1 GnuTLS NEWS -- History of user-visible changes. -*- outline -*-
2 Copyright (C) 2000-2012 Free Software Foundation, Inc.
3 See the end for copying conditions.
5 * Version 3.0.24 (unreleased)
7 ** libgnutls: The %COMPAT keyword, if specified, will tolerate
8 key usage violation errors (they are far too common to ignore).
10 ** libgnutls: Added X.509 certificate verification flag
11 GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification
12 of unsorted certificate chains and is enabled by default for
13 TLS certificate verification (if gnutls_certificate_set_verify_flags()
14 does not override it).
16 ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(),
17 which provides a tool to counter compression-related attacks where
18 parts of the data are controlled by the attacker _and_ placed in
19 separate records (use with care - do not use compression if not sure).
21 ** libgnutls: Depends on libtasn1 2.14 or later.
23 ** API and ABI modifications:
24 No changes since last version.
27 * Version 3.0.23 (released 2012-09-02)
29 ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link.
31 ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using
32 SHA256 with a SECP384 curve instead of SHA-384), to interoperate with
35 ** libgnutls: Fixed DSA and ECDSA signature generation in
38 ** API and ABI modifications:
39 No changes since last version.
42 * Version 3.0.22 (released 2012-08-04)
44 ** libgnutls: gnutls_certificate_set_x509_system_trust()
45 is now supported on OpenBSD.
47 ** libgnutls: When verifying a certificate chain make sure it is chain.
48 If the chain is wronly interrupted at some point then truncate it,
49 and only try to verify the correct part. Patch by David Woodhouse
51 ** libgnutls: Restored the behavior of gnutls_x509_privkey_import_pkcs8()
52 which now may (again) accept a NULL password.
54 ** certtool: Allow the user to choose the hash algorithm
55 when signing certificate request or certificate revocation list.
58 ** API and ABI modifications:
59 No changes since last version.
62 * Version 3.0.21 (released 2012-07-02)
64 ** libgnutls: fixed bug in gnutls_x509_privkey_import()
65 that prevented the loading of EC private keys when DER
66 encoded. Reported by David Woodhouse.
68 ** libgnutls: In DTLS larger to mtu records result to
69 GNUTLS_E_LARGE_PACKET instead of being truncated.
71 ** libgnutls: gnutls_dtls_get_data_mtu() is more precise. Based
72 on patch by David Woodhouse.
74 ** libgnutls: Fixed memory leak in PKCS #8 key import.
76 ** libgnutls: Added support for an old version of the DTLS protocol
77 used by openconnect vpn client for compatibility with Cisco's AnyConnect
78 SSL VPN. It is marked as GNUTLS_DTLS0_9. Do not use it for newer protocols
81 ** libgnutls: Corrected bug that prevented resolving PKCS #11 URLs
82 if only the label is specified. Patch by David Woodhouse.
84 ** libgnutls: When EMSGSIZE errno is seen then GNUTLS_E_LARGE_PACKET
87 ** API and ABI modifications:
88 gnutls_dtls_set_data_mtu: Added
89 gnutls_session_set_premaster: Added
92 * Version 3.0.20 (released 2012-06-05)
94 ** libgnutls: Corrected bug which prevented the parsing of
95 handshake packets spanning multiple records.
97 ** libgnutls: Check key identifiers when checking for an issuer.
99 ** libgnutls: Added gnutls_pubkey_verify_hash2()
101 ** libgnutls: Added gnutls_certificate_set_x509_system_trust()
102 that loads the trusted CA certificates from system locations
103 (e.g. trusted storage in windows and CA bundle files in other systems).
105 ** certtool: Added support for the URI subject alternative
106 name type in certtool.
108 ** certtool: Increase to 128 the maximum number of distinct options
109 (e.g. dns_names) allowed.
111 ** gnutls-cli: If --print-cert is given, print the certificate,
112 even on verification failure.
114 ** API and ABI modifications:
115 gnutls_pk_to_sign: Added
116 gnutls_pubkey_verify_hash2: Added
117 gnutls_certificate_set_x509_system_trust: Added
120 * Version 3.0.19 (released 2012-04-22)
122 ** libgnutls: When decoding a PKCS #11 URL the pin-source field
123 is assumed to be a file that stores the pin. Based on patch
126 ** libgnutls: gnutls_record_check_pending() no longer
127 returns unprocessed data, and thus ensure the non-blocking
128 of the next call to gnutls_record_recv().
130 ** libgnutls: Added strict tests in Diffie-Hellman and
131 SRP key exchange public keys.
133 ** libgnutls: in ECDSA and DSA TLS 1.2 authentication be less
134 strict in hash selection, and allow a stronger hash to
135 be used than the appropriate, to improve interoperability
138 ** tests: Disabled floating point test, and corrections
139 in pkcs12 decoding tests.
141 ** API and ABI modifications:
142 No changes since last version.
145 * Version 3.0.18 (released 2012-04-02)
147 ** certtool: Avoid a Y2K38 bug when generating certificates.
148 Patch by Robert Millan.
150 ** libgnutls: Make sure that GNUTLS_E_PREMATURE_TERMINATION
151 is returned on premature termination (and added unit test).
153 ** libgnutls: Fixes for W64 API. Patch by B. Scott Michel.
155 ** libgnutls: Corrected VIA padlock detection for old
156 VIA processors. Reported by Kris Karas.
158 ** libgnutls: Updated assembler files.
160 ** libgnutls: Time in generated certificates is stored
161 as GeneralizedTime instead of UTCTime (which only stores
164 ** minitasn1: Upgraded to libtasn1 version 2.13 (pre-release).
166 ** API and ABI modifications:
167 gnutls_x509_crt_set_private_key_usage_period: Added
168 gnutls_x509_crt_get_private_key_usage_period: Added
169 gnutls_x509_crq_set_private_key_usage_period: Added
170 gnutls_x509_crq_get_private_key_usage_period: Added
171 gnutls_session_get_random: Added
174 * Version 3.0.17 (released 2012-03-17)
176 ** command line apps: Always link with local libopts.
178 ** API and ABI modifications:
179 No changes since last version.
182 * Version 3.0.16 (released 2012-03-16)
184 ** minitasn1: Upgraded to libtasn1 version 2.12 (pre-release).
186 ** libgnutls: Corrected SRP-RSA ciphersuites when used under TLS 1.2.
188 ** libgnutls: included assembler files for MacOSX.
190 ** p11tool: Small fixes in handling of the --private command
193 ** certtool: The template option allows for setting the domain
194 component (DC) option of the distinguished name, and the ocsp_uri
195 as well as the ca_issuers_uri options.
197 ** API and ABI modifications:
198 gnutls_x509_crt_set_authority_info_access: Added
201 * Version 3.0.15 (released 2012-03-02)
203 ** test suite: Only run under valgrind in the development
204 system (the full git repository)
206 ** command line apps: Link with local libopts if the
207 installed is an old one.
209 ** libgnutls: Eliminate double free during SRP
210 authentication. Reported by Peter Penzov.
212 ** libgnutls: Corrections in record packet parsing.
213 Reported by Matthew Hall.
215 ** libgnutls: Cryptodev updates and fixes.
217 ** libgnutls: Corrected issue with select() that affected
218 FreeBSD. This prevented establishing DTLS sessions.
219 Reported by Andreas Metzler.
221 ** libgnutls: Corrected rehandshake and resumption
222 operations in DTLS. Reported by Sean Buckheister.
224 ** libgnutls: PKCS #11 objects that do not have ID
225 no longer crash listing. Reported by Sven Geggus.
227 ** API and ABI modifications:
228 No changes since last version.
231 * Version 3.0.14 (released 2012-02-24)
233 ** command line apps: Included libopts doesn't get installed
236 ** libgnutls: Eliminate double free on wrongly formatted
237 certificate list. Reported by Remi Gacogne.
239 ** libgnutls: cryptodev code corrected, updated to account
240 for hashes and GCM mode.
242 ** libgnutls: Eliminated memory leak in PCKS #11 initialization.
243 Report and fix by Sam Varshavchik.
245 ** API and ABI modifications:
246 No changes since last version.
249 * Version 3.0.13 (released 2012-02-18)
251 ** gnutls-cli: added the --ocsp option which will verify
252 the peer's certificate with OCSP.
254 ** gnutls-cli: added the --tofu and if specified, gnutls-cli
255 will use an ssh-style authentication method.
257 ** gnutls-cli: if no --x509cafile is provided a default is
258 assumed (/etc/ssl/certs/ca-certificates.crt), if it exists.
260 ** ocsptool: Added --ask parameter, to verify a certificate's
261 status from an ocsp server.
263 ** command line apps: Use gnu autogen (libopts) to parse command
264 line arguments and template files.
266 ** tests: Added stress test for DTLS packet losses and
267 out-of-order receival. Contributed by Sean Buckheister.
269 ** libgnutls: Several updates and corrections in the DTLS
270 DTLS lost packet handling and retransmission timeouts.
271 Report and patches by Sean Buckheister.
273 ** libgnutls: Added new functions to easily allow the usage of
274 a trust on first use (SSH-style) authentication.
276 ** libgnutls: SUITEB128 and SUITEB192 priority strings account
277 for the RFC6460 requirements.
279 ** libgnutls: Added new security parameter GNUTLS_SEC_PARAM_LEGACY
280 to account for security level of 96-bits.
282 ** libgnutls: In client side if server does not advertise any
283 known CAs and only a single certificate is set in the credentials,
286 ** libgnutls: Added functions to parse authority key identifiers
287 when stored as a 'general name' and serial combo.
289 ** libgnutls: Added function to force explicit reinitialization
290 of PKCS #11 modules. This is required on the child process after
291 a fork (if PKCS #11 functionality is desirable).
293 ** libgnutls: Depend on p11-kit 0.11.
295 ** API and ABI modifications:
296 gnutls_dtls_get_timeout: Added
297 gnutls_verify_stored_pubkey: Added
298 gnutls_store_pubkey: Added
299 gnutls_store_commitment: Added
300 gnutls_x509_crt_get_authority_key_gn_serial: Added
301 gnutls_x509_crl_get_authority_key_gn_serial: Added
302 gnutls_pkcs11_reinit: Added
303 gnutls_ecc_curve_list: Added
304 gnutls_priority_certificate_type_list: Added
305 gnutls_priority_sign_list: Added
306 gnutls_priority_protocol_list: Added
307 gnutls_priority_compression_list: Added
308 gnutls_priority_ecc_curve_list: Added
309 gnutls_tdb_init: Added
310 gnutls_tdb_set_store_func: Added
311 gnutls_tdb_set_store_commitment_func: Added
312 gnutls_tdb_set_verify_func: Added
313 gnutls_tdb_deinit: Added
316 * Version 3.0.12 (released 2012-01-20)
318 ** libgnutls: Added OCSP support.
319 There is a new header file gnutls/ocsp.h and a set of new functions
320 under the gnutls_ocsp namespace. Currently the functionality provided
321 is to parse and extract information from OCSP requests/responses, to
322 generate OCSP requests and to verify OCSP responses. See the manual
323 for more information. Run ./configure with --disable-ocsp to build
324 GnuTLS without OCSP support.
326 This work was sponsored by Smoothwall <http://smoothwall.net/>.
328 ** ocsptool: Added new command line tool.
329 The tool can parse OCSP request/responses, generate OCSP requests and
330 verify OCSP responses. See the manual for more information.
332 ** certtool: --outder option now works for private
333 and public keys as well.
335 ** libgnutls: Added error code GNUTLS_E_NO_PRIORITIES_WERE_SET
336 to warn when no or insufficient priorities were set.
338 ** libgnutls: Corrected an alignment issue in ECDH
339 key generation which prevented some keys from being
340 correctly aligned in rare circumstances.
342 ** libgnutls: Corrected memory leaks in DH parameter
343 generation and ecc_projective_check_point().
345 ** libgnutls: Added gnutls_x509_dn_oid_name() to
346 return a descriptive name of a DN OID.
348 ** API and ABI modifications:
349 gnutls_pubkey_encrypt_data: Added
350 gnutls_x509_dn_oid_name: Added
351 gnutls_session_resumption_requested: Added
352 gnutls/ocsp.h: Added new header file.
353 gnutls_ocsp_print_formats_t: Added new type.
354 gnutls_ocsp_resp_status_t: Added new type.
355 gnutls_ocsp_cert_status_t: Added new type.
356 gnutls_x509_crl_reason_t: Added new type.
357 gnutls_ocsp_req_add_cert: Added.
358 gnutls_ocsp_req_add_cert_id: Added.
359 gnutls_ocsp_req_deinit: Added.
360 gnutls_ocsp_req_export: Added.
361 gnutls_ocsp_req_get_cert_id: Added.
362 gnutls_ocsp_req_get_extension: Added.
363 gnutls_ocsp_req_get_nonce: Added.
364 gnutls_ocsp_req_get_version: Added.
365 gnutls_ocsp_req_import: Added.
366 gnutls_ocsp_req_init: Added.
367 gnutls_ocsp_req_print: Added.
368 gnutls_ocsp_req_randomize_nonce: Added.
369 gnutls_ocsp_req_set_extension: Added.
370 gnutls_ocsp_req_set_nonce: Added.
371 gnutls_ocsp_resp_deinit: Added.
372 gnutls_ocsp_resp_export: Added.
373 gnutls_ocsp_resp_get_certs: Added.
374 gnutls_ocsp_resp_get_extension: Added.
375 gnutls_ocsp_resp_get_nonce: Added.
376 gnutls_ocsp_resp_get_produced: Added.
377 gnutls_ocsp_resp_get_responder: Added.
378 gnutls_ocsp_resp_get_response: Added.
379 gnutls_ocsp_resp_get_signature: Added.
380 gnutls_ocsp_resp_get_signature_algorithm: Added.
381 gnutls_ocsp_resp_get_single: Added.
382 gnutls_ocsp_resp_get_status: Added.
383 gnutls_ocsp_resp_get_version: Added.
384 gnutls_ocsp_resp_import: Added.
385 gnutls_ocsp_resp_init: Added.
386 gnutls_ocsp_resp_print: Added.
387 gnutls_ocsp_resp_verify: Added.
389 * Version 3.0.11 (released 2012-01-06)
391 ** libgnutls: Corrected functionality of
392 gnutls_record_get_direction(). Reported by Philip Allison.
394 ** libgnutls: Provide less timing information when decoding
395 TLS/DTLS record packets. Patch by Nadhem Alfardan.
397 ** API and ABI modifications:
398 No changes since last version.
401 * Version 3.0.10 (released 2012-01-04)
403 ** gnutls-cli/serv: Set don't fragment bit in DTLS sessions
404 in Linux as well as in BSD.
406 ** gnutls-cli: Fixed reading from windows terminals.
408 ** libgnutls: When GNUTLS_OPENPGP_FMT_BASE64 is specified
409 the stream is assumed to be base64 encoded (previously
410 the encoding was auto-detected). This avoids a decoding
411 issue in windows systems.
413 ** libgnutls: Corrected ciphersuite GNUTLS_ECDHE_PSK_AES_256_CBC_SHA384
415 ** libgnutls: Added ciphersuites: GNUTLS_PSK_WITH_AES_256_GCM_SHA384
416 and GNUTLS_DHE_PSK_WITH_AES_256_GCM_SHA384.
418 ** libgnutls: Added function gnutls_random_art() to convert
419 fingerprints to images (currently ascii-art).
421 ** libgnutls: Corrected bug in DSA private key parsing, which
422 prevented the verification of the key.
424 ** API and ABI modifications:
425 gnutls_random_art: Added
428 * Version 3.0.9 (released 2011-12-13)
430 ** certtool: Added new parameter --dh-info.
432 ** certtool: -l option was overloaded so if combined with --priority
433 it will only list the ciphersuites that are enabled by the given
436 ** libgnutls: Added new priority string %SERVER_PRECEDENCE, which
437 changes the ciphersuite selection procedure. If specified the server
438 priorities will be used for selection instead of the client's.
440 ** libgnutls: Optimizations in Diffie-Hellman parameters generation
443 ** libgnutls: When session tickets are negotiated and used in a
444 session, a server will not store that session data into its cache.
446 ** libgnutls: Added the SECP192R1 curve.
448 ** libgnutls: Added gnutls_priority_get_cipher_suite_index() to
449 allow listing the ciphersuites enabled in a priority structure.
450 It outputs an index to be used in gnutls_get_cipher_suite_info().
452 ** libgnutls: Optimizations in the elliptic curve code --timing
453 attacks resistant code is only used in ECDSA private key operations.
455 ** doc: man pages for API functions generation was fixed and are
456 now added again in the distribution.
458 ** API and ABI modifications:
459 GNUTLS_ECC_CURVE_SECP192R1: New curve definition
460 gnutls_priority_get_cipher_suite_index: Added
463 * Version 3.0.8 (released 2011-11-12)
465 ** certtool: Certtool -e returns error code on verification
468 ** certtool: Verifies parameters of generated keys.
470 ** libgnutls: Corrected ECC key generation (introduced in 3.0.6)
472 ** libgnutls: Provide less timing information when decoding
473 TLS/DTLS record packets.
475 ** doc: man pages for API functions were removed.
476 The reason was that the code that auto-generated the man pages missed
477 many APIs and we couldn't fix it (volunteers welcome). See the info
478 manual or the GTK-DOC manual instead.
480 ** API and ABI modifications:
481 gnutls_x509_privkey_verify_params: Added
484 * Version 3.0.7 (released 2011-11-08)
486 ** libgnutls: Corrected fix in gnutls_session_get_data()
487 to report the actual session size when the provided buffer
490 ** libgnutls: Fixed ciphersuite GNUTLS_ECDHE_RSA_AES_128_CBC_SHA256,
491 which was using a wrong MAC algorithm. Reported by Fabrice Gautier.
493 ** API and ABI modifications:
494 No changes since last version.
497 * Version 3.0.6 (released 2011-11-07)
499 ** gnutls-guile: Compilation fixes.
501 ** libgnutls: Fixed possible buffer overflow in
502 gnutls_session_get_data(). Reported and fix by Alban Crequy.
504 ** libgnutls: Bug fixes in the ciphersuites with NULL cipher.
505 Reported by Fabrice Gautier.
507 ** libgnutls: Bug fixes in ECC code for 64-bit MIPS systems.
508 Thanks to Joseph Graham for providing access to such a system.
510 ** libgnutls: Correctly report ECC private key parsing errors.
511 Reported by Fabrice Gautier.
513 ** libgnutls: In ECDHE verify that the received point lies on
514 the selected curve. The ECDHE ciphersuites now take precendence
517 ** API and ABI modifications:
518 No changes since last version.
521 * Version 3.0.5 (released 2011-10-27)
523 ** libgnutls-extra: is no more
525 ** libgnutls: Corrections in order to compile with mingw32.
