced at the output buffers.
3397 - gnutls_global_init_extra() now fails if the library versions do
3399 - Fixes in client and server example programs. Null encryption can
3400 be used in these programs, to assist in debuging.
3401 - Fixes in zlib compression code.
3403 * Version 0.5.0 (2002-07-06)
3404 - Added X.509 certificate tests in tests/ directory
3405 - Removed stubs for SRP and Anonymous authentication. They served
3406 no purpose since they are always included, unless it was requested
3408 - Added gnutls_handshake_set_private_extensions() function. This
3409 function can be used to enable private (gnutls specific) cipher suites
3410 and compression algorithms.
3411 - Added check for C99 macro support by the compiler.
3412 - Added functions gnutls_b64_encode_fmt2() and gnutls_b64_decode_fmt2()
3413 - Added the new libtasn1 library.
3414 - Removed the gdbm backend. Applications are now responsible for the
3415 session resuming backend. The gnutls-serv application contains an
3416 simple example on how to use gdbm for resuming.
3417 - Headers for the gnutls library are now installed in $(includedir)/gnutls
3418 - Added an OpenSSL compatible interface (with some limitations).
3419 - Added functions to convert DER encoded certificates to XML format.
3421 * Version 0.4.4 (2002-06-24)
3422 - Corrected bug in PKCS-1 RSA encryption which prevented gnutls to encrypt
3423 using keys of some specific size.
3425 * Version 0.4.3 (2002-05-23)
3426 - The gnutls-extra library now compiles fine, if the opencdk library is
3428 - Several bug fixes.
3429 - Added gnutls_global_set_mem_func() function, to set the memory allocation
3430 functions, if other than the defaults are to be used.
3431 - The default memory allocation functions are now the ones in libc.
3433 * Version 0.4.2 (2002-05-21)
3434 - Separated ASN.1 structures parser documentation and TLS library
3436 - Added gnutls_handshake_set_rsa_pms() function, which disables the
3437 version check in RSA premaster secret.
3438 - Added gnutls_session_is_resumed() function, which reports if a session
3440 - Added gnutls_state_set_ptr() and gnutls_state_get_ptr() functions, to
3441 assist in callback functions.
3442 - Replaced the included 1024 bit prime for Diffie Hellman, with a new
3444 - Relicensed the library under the GNU Lesser General Public License
3445 - Added gnutls-extra library which contains the GPL covered code of gnutls.
3447 * Version 0.4.1 (2002-04-07)
3448 - Now uses alloca() for temporary variables
3449 - Optimized RSA signing
3450 - Added functions to return the peer's certificate activation and
3452 - Corrected time function's behaviour (the time value returned no longer
3453 relate to local timezone).
3455 * Version 0.4.0 (2002-04-01)
3456 - Added support for RFC2630 (PKCS7) X.509 certificate sets
3457 - Added new functions: gnutls_x509_extract_certificate_pk_algorithm(),
3458 gnutls_openpgp_extract_key_pk_algorithm().
3459 - Several optimizations in the Handshake protocol
3460 - Several optimizations in RSA algorithm
3461 - Unified the return values because of small buffers.
3463 * Version 0.3.92 (2002-03-23)
3464 - Updated documentation
3465 - Combined error codes of ASN.1 parser and gnutls
3466 - Removed GNUTLS_CERT_TRUSTED from the CertificateStatus enumeration
3467 - Added protection against CBC chosen plaintext attack (disabled by default)
3468 - Improved and optimized compression support
3470 * Version 0.3.91 (2002-03-03)
3471 - Added gnutls-cli-debug program
3472 - Corrections in session resumption
3473 - Rehandshake can now handle negotiation of different authentication
3475 - gnutls-cli, gnutls-serv, gnutls-srpcrypt and gnutls-cli-debug are
3476 now being installed.
3478 * Version 0.3.90 (2002-02-24)
3479 - Handshake messages are not kept in memory any more. Now we use
3480 less memory during a handshake
3481 - Added support for certificates with DSA parameters
3482 - Added DHE_DSS cipher suites
3483 - Key exchange methods changed so they do not depend on the
3484 certificate type. Added certificate type negotiation TLS extension.