527 ** libgnutls: Corrections in VIA padlock code for VIA C5 processor
528 and new detection of PHE with support for partial hashing.
530 ** libgnutls: Corrected bug in gnutls_x509_data2hex. Report and fix
533 ** minitasn1: Upgraded to libtasn1 version 2.10.
535 ** API and ABI modifications:
536 No changes since last version.
539 * Version 3.0.4 (released 2011-10-15)
541 ** libgnutls-extra: gnutls_register_md5_handler() was
544 ** gnutls-cli-debug: Added more tests including AES-GCM,
545 SHA256 and elliptic curves.
547 ** gnutls-cli: Added --benchmark-soft-ciphers to benchmark
548 the software version of the ciphers instead of hw accelerated
551 ** libgnutls: Public key ID calculation is consistent among
552 all structures. It uses a SHA-1 hash of the subjectPublicKeyInfo.
554 ** libgnutls: gnutls_privkey_t allows setting external callback
555 to perform signing or decryption. Can be set using
556 gnutls_privkey_import_ext()
558 ** libgnutls: A certificate credentials structure can be
559 used with a gnutls_privkey_t and a gnutls_pcert_st
560 structure using gnutls_certificate_set_key().
562 ** libgnutls: Fixes to enable external signing callback to
563 operate with TLS 1.2.
565 ** libgnutls: Fixed crash when printing ECDSA certificate key
566 ID. Reported by Erik Jensen.
568 ** libgnutls: Corrected VIA padlock code for C3. In C3 benchmarks
569 show a 50x increase in AES speed and a 14x increase in VIA nano. Added
570 support for hashes and HMACs.
572 ** libgnutls: Compilation fixed when p11-kit is not detected.
574 ** libgnutls: Fixed the deflate compression code.
576 ** libgnutls: Added gnutls_x509_crt_get_authority_info_access.
577 Used to get the PKIX Authority Information Access (AIA) field.
579 ** libgnutls: gnutls_x509_crt_print supports printing AIA fields.
581 ** libgnutls: Added ability to gnutls_privkey_t to operate with
582 signing callback function.
584 ** API and ABI modifications:
585 gnutls_x509_crt_get_authority_info_access (x509.h): Added function.
586 gnutls_privkey_import_ext: Added function.
587 gnutls_certificate_set_key: Added function.
588 gnutls_info_access_what_t (x509.h): Added enum.
589 GNUTLS_OID_AIA (x509.h): Added symbol.
590 GNUTLS_OID_AD_OCSP (x509.h): Added symbol.
591 GNUTLS_OID_AD_CAISSUERS (x509.h): Added symbol.
593 * Version 3.0.3 (released 2011-09-18)
595 ** libgnutls: Added gnutls_record_get_discarded() to return the
596 number of discarded records in a DTLS session.
598 ** libgnutls: All functions related to RSA-EXPORT were deprecated.
599 Support for RSA-EXPORT ciphersuites will be ceased in future versions.
601 ** libgnutls: Memory leak fixes in credentials private key
602 deinitialization. Reported by Dan Winship.
604 ** libgnutls: Memory leak fixes in ECC ciphersuites.
606 ** libgnutls: Do not send an empty extension structure in server
607 hello. This affected old implementations that do not support extensions.
608 Reported by J. Cameijo Cerdeira.
610 ** libgnutls: Allow CA importing of 0 certificates to succeed.
611 Reported by Jonathan Nieder <jrnieder@gmail.com> in
612 <http://bugs.debian.org/640639>.
614 ** libgnutls: Added support for VIA padlock AES optimizations.
615 (disabled by default)
617 ** libgnutls: Added support for elliptic curves in
620 ** libgnutls: Added gnutls_pkcs11_privkey_generate()
621 to allow generating a key in a token.
623 ** p11tool: Added generate-rsa, generate-dsa and
624 generate-ecc options to allow generating private
627 ** libgnutls: gnutls_transport_set_lowat dummy macro was
630 ** API and ABI modifications:
631 gnutls_pkcs11_privkey_generate: Added
632 gnutls_pubkey_import_ecc_raw: Added
633 gnutls_pubkey_import_ecc_x962: Added
634 gnutls_pubkey_get_pk_ecc_x962: Added
635 gnutls_record_get_discarded: Added
638 * Version 3.0.2 (released 2011-09-01)
640 ** libgnutls: OpenPGP certificate type is not enabled
643 ** libgnutls: Added %NO_EXTENSIONS priority string.
645 ** libgnutls: Corrected issue in gnutls_record_recv()
646 triggered on encryption or compression error.
648 ** libgnutls: Compatibility fixes in CPU ID detection
649 for i386 and old GCC.
651 ** gnutls-cli: Benchmark applications were incorporated
654 ** libgnutls: Corrected parsing of XMPP subject
657 ** libgnutls: Allow for out-of-order ChangeCipherSpec
660 ** libgnutls: gnutls_certificate_set_x509_key() and
661 gnutls_certificate_set_openpgp_key() operate as in 2.10.x
662 and allow the release of the private key during the
663 lifetime of the certificate structure.
665 ** API and ABI modifications:
666 GNUTLS_PRIVKEY_IMPORT_COPY: new gnutls_privkey_import() flag
669 * Version 3.0.1 (released 2011-08-20)
671 ** libgnutls: gnutls_certificate_set_x509_key_file() and
672 friends support server name indication. If multiple
673 certificates are set using these functions the proper one
674 will be selected during a handshake.
676 ** libgnutls: Added AES-256-GCM which was left out from
677 the previous release. Reported by Benjamin Hof.
679 ** libgnutls: When asking for a PKCS# 11 PIN multiple
680 times, the flags in the callback were not being updated
681 to reflect for PIN low count or final try.
683 ** libgnutls: Do not allow second instances of PKCS #11
686 ** libgnutls: fixed alignment issue in AES-NI code.
688 ** libgnutls: The config file at gnutls_pkcs11_init()
689 is being read if provided.
691 ** libgnutls: Ensure that a certificate list specified
692 using gnutls_certificate_set_x509_key() and friends, is
693 sorted according to TLS specification (from subject to issuer).
695 ** libgnutls: Added GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED flag for
696 gnutls_x509_crt_list_import. It checks whether the list to be
697 imported is properly sorted.
699 ** crywrap: Added to the distribution. It is an application
700 that proxies TLS session to a port using a plaintext service.
702 ** doc: Many GTK-DOC improvements.
704 ** i18n: Translations were updated.
706 ** API and ABI modifications:
707 GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED: New element in gnutls_certificate_import_flags
708 GNUTLS_PKCS11_PIN_WRONG: New flag for PIN callback
711 * Version 3.0.0 (released 2011-07-29)
713 ** libgnutls: writev_emu: stop on the first incomplete write. Patch by
716 ** libgnutls: Fix zlib handling in gnutls.pc. Patch by Andreas
719 ** certtool: bug fixes in certificate request generation. Patch
722 ** API and ABI modifications:
723 gnutls_pcert_list_import_x509_raw: ADDED
726 * Version 2.99.4 (released 2011-07-23)
728 ** doc: documentation updates.
730 ** libgnutls: gnutls_rsa_params_t is now identical to gnutls_x509_privkey_t
731 to avoid thread-safety issues. Reported by Sam Varshavchik.
733 ** libgnutls: Added compatibility mode with /etc/gnutls/pkcs11.conf
735 ** libgnutls: license upgraded to LGPLv3
737 ** libgnutls: gnutls_srp_verifier() returns data allocated with gnutls_malloc()
740 ** API and ABI modifications:
741 No changes since last version.
744 * Version 2.99.3 (released 2011-06-18)
746 ** libgnutls: Added new PKCS #11 flags to force an object being private or
747 not. (GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE and GNUTLS_PKCS11_OBJ_FLAG_MARK_NOT_PRIVATE)
749 ** libgnutls: Added SUITEB128 and SUITEB192 priority
750 strings to enable the NSA SuiteB cryptography ciphersuites.
752 ** libgnutls: Added gnutls_pubkey_verify_data2() that will
753 verify data provided the signature algorithm.
755 ** libgnutls: Simplified the handling of handshake messages to
756 be hashed. Instead of hashing during the handshake process we now
757 keep the data until handshake is over and hash them on request.
758 This uses more memory but eliminates issues with TLS 1.2 and
761 ** libgnutls: Added AES-GCM optimizations using the PCLMULQDQ
762 instruction. Uses Andy Polyakov's assembly code.
764 ** libgnutls: Added gnutls_x509_trust_list_add_named_crt() and
765 gnutls_x509_trust_list_verify_named_crt() that allow having a
766 list of certificates in the trusted list that will be associated
767 with a name (e.g. server name) and will not be used as CAs.
769 ** libgnutls: PKCS #11 back-end rewritten to use p11-kit
770 http://p11-glue.freedesktop.org/p11-kit.html. Rewrite by
773 ** libgnutls: Added ECDHE-PSK ciphersuites for TLS (RFC 5489).
775 ** API and ABI modifications:
776 gnutls_pubkey_verify_data2: ADDED
777 gnutls_ecc_curve_get: ADDED
778 gnutls_x509_trust_list_add_named_crt: ADDED
779 gnutls_x509_trust_list_verify_named_crt: ADDED
780 gnutls_x509_privkey_verify_data: REMOVED
781 gnutls_crypto_bigint_register: REMOVED
782 gnutls_crypto_cipher_register: REMOVED
783 gnutls_crypto_digest_register: REMOVED
784 gnutls_crypto_mac_register: REMOVED
785 gnutls_crypto_pk_register: REMOVED
786 gnutls_crypto_rnd_register: REMOVED
787 gnutls_crypto_single_cipher_register: REMOVED
788 gnutls_crypto_single_digest_register: REMOVED
789 gnutls_crypto_single_mac_register: REMOVED
790 GNUTLS_KX_ECDHE_PSK: New key exchange method
791 GNUTLS_VERIFY_DISABLE_CRL_CHECKS: New certificate verification flag.
792 GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE: New PKCS#11 object flag.
793 GNUTLS_PKCS11_OBJ_FLAG_MARK_NOT_PRIVATE: New PKCS#11 object flag.
796 * Version 2.99.2 (released 2011-05-26)
798 ** libgnutls: Added Elliptic curve support. This is not
799 enabled by default. Requires priority strings:
800 +CURVE-ALL: to add all supported curves
801 +ECDHE-RSA: to add ephemeral ECDHE with an RSA-signed certificate
802 +ECDHE-ECDSA: to add ephemeral ECDHE with an ECDSA-signed certificate
803 +ANON-ECDHE: to add anonymous ECDH
805 ** libgnutls: PKCS #11 URLs conform to the latest draft
806 being http://tools.ietf.org/html/draft-pechanec-pkcs11uri-04.
808 ** certtool: Can now load private keys and public keys from PKCS #11 tokens
811 ** libgnutls: Added gnutls_global_set_audit_log_function() that allows
812 to get important auditing information including the corresponding session.
813 That might be useful to block DoS or other attacker from specific IPs.
815 ** libgnutls: gnutls_pkcs11_privkey_import_url() will now correctly read
816 the public key algorithm of the key.
818 ** libgnutls: Added gnutls_certificate_get_issuer() and
819 gnutls_x509_trust_list_get_issuer() to compensate for the
820 missing gnutls_certificate_get_x509_cas().
822 ** libgnutls: Added gnutls_x509_crq_verify() to allow
823 verification of the self signature in a certificate request.
824 This allows verifying whether the owner of the private key
825 is the generator of the request.
827 ** libgnutls: gnutls_x509_crt_set_crq() implicitly verifies
828 the self signature of the request.
830 ** API and ABI modifications:
831 gnutls_certificate_get_issuer: ADDED
832 gnutls_x509_trust_list_get_issuer: ADDED
833 gnutls_x509_crq_verify: ADDED
834 gnutls_global_set_audit_log_function: ADDED
835 gnutls_ecc_curve_get_name: ADDED
836 gnutls_ecc_curve_get_size: ADDED
837 gnutls_x509_privkey_import_ecc_raw: ADDED
838 gnutls_x509_privkey_export_ecc_raw: ADDED
839 gnutls_global_set_time_function: ADDED
841 GNUTLS_E_ECC_NO_SUPPORTED_CURVES: New error code
842 GNUTLS_E_ECC_UNSUPPORTED_CURVE: New error code
843 GNUTLS_KX_ECDHE_RSA: New key exchange method
844 GNUTLS_KX_ECDHE_ECDSA: New key exchange method
845 GNUTLS_KX_ANON_ECDH: New key exchange method
846 GNUTLS_PK_ECC: New public key algorithm
847 GNUTLS_SIGN_ECDSA_SHA1: New signature algorithm
848 GNUTLS_SIGN_ECDSA_SHA256: New signature algorithm
849 GNUTLS_SIGN_ECDSA_SHA384: New signature algorithm
850 GNUTLS_SIGN_ECDSA_SHA512: New signature algorithm
851 GNUTLS_SIGN_ECDSA_SHA224: New signature algorithm
852 GNUTLS_ECC_CURVE_INVALID: New curve definition
853 GNUTLS_ECC_CURVE_SECP224R1: New curve definition
854 GNUTLS_ECC_CURVE_SECP256R1: New curve definition
855 GNUTLS_ECC_CURVE_SECP384R1: New curve definition
856 GNUTLS_ECC_CURVE_SECP521R1: New curve definition
859 * Version 2.99.1 (released 2011-04-23)
861 ** libgnutls: LZO support was removed.
863 ** libgnutls: Corrections in SSLv2 client hello parsing.
865 ** libgnutls: Added support for AES-NI if detected. Uses
866 Andy Polyakov's AES-NI code.
868 ** libgnutls: Restored HMAC-MD5 for compatibility. Although considered
869 weak, several sites require it for connection. It is enabled for
870 "NORMAL" and "PERFORMANCE" priority strings.
872 ** libgnutls: depend on libdl.
874 ** libgnutls-extra: Dropped support of LZO compression via liblzo.
876 ** libgnutls: gnutls_transport_set_global_errno() was removed. This
877 function required GnuTLS to access system specific data, for no reason.
878 Use gnutls_transport_set_errno(), or your system's errno fascility
881 ** libgnutls: Added gnutls_certificate_set_retrieve_function2()
882 to set a callback to retrieve a certificate. The certificate is
883 received in a format that requires no processing from gnutls thus
884 it is suitable when performance is required.
886 ** API and ABI modifications:
887 gnutls_transport_set_global_errno: REMOVED
888 gnutls_certificate_set_retrieve_function2: ADDED
890 * Version 2.99.0 (released 2011-04-09)
892 ** libgnutls: Added Datagram TLS support.
894 ** libgnutls: Uses a single configure file and a single
895 gnulib library to save space.
897 ** libgnutls: Several bug fixes.
899 ** libgnutls: gnutls_transport_set_lowat() is no more.
901 ** libgnutls-openssl: modified to use modern gnutls' functions.
902 This introduces an ABI incompatibility with previous versions.
904 ** libgnutls: Corrected signature generation and verification
905 in the Certificate Verify message when in TLS 1.2. Reported
908 ** libgnutlsxx: The C++ interface returns exception on
909 every error and not only on fatal ones. This allows easier
912 ** libgnutls: Corrected issue in DHE-PSK ciphersuites that ignored
915 ** libgnutls: SRP and PSK are no longer set on the default priorities.
916 They have to be explicitly set.
918 ** libgnutls: During handshake message verification using DSS
919 use the hash algorithm required by it.
921 ** libgnutls: gnutls_recv() return GNUTLS_E_PREMATURE_TERMINATION
922 on unexpected EOF, instead of GNUTLS_E_UNEXPECTED_PACKET_LENGTH.
924 ** libgnutls: Added GCM mode (interoperates with tls.secg.org)
926 ** libgnutls-extra: Inner application extension was removed.
927 It was never standardized nor published as an RFC.
929 ** libgnutls: Added new certificate verification functions, that
930 can provide more details and are more efficient. Check
931 gnutls_x509_trust_list_*.
933 ** certtool: Uses the new certificate verification functions for
936 ** certtool: Added new certificate verification functionality
937 using the --verify option. Combined with --load-ca-certificate
938 it can verify a certificate chain against a list of certificates.
940 ** Several files unnecessarily included <gcrypt.h>; this has been fixed.
942 ** API and ABI modifications:
943 gnutls_dtls_set_timeouts: ADDED
944 gnutls_dtls_get_mtu: ADDED
945 gnutls_dtls_get_data_mtu: ADDED
946 gnutls_dtls_set_mtu: ADDED
947 gnutls_dtls_cookie_send: ADDED
948 gnutls_dtls_cookie_verify: ADDED
949 gnutls_dtls_prestate_set: ADDED
950 gnutls_x509_trust_list_verify_crt: ADDED
951 gnutls_x509_trust_list_add_crls: ADDED
952 gnutls_x509_trust_list_add_cas: ADDED
953 gnutls_x509_trust_list_init: ADDED
954 gnutls_x509_trust_list_deinit: ADDED
955 gnutls_cipher_add_auth: ADDED
956 gnutls_cipher_tag: ADDED
957 gnutls_psk_netconf_derive_key: REMOVED
958 gnutls_certificate_verify_peers: REMOVED
959 gnutls_session_set_finished_function: REMOVED
960 gnutls_ext_register: REMOVED
961 gnutls_certificate_get_x509_crls: REMOVED
962 gnutls_certificate_get_x509_cas: REMOVED
963 gnutls_certificate_get_openpgp_keyring: REMOVED
964 gnutls_session_get_server_random: REMOVED
965 gnutls_session_get_client_random: REMOVED
966 gnutls_session_get_master_secret: REMOVED
967 gnutls_ia_allocate_client_credentials: REMOVED
968 gnutls_ia_allocate_server_credentials: REMOVED
969 gnutls_ia_enable: REMOVED
970 gnutls_ia_endphase_send: REMOVED
971 gnutls_ia_extract_inner_secret: REMOVED
972 gnutls_ia_free_client_credentials: REMOVED
973 gnutls_ia_free_server_credentials: REMOVED
974 gnutls_ia_generate_challenge: REMOVED
975 gnutls_ia_get_client_avp_ptr: REMOVED
976 gnutls_ia_get_server_avp_ptr: REMOVED
977 gnutls_ia_handshake: REMOVED
978 gnutls_ia_handshake_p: REMOVED
979 gnutls_ia_permute_inner_secret: REMOVED
980 gnutls_ia_recv: REMOVED
981 gnutls_ia_send: REMOVED
982 gnutls_ia_set_client_avp_function: REMOVED
983 gnutls_ia_set_client_avp_ptr: REMOVED
984 gnutls_ia_set_server_avp_function: REMOVED
985 gnutls_ia_set_server_avp_ptr: REMOVED
986 gnutls_ia_verify_endphase: REMOVED
989 * Version 2.12.2 (released 2011-04-08)
991 ** libgnutls: Several updates and fixes for win32. Patches by LRN.