3485 - Added openpgp key support (EXPERIMENTAL)
3486 - Improved Diffie Hellman key exchange support.
3487 - Bug fixes in the RSA key exchange.
3488 - Added check for the requested TLS extensions
3489 - TLS extensions now use a 16 bit type field.
3490 - Added a minimal string library to assist in ASN.1 parsing
3491 - Changes in ASN.1 parser to work with the new bison
3492 - Added gnutls_x509_extract_subject_alt_name(), which deprecates
3493 gnutls_x509_extract_subject_dns_name()
3494 - gnutls_x509_set_trust_(file/mem) can now be called multiple times
3495 - gnutls_srp_server_set_cred_file() can now be called multiple times
3497 * Version 0.3.5 (2002-01-25)
3498 - Corrected the RSA key exchange method, to avoid attacks against
3501 * Version 0.3.4 (2002-01-20)
3502 - Corrected bugs in DHE_RSA key exchange method
3504 * Version 0.3.3 (2002-01-19)
3505 - Added gnutls_x509pki_verify_certificate()
3506 - Added gnutls_x509pki_set_trust_mem() and gnutls_x509pki_set_key_mem()
3507 - Bug fixes in srpcrypt (based on patch by Marc Huber)
3508 - Bug fixes in the Handshake protocol (based on patch by Guillaume Morin)
3509 - Corrected library versioning
3511 * Version 0.3.2 (2002-01-05)
3512 - Corrected bug which did not allow a client to accept multiple CA names
3513 - Added gnutls_fingerprint()
3514 - Added gnutls_x509pki_extract_certificate_serial()
3515 - Added gnutls_b64_encode_fmt() and gnutls_b64_decode_fmt()
3516 - Corrected behaviour in version advertizing
3517 - Updated documentation
3518 - Prefixed all types in gnutls.h with 'GNUTLS_' to avoid namespace collisions
3520 * Version 0.3.1 (2001-12-21)
3521 - Corrections in the configuration files
3522 - Fixes a bug in anonymous authentication
3524 * Version 0.3.0 (2001-12-17)
3525 - Corrected bug in new integer formatting (now we use the old format again)
3526 - Several corrections and usual cleanups
3528 * Version 0.2.91 (2001-12-10)
3529 - Fixes in MPI handling (fixes possible bug with signed integers)
3530 - Removed name indication extension
3531 - Added gnutls_transport_get_ptr() and gnutls_db_get_ptr()
3532 - Optimizations in server certificate callback.
3533 - Fixes in anonymous authentication
3534 - Corrections in client ciphersuite selection
3536 * Version 0.2.90 (2001-12-07)
3537 - gnutls_handshake(), gnutls_read() etc. functions no longer require
3538 the 'SOCKET cd' argument. This argument is set using the function
3539 gnutls_set_transport_ptr().
3540 - introduced gnutls_x509pki_get_peer_certificate_list(). This function returns
3541 a list containing peer's certificate and issuers DER encoded.
3542 - Updated X.509 certificate handling API
3543 - Added callback to select the server certificate
3544 - More consistent function naming (changes in several function names)
3545 - Buffer overflow checking in ASN.1 structures parser
3546 - Updated documentation
3548 * Version 0.2.11 (2001-11-16)
3549 - Changed the meaning of GNUTLS_E_REHANDSHAKE value. If this value
3550 is returned, then the caller should perform a handshake or send
3551 an alert to the peer.
3552 - Made receive buffer dynamic. Normally if no large chunks are received
3553 it occupies less space.