993 ** libgnutls: Several bug and memory leak fixes.
995 ** srptool: Accepts the -d option to enable debugging.
997 ** libgnutls: Corrected bug in gnutls_srp_verifier() that prevented
998 the allocation of a verifier. Reported by Andrew Wiseman.
1000 ** API and ABI modifications:
1001 No changes since last version.
1004 * Version 2.12.1 (released 2011-04-02)
1006 ** certtool: Generated certificate request with stricter permissions.
1007 Reported by Luca Capello.
1009 ** libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov.
1011 ** libgnutls: Corrected windows system_errno() function prototype.
1013 ** libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand.
1015 ** libgnutls: Fix size of gnutls_openpgp_keyid_t by using the
1016 GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
1018 ** API and ABI modifications:
1019 No changes since last version.
1024 * Version 2.12.0 (released 2011-03-24)
1026 ** certtool: Warns on generation of DSA keys of over 1024 bits, about
1027 the incompatibility with TLS other than 1.2.
1029 ** libgnutls: Modified signature algorithm selection in client
1030 certificate request, to avoid failures in DSA certificates.
1032 ** libgnutls: Instead of failing with internal error, return
1033 GNUTLS_E_INCOMPAT_DSA_KEY_WITH_TLS_PROTOCOL if an incompatible DSA
1034 key with the negotiated protocol is encountered.
1036 ** libgnutls: Bug fixes in the RSA ciphersuite behavior with openpgp keys.
1038 ** libgnutls: Force state update when fork is detected in the nettle
1041 ** libgnutls: modified gnutls_pubkey_import_openpgp() to use the preferred
1042 subkey instead of setting explicitly one.
1044 ** libgnutls: Corrected default behavior in record version of Client Hellos.
1046 ** libgnutls-openssl: modified to use modern gnutls' functions.
1047 This introduces an ABI incompatibility with previous versions.
1049 ** API and ABI modifications:
1050 gnutls_pubkey_import_openpgp: MODIFIED
1055 ** libgnutls: The deprecated gnutls_x509_privkey_sign_hash() was
1056 replaced by gnutls_privkey_sign_hash2().
1058 ** libgnutls: gnutls_pubkey_verify_data, gnutls_pubkey_verify_hash,
1059 gnutls_x509_privkey_verify_data, gnutls_x509_crt_verify_data,
1060 gnutls_x509_crt_verify_hash return the negative error code
1061 GNUTLS_E_PK_SIG_VERIFY_FAILED if verification fails to simplify error
1064 ** libgnutls: Added helper functions for signature verification:
1065 gnutls_pubkey_verify_data() and gnutls_pubkey_import_privkey().
1067 ** libgnutls: Modified gnutls_privkey_sign_data().
1069 ** gnutls_x509_crl_privkey_sign2(), gnutls_x509_crq_sign2()
1070 gnutls_x509_privkey_sign_hash(), gnutls_x509_privkey_sign_data(),
1071 gnutls_x509_crt_verify_hash(), gnutls_x509_crt_verify_data(), were
1072 deprecated for gnutls_x509_crl_privkey_sign(),
1073 gnutls_x509_crq_privkey_sign(), gnutls_privkey_sign_hash(),
1074 gnutls_privkey_sign_data(), gnutls_pubkey_verify_hash()
1075 gnutls_pubkey_verify_data() respectively.
1077 ** libgnutls: gnutls_*_export_raw() functions now add leading zero in
1080 ** libgnutls: Added convenience functions gnutls_x509_crl_list_import2()
1081 and gnutls_x509_crt_list_import2().
1083 ** crypto.h: Fix use with C++.
1084 Reported by "Brendan Doherty" <brendand@gentrack.com>.
1086 ** API and ABI modifications:
1087 gnutls_x509_crl_list_import: ADDED
1088 gnutls_x509_crl_list_import2: ADDED
1089 gnutls_x509_crt_list_import2: ADDED
1090 gnutls_x509_crl_get_raw_issuer_dn: ADDED
1091 gnutls_pubkey_import_privkey: ADDED
1092 gnutls_pubkey_verify_data: ADDED
1093 gnutls_privkey_sign_hash: MODIFIED (was added in 2.11.0)
1094 gnutls_privkey_sign_data: MODIFIED (was added in 2.11.0)
1095 gnutls_x509_crq_sign2: DEPRECATED (use: gnutls_x509_crq_privkey_sign)
1096 gnutls_x509_crq_sign: DEPRECATED (use: gnutls_x509_crq_privkey_sign)
1097 gnutls_x509_crq_get_preferred_hash_algorithm: REMOVED (was added in 2.11.0)
1098 gnutls_x509_crl_sign: DEPRECATED (use: gnutls_x509_crl_privkey_sign)
1099 gnutls_x509_crl_sign2: DEPRECATED (use: gnutls_x509_crl_privkey_sign)
1100 gnutls_x509_privkey_sign_data: DEPRECATED (use: gnutls_privkey_sign_data2)
1101 gnutls_x509_privkey_sign_hash: DEPRECATED (use: gnutls_privkey_sign_hash2)
1102 gnutls_x509_privkey_verify_data: DEPRECATED (use: gnutls_pubkey_verify_data)
1103 gnutls_session_set_finished_function: DEPRECATED
1104 gnutls_x509_crt_verify_hash: DEPRECATED (use: gnutls_pubkey_verify_hash)
1105 gnutls_x509_crt_verify_data: DEPRECATED (use: gnutls_pubkey_verify_data)
1106 gnutls_x509_crt_get_verify_algorithm: DEPRECATED (use: gnutls_pubkey_get_verify_algorithm)
1107 gnutls_x509_crt_get_preferred_hash_algorithm: DEPRECATED (use: gnutls_pubkey_get_preferred_hash_algorithm)
1108 gnutls_openpgp_privkey_sign_hash: DEPRECATED (use: gnutls_privkey_sign_hash2)
1109 gnutls_pkcs11_privkey_sign_hash: REMOVED (was added in 2.11.0)
1110 gnutls_pkcs11_privkey_decrypt_data: REMOVED (was added in 2.11.0)
1111 gnutls_privkey_sign_hash: REMOVED (was added in 2.11.0)
1113 * Version 2.11.6 (released 2010-12-06)
1115 ** libgnutls: Record version of Client Hellos is now set by default to
1116 SSL 3.0. To restore the previous default behavior use %LATEST_RECORD_VERSION
1119 ** libgnutls: Use ASN1_NULL when writing parameters for RSA signatures.
1120 This makes us comply with RFC3279. Reported by Michael Rommel.
1122 ** gnutls-serv: Corrected a buffer overflow. Reported and patch by Tomas Mraz.
1124 ** API and ABI modifications:
1125 No changes since last version.
1127 * Version 2.11.5 (released 2010-12-01)
1129 ** libgnutls: Reverted default behavior for verification and
1130 introduced GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT. Thus by default
1131 V1 trusted CAs are allowed, unless the new flag is specified.
1133 ** libgnutls: Correctly add leading zero to PKCS #8 encoded DSA key.
1134 Reported by Jeffrey Walton.
1136 ** libgnutls: Added SIGN-ALL, CTYPE-ALL, COMP-ALL, and VERS-TLS-ALL
1137 as priority strings. Those allow to set all the supported algorithms
1140 ** p11tool: Introduced. It allows manipulating pkcs 11 tokens.
1142 ** gnutls-cli: Print channel binding only in verbose mode.
1143 Before it printed it after the 'Compression:' output, thus breaking
1144 Emacs starttls.el string searches.
1146 ** API and ABI modifications:
1147 gnutls_pkcs11_token_init: New function
1148 gnutls_pkcs11_token_set_pin: New function
1150 * Version 2.11.4 (released 2010-10-15)
1152 ** libgnutls: Add new API gnutls_session_channel_binding.
1153 The function is used to get the channel binding data. Currently only
1154 the "tls-unique" (RFC 5929) channel binding type is supported, through
1155 the GNUTLS_CB_TLS_UNIQUE type. See new section "Channel Bindings" in
1158 ** gnutls-cli, gnutls-serv: Print 'tls-unique' Channel Bindings.
1160 ** doc: Added pkcs11.h header file to GTK-DOC manual.
1162 ** build: Update gnulib files.
1164 ** i18n: Update translations.
1166 ** tests: Add self tests gendh.c. Speed up Guile self checks.
1168 ** API and ABI modifications:
1169 gnutls_session_channel_binding: New function.
1170 gnutls_channel_binding_t: New enumeration.
1171 GNUTLS_CB_TLS_UNIQUE: New gnutls_channel_binding_t enum member.
1172 GNUTLS_E_CHANNEL_BINDING_NOT_AVAILABLE: New error code.
1174 * Version 2.11.3 (released 2010-10-14)
1176 ** Indent code to follow the GNU Coding Standard.
1177 You should be able to unpack the 2.11.2 release and run 'make indent'
1178 twice to get exactly the same content as 2.11.3 except for generated
1179 files. Using GNU Indent 2.2.11.
1181 ** API and ABI modifications:
1182 No changes since last version.
1184 * Version 2.11.2 (released 2010-10-08)
1186 ** libgnutls: Several bug fixes on session resumption
1187 and session tickets support.
1189 ** libgnutls: Add new extended key usage ipsecIKE.
1191 ** certtool: Renamed PKCS #11 options to: --p11-provider,
1192 --p11-export-url, --p11-list-certs, --p11-list-certs,
1193 --p11-list-privkeys, --p11-list-trusted, --p11-list-all-certs,
1194 --p11-list-all, --p11-list-tokens, --p11-login, --p11-write,
1195 --p11-write-label, --p11-write-trusted, --p11-detailed-url,
1198 ** libgnutls: Corrected bug that caused importing DSA keys as RSA,
1199 introduced with the new nettle code.
1201 ** libgnutls: Corrected advertizing issue for session tickets.
1203 ** API and ABI modifications:
1204 gnutls_x509_crt_get_subject_unique_id: ADDED.
1205 gnutls_x509_crt_get_issuer_unique_id: ADDED.
1207 * Version 2.11.1 (released 2010-09-14)
1209 ** libgnutls: Nettle is the default crypto back end. Use --with-libgcrypt
1210 to use the libgcrypt back end.
1212 ** libgnutls: Depend on nettle 2.1. This makes nettle a fully working
1213 backend crypto library.
1215 ** libgnutls: Added RSA_NULL_SHA1 and SHA256 ciphersuites.
1217 ** libgnutls: Several updates in the buffering internal interface.
1219 ** libgnutls: Is now more liberal in the PEM decoding. That is spaces and
1220 tabs are being skipped.
1222 ** libgnutls: Added support for draft-pechanec-pkcs11uri-02.
1224 ** libgnutls: The %COMPAT flag now allows larger records that violate the
1227 ** libgnutls: by default lowat level has been set to zero to avoid unnecessary
1228 system calls. Applications that depended on it being 1 should explicitly call
1229 gnutls_transport_set_lowat().
1231 ** libgnutls: Updated documentation and gnutls_pk_params_t mappings
1232 to ECRYPT II recommendations. Mappings were moved to a single location
1233 and DSA keys are handled differently (since DSA2 allows for 1024,2048
1234 and 3072 keys only).
1236 ** libgnutls: gnutls_x509_privkey_import() will fallback to
1237 gnutls_x509_privkey_import_pkcs8() without a password, if it
1238 is unable to decode the key.
1240 ** libgnutls: HMAC-MD5 no longer used by default.
1242 ** API and ABI modifications:
1243 gnutls_openpgp_privkey_sec_param: ADDED
1244 gnutls_x509_privkey_sec_param: ADDED
1246 * Version 2.11.0 (released 2010-07-22)
1248 ** libgnutls: support scattered write using writev(). This takes
1249 advantage of the new buffering layer and allows queuing of packets
1250 and flushing them. This is currently used for handshake messages
1253 ** libgnutls: Added gnutls_global_set_mutex() to allow setting
1254 alternative locking procedures. By default the system available
1255 locking is used. In *NIX pthreads are used and in windows the
1256 critical section API. This follows a different approach than the
1257 previous versions that depended on libgcrypt initialization. The
1258 locks are now set by default in systems that support it. Programs
1259 that used gcry_control() to set thread locks should insert it into
1261 #if GNUTLS_VERSION_NUMBER <= 0x020b00
1265 ** libgnutls: Added support for reading DN from EV-certificates.
1267 jurisdictionOfIncorporationLocalityName,
1268 jurisdictionOfIncorporationStateOrProvinceName,
1269 jurisdictionOfIncorporationCountryName
1271 ** libgnutls: Added support for DSA signing/verifying with bit
1274 ** libgnutls-extra: When in FIPS mode gnutls_global_init_extra()
1275 has to be called to register any required md5 handlers.
1277 ** libgnutls: Internal buffering code was replaced by simpler
1278 code contributed by Jonathan Bastien-Filiatrault.
1280 ** libgnutls: Internal API for extensions augmented to allow
1281 safe storing and loading of data on resumption. This allows writing
1282 self-contained extensions (when possible). As a side effect
1283 the OPRFI extension was removed.
1285 ** libgnutls: Added support for DSA-SHA256 and DSA-SHA224
1287 ** libgnutls: Added PKCS #11 support and an API to access objects in
1288 gnutls/pkcs11.h. Currently certificates and public keys can be
1289 imported from tokens, and operations can be performed on private keys.
1291 ** libgnutls: Added abstract gnutls_privkey_t and gnutls_pubkey_t
1293 ** libgnutls: Added initial support for the nettle library. It uses
1294 the system's random generator for seeding. That is /dev/urandom in Linux,
1295 system calls in Win32 and EGD on other systems.
1297 ** libgnutls: Corrected issue on the %SSL3_RECORD_VERSION priority string. It now
1298 works even when resuming a session.
1300 ** libgnutls: Added gnutls_certificate_set_retrieve_function() to replace the
1301 similar gnutls_certificate_set_server_retrieve_function() and
1302 gnutls_certificate_set_client_retrieve_function(). In addition it support
1303 PKCS #11 private keys.
1305 ** libgnutls: Added gnutls_pkcs11_copy_x509_crt(), gnutls_pkcs11_copy_x509_privkey(),
1306 and gnutls_pkcs11_delete_url() to allow copying and deleting data in tokens.
1308 ** libgnutls: Added gnutls_sec_param_to_pk_bits() et al. to allow select bit
1309 sizes for private keys using a human understandable scale.
1311 ** certtool: Added new options: --pkcs11-list-tokens, --pkcs11-list-all
1312 --pkcs11-list-all-certs, --pkcs11-list-trusted, --pkcs11-list-certs,
1313 --pkcs11-delete-url, --pkcs11-write
1315 certtool: The --pkcs-cipher is taken into account when generating a
1316 private key. The default cipher used now is aes-128. The old behavior can
1317 be simulated by specifying "--pkcs-cipher 3des-pkcs12".
1319 certtool: Added --certificate-pubkey to print the public key of the
1322 ** gnutls-cli/gnutls-serv: --x509cafile, --x509certfile and --x509keyfile
1323 can now accept a PKCS #11 URL in addition to a file. This will allow for
1324 example to use the Gnome-keyring trusted certificate list to verify
1325 connections using a url such as:
1326 pkcs11:token=Root%20CA%20Certificates;serial=1%3AROOTS%3ADEFAULT;model=1%2E0;manufacturer=Gnome%20Keyring
1328 ** API and ABI modifications:
1329 gnutls_certificate_set_server_retrieve_function: DEPRECATED
1330 gnutls_certificate_set_client_retrieve_function: DEPRECATED
1331 gnutls_sign_callback_set: DEPRECATED
1332 gnutls_global_set_mutex: ADDED
1333 gnutls_pubkey_get_preferred_hash_algorithm: ADDED
1334 gnutls_x509_crt_get_preferred_hash_algorithm: ADDED
1335 gnutls_x509_privkey_export_rsa_raw2: ADDED
1337 gnutls_sec_param_to_pk_bits: ADDED
1338 gnutls_pk_bits_to_sec_param: ADDED
1339 gnutls_sec_param_get_name: ADDED
1340 gnutls_pkcs11_type_get_name: ADDED
1341 gnutls_certificate_set_retrieve_function: ADDED
1342 gnutls_pkcs11_init: ADDED
1343 gnutls_pkcs11_deinit: ADDED
1344 gnutls_pkcs11_set_pin_function: ADDED
1345 gnutls_pkcs11_set_token_function: ADDED
1346 gnutls_pkcs11_add_provider: ADDED
1347 gnutls_pkcs11_obj_init: ADDED
1348 gnutls_pkcs11_obj_import_url: ADDED
1349 gnutls_pkcs11_obj_export_url: ADDED
1350 gnutls_pkcs11_obj_deinit: ADDED
1351 gnutls_pkcs11_obj_export: ADDED
1352 gnutls_pkcs11_obj_list_import_url: ADDED
1353 gnutls_pkcs11_obj_export: ADDED
1354 gnutls_x509_crt_import_pkcs11: ADDED
1355 gnutls_pkcs11_obj_get_type: ADDED
1356 gnutls_x509_crt_list_import_pkcs11: ADDED
1357 gnutls_x509_crt_import_pkcs11_url: ADDED
1358 gnutls_pkcs11_obj_get_info: ADDED
1359 gnutls_pkcs11_token_get_info: ADDED
1360 gnutls_pkcs11_token_get_url: ADDED
1361 gnutls_pkcs11_privkey_init: ADDED
1362 gnutls_pkcs11_privkey_deinit: ADDED
1363 gnutls_pkcs11_privkey_get_pk_algorithm: ADDED
1364 gnutls_pkcs11_privkey_get_info: ADDED
1365 gnutls_pkcs11_privkey_import_url: ADDED
1366 gnutls_pkcs11_privkey_sign_data: ADDED
1367 gnutls_pkcs11_privkey_sign_hash: ADDED
1368 gnutls_pkcs11_privkey_decrypt_data: ADDED
1369 gnutls_privkey_init: ADDED
1370 gnutls_privkey_deinit: ADDED
1371 gnutls_privkey_get_pk_algorithm: ADDED
1372 gnutls_privkey_get_type: ADDED
1373 gnutls_privkey_import_pkcs11: ADDED
1374 gnutls_privkey_import_x509: ADDED
1375 gnutls_privkey_import_openpgp: ADDED
1376 gnutls_privkey_sign_data: ADDED
1377 gnutls_privkey_sign_hash: ADDED
1378 gnutls_privkey_decrypt_data: ADDED
1379 gnutls_pkcs11_privkey_export_url: ADDED
1380 gnutls_x509_crq_privkey_sign: ADDED
1381 gnutls_x509_crl_privkey_sign: ADDED
1382 gnutls_x509_crt_privkey_sign: ADDED
1383 gnutls_pubkey_init: ADDED
1384 gnutls_pubkey_deinit: ADDED
1385 gnutls_pubkey_get_pk_algorithm: ADDED
1386 gnutls_pubkey_import_x509: ADDED
1387 gnutls_pubkey_import_openpgp: ADDED
1388 gnutls_pubkey_get_pk_rsa_raw: ADDED
1389 gnutls_pubkey_get_pk_dsa_raw: ADDED
1390 gnutls_pubkey_export: ADDED
1391 gnutls_pubkey_get_key_id: ADDED
1392 gnutls_pubkey_get_key_usage: ADDED
1393 gnutls_pubkey_verify_hash: ADDED
1394 gnutls_pubkey_get_verify_algorithm: ADDED
1395 gnutls_pkcs11_type_get_name: ADDED
1396 gnutls_pubkey_import_pkcs11_url: ADDED
1397 gnutls_pubkey_import: ADDED
1398 gnutls_pubkey_import_pkcs11: ADDED
1399 gnutls_pubkey_import_dsa_raw: ADDED
1400 gnutls_pubkey_import_rsa_raw: ADDED
1401 gnutls_x509_crt_set_pubkey: ADDED
1402 gnutls_x509_crq_set_pubkey: ADDED
1403 gnutls_pkcs11_copy_x509_crt: ADDED
1404 gnutls_pkcs11_copy_x509_privkey: ADDED
1405 gnutls_pkcs11_delete_url: ADDED
1407 * Version 2.10.1 (released 2010-07-25)
1409 ** libgnutls: Added support for broken certificates that indicate RSA
1412 ** gnutls-cli: Allow verification using V1 CAs.
1414 ** libgnutls: gnutls_x509_privkey_import() will fallback to
1415 gnutls_x509_privkey_import_pkcs8() without a password, if it
1416 is unable to decode the key.
1418 ** libgnutls: Correctly deinitialize crypto API functions to prevent
1419 a memory leak. Reported by Mads Kiilerich.
1421 ** certtool: If asked to generate DSA keys of size more than 1024 bits,
1422 issue a warning, that the output key might not be working everywhere.
1424 ** certtool: The --pkcs-cipher is taken into account when generating a
1425 private key. The default cipher used now is aes-128. The old behavior
1426 can be simulated by specifying "--pkcs-cipher 3des-pkcs12".
1428 ** API and ABI modifications:
1429 No changes since last version.
1431 * Version 2.10.0 (released 2010-06-25)
1433 ** API and ABI modifications:
1434 No changes since last version.
1436 * Version 2.9.12 (released 2010-06-17)
1438 ** gnutls-cli: Make --starttls work again.
1439 Problem introduced in patch to use read() instead of fgets() committed
1442 ** API and ABI modifications:
1443 No changes since last version.
1445 * Version 2.9.11 (released 2010-06-07)
1447 ** libgnutls: Removed two APIs related to safe renegotiation.
1448 Use priority strings instead. The APIs were
1449 gnutls_safe_negotiation_set_initial and gnutls_safe_renegotiation_set.
1450 (Remember that we don't promise ABI stability during development
1451 series, so this doesn't cause an shared library ABI increment.)
1453 ** tests: More self testing of safe renegotiation extension.
1454 See tests/safe-renegotiation/README for more information.
1456 ** doc: a PDF version of the API reference manual (GTK-DOC) is now built.
1458 ** doc: Terms 'GNUTLS' and 'GNU TLS' were changed to 'GnuTLS' for consistency.
1460 ** API and ABI modifications:
1461 gnutls_safe_negotiation_set_initial: REMOVED.
1462 gnutls_safe_renegotiation_set: REMOVED.
1464 * Version 2.9.10 (released 2010-04-22)
1466 ** libgnutls: Time verification extended to trusted certificate list.
1467 Unless new constant GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS flag is
1470 ** certtool: Display postalCode and Name X.509 DN attributes correctly.
1471 Based on patch by Pavan Konjarla. Adds new constant
1472 GNUTLS_OID_X520_POSTALCODE and GNUTLS_OID_X520_NAME.
1474 ** libgnutls: Added Steve Dispensa's patch for safe renegotiation (RFC 5746)
1475 Solves the issue discussed in:
1476 <http://www.ietf.org/mail-archive/web/tls/current/msg03928.html> and
1477 <http://www.ietf.org/mail-archive/web/tls/current/msg03948.html>.
1478 Note that to allow connecting to unpatched servers the full protection
1479 is only enabled if the priority string %SAFE_RENEGOTIATION is
1480 specified. You can check whether protection is in place by querying
1481 gnutls_safe_renegotiation_status(). New error codes
1482 GNUTLS_E_SAFE_RENEGOTIATION_FAILED and
1483 GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED added.
1485 ** libgnutls: When checking openpgp self signature also check the signatures
1487 Ilari Liusvaara noticed and reported the issue and provided test
1490 ** libgnutls: Added cryptodev support (/dev/crypto).
1491 Tested with http://www.logix.cz/michal/devel/cryptodev/. Added
1492 benchmark utility for AES. Adds new error codes
1493 GNUTLS_E_CRYPTODEV_IOCTL_ERROR and GNUTLS_E_CRYPTODEV_DEVICE_ERROR.
1495 ** libgnutls: Exported API to access encryption and hash algorithms.
1496 The new API functions are gnutls_cipher_decrypt, gnutls_cipher_deinit,
1497 gnutls_cipher_encrypt, gnutls_cipher_get_block_size,
1498 gnutls_cipher_init, gnutls_hash, gnutls_hash_deinit, gnutls_hash_fast,
1499 gnutls_hash_get_len, gnutls_hash_init, gnutls_hash_output,
1500 gnutls_hmac, gnutls_hmac_deinit, gnutls_hmac_fast,
1501 gnutls_hmac_get_len, gnutls_hmac_init, gnutls_hmac_output. New API
1502 constants are GNUTLS_MAC_SHA224 and GNUTLS_DIG_SHA224.
1504 ** libgnutls: Added gnutls_certificate_set_verify_function() to allow
1505 verification of certificate upon receipt rather than waiting until the
1506 end of the handshake.
1508 ** libgnutls: Don't send alerts during handshake.
1509 Instead new error code GNUTLS_E_UNKNOWN_SRP_USERNAME is added.
1511 ** certtool: Corrected two issues that affected certificate request generation.
1512 (1) Null padding is added on integers (found thanks to Wilankar Trupti),
1513 (2) In optional SignatureAlgorithm parameters field for DSA keys the DSA
1514 parameters were added. Those were rejected by Verisign. Gnutls no longer adds
1515 those parameters there since other implementations don't do either and having
1516 them does not seem to offer anything (anyway you need the signer's certificate
1517 to verify thus public key will be available). Found thanks to Boyan Kasarov.
1518 This however has the side-effect that public key IDs shown by certtool are
1519 now different than previous gnutls releases.
1520 (3) the option --pgp-certificate-info will verify self signatures
1522 ** certtool: Allow exporting of Certificate requests on DER format.
1524 ** certtool: New option --no-crq-extensions to avoid extensions in CSRs.
1526 ** gnutls-cli: Handle reading binary data from server.
1527 Reported by and tiny patch from Vitaly Mayatskikh
1528 <v.mayatskih@gmail.com> in
1529 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4096>.
1531 ** minitasn1: Upgraded to libtasn1 version 2.6.
1533 ** i18n: Updated Czech, Dutch, French, Polish, Swedish translation.
1534 ** Added Italian and Simplified Chinese translation.
1535 Thanks to Petr Pisar, Erwin Poeze, Nicolas Provost, Jakub Bogusz,
1536 Daniel Nylander, Sergio Zanchetta, Tao Wei, and Aron Xu.
1538 ** doc: The GTK-DOC manual is significantly improved.
1540 ** API and ABI modifications:
1541 %DISABLE_SAFE_RENEGOTIATION: Added to priority strings (do not use).
1542 %INITIAL_SAFE_RENEGOTIATION: Added to priority strings.
1543 %UNSAFE_RENEGOTIATION: Added to priority strings.
1544 GNUTLS_DIG_SHA224: ADDED.
1545 GNUTLS_E_CRYPTODEV_DEVICE_ERROR: ADDED.
1546 GNUTLS_E_CRYPTODEV_IOCTL_ERROR: ADDED.
1547 GNUTLS_E_SAFE_RENEGOTIATION_FAILED: ADDED.
1548 GNUTLS_E_UNKNOWN_SRP_USERNAME: ADDED.
1549 GNUTLS_E_UNSAFE_RENEGOTIATION_DENIED: ADDED.
1550 GNUTLS_MAC_SHA224: ADDED.
1551 GNUTLS_OID_X520_NAME: ADDED.
1552 GNUTLS_OID_X520_POSTALCODE: ADDED.
1553 GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS: ADDED.
1554 GNUTLS_VERSION_MAX: ADDED.
1555 gnutls_certificate_set_verify_function: ADDED.
1556 gnutls_cipher_decrypt: ADDED.
1557 gnutls_cipher_deinit: ADDED.
1558 gnutls_cipher_encrypt: ADDED.
1559 gnutls_cipher_get_block_size: ADDED.
1560 gnutls_cipher_init: ADDED.
1562 gnutls_hash_deinit: ADDED.
1563 gnutls_hash_fast: ADDED.
1564 gnutls_hash_get_len: ADDED.
1565 gnutls_hash_init: ADDED.
1566 gnutls_hash_output: ADDED.
1568 gnutls_hmac_deinit: ADDED.
1569 gnutls_hmac_fast: ADDED.
1570 gnutls_hmac_get_len: ADDED.
1571 gnutls_hmac_init: ADDED.
1572 gnutls_hmac_output: ADDED.
1573 gnutls_safe_negotiation_set_initial: ADDED.
1574 gnutls_safe_renegotiation_set: ADDED.
1575 gnutls_safe_renegotiation_status: ADDED.
1577 * Version 2.9.9 (released 2009-11-09)
1579 ** libgnutls: Cleanups and several bug fixes.
1580 Found by Steve Grubb and Tomas Mraz.
1582 ** Link libgcrypt explicitly to certtool, gnutls-cli, gnutls-serv.
1584 ** Fix --disable-valgrind-tests.
1585 Reported by Ingmar Vanhassel in
1586 <https://savannah.gnu.org/support/?107029>.
1588 ** API and ABI modifications:
1589 No changes since last version.
1591 * Version 2.9.8 (released 2009-11-05)
1593 ** libgnutls: Fix for memory leaks on interrupted handshake.
1594 Reported by Tang Tong.
1596 ** libgnutls: Addition of support for TLS 1.2 signature algorithms
1597 ** extension and certificate verify field.
1598 This requires changes for TLS 1.2 servers and clients that use
1599 callbacks for certificate retrieval. They are now required to check
1600 with gnutls_sign_algorithm_get_requested() whether the certificate
1601 they send complies with the peer's preferences in signature
1604 ** libgnutls: In server side when resuming a session do not overwrite the
1605 ** initial session data with the resumed session data.
1607 ** libgnutls: Added support for AES-128, AES-192 and AES-256 in PKCS #8
1609 This affects also PKCS #12 encoded files. This adds the following new
1610 enums: GNUTLS_CIPHER_AES_192_CBC, GNUTLS_PKCS_USE_PBES2_AES_128,
1611 GNUTLS_PKCS_USE_PBES2_AES_192, GNUTLS_PKCS_USE_PBES2_AES_256.
1613 ** libgnutls: Fix PKCS#12 encoding.
1614 The error you would get was "The OID is not supported.". Problem
1615 introduced for the v2.8.x branch in 2.7.6.
1617 ** certtool: Added the --pkcs-cipher option.
1618 To explicitely specify the encryption algorithm to use.
1620 ** tests: Added "pkcs12_encode" self-test to check PKCS#12 functions.
1622 ** tests: Fix time bomb in chainverify self-test.
1623 Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in
1624 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3925>.
1626 ** tests: Fix expired cert in chainverify self-test.
1628 ** i18n: Vietnamese translation updated.
1629 Thanks to Clytie Siddall.
1631 ** API and ABI modifications:
1632 GNUTLS_CIPHER_AES_192_CBC: ADDED to gnutls/gnutls.h.
1633 GNUTLS_PKCS_USE_PBES2_AES_128: ADDED to gnutls/x509.h.
1634 GNUTLS_PKCS_USE_PBES2_AES_192: ADDED to gnutls/x509.h.
1635 GNUTLS_PKCS_USE_PBES2_AES_256: ADDED to gnutls/x509.h.
1636 GNUTLS_BAG_SECRET: ADDED to gnutls/pkcs12.h.
1637 GNUTLS_DIG_UNKNOWN: ADDED to gnutls/gnutls.h.
1638 gnutls_sign_algorithm_get_requested: ADDED.
1640 * Version 2.9.7 (released 2009-10-06)
1642 ** libgnutls: TLS 1.2 server mode fixes.
1643 Now interoperates against Opera. Contributed by Daiki Ueno.
1645 ** libgnutlsxx: Fix link problems.
1646 Tiny patch from Boyan Kasarov <bkasarov@gmail.com>.
1648 ** guile: Compatibility with guile 2.x.
1649 By Ludovic Courtes <ludovic.courtes@laas.fr>.
1651 ** API and ABI modifications:
1652 No changes since last version.
1654 * Version 2.9.6 (released 2009-09-22)
1656 ** libgnutls: Enable Camellia ciphers by default.
1658 ** API and ABI modifications:
1659 No changes since last version.
1661 * Version 2.9.5 (released 2009-09-10)
1663 ** libgnutls: Add new functions to extract X.509 Issuer Alternative Names.
1664 The new functions are gnutls_x509_crt_get_issuer_alt_name2,
1665 gnutls_x509_crt_get_issuer_alt_name, and
1666 gnutls_x509_crt_get_issuer_alt_othername_oid. Contributed by Brad
1667 Hards <bradh@frogmouth.net>.
1669 ** API and ABI modifications:
1670 gnutls_x509_crt_get_issuer_alt_name2: ADDED.
1671 gnutls_x509_crt_get_issuer_alt_name: ADDED.
1672 gnutls_x509_crt_get_issuer_alt_othername_oid: ADDED.
1674 * Version 2.9.4 (released 2009-09-03)
1676 ** libgnutls: Client-side TLS 1.2 and SHA-256 ciphersuites now works.
1677 The new supported ciphersuites are AES-128/256 in CBC mode with
1678 ANON-DH/RSA/DHE-DSS/DHE-RSA. Contributed by Daiki Ueno. Further,
1679 SHA-256 is now the preferred default MAC (however it is only used with
1682 ** libgnutls: Make OpenPGP hostname checking work again.
1683 The patch to resolve the X.509 CN/SAN issue accidentally broken
1684 OpenPGP hostname comparison.
1686 ** libgnutls: When printing X.509 certificates, handle XMPP SANs better.
1687 Reported by Howard Chu <hyc@symas.com> in
1688 <https://savannah.gnu.org/support/?106975>.
1690 ** Fix use of deprecated types internally.
1691 Use of deprecated types in GnuTLS from now on will lead to a compile
1692 error, to prevent this from happening again.
1694 ** API and ABI modifications:
1695 No changes since last version.
1697 * Version 2.9.3 (released 2009-08-19)
1699 ** libgnutls: Support for TLS tickets was contributed by Daiki Ueno.
1700 The new APIs are gnutls_session_ticket_enable_client,
1701 gnutls_session_ticket_enable_server, and
1702 gnutls_session_ticket_key_generate.
1704 ** gnutls-cli, gnutls-serv: New parameter --noticket to disable TLS tickets.
1706 ** API and ABI modifications:
1707 gnutls_session_ticket_key_generate: ADDED.
1708 gnutls_session_ticket_enable_client: ADDED.
1709 gnutls_session_ticket_enable_server: ADDED.
1711 * Version 2.9.2 (released 2009-08-14)
1713 ** libgnutls: Fix problem with NUL bytes in X.509 CN and SAN fields.
1714 By using a NUL byte in CN/SAN fields, it was possible to fool GnuTLS
1715 into 1) not printing the entire CN/SAN field value when printing a
1716 certificate and 2) cause incorrect positive matches when matching a
1717 hostname against a certificate. Some CAs apparently have poor
1718 checking of CN/SAN values and issue these (arguable invalid)
1719 certificates. Combined, this can be used by attackers to become a
1720 MITM on server-authenticated TLS sessions. The problem is mitigated
1721 since attackers needs to get one certificate per site they want to
1722 attack, and the attacker reveals his tracks by applying for a
1723 certificate at the CA. It does not apply to client authenticated TLS
1724 sessions. Research presented independently by Dan Kaminsky and Moxie
1725 Marlinspike at BlackHat09. Thanks to Tomas Hoger <thoger@redhat.com>
1726 for providing one part of the patch. [GNUTLS-SA-2009-4] [CVE-2009-2730].
1728 ** libgnutls: Fix rare failure in gnutls_x509_crt_import.
1729 The function may fail incorrectly when an earlier certificate was
1730 imported to the same gnutls_x509_crt_t structure.
1732 ** minitasn1: Internal copy updated to libtasn1 v2.3.
1734 ** libgnutls: Fix return value of gnutls_certificate_client_get_request_status.
1735 Before it always returned false. Reported by Peter Hendrickson
1736 <pdh@wiredyne.com> in
1737 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3668>.
1739 ** libgnutls: Fix off-by-one size computation error in unknown DN printing.
1740 The error resulted in truncated strings when printing unknown OIDs in
1741 X.509 certificate DNs. Reported by Tim Kosse
1742 <tim.kosse@filezilla-project.org> in
1743 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3651>.
1745 ** libgnutls: Fix PKCS#12 decryption from password.
1746 The encryption key derived from the password was incorrect for (on
1747 average) 1 in every 128 input for random inputs. Reported by "Kukosa,
1748 Tomas" <tomas.kukosa@siemens-enterprise.com> in
1749 <http://permalink.gmane.org/gmane.network.gnutls.general/1663>.
1751 ** libgnutls: Return correct bit lengths of some MPIs.