3554 - Added max_record_size extension
3555 - Bugfixes in session handling
3556 - Improved non blocking IO support in the Handshake Protocol
3557 - Usual bugfixes and cleanups
3558 - Documentation updated (includes ASN.1 documentation)
3560 * Version 0.2.10 (2001-11-05)
3561 - Corrected bugs and improved non blocking IO
3562 - Added hooks to use external database to store sessions
3565 * Version 0.2.9 (2001-10-27)
3566 - AUTH_INFO types and structures were moved to library internals
3567 - AUTH_FAILED is no longer returned in SRP authentication
3568 (any fatal error in SRP means auth failed)
3569 - Introduced GNUTLS_E_INTERRUPTED
3570 - Added support for non blocking IO
3571 - gnutls_recv() and gnutls_send() are now obsolete
3572 - Changed semantics of gnutls_rehandshake()
3574 * Version 0.2.4 (2001-10-12)
3575 - Better handling of X.509 certificate extensions
3576 - Added DHE_RSA ciphersuites
3577 - Updated the Name Indication (dnsname) extension
3578 - Improvements in Diffie Hellman primes handling
3580 * Version 0.2.3 (2001-09-19)
3581 - Memory optimizations in gnutls_recv()
3582 - Fixed several memory leaks
3583 - Added ability to specify callback for x509 client certificate selection
3584 - Better documentation
3586 * Version 0.2.2 (2001-08-21)
3587 - Several bugfixes (library and documentation)
3589 * Version 0.2.1 (2001-08-07)
3592 * Version 0.2.0 (2001-08-07)
3593 - Partial support for X.509v3 Certificate extensions.
3594 - Added Internal memory handlers
3595 - Removed gnutls_x509_set_cn()
3596 - Added X.509 client authentication
3597 - Several bug fixes and protocol fixes
3599 * Version 0.1.9 (2001-07-30)
3600 - Corrected bug(s) in ChangeCipherSpec packet (fixes renegotiate)
3601 - SRP is updated to conform to the newest draft.
3602 - Added support for DNSNAME extension.
3603 - Reentracy fixes in ASN.1 Parsing.
3604 - Optimizations in hash/hmac functions
3605 - (Error) message handling has changed
3606 - Better Protocol Version handling
3607 - Added X.509 Certificate Verification
3608 - gnutls_read() semantics are now closer to read(2) - added EOF
3609 - Documented some part of gnutls in doc/tex/ using Latex
3611 * Version 0.1.4 (2001-06-22)
3612 - Corrected (srp) base64 encoding.
3613 - Changed bcrypt algorithm to include username.
3614 - Added RSA Ciphersuites (no certificate checking).
3615 - Fixes in SSL 2.0 client hello parsing.
3616 - Added ASN.1 and DER parsers.
3617 - Bugfixes in session resuming
3618 - Updated Ciphersuite selection algorithm
3619 - Added internal representation of X.509 structures.
3620 - Added global state
3622 * Version 0.1.3 (2001-06-01)
3623 - Updated API (and the way it is documented - we use inline documentation)
3624 - Added function to access alert messages.
3625 - Added support for renegotiating parameters.
3626 - Better and Faster Resume Database handling.
3629 * Version 0.1.2 (2001-05-14)
3631 - Fixes in extension handling
3633 * Version 0.1.1 (2001-05-13)
3634 - Added compatibility with Stanford's libsrp library
3636 * Version 0.1.0 (2001-05-09)
3637 - Added SSL 2.0 client hello support
3638 - GNUTLS is a gnu library
3639 - Added support for TLS extensions.
3640 - Added support for SRP
3642 * Version 0.0.7 (2001-01-11)
3643 - Added server side session resuming (using gdbm)
3644 - Added twofish algorithm
3646 * Version 0.0.6 (2000-12-20)
3647 - Added client side session resuming
3648 - Better documentation (check doc/API)
3649 - Better socket handling (gnutls can be used with select())
3650 - Some primitive support for non blocking IO and socket options has been added.
3652 * Version 0.0.5 (2000-12-07)
3653 - Added Compression (using ZLIB)
3654 - Added SSL 3.0 support
3656 ----------------------------------------------------------------------
3657 Copying and distribution of this file, with or without modification,
3658 are permitted in any medium without royalty provided the copyright
3659 notice and this notice are preserved.