1752 gnutls_dh_get_prime_bits, gnutls_rsa_export_get_modulus_bits, and
1753 gnutls_dh_get_peers_public_bits. Before the reported value was
1754 overestimated. Reported by Peter Hendrickson <pdh@wiredyne.com> in
1755 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3607>.
1757 ** libgnutls: Avoid internal error when invoked after GNUTLS_E_AGAIN.
1758 Report and patch by Tim Kosse <tim.kosse@filezilla-project.org> in
1759 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3671>
1761 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3670>.
1763 ** libgnutls: Relax checking of required libtasn1/libgcrypt versions.
1764 Before we required that the runtime library used the same (or more
1765 recent) libgcrypt/libtasn1 as it was compiled with. Now we just check
1766 that the runtime usage is above the minimum required. Reported by
1767 Marco d'Itri <md@linux.it> via Andreas Metzler
1768 <ametzler@downhill.at.eu.org> in <http://bugs.debian.org/540449>.
1770 ** tests: Added new self-test pkcs12_s2k_pem to detect MPI bit length error.
1772 ** tests: Improved test vectors in self-test pkcs12_s2k.
1774 ** tests: Added new self-test dn2 to detect off-by-one size error.
1776 ** tests: Fix failure in "chainverify" because a certificate have expired.
1778 ** API and ABI modifications:
1779 No changes since last version.
1781 * Version 2.9.1 (released 2009-06-08)
1783 ** libgnutls: Fix crash in gnutls_global_init after earlier init/deinit cycle.
1784 Forwarded by Martin von Gagern <Martin.vGagern@gmx.net> from
1785 <http://bugs.gentoo.org/272388>.
1787 ** tests: Added new self-tests init_roundtrip.c to detect previous problem.
1789 ** Reduce stack usage for some CRQ functions.
1791 ** Doc fixes for CRQ functions.
1793 ** API and ABI modifications:
1794 No changes since last version.
1796 * Version 2.9.0 (released 2009-05-28)
1800 ** API and ABI modifications:
1801 No changes since last version.
1803 * Version 2.8.6 (released 2010-03-15)
1805 ** libgnutls: For CSRs, don't null pad integers for RSA/DSA value.
1806 VeriSign rejected CSRs with this padding. Reported by Wilankar Trupti
1807 <trupti.wilankar@hp.com> and Boyan Kasarov <bkasarov@gmail.com>.
1809 Note: As a side effect of this change, the "public key identifier"
1810 value computed for a certificate using this version of GnuTLS will be
1811 different from values computed using earlier versions of GnuTLS.
1813 ** libgnutls: For CSRs on DSA keys, don't add DSA parameters to the
1814 ** optional SignatureAlgorithm parameter field.
1815 VeriSign rejected these CSRs. They are stricly speaking not needed
1816 since you need the signer's certificate to verify the certificate
1817 signature anyway. Reported by Wilankar Trupti
1818 <trupti.wilankar@hp.com> and Boyan Kasarov <bkasarov@gmail.com>.
1820 ** libgnutls: When checking openpgp self signature also check the signatures
1822 Ilari Liusvaara noticed and reported the issue and provided test
1825 ** libgnutls: Cleanups and several bug fixes.
1826 Found by Steve Grubb and Tomas Mraz.
1828 ** Link libgcrypt explicitly to certtool, gnutls-cli, gnutls-serv.
1830 ** Fix --disable-valgrind-tests.
1831 Reported by Ingmar Vanhassel in
1832 <https://savannah.gnu.org/support/?107029>.
1834 ** examples: Use the new APIs for printing X.509 certificate information.
1836 ** Fix build failures on Solaris.
1837 Thanks to Dagobert Michelsen <dam@opencsw.org>.
1839 ** i18n: Updated Czech, Dutch, French, Polish, Swedish and Vietnamese
1840 ** translations. Added Simplified Chinese translation.
1842 ** API and ABI modifications:
1843 No changes since last version.
1845 * Version 2.8.5 (released 2009-11-02)
1847 ** libgnutls: In server side when resuming a session do not overwrite the
1848 ** initial session data with the resumed session data.
1850 ** libgnutls: Fix PKCS#12 encoding.
1851 The error you would get was "The OID is not supported.". Problem
1852 introduced for the v2.8.x branch in 2.7.6.
1854 ** guile: Compatibility with guile 2.x.
1855 By Ludovic Courtes <ludovic.courtes@laas.fr>.
1857 ** tests: Fix expired cert in chainverify self-test.
1859 ** tests: Fix time bomb in chainverify self-test.
1860 Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in
1861 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3925>.
1863 ** API and ABI modifications:
1864 No changes since last version.
1866 * Version 2.8.4 (released 2009-09-18)
1868 ** libgnutls: Enable Camellia ciphers by default.
1870 ** libgnutls: Make OpenPGP hostname checking work again.
1871 The patch to resolve the X.509 CN/SAN issue accidentally broken
1872 OpenPGP hostname comparison.
1874 ** libgnutls: When printing X.509 certificates, handle XMPP SANs better.
1875 Reported by Howard Chu <hyc@symas.com> in
1876 <https://savannah.gnu.org/support/?106975>.
1878 ** API and ABI modifications:
1879 No changes since last version.
1881 * Version 2.8.3 (released 2009-08-13)
1883 ** libgnutls: Fix patch for NUL in CN/SAN in last release.
1884 Code intended to be removed would lead to an read-out-bound error in
1885 some situations. Reported by Tomas Hoger <thoger@redhat.com>. A CVE
1886 code have been allocated for the vulnerability: [CVE-2009-2730].
1888 ** libgnutls: Fix rare failure in gnutls_x509_crt_import.
1889 The function may fail incorrectly when an earlier certificate was
1890 imported to the same gnutls_x509_crt_t structure.
1892 ** libgnutls-extra, libgnutls-openssl: Fix MinGW cross-compiling build error.
1894 ** tests: Made self-test mini-eagain take less time.
1898 ** API and ABI modifications:
1899 No changes since last version.
1901 * Version 2.8.2 (released 2009-08-10)
1903 ** libgnutls: Fix problem with NUL bytes in X.509 CN and SAN fields.
1904 By using a NUL byte in CN/SAN fields, it was possible to fool GnuTLS
1905 into 1) not printing the entire CN/SAN field value when printing a
1906 certificate and 2) cause incorrect positive matches when matching a
1907 hostname against a certificate. Some CAs apparently have poor
1908 checking of CN/SAN values and issue these (arguable invalid)
1909 certificates. Combined, this can be used by attackers to become a
1910 MITM on server-authenticated TLS sessions. The problem is mitigated
1911 since attackers needs to get one certificate per site they want to
1912 attack, and the attacker reveals his tracks by applying for a
1913 certificate at the CA. It does not apply to client authenticated TLS
1914 sessions. Research presented independently by Dan Kaminsky and Moxie
1915 Marlinspike at BlackHat09. Thanks to Tomas Hoger <thoger@redhat.com>
1916 for providing one part of the patch. [GNUTLS-SA-2009-4].
1918 ** libgnutls: Fix return value of gnutls_certificate_client_get_request_status.
1919 Before it always returned false. Reported by Peter Hendrickson
1920 <pdh@wiredyne.com> in
1921 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3668>.
1923 ** libgnutls: Fix off-by-one size computation error in unknown DN printing.
1924 The error resulted in truncated strings when printing unknown OIDs in
1925 X.509 certificate DNs. Reported by Tim Kosse
1926 <tim.kosse@filezilla-project.org> in
1927 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3651>.
1929 ** libgnutls: Return correct bit lengths of some MPIs.
1930 gnutls_dh_get_prime_bits, gnutls_rsa_export_get_modulus_bits, and
1931 gnutls_dh_get_peers_public_bits. Before the reported value was
1932 overestimated. Reported by Peter Hendrickson <pdh@wiredyne.com> in
1933 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3607>.
1935 ** libgnutls: Avoid internal error when invoked after GNUTLS_E_AGAIN.
1936 Report and patch by Tim Kosse <tim.kosse@filezilla-project.org> in
1937 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3671>
1939 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3670>.
1941 ** libgnutls: Relax checking of required libtasn1/libgcrypt versions.
1942 Before we required that the runtime library used the same (or more
1943 recent) libgcrypt/libtasn1 as it was compiled with. Now we just check
1944 that the runtime usage is above the minimum required. Reported by
1945 Marco d'Itri <md@linux.it> via Andreas Metzler
1946 <ametzler@downhill.at.eu.org> in <http://bugs.debian.org/540449>.
1948 ** minitasn1: Internal copy updated to libtasn1 v2.3.
1950 ** tests: Fix failure in "chainverify" because a certificate have expired.
1952 ** API and ABI modifications:
1953 No changes since last version.
1955 * Version 2.8.1 (released 2009-06-10)
1957 ** libgnutls: Fix crash in gnutls_global_init after earlier init/deinit cycle.
1958 Forwarded by Martin von Gagern <Martin.vGagern@gmx.net> from
1959 <http://bugs.gentoo.org/272388>.
1961 ** libgnutls: Fix PKCS#12 decryption from password.
1962 The encryption key derived from the password was incorrect for (on
1963 average) 1 in every 128 input for random inputs. Reported by "Kukosa,
1964 Tomas" <tomas.kukosa@siemens-enterprise.com> in
1965 <http://permalink.gmane.org/gmane.network.gnutls.general/1663>.
1967 ** API and ABI modifications:
1968 No changes since last version.
1970 * Version 2.8.0 (released 2009-05-27)
1972 ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists.
1974 ** Major changes compared to the v2.4 branch:
1976 *** lib: Linker version scripts reduces number of exported symbols.
1978 *** lib: Limit exported symbols on systems without LD linker scripts.
1980 *** libgnutls: Fix namespace issue with version symbols.
1982 *** libgnutls: Add functions to verify a hash against a certificate.
1983 gnutls_x509_crt_verify_hash: ADDED
1984 gnutls_x509_crt_get_verify_algorithm: ADDED
1986 *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6.
1988 *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'.
1990 *** certtool: Query for multiple dnsName subjectAltName in interactive mode.
1992 *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify.
1994 *** gnutls-serv: No longer disable MAC padding by default.
1996 *** gnutls-cli: Certificate information output format changed.
1998 *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5
1999 *** and %VERIFY_ALLOW_X509_V1_CA_CRT.
2001 *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode.
2003 *** libgnutls: gnutls_openpgp_crt_print supports oneline mode.
2005 *** libgnutls: gnutls_handshake when sending client hello during a
2006 rehandshake, will not offer a version number larger than the current.
2008 *** libgnutls: New interface to get key id for certificate requests.
2009 gnutls_x509_crq_get_key_id: ADDED.
2011 *** libgnutls: gnutls_x509_crq_print will now also print public key id.
2013 *** certtool: --verify-chain now prints results of using library verification.
2015 *** libgnutls: Libgcrypt initialization changed.
2017 *** libgnutls: Small byte reads via gnutls_record_recv() optimized.
2019 *** gnutls-cli: Return non-zero exit code on error conditions.
2021 *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored.
2023 *** certtool: allow setting arbitrary key purpose object identifiers.
2025 *** libgnutls: Change detection of when to use a linker version script.
2026 Use --enable-ld-version-script or --disable-ld-version-script to
2027 override auto-detection logic.
2029 *** Fix warnings and build GnuTLS with more warnings enabled.
2031 *** New API to set X.509 credentials from PKCS#12 memory structure.
2032 gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED
2034 *** Old libgnutls.m4 and libgnutls-config scripts removed.
2035 Please use pkg-config instead.
2037 *** libgnutls: Added functions to handle CRL extensions.
2038 gnutls_x509_crl_get_authority_key_id: ADDED
2039 gnutls_x509_crl_get_number: ADDED
2040 gnutls_x509_crl_get_extension_oid: ADDED
2041 gnutls_x509_crl_get_extension_info: ADDED
2042 gnutls_x509_crl_get_extension_data: ADDED
2043 gnutls_x509_crl_set_authority_key_id: ADDED
2044 gnutls_x509_crl_set_number: ADDED
2046 *** libgnutls: Added functions to handle X.509 extensions in Certificate
2048 gnutls_x509_crq_get_key_rsa_raw: ADDED
2049 gnutls_x509_crq_get_attribute_info: ADDED
2050 gnutls_x509_crq_get_attribute_data: ADDED
2051 gnutls_x509_crq_get_extension_info: ADDED
2052 gnutls_x509_crq_get_extension_data: ADDED
2053 gnutls_x509_crq_get_key_usage: ADDED
2054 gnutls_x509_crq_get_basic_constraints: ADDED
2055 gnutls_x509_crq_get_subject_alt_name: ADDED
2056 gnutls_x509_crq_get_subject_alt_othername_oid: ADDED
2057 gnutls_x509_crq_get_extension_by_oid: ADDED
2058 gnutls_x509_crq_set_subject_alt_name: ADDED
2059 gnutls_x509_crq_set_basic_constraints: ADDED
2060 gnutls_x509_crq_set_key_usage: ADDED
2061 gnutls_x509_crq_get_key_purpose_oid: ADDED
2062 gnutls_x509_crq_set_key_purpose_oid: ADDED
2063 gnutls_x509_crq_print: ADDED
2064 gnutls_x509_crt_set_crq_extensions: ADDED
2066 *** certtool: Print and set CRL and CRQ extensions.
2068 *** minitasn1: Internal copy updated to libtasn1 v2.1.
2070 *** examples: Now released into the public domain.
2072 *** The Texinfo and GTK-DOC manuals were improved.
2074 *** Several self-tests were added and others improved.
2076 *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x
2077 No offically supported interfaces have been modified or removed. The
2078 library should be completely backwards compatible on both the source
2081 The shared library no longer exports some symbols that have never been
2082 officially supported, i.e., not mentioned in any of the header files.
2088 Normally when symbols are removed, the shared library version has to
2089 be incremented. This leads to a significant cost for everyone using
2090 the library. Because none of the above symbols have ever been
2091 intended for use by well-behaved applications, we decided that the it
2092 would be better for those applications to pay the price rather than
2093 incurring problems on the majority of applications.
2095 If it turns out that applications have been using unofficial
2096 interfaces, we will need to release a follow-on release on the v2.8
2097 branch to exports additional interfaces. However, initial testing
2098 suggests that few if any applications have been using any of the
2101 Although not a new change compared to 2.6.x, we'd like to remind you
2102 interfaces have been modified so that X.509 chain verification now
2103 also checks activation/expiration times on certificates. The affected
2106 gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times.
2107 gnutls_certificate_verify_peers: Likewise.
2108 gnutls_certificate_verify_peers2: Likewise.
2109 GNUTLS_CERT_NOT_ACTIVATED: ADDED.
2110 GNUTLS_CERT_EXPIRED: ADDED.
2111 GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED.
2113 This change in behaviour was made during the GnuTLS 2.6.x cycle, and
2114 we gave our rationale for it in earlier release notes.
2116 The following symbols have been added to the library:
2118 gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED
2119 gnutls_x509_crl_get_authority_key_id: ADDED
2120 gnutls_x509_crl_get_extension_data: ADDED
2121 gnutls_x509_crl_get_extension_info: ADDED
2122 gnutls_x509_crl_get_extension_oid: ADDED
2123 gnutls_x509_crl_get_number: ADDED
2124 gnutls_x509_crl_set_authority_key_id: ADDED
2125 gnutls_x509_crl_set_number: ADDED
2126 gnutls_x509_crq_get_attribute_data: ADDED
2127 gnutls_x509_crq_get_attribute_info: ADDED
2128 gnutls_x509_crq_get_basic_constraints: ADDED
2129 gnutls_x509_crq_get_extension_by_oid: ADDED
2130 gnutls_x509_crq_get_extension_data: ADDED
2131 gnutls_x509_crq_get_extension_info: ADDED
2132 gnutls_x509_crq_get_key_id: ADDED.
2133 gnutls_x509_crq_get_key_purpose_oid: ADDED
2134 gnutls_x509_crq_get_key_rsa_raw: ADDED
2135 gnutls_x509_crq_get_key_usage: ADDED
2136 gnutls_x509_crq_get_subject_alt_name: ADDED
2137 gnutls_x509_crq_get_subject_alt_othername_oid: ADDED
2138 gnutls_x509_crq_print: ADDED
2139 gnutls_x509_crq_set_basic_constraints: ADDED
2140 gnutls_x509_crq_set_key_purpose_oid: ADDED
2141 gnutls_x509_crq_set_key_usage: ADDED
2142 gnutls_x509_crq_set_subject_alt_name: ADDED
2143 gnutls_x509_crt_get_verify_algorithm: ADDED
2144 gnutls_x509_crt_set_crq_extensions: ADDED
2145 gnutls_x509_crt_verify_hash: ADDED
2147 The following interfaces have been added to the header files:
2149 GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION.
2150 GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR.
2151 GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR.
2152 GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH.
2153 GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER.
2154 GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION.
2156 The following interfaces have been deprecated:
2158 LIBGNUTLS_VERSION: DEPRECATED.
2159 LIBGNUTLS_VERSION_MAJOR: DEPRECATED.
2160 LIBGNUTLS_VERSION_MINOR: DEPRECATED.
2161 LIBGNUTLS_VERSION_PATCH: DEPRECATED.
2162 LIBGNUTLS_VERSION_NUMBER: DEPRECATED.
2163 LIBGNUTLS_EXTRA_VERSION: DEPRECATED.
2165 * Version 2.7.14 (released 2009-05-26)
2167 ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra.
2168 The symbol LIBGNUTLS_EXTRA_VERSION were renamed to
2169 GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is
2172 ** Doc: Several typo fixes in documentation.
2173 Reported by Peter Hendrickson <pdh@wiredyne.com>.
2175 ** API and ABI modifications:
2176 GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION.
2177 LIBGNUTLS_EXTRA_VERSION: DEPRECATED.
2179 * Version 2.7.13 (released 2009-05-25)
2181 ** libgnutls: Fix version of some exported symbols in the shared library.
2182 Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in
2183 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>.
2185 ** tests: Handle recently expired certificates in chainverify self-test.
2186 Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in
2187 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>.
2189 ** API and ABI modifications:
2190 No changes since last version.
2192 * Version 2.7.12 (released 2009-05-20)
2194 ** gnutls-serv, gnutls-cli-debug: Make them work on Windows.
2196 ** tests/crq_key_id: Don't read entropy from /dev/random in self-test.
2197 Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in
2198 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>.
2200 ** Fix build failures.
2201 Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom
2202 G. Christensen" <tgc@jupiterrise.com> in
2203 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>.
2205 ** minitasn1: Internal copy updated to libtasn1 v2.2.
2206 GnuTLS should work fine with libtasn1 v1.x and that is still
2209 ** API and ABI modifications:
2210 No changes since last version.
2212 * Version 2.7.11 (released 2009-05-18)
2214 ** minitasn1: Fix build failure when using internal libtasn1.
2215 Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in
2216 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>.
2218 ** libgnutls: Fix build failure with --disable-cxx.
2219 Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in
2220 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>.
2222 ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV.
2223 Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in
2224 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560>
2226 ** Building with many warning flags now requires --enable-gcc-warnings.
2227 This avoids crying wolf for normal compiles.
2229 ** API and ABI modifications:
2230 No changes since last version.
2232 * Version 2.7.10 (released 2009-05-13)
2234 ** examples: Now released into the public domain.
2235 This makes the license of the example code compatible with more
2236 licenses, including the (L)GPL.
2238 ** minitasn1: Internal copy updated to libtasn1 v2.1.
2239 GnuTLS should work fine with libtasn1 v1.x and that is still
2242 ** libgnutls: Fix crash in signature verification
2243 The fix for the CVE-2009-1415 problem wasn't merged completely.
2245 ** doc: Fixes for GTK-DOC output.
2247 ** API and ABI modifications:
2248 No changes since last version.
2250 * Version 2.7.9 (released 2009-05-11)
2252 ** doc: Fix strings in man page of gnutls_priority_init.
2254 ** doc: Fix tables of error codes and supported algorithms.
2256 ** Fix build failure when cross-compiled using MinGW.
2258 ** Fix build failure when LZO is enabled.
2259 Reported by Arfrever Frehtes Taifersar Arahesis
2260 <arfrever.fta@gmail.com> in
2261 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>.
2263 ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6.
2264 Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in
2265 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>.
2267 ** Fix warnings in self-tests.
2269 ** API and ABI modifications:
2270 No changes since last version.
2272 * Version 2.7.8 (released 2009-05-03)
2274 ** libgnutls: Fix DSA key generation.
2275 Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416]
2277 ** libgnutls: Check expiration/activation time on untrusted certificates.
2278 Merged from stable branch. Reported by Romain Francoise
2279 <romain@orebokech.com>. This changes the semantics of
2280 gnutls_x509_crt_list_verify, which in turn is used by
2281 gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2.
2282 We add two new gnutls_certificate_status_t codes for reporting the new
2283 error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED.
2284 We also add a new gnutls_certificate_verify_flags flag,
2285 GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new
2286 behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417]
2288 ** lib: Linker version scripts reduces number of exported symbols.
2289 The linker version script now lists all exported ABIs explicitly, to
2290 avoid accidentally exporting unintended functions. Compared to
2291 before, most symbols beginning with _gnutls* are no longer exported.
2292 These functions have never been intended for use by applications, and
2293 there were no prototypes for these function in the public header
2294 files. Thus we believe it is possible to do this without incrementing
2295 the library ABI version which normally has to be done when removing an
2298 ** lib: Limit exported symbols on systems without LD linker scripts.
2299 Before all symbols were exported. Now we limit the exported symbols
2300 to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls)
2301 _gnutls*. This is a superset of the actual supported ABI, but still
2302 an improvement compared to before. This is implemented using Libtool
2303 -export-symbols-regex. It is more portable than linker version
2306 ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols.
2307 This should have been done in the last release.
2309 ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6.
2310 Reported by Peter Hendrickson <pdh@wiredyne.com> in
2311 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>.
2313 ** doc: Improved sections for the info manual.
2314 We now follow the advice given by the texinfo manual on which
2315 directory categories to use. In particular, libgnutls moved from the
2316 'GNU Libraries' section to the 'Software libraries' and the command
2317 line tools moved from 'Network Applications' to 'System
2320 ** API and ABI modifications:
2321 gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times.
2322 gnutls_certificate_verify_peers: Likewise.
2323 gnutls_certificate_verify_peers2: Likewise.
2324 GNUTLS_CERT_NOT_ACTIVATED: ADDED.
2325 GNUTLS_CERT_EXPIRED: ADDED.
2326 GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED.
2328 * Version 2.7.7 (released 2009-04-20)
2330 ** libgnutls: Applied patch by Cedric Bail to add functions
2331 gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm().
2333 ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output.
2334 Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in
2335 <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>.
2337 ** minitasn1: Internal copy updated to libtasn1 v1.8.
2338 GnuTLS is also internally ready to be used with libtasn1 v2.0.
2340 ** doc: Fix build failure of errcodes/printlist.
2341 Reported by Roman Bogorodskiy <novel@FreeBSD.org> in
2342 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>.
2344 ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'.
2345 It is currently only used by the core library. This will enable a new
2346 domain 'gnutls' for translations of the command line tools.
2348 ** Corrected possible memory corruption on signature verification failure.
2349 Reported by Miroslav Kratochvil <exa.exa@gmail.com>
2351 ** API and ABI modifications:
2352 gnutls_x509_crt_verify_hash: ADDED
2353 gnutls_x509_crt_get_verify_algorithm: ADDED
2355 * Version 2.7.6 (released 2009-02-27)
2357 ** certtool: Query for multiple dnsName subjectAltName in interactive mode.
2358 This applies both to generating certificates and certificate requests.
2360 ** pkix.asn: Removed unneeded definitions to reduce memory usage.
2362 ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify.
2363 Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to
2364 be used for chain verification.
2366 ** gnutls-serv: No longer disable MAC padding by default.
2367 Use --priority NORMAL:%COMPAT to disable MAC padding again.
2369 ** gnutls-cli: Certificate information output format changed.
2370 The tool now uses libgnutls' functions to print certificate
2371 information. This avoids code duplication.
2373 ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5
2374 ** and %VERIFY_ALLOW_X509_V1_CA_CRT.
2375 They can be used to override the default certificate chain validation
2378 ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to
2379 specify the client hello message record version. Used to overcome buggy
2380 TLS servers. Report by Martin von Gagern.
2382 ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode.
2384 ** libgnutls: gnutls_openpgp_crt_print supports oneline mode.
2386 ** doc: Update gnutls-cli and gnutls-serv --help output descriptions.
2388 ** API and ABI modifications:
2389 No changes since last version.
2391 * Version 2.7.5 (released 2009-02-06)
2393 ** libgnutls: Accept chains where intermediary certs are trusted.
2394 Before GnuTLS needed to validate the entire chain back to a
2395 self-signed certificate. GnuTLS will now stop looking when it has
2396 found an intermediary trusted certificate. The new behaviour is
2397 useful when chains, for example, contains a top-level CA, an
2398 intermediary CA signed using RSA-MD5, and an end-entity certificate.
2399 To avoid chain validation errors due to the RSA-MD5 cert, you can
2400 explicitly add the intermediary RSA-MD5 cert to your trusted certs.
2401 The signature on trusted certificates are not checked, so the chain
2402 has a chance to validate correctly. Reported by "Douglas E. Engert"
2403 <deengert@anl.gov> in
2404 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>.
2406 ** libgnutls: result_size in gnutls_hex_encode now holds
2407 the size of the result. Report by John Brooks <special@dereferenced.net>.
2409 ** libgnutls: gnutls_handshake when sending client hello during a
2410 rehandshake, will not offer a version number larger than the current.
2411 Reported by Tristan Hill <stan@saticed.me.uk>.
2413 ** libgnutls: Permit V1 Certificate Authorities properly.
2414 Before they were mistakenly rejected even though
2415 GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or
2416 GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by
2417 "Douglas E. Engert" <deengert@anl.gov> in
2418 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>.
2420 ** API and ABI modifications:
2421 No changes since last version.
2423 * Version 2.7.4 (released 2009-01-07)
2425 ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures.
2426 This is a bugfix -- the previous attempt to do this from internal x509
2427 certificate verification procedures did not return the correct value
2428 for certificates using a weak hash. Reported by Daniel Kahn Gillmor
2429 <dkg@fifthhorseman.net> in
2430 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>,
2431 debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn
2432 Gillmor <dkg@fifthhorseman.net>.
2434 ** libgnutls: New interface to get key id for certificate requests.
2435 Patch from David Marín Carreño <davefx@gmail.com> in
2436 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>.
2438 ** libgnutls: gnutls_x509_crq_print will now also print public key id.
2440 ** certtool: --verify-chain now prints results of using library verification.
2441 Earlier, certtool --verify-chain used its own validation algorithm
2442 which wasn't guaranteed to give the same result as the libgnutls
2443 internal validation algorithm. Now this command print a new final
2444 line with header 'Chain verification output:' that contains the result
2445 from using the internal verification algorithm on the same chain.
2447 ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id.
2449 ** API and ABI modifications:
2450 gnutls_x509_crq_get_key_id: ADDED.
2452 * Version 2.7.3 (released 2008-12-10)
2454 ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs.
2455 Reported by Michael Kiefer <Michael-Kiefer@web.de> in
2456 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by
2457 Andreas Metzler <ametzler@downhill.at.eu.org> in
2458 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>.
2460 ** libgnutls: Libgcrypt initialization changed.
2461 If libgcrypt has not already been initialized, GnuTLS will now
2462 initialize libgcrypt with disabled secure memory. Initialize
2463 libgcrypt explicitly in your application if you want to enable secure
2464 memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory
2465 allocation functions, which doesn't use secure memory, so there is no
2466 real change in behaviour.
2468 ** libgnutls: Fix memory leak in PSK authentication.
2469 Reported by Michael Weiser <michael@weiser.dinsnail.net> in
2470 <http://permalink.gmane.org/gmane.network.gnutls.general/1465>.
2472 ** libgnutls: Small byte reads via gnutls_record_recv() optimized.
2474 ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier.
2475 It needs to be invoked before libgcrypt is initialized.
2477 ** gnutls-cli: Return non-zero exit code on error conditions.
2479 ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored.
2481 ** tests: Added chainverify self-test that tests X.509 chain verifications.
2483 ** API and ABI modifications:
2484 No changes since last version.
2486 * Version 2.7.2 (released 2008-11-18)
2488 ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3]
2489 The flaw makes it possible for man in the middle attackers (i.e.,
2490 active attackers) to assume any name and trick GnuTLS clients into
2491 trusting that name. Thanks for report and analysis from Martin von
2492 Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989]
2494 Any updates with more details about this vulnerability will be added
2495 to <http://www.gnu.org/software/gnutls/security.html>
2497 ** libgnutls: Fix namespace issue with version symbols.
2498 The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR,
2499 LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and
2500 LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER,
2501 GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and
2502 GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to
2503 work but are deprecated.
2505 ** certtool: allow setting arbitrary key purpose object identifiers.
2507 ** libgnutls: Fix detection of C99 macros, to make debug logging work again.
2509 ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits.
2510 Reported by Kevin Quick <quick@sparq.org> in
2511 <https://savannah.gnu.org/support/index.php?106454>.
2513 ** libgnutls-extra: Make building with LZO compression work again.
2514 Build failure reported by Arfrever Frehtes Taifersar Arahesis
2515 <arfrever.fta@gmail.com> in
2516 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>.
2518 ** libgnutls: Change detection of when to use a linker version script.
2519 Use --enable-ld-version-script or --disable-ld-version-script to
2520 override auto-detection logic.
2522 ** doc: Change license on the manual to GFDLv1.3+.
2524 ** doc: GTK-DOC fixes for new splitted configuration system.
2526 ** doc: Texinfo stylesheet uses white background.
2528 ** tests: Add cve-2008-4989.c self-test.
2529 Tests regressions of the GNUTLS-SA-2008-3 security problem, and the
2530 follow-on problem with crashes on length 1 certificate chains.
2532 ** gnulib: Deprecated modules removed.
2533 Modules include memchr and memcmp.
2535 ** Fix warnings and build GnuTLS with more warnings enabled.
2537 ** minitasn1: Internal copy updated to libtasn1 v1.7.
2539 ** API and ABI modifications:
2540 gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED
2541 GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION.
2542 GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR.
2543 GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR.
2544 GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH.
2545 GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER.
2546 LIBGNUTLS_VERSION: DEPRECATED.
2547 LIBGNUTLS_VERSION_MAJOR: DEPRECATED.
2548 LIBGNUTLS_VERSION_MINOR: DEPRECATED.
2549 LIBGNUTLS_VERSION_PATCH: DEPRECATED.
2550 LIBGNUTLS_VERSION_NUMBER: DEPRECATED.
2552 * Version 2.7.1 (released 2008-10-31)
2554 ** certtool: print a PKCS #8 key even if it is not encrypted.
2556 ** Old libgnutls.m4 and libgnutls-config scripts removed.
2557 Please use pkg-config instead.
2559 ** Configuration system modified.
2560 There is now a configure script in lib/ and libextra/ as well, because
2561 gnulib works better with a config.h per gnulib directory.
2563 ** API and ABI modifications:
2564 No changes since last version.
2566 * Version 2.7.0 (released 2008-10-16)
2568 ** libgnutls: Added functions to handle CRL extensions.
2570 ** libgnutls: Added functions to handle X.509 extensions in Certificate
2573 ** libgnutls: Improved error string for GNUTLS_E_AGAIN.
2574 Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>.
2576 ** certtool: Print and set CRL and CRQ extensions.
2578 ** libgnutls-extra: Protect internal symbols with static.
2579 Fixes problem when linking certtool statically. Tiny patch from Aaron
2580 Ucko <ucko@ncbi.nlm.nih.gov>.
2582 ** libgnutls-openssl: fix out of bounds access.
2583 Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch
2584 from Thomas Viehmann <tv@beamnet.de>.
2586 ** libgnutlsxx: Define server_session::get_srp_username even if no SRP.
2588 ** tests: Make tests compile when using internal libtasn1.
2589 Patch by ludo@gnu.org (Ludovic Courtès).
2591 ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config.
2592 We now require a libgcrypt that has Camellia constants declared in
2593 gcrypt.h, which means v1.3.0 or later.
2595 ** API and ABI modifications:
2596 gnutls_x509_crl_get_authority_key_id: ADDED
2597 gnutls_x509_crl_get_number: ADDED
2598 gnutls_x509_crl_get_extension_oid: ADDED
2599 gnutls_x509_crl_get_extension_info: ADDED
2600 gnutls_x509_crl_get_extension_data: ADDED
2601 gnutls_x509_crl_set_authority_key_id: ADDED
2602 gnutls_x509_crl_set_number: ADDED
2603 gnutls_x509_crq_get_key_rsa_raw: ADDED
2604 gnutls_x509_crq_get_attribute_info: ADDED
2605 gnutls_x509_crq_get_attribute_data: ADDED
2606 gnutls_x509_crq_get_extension_info: ADDED
2607 gnutls_x509_crq_get_extension_data: ADDED
2608 gnutls_x509_crq_get_key_usage: ADDED
2609 gnutls_x509_crq_get_basic_constraints: ADDED
2610 gnutls_x509_crq_get_subject_alt_name: ADDED
2611 gnutls_x509_crq_get_subject_alt_othername_oid: ADDED
2612 gnutls_x509_crq_get_extension_by_oid: ADDED
2613 gnutls_x509_crq_set_subject_alt_name: ADDED
2614 gnutls_x509_crq_set_basic_constraints: ADDED
2615 gnutls_x509_crq_set_key_usage: ADDED
2616 gnutls_x509_crq_get_key_purpose_oid: ADDED
2617 gnutls_x509_crq_set_key_purpose_oid: ADDED
2618 gnutls_x509_crq_print: ADDED
2619 gnutls_x509_crt_set_crq_extensions: ADDED
2621 * Version 2.6.6 (released 2009-04-30)
2623 ** libgnutls: Corrected double free on signature verification failure.
2624 Reported by Miroslav Kratochvil <exa.exa@gmail.com>. See the advisory
2625 for more details. [GNUTLS-SA-2009-1] [CVE-2009-1415]
2627 ** libgnutls: Fix DSA key generation.
2628 Noticed when investigating the previous GNUTLS-SA-2009-1 problem. All
2629 DSA keys generated using GnuTLS 2.6.x are corrupt. See the advisory
2630 for more details. [GNUTLS-SA-2009-2] [CVE-2009-1416]
2632 ** libgnutls: Check expiration/activation time on untrusted certificates.
2633 Reported by Romain Francoise <romain@orebokech.com>. Before the
2634 library did not check activation/expiration times on certificates, and
2635 was documented as not doing so. We have realized that many
2636 applications that use libgnutls, including gnutls-cli, fail to perform
2637 proper checks. Implementing similar logic in all applications leads
2638 to code duplication. Hence, we decided to check whether the current
2639 time (as reported by the time function) is within the
2640 activation/expiration period of certificates when verifying untrusted
2643 This changes the semantics of gnutls_x509_crt_list_verify, which in
2644 turn is used by gnutls_certificate_verify_peers and
2645 gnutls_certificate_verify_peers2. We add two new
2646 gnutls_certificate_status_t codes for reporting the new error
2647 condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also
2648 add a new gnutls_certificate_verify_flags flag,
2649 GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new
2652 More details about the vulnerabilities will be posted at
2653 <http://www.gnu.org/software/gnutls/security.html>.
2655 ** gnutls-cli, gnutls-cli-debug: Fix AIX build problem.
2656 Reported by LAUPRETRE François (P) <francois.laupretre@ratp.fr> in
2657 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3468>.
2659 ** tests: Fix linking of tests/openpgp/keyring self-test.
2660 Reported by Daniel Black in <https://savannah.gnu.org/support/?106543>.
2662 ** API and ABI modifications:
2663 gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times.
2664 gnutls_certificate_verify_peers: Likewise.
2665 gnutls_certificate_verify_peers2: Likewise.
2666 GNUTLS_CERT_NOT_ACTIVATED: ADDED.
2667 GNUTLS_CERT_EXPIRED: ADDED.
2668 GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED.
2670 * Version 2.6.5 (released 2009-04-11)
2672 ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to
2673 specify the client hello message record version. Used to overcome buggy
2674 TLS servers. Report by Martin von Gagern.
2676 ** GnuTLS no longer uses the libtasn1-config script to find libtasn1.
2677 Libtasn1 0.3.4 or later is required. This is to align with the
2678 upcoming libtasn1 v2.0 release that doesn't have a libtasn1-script.
2680 ** API and ABI modifications:
2681 No changes since last version.
2683 * Version 2.6.4 (released 2009-02-06)
2685 ** libgnutls: Accept chains where intermediary certs are trusted.
2686 Before GnuTLS needed to validate the entire chain back to a
2687 self-signed certificate. GnuTLS will now stop looking when it has
2688 found an intermediary trusted certificate. The new behaviour is
2689 useful when chains, for example, contains a top-level CA, an
2690 intermediary CA signed using RSA-MD5, and an end-entity certificate.
2691 To avoid chain validation errors due to the RSA-MD5 cert, you can
2692 explicitly add the intermediary RSA-MD5 cert to your trusted certs.
2693 The signature on trusted certificates are not checked, so the chain
2694 has a chance to validate correctly. Reported by "Douglas E. Engert"
2695 <deengert@anl.gov> in
2696 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>.
2698 ** libgnutls: result_size in gnutls_hex_encode now holds
2699 the size of the result. Report by John Brooks <special@dereferenced.net>.
2701 ** libgnutls: gnutls_handshake when sending client hello during a
2702 rehandshake, will not offer a version number larger than the current.
2703 Reported by Tristan Hill <stan@saticed.me.uk>.
2705 ** libgnutls: Permit V1 Certificate Authorities properly.
2706 Before they were mistakenly rejected even though
2707 GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or
2708 GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by
2709 "Douglas E. Engert" <deengert@anl.gov> in
2710 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>.
2712 ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures.
2713 This is a bugfix -- the previous attempt to do this from internal x509
2714 certificate verification procedures did not return the correct value
2715 for certificates using a weak hash. Reported by Daniel Kahn Gillmor
2716 <dkg@fifthhorseman.net> in
2717 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>,
2718 debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn
2719 Gillmor <dkg@fifthhorseman.net>.
2721 ** libgnutls: Fix compile error with Sun CC.
2722 Reported by Jeff Cai <jeff.cai@sun.com> in
2723 <https://savannah.gnu.org/support/?106549>.
2725 ** API and ABI modifications:
2726 No changes since last version.
2728 * Version 2.6.3 (released 2008-12-12)
2730 ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs.
2731 Reported by Michael Kiefer <Michael-Kiefer@web.de> in
2732 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by
2733 Andreas Metzler <ametzler@downhill.at.eu.org> in
2734 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>.
2736 ** libgnutls: Fix memory leak in PSK authentication.
2737 Reported by Michael Weiser <michael@weiser.dinsnail.net> in
2738 <http://permalink.gmane.org/gmane.network.gnutls.general/1465>.
2740 ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier.
2741 It needs to be invoked before libgcrypt is initialized.
2743 ** gnutls-cli: Return non-zero exit code on error conditions.
2745 ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored.
2747 ** API and ABI modifications:
2748 No changes since last version.
2750 * Version 2.6.2 (released 2008-11-12)
2752 ** libgnutls: Fix crash in X.509 validation code for self-signed certificates.
2753 The patch to fix the security problem GNUTLS-SA-2008-3 introduced a
2754 problem for certificate chains that contained just one self-signed
2755 certificate. Reported by Michael Meskes <meskes@debian.org> in
2756 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505279>.
2758 ** API and ABI modifications:
2759 No changes since last version.
2761 * Version 2.6.1 (released 2008-11-10)
2763 ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3]
2764 The flaw makes it possible for man in the middle attackers (i.e.,
2765 active attackers) to assume any name and trick GnuTLS clients into
2766 trusting that name. Thanks for report and analysis from Martin von
2767 Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989]
2769 Any updates with more details about this vulnerability will be added
2770 to <http://www.gnu.org/software/gnutls/security.html>
2772 ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits.
2773 Reported by Kevin Quick <quick@sparq.org> in
2774 <https://savannah.gnu.org/support/index.php?106454>.
2776 ** libgnutls-extra: Protect internal symbols with static.
2777 Fixes problem when linking certtool statically. Tiny patch from Aaron
2778 Ucko <ucko@ncbi.nlm.nih.gov>.
2780 ** libgnutls-openssl: Fix patch against X509_get_issuer_name.
2781 It incorrectly returned the subject DN instead of issuer DN in v2.6.0.
2782 Thanks to Thomas Viehmann <tv@beamnet.de> for report.
2784 ** certtool: Print a PKCS #8 key even if it is not encrypted.
2786 ** tests: Make tests compile when using internal libtasn1.
2787 Patch by ludo@gnu.org (Ludovic Courtès).
2789 ** API and ABI modifications:
2790 No changes since last version.
2792 * Version 2.6.0 (released 2008-10-06)
2794 ** libgnutls: Correct printing and parsing of IPv6 addresses.
2796 ** libgnutls-openssl: fix out of bounds access.
2797 Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch
2798 from Thomas Viehmann <tv@beamnet.de>.
2800 ** certtool: Use inet_pton for parsing IPv6 addresses.
2802 ** Major changes compared to the v2.4 branch:
2804 *** Added API to replace and update the crypto backend.
2806 *** certtool: can add several subject alternative names via template file.
2808 *** opencdk: Parse (but not decrypt) encrypted secret keys.
2810 *** libgnutls: gnutls_x509_crt_set_subject_alt_name() was added that can
2811 either set or append alternative names. It can also handle binary structures
2812 such as IP addresses.
2814 *** libgnutls: New function to set minimum acceptable SRP bits.
2815 The function is gnutls_srp_set_prime_bits.
2817 *** libgnutls: Add interface to deal with public key and signature algorithms.
2818 The functions are called gnutls_pk_list, gnutls_pk_get_id,
2819 gnutls_sign_list, and gnutls_sign_get_id.
2821 *** libgnutls: New interfaces to get name of public key and signing algorithms.
2822 The functions are gnutls_sign_get_name and gnutls_pk_get_name.
2824 *** libgnutls: New API to get a string corresponding to a error symbol.
2825 The function is gnutls_strerror_name.
2827 *** libgnutls: New API to set the public parameters in a certificate request
2828 *** from a private key.
2829 The function is gnutls_x509_crq_set_key_rsa_raw.
2831 *** libgnutls: New API to set a callback to extract TLS Finished data.
2832 The function to register is gnutls_session_set_finished_function and
2833 it takes a callback of the gnutls_finished_callback_func type.
2835 *** libgnutls: Fix namespace problem with TLS_MASTER_SIZE and TLS_RANDOM_SIZE.
2837 *** libgnutls: New interface to register a new TLS extension handler.
2838 The new function gnutls_ext_register can be used to register handlers
2839 for specific TLS extension types. The callback functions have the new
2840 types gnutls_ext_recv_func and gnutls_ext_send_func. A type to
2841 classify TLS extensions, gnutls_ext_parse_type_t, has been added as
2844 *** libgnutls-extra: Add function to work with Libgcrypt in FIPS mode.
2845 The function is gnutls_register_md5_handler. When libgcrypt is in
2846 FIPS mode, MD5 is disabled, but TLS normally requires use of MD5 in
2849 *** API/ABI changes in GnuTLS 2.6
2850 No functions have been removed or modified. The library should be
2851 fully backwards compatible on both the source and binary level.
2853 A new header file <gnutls/crypto.h> have been added. It contains
2854 definitions related to replacing the internal crypto functionality.
2855 All definitions and the header itself is experimental but supported.
2857 We have realized that the symbols TLS_MASTER_SIZE and TLS_RANDOM_SIZE
2858 does not use the normal namespace. We have added GNUTLS_MASTER_SIZE
2859 and GNUTLS_RANDOM_SIZE, but the old symbols are still defined.
2861 The following functions have been added to libgnutls:
2865 gnutls_crypto_bigint_register2
2866 gnutls_crypto_cipher_register2
2867 gnutls_crypto_digest_register2
2868 gnutls_crypto_mac_register2
2869 gnutls_crypto_pk_register2
2870 gnutls_crypto_rnd_register2
2871 gnutls_crypto_single_cipher_register2
2872 gnutls_crypto_single_digest_register2
2873 gnutls_crypto_single_mac_register2
2878 gnutls_session_set_finished_function
2880 gnutls_sign_get_name
2882 gnutls_srp_set_prime_bits:
2883 gnutls_strerror_name
2884 gnutls_x509_crq_set_key_rsa_raw
2885 gnutls_x509_crt_set_crl_dist_points2
2886 gnutls_x509_crt_set_subject_alt_name
2888 The following functions have been added to libgnutls-extra:
2890 gnutls_register_md5_handler
2892 ** API and ABI modifications:
2893 No changes since last version.
2895 * Version 2.5.9 (released 2008-09-29)
2897 ** libgnutls: Fix several memory leaks.
2898 Reported by Sam Varshavchik <mrsam@courier-mta.com>.
2900 ** libgnutls: Fix buffer overrun in gnutls_x509_crt_list_import.
2901 Report and patch by Jonathan Manktelow.
2903 ** libgnutls: crypto.h gnutls_pk_params_st changes allocation strategy.
2904 The parameters are now allocated in the structure itself.
2906 ** doc: Texinfo HTML manual uses a stylesheet to improve readability.
2908 ** tests: Scripts now use EXEEXT properly.
2909 Modern libtool doesn't create wrapper script, so the self tests need
2910 to invoke certtool.exe under MinGW32+Wine.
2912 ** Uses autoconf 2.63, automake 1.10.1, libtool 2.2.6a.
2913 Automake warnings are now also enabled.
2915 ** API and ABI modifications:
2916 gnutls_pk_params_st: MODIFIED
2918 * Version 2.5.8 (released 2008-09-21)
2920 ** certtool: updated so it can add several subject alternative names using
2923 ** libgnutls: gnutls_x509_crt_set_subject_alt_name() was added that can
2924 either set or append alternative names. It can also handle binary structures
2925 such as IP addresses.
2927 ** libgnutls: Fix crash in hashing code when using non-libgcrypt handlers.
2929 ** libgnutls: New function to set minimum acceptable SRP bits.
2930 The function is gnutls_srp_set_prime_bits. Tiny patch by Kevin Quick
2931 <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>.
2933 ** libgnutls: Check for overflows in gnutls_calloc and gnutls_secure_calloc.
2934 Also fix overflows in calls to those functions. Reported by Werner
2935 Koch <wk@gnupg.org>.
2937 ** libgnutls-extra: Add function to work with Libgcrypt in FIPS mode.
2938 The function is gnutls_register_md5_handler. When libgcrypt is in
2939 FIPS mode, MD5 is disabled, but TLS normally requires use of MD5 in
2942 ** Opencdk: Add calls to gnutls_assert to ease debugging.
2946 ** API and ABI modifications:
2947 gnutls_srp_set_prime_bits: ADDED
2948 gnutls_register_md5_handler: ADDED
2949 gnutls_x509_crt_set_crl_dist_points2: ADDED
2950 gnutls_x509_crt_set_subject_alt_name: ADDED
2952 * Version 2.5.7 (released 2008-09-16)
2954 ** libgnutls: New interfaces to get name of public key and signing algorithms.
2955 The functions are gnutls_sign_get_name and gnutls_pk_get_name.
2957 ** libgnutls: Don't crash when gnutls_credentials_set is called twice.
2959 ** libgnutls: Fix libgnutls shared library version.
2960 It wasn't properly incremented after adding symbols in the last
2963 ** manual: Now mention supported public key and public key signing algorithms.
2965 ** tests/openssl: initialize gnutls before use.
2967 ** tests/setcredcrash: New test to catch regressions of gnutls_credentials_set.
2969 ** GTK-DOC manual: mention new symbols in 2.6.x. Mention crypto.h functions.
2971 ** API and ABI modifications:
2972 gnutls_sign_get_name: ADDED
2973 gnutls_pk_get_name: ADDED
2975 * Version 2.5.6 (released 2008-09-08)
2977 ** libgnutls: Add interface to deal with public key and signature algorithms.
2978 The functions are called gnutls_pk_list, gnutls_pk_get_id,
2979 gnutls_sign_list, and gnutls_sign_get_id. Suggested by Sam
2980 Varshavchik <mrsam@courier-mta.com>.
2982 ** libgnutls: Refactor and clean up some code.
2984 ** libgnutls: Fix compile error with Sun CC.
2986 ** gnutls-cli: Improve --list output to include public key and signature algs.
2988 ** gnutls-cli, gnutls-serv: Remove --copyright parameter.
2989 Use standard --version to get license info.
2991 ** gnutls-cli.1: Document all new parameters.
2992 Thanks to James Westby <jw+debian@jameswestby.net>.
2994 ** tests: New self-test pgps2kgnu to test parsing of encrypted secrets.
2995 Contributed by Daniel Kahn Gillmor <dkg-debian.org@fifthhorseman.net>.
2997 ** API and ABI modifications:
2998 gnutls_pk_list: ADDED
2999 gnutls_pk_get_id: ADDED
3000 gnutls_sign_list: ADDED
3001 gnutls_sign_get_id: ADDED
3003 * Version 2.5.5 (released 2008-08-29)
3005 ** libgnutls: New API to get a string corresponding to a error symbol.
3006 The function is gnutls_strerror_name.
3008 ** libgnutls: Fix include paths so that building with internal libtasn1 works.
3009 Reported by "jth.net ApS" <info@jth.net>.
3011 ** libgnutls: Fix segmentation fault when generating private keys.
3012 Reported by Daniel Kahn Gillmor <dkg-debian.org@fifthhorseman.net>.
3014 ** libgnutls: Remove code to import certificate chains in PKCS#7 format.
3015 The code has not worked since v0.9.0 and apparently nobody has missed
3016 it, so we decided to remove the code rather than fix it. If you have
3017 old certificate chains stored in PKCS#7 format, you can convert them
3018 to a list of PEM certificates by using 'certtool --p7-info'. Reported
3019 by Christian Grothoff <christian@grothoff.org>.
3021 ** opencdk: Parse (but not decrypt) encrypted secret keys.
3022 Contributed by Daniel Kahn Gillmor <dkg-debian.org@fifthhorseman.net>.
3024 ** libgnutls: Fix many warnings.
3026 ** Included copy of libtasn1 is upgraded to version 1.5.
3028 ** Add French translation, thanks to Nicolas Provost.
3030 ** API and ABI modifications:
3031 gnutls_strerror_name: ADDED
3033 * Version 2.5.4 (released 2008-08-19)
3035 ** Fix secure memory initialization of libgcrypt.
3036 Reported by Joe Orton <joe@manyfish.co.uk> in
3037 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2992>.
3040 Reference to NIST SP 800-57 in the manual on key size recommendations.
3041 Added 'Since:' tags to new APIs for gtk-doc.
3043 ** API and ABI modifications:
3044 No changes since last version.
3046 * Version 2.5.3 (released 2008-08-14)
3048 ** libgnutls: New API to set the public parameters in a certificate request
3049 ** from a private key.
3050 The function is gnutls_x509_crq_set_key_rsa_raw. Inspired by
3051 discussion with "Zach C." <fxchip@gmail.com>.
3053 ** libgnutls: New API to set a callback to extract TLS Finished data.
3054 The function to register is gnutls_session_set_finished_function and
3055 it takes a callback of the gnutls_finished_callback_func type.
3057 ** libgnutls: Drop final comma after GNUTLS_CRT_PRINT_UNSIGNED_FULL in enum.
3058 Reported in <https://savannah.gnu.org/support/?106453>.
3060 ** libgnutls: Fix namespace problem with TLS_MASTER_SIZE and TLS_RANDOM_SIZE.
3061 The new names are GNUTLS_MASTER_SIZE and GNUTLS_RANDOM_SIZE. The old
3062 names are mapped to the new names in compat.h. These mappings will
3063 likely be removed more quickly than other mappings in that file due to
3064 the namespace violation.
3066 ** libgnutlsxx: Make it build when SRP is disabled.
3068 ** doc: Add doxygen files in doc/doxygen/.
3070 ** API and ABI modifications:
3071 gnutls_x509_crq_set_key_rsa_raw: ADDED
3072 gnutls_session_set_finished_function: ADDED
3073 gnutls_finished_callback_func: ADDED
3074 GNUTLS_MASTER_SIZE: ADDED
3075 GNUTLS_RANDOM_SIZE: ADDED
3076 TLS_MASTER_SIZE: DEPRECATED
3077 TLS_RANDOM_SIZE: DEPRECATED
3079 * Version 2.5.2 (released 2008-07-08)
3081 ** libgnutls: Fix bug in gnutls_dh_params_generate2.
3082 The prime and generator was swapped.
3084 ** libgnutls: New interface to register a new TLS extension handler.
3085 The new function gnutls_ext_register can be used to register handlers
3086 for specific TLS extension types. The callback functions have the new
3087 types gnutls_ext_recv_func and gnutls_ext_send_func. A type to
3088 classify TLS extensions, gnutls_ext_parse_type_t, has been added as
3091 ** Move more code for TLS/IA extension from libgnutls to libgnutls-extra.
3092 This was made possible by using the new gnutls_ext_register interface.
3093 The TLS/IA functionality has only been supported through the
3094 libgnutls-extra library, so it makes sense for the code to belong
3097 ** API and ABI modifications:
3098 gnutls_ext_recv_func: ADDED
3099 gnutls_ext_send_func: ADDED
3100 gnutls_ext_parse_type_t: ADDED
3101 gnutls_ext_register: ADDED
3103 * Version 2.5.1 (released 2008-07-02)
3107 ** API and ABI modifications:
3108 No changes since last version.
3110 * Version 2.5.0 (released 2008-07-02)
3112 ** Port fixes from v2.4.1 release, see below.
3114 ** Added API to replace and update the crypto backend.
3115 The header gnutls/crypto.h is now officially supported, and declares
3118 ** Rewritten opencdk crypto backend, to use the gnutls internal one.
3120 ** Update gnulib and translations.
3121 The gnulib gc crypto code has been removed since it was never finished
3122 and is no longer even used. An internal non-libgcrypt crypto
3123 implementation may be added in the future, but we'll decide that later
3126 ** API and ABI modifications:
3127 gnutls_crypto_bigint_register2: ADDED.
3128 gnutls_crypto_cipher_register2: ADDED.
3129 gnutls_crypto_digest_register2: ADDED.
3130 gnutls_crypto_mac_register2: ADDED.
3131 gnutls_crypto_pk_register2: ADDED.
3132 gnutls_crypto_rnd_register2: ADDED.
3133 gnutls_crypto_single_cipher_register2: ADDED.
3134 gnutls_crypto_single_digest_register2: ADDED.
3135 gnutls_crypto_single_mac_register2: ADDED.
3137 * Version 2.4.3 (released 2009-02-06)
3139 ** libgnutls: Accept chains where intermediary certs are trusted.
3140 Before GnuTLS needed to validate the entire chain back to a
3141 self-signed certificate. GnuTLS will now stop looking when it has
3142 found an intermediary trusted certificate. The new behaviour is
3143 useful when chains, for example, contains a top-level CA, an
3144 intermediary CA signed using RSA-MD5, and an end-entity certificate.
3145 To avoid chain validation errors due to the RSA-MD5 cert, you can
3146 explicitly add the intermediary RSA-MD5 cert to your trusted certs.
3147 The signature on trusted certificates are not checked, so the chain
3148 has a chance to validate correctly. Reported by "Douglas E. Engert"
3149 <deengert@anl.gov> in
3150 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>.
3152 ** libgnutls: Permit V1 Certificate Authorities properly.
3153 Before they were mistakenly rejected even though
3154 GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or
3155 GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by
3156 "Douglas E. Engert" <deengert@anl.gov> in
3157 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>.
3159 ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures.
3160 This is a bugfix -- the previous attempt to do this from internal x509
3161 certificate verification procedures did not return the correct value
3162 for certificates using a weak hash. Reported by Daniel Kahn Gillmor
3163 <dkg@fifthhorseman.net> in
3164 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>,
3165 debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn
3166 Gillmor <dkg@fifthhorseman.net>.
3168 ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs.
3169 Reported by Michael Kiefer <Michael-Kiefer@web.de> in
3170 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by
3171 Andreas Metzler <ametzler@downhill.at.eu.org> in
3172 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>.
3174 ** libgnutls: Fix crash in X.509 validation code for self-signed certificates.
3175 The patch to fix the security problem GNUTLS-SA-2008-3 introduced a
3176 problem for certificate chains that contained just one self-signed
3177 certificate. Reported by Michael Meskes <meskes@debian.org> in
3178 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505279>.
3180 ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3]
3181 The flaw makes it possible for man in the middle attackers (i.e.,
3182 active attackers) to assume any name and trick GnuTLS clients into
3183 trusting that name. Thanks for report and analysis from Martin von
3184 Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989]
3186 Any updates with more details about this vulnerability will be added
3187 to <http://www.gnu.org/software/gnutls/security.html>
3189 ** libgnutls: Fix buffer overrun in gnutls_x509_crt_list_import.
3190 Report and patch by Jonathan Manktelow.
3192 ** libgnutls: Avoid use of non-thread safe strerror.
3194 ** API and ABI modifications:
3195 No changes since last version.
3197 * Version 2.4.2 (released 2008-09-15)
3199 ** libgnutls: Don't crash when gnutls_credentials_set is called twice.
3201 ** libgnutls: Corrected memory leak in X.509 functions.
3202 Thanks to Colin Leroy <colin@colino.net>.
3204 ** libgnutls: Fix compile error with Sun CC.
3206 ** gnutls-cli.1: Document all new parameters.
3207 Thanks to James Westby <jw+debian@jameswestby.net>.
3209 ** tests/openssl: initialize gnutls before use.
3210 Fixes crash with libgcrypt 1.4.2. Reported by Ludovic Courtes
3211 <ludovic.courtes@laas.fr>.
3213 ** doc/: Fix texinfo markup for old texinfo versions.
3215 ** Included copy of libtasn1 is upgraded to version 1.5.
3217 ** API and ABI modifications:
3218 No changes since last version.
3220 * Version 2.4.1 (released 2008-06-30)
3222 ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2]
3223 If the gnutls_handshake function is called for a normal session, which
3224 can happen for re-handshakes, the library would crash because it tried
3225 to hash some data using a libgcrypt handle that had been deallocated.
3226 Report and tiny patch from Tomas Mraz <tmraz@redhat.com>. Any updates
3227 with more details about this vulnerability will be added to
3228 <http://www.gnu.org/software/gnutls/security.html>
3230 ** libgnutls: Fix memory leaks when doing a re-handshake.
3231 Reported by Sam Varshavchik <mrsam@courier-mta.com> in
3232 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2928>.
3234 ** Fix compiler warnings.
3235 Reported by Massimo Gaspari <massimo.gaspari@alice.it> in
3236 <http://thread.gmane.org/gmane.network.gnutls.general/1281>.
3238 ** Fix ordering of -I's to avoid opencdk.h conflict with system headers.
3239 Reported by Roman Bogorodskiy <novel@FreeBSD.org> in
3240 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2930>.
3242 ** srptool: Fix a problem where --verify check does not succeed.
3243 Report and tiny patch by Matthias Koenig <mkoenig@suse.de> in
3244 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2944>.
3246 ** API and ABI modifications:
3247 No changes since last version.
3249 * Version 2.4.0 (released 2008-06-19)
3251 ** Major changes compared to the v2.2 branch:
3253 *** The OpenPGP sub-system has been improved and now supports subkeys.
3255 *** The PSK sub-system has been improved and now supports password
3256 *** derivation and PSK identity hints.
3257 The password derivation algorithms support is documented in
3258 draft-ietf-netconf-tls-02.txt.
3260 *** The certtool --inder and --outder has been replaced by --inraw and --outraw.
3261 This aligns terminology with OpenPGP, which doesn't use DER encoding.
3262 The old parameters will continue to work for some time.
3264 *** Certtool now confirm passwords and changes permissions of private key files.
3266 *** The default handshake size limit has been increased to 48kb.
3267 It appears as if some valid handshakes are large due to sending many
3268 CA certificates. (The earlier limit was 16kb.)
3270 *** LZO compression is now disabled by default.
3271 The main reason is that LZO compression in TLS is not standardized,
3272 but license compatiblity issues with minilzo triggered us to make this
3275 *** Improvements for cross-compilation to Windows and OpenWRT.
3277 *** The look of the GTK-DOC manual has been improved.
3278 Major developer visible changes compared to the v2.2 branch:
3280 *** Full OpenPGP support is part of libgnutls, licensed under the LGPL.
3282 *** New APIs to access the raw X.509 Subject and Issuer DN's and
3283 *** elements from the certificate credentials structure.
3284 Thanks to Joe Orton.
3286 *** New APIs to improve working with username/passwords and PSK.
3288 *** Names of constants to affect certificate printing changed.
3289 The constants are used for OpenPGP too, which the names didn't
3290 reflect, so the following name change has been made:
3293 GNUTLS_X509_CRT_FULL GNUTLS_CRT_PRINT_FULL
3294 GNUTLS_X509_CRT_ONELINE GNUTLS_CRT_PRINT_ONELINE
3295 GNUTLS_X509_CRT_UNSIGNED_FULL GNUTLS_CRT_PRINT_UNSIGNED_FULL
3297 The old names will be mapped to the new names for some time.
3299 *** The function gnutls_openpgp_privkey_get_id has been renamed to
3300 *** gnutls_openpgp_privkey_get_key_id.
3301 A compatibility mapping exists to avoid breaking API backwards
3304 *** Replaced all uses of alloca with malloc and free.
3306 *** We no longer build with -D_REENTRANT -D_THREAD_SAFE.
3307 We have been unable to find a documented rationale for this practice.
3309 *** Of course, many smaller fixes have been made, see the ChangeLog file.
3311 *** API/ABI changes in GnuTLS 2.4
3312 All OpenPGP related functions have been moved from libgnutls-extra to
3313 libgnutls, and several new functions have been added (see below).
3314 Before making the release, we discussed whether moving functions from
3315 libgnutls-extra to libgnutls would require us to increment the ABI
3316 version, but the general opinion was that this would not be required.
3317 All older functions continue to work the same. We are open to the
3318 possibility that this decision will lead to problem on some platform,
3319 and if it turns out that the Right Thing should have been to increment
3320 the shared library version, we would need to release an update within
3321 the 2.4.x branch that increments the shared library version.
3323 This release adds the following functions:
3325 gnutls_psk_client_get_hint
3326 gnutls_psk_set_server_credentials_hint
3327 gnutls_psk_netconf_derive_key
3329 Used to get/set the PSK identity hint, and derive PSK keys from
3330 passwords a'la netconf.
3332 gnutls_x509_dn_deinit
3333 gnutls_x509_dn_export
3334 gnutls_x509_dn_import
3337 Used to handle X.509 Certificate DN's directly.
3341 Converts a data buffer to hex. Useful for handling PSK/SRP shared
3344 gnutls_certificate_get_x509_cas
3345 gnutls_certificate_get_x509_crls
3346 gnutls_certificate_get_openpgp_keyring
3348 Functions for direct access to credential elements.
3350 gnutls_openpgp_crt_get_auth_subkey
3351 gnutls_openpgp_crt_get_key_id
3352 gnutls_openpgp_crt_get_pk_dsa_raw
3353 gnutls_openpgp_crt_get_pk_rsa_raw
3354 gnutls_openpgp_crt_get_preferred_key_id
3355 gnutls_openpgp_crt_get_revoked_status
3356 gnutls_openpgp_crt_get_subkey_count
3357 gnutls_openpgp_crt_get_subkey_creation_time
3358 gnutls_openpgp_crt_get_subkey_expiration_time
3359 gnutls_openpgp_crt_get_subkey_fingerprint
3360 gnutls_openpgp_crt_get_subkey_id
3361 gnutls_openpgp_crt_get_subkey_idx
3362 gnutls_openpgp_crt_get_subkey_pk_algorithm
3363 gnutls_openpgp_crt_get_subkey_pk_dsa_raw
3364 gnutls_openpgp_crt_get_subkey_pk_rsa_raw
3365 gnutls_openpgp_crt_get_subkey_revoked_status
3366 gnutls_openpgp_crt_get_subkey_usage
3367 gnutls_openpgp_crt_print
3368 gnutls_openpgp_crt_set_preferred_key_id
3369 gnutls_openpgp_keyring_get_crt
3370 gnutls_openpgp_keyring_get_crt_count
3371 gnutls_openpgp_privkey_export
3372 gnutls_openpgp_privkey_export_dsa_raw
3373 gnutls_openpgp_privkey_export_rsa_raw
3374 gnutls_openpgp_privkey_export_subkey_dsa_raw
3375 gnutls_openpgp_privkey_export_subkey_rsa_raw
3376 gnutls_openpgp_privkey_get_fingerprint
3377 gnutls_openpgp_privkey_get_key_id
3378 gnutls_openpgp_privkey_get_pk_algorithm
3379 gnutls_openpgp_privkey_get_preferred_key_id
3380 gnutls_openpgp_privkey_get_revoked_status
3381 gnutls_openpgp_privkey_get_subkey_count
3382 gnutls_openpgp_privkey_get_subkey_creation_time
3383 gnutls_openpgp_privkey_get_subkey_expiration_time
3384 gnutls_openpgp_privkey_get_subkey_fingerprint
3385 gnutls_openpgp_privkey_get_subkey_id
3386 gnutls_openpgp_privkey_get_subkey_idx
3387 gnutls_openpgp_privkey_get_subkey_pk_algorithm
3388 gnutls_openpgp_privkey_get_subkey_revoked_status
3389 gnutls_openpgp_privkey_set_preferred_key_id
3391 New OpenPGP related functions.
3393 The function gnutls_openpgp_crt_get_key_id is the same as the old
3394 from gnutls_openpgp_crt_get_id, see above.
3396 The release also adds a new header file 'gnutls/crypto.h', however it
3397 is currently not used.
3399 ** libgnutls [OpenPGP]: New APIs to retrieve fingerprint from OpenPGP subkeys.
3400 Contributed by Daniel Kahn Gillmor <dkg-debian.org@fifthhorseman.net>.
3402 ** API and ABI modifications:
3403 gnutls_openpgp_crt_get_subkey_fingerprint: ADDED.
3404 gnutls_openpgp_privkey_get_subkey_fingerprint: ADDED.
3406 * Version 2.3.15 (released 2008-06-15)
3408 ** Disable the openpgp-certs self-tests.
3409 It results in failure under Wine and doesn't work on Debian buildds.
3411 ** API and ABI modifications:
3412 No changes since last version.
3414 * Version 2.3.14 (released 2008-06-11)
3416 ** libgnutls [OpenPGP]: Changed OpenPGP verification behaviour.
3417 An OpenPGP certificate is now only considered verified if all the user
3420 ** Examples: Make C++ example compile.
3421 Earlier it may have failed with an unresolved reference to strlen.
3423 ** Documentation: Doc fix for gnutls_x509_crt_get_extension_oid.
3424 Reported by Sam Varshavchik <mrsam@courier-mta.com>.
3426 ** API and ABI modifications:
3427 No changes since last version.
3429 * Version 2.3.13 (released 2008-06-07)
3431 ** libgnutls [OpenPGP]: Make OpenPGP handshakes work again.
3433 ** doc/: Add psktool to info index. Some minor cleanups.
3435 ** tests/: Added non-forking TLS handshake test, see tests/mini.c.
3437 ** tests/: Added libgcrypt.supp which can be used with valgrind.
3438 The file suppresses the known libgcrypt memory leaks, so they aren't
3439 printed when you run valgrind on the gnutls self-tests. Use it as
3440 follows: valgrind --suppressions=libgcrypt.supp ./x509self or add
3441 '--suppressions=/home/you/src/gnutls/tests/libgcrypt.supp' to your
3444 ** tests/: Reduce amount of debugging output by default.
3445 Use --verbose for each test to get the full output.
3447 ** tests/: Fix memory leaks in several self-tests.
3448 None of the self tests should be leaking memory when running valgrind
3449 or similar tools. (Known exceptions are dhepskself, pskself, and
3450 set_pkcs12_cred, which appear likely to be due to memory leaks in the
3453 ** API and ABI modifications:
3454 No changes since last version.
3456 * Version 2.3.12 (released 2008-06-04)
3458 ** Merge gnutls_with_netconf branch.
3460 *** libgnutls [PSK]: New API to retrieve PSK identity hint in client.
3461 The function is gnutls_psk_client_get_hint.
3463 *** libgnutls [PSK]: New API to set PSK identity hint in server.
3464 The function is gnutls_psk_set_server_credentials_hint.
3466 *** libgnutls [PSK]: Support server key exchange with PSK identity hint.
3467 In the client, the message is parsed and the application can use
3468 gnutls_psk_client_get_hint to retrieve the hint. In the server, the
3469 message is sent if the application has specified a PSK identity hint
3470 using gnutls_psk_set_server_credentials_hint.
3472 *** libgnutls [PSK]: Support Netconf PSK key derivation.
3473 The function gnutls_psk_netconf_derive_key supports the PSK key
3474 derivation as specified in draft-ietf-netconf-tls-02.txt. New self
3477 *** psktool: Support new --netconf-hint to generate PSK key from password.
3478 Uses the Netconf algorithm to derive PSK key from password.
3480 *** gnutls-serv: Support new --pskhint parameter to set PSK identity hint.
3482 *** gnutls-cli: Always support PSK modes, through a callback.
3483 The callback will derive a PSK key using Netconf algorithm. It will
3484 print the PSK identity hint to help the user.
3486 *** New PSK example client and server.
3487 See doc/examples/ex-client-psk.c and doc/examples/ex-serv-psk.c.
3489 ** libgnutls: Fix gnutls_x509_crl_set_version on arm platforms.
3490 The code didn't work properly on platforms where 'char' is unsigned,
3491 when you set version 0. Reported by Laurence Withers
3492 <l@lwithers.me.uk> in
3493 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2825>.
3495 ** libgnutls-openssl: added RAND_pseudo_bytes API.
3496 Patch from Robert Millan <rmh@aybabtu.com>.
3498 ** API and ABI modifications:
3499 RAND_pseudo_bytes: ADDED to libgnutls-openssl.
3500 gnutls_psk_client_get_hint: ADDED.
3501 gnutls_psk_set_server_credentials_hint: ADDED.
3502 gnutls_psk_netconf_derive_key: ADDED
3504 * Version 2.3.11 (released 2008-05-20)
3506 ** Fix flaw in fix for GNUTLS-SA-2008-1-3.
3507 The flaw would result in incorrectly terminated sessions with the
3508 error "Decryption has failed" when the server sends a small packet
3509 (typically when the session is closed). Reported by Andreas Metzler
3510 <ametzler@downhill.at.eu.org> in
3511 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2807>.
3513 ** Don't use gnulib headers when building C++ library.
3514 Fixes builds under Windows.
3516 ** Make umask a requirement.
3517 We don't know of any system that lacks it, even GNU CoreUtils use it
3520 ** Update gnulib files.
3521 Fixes a problem where it pulled in a replacement for memcmp under
3522 MinGW, which caused the C++ example to fail to build.
3524 ** API and ABI modifications:
3525 No changes since last version.
3527 * Version 2.3.10 (released 2008-05-19)
3529 ** Added wide wildcard hostname matching.
3530 Tiny patch by Jean-Philippe Garcia Ballester.
3532 ** Fix three security vulnerabilities. [GNUTLS-SA-2008-1]
3533 Thanks to CERT-FI for finding the bugs and providing detailed reports,
3534 which allowed the bugs to be reproduced and fixed easily. Patches
3535 developed by Simon Josefsson and Nikos Mavrogiannopoulos. Any updates
3536 with more details about these vulnerabilities will be added to
3537 <http://www.gnu.org/software/gnutls/security.html>
3539 *** [GNUTLS-SA-2008-1-1]
3540 *** libgnutls: Fix crash when sending invalid server name.
3541 The crash can be triggered remotely before authentication, which can
3542 lead to a Daniel of Service attack to disable the server. The bug
3543 cause gnutls to store more session resumption data than what was
3544 allocated for, thus overwriting unallocated memory.
3546 *** [GNUTLS-SA-2008-1-2]
3547 *** libgnutls: Fix crash when sending repeated client hellos.
3548 The crash can be triggered remotely before authentication, which can
3549 lead to a Daniel of Service attack to disable the server. The bug
3550 triggers a null-pointer dereference.
3552 *** [GNUTLS-SA-2008-1-3]
3553 *** libgnutls: Fix crash in cipher padding decoding for invalid record lengths.
3554 The crash can be triggered remotely before authentication, which can
3555 lead to a Daniel of Service attack to disable the server. The bug
3556 cause gnutls to read memory beyond the end of the received record.
3558 ** libgnutlsxx: Updated API according to patches from Eduardo
3559 Villanueva Che (discussion at
3560 <http://lists.gnu.org/archive/html/gnutls-devel/2007-02/msg00017.html>)
3562 ** Use umask to restrict permissions to owner before creating a file.
3564 ** API and ABI modifications:
3565 No changes since last version.
3567 * Version 2.3.9 (released 2008-05-16)
3569 ** libgnutls: Fix build failures if SRP/OpenPGP is disabled.
3570 Based on report and tiny patches from
3571 <jared.jennings.ctr@eglin.af.mil>, see
3572 <https://savannah.gnu.org/support/index.php?106342>.
3574 ** libgnutls: Translation fixes.
3576 ** gnutls-cli: Fix so that PSK authentication works.
3577 Also improve manual to give example for gnutls-cli PSK authentication.
3579 ** certtool: Encrypting a private key now require a confirmed password.
3580 Before './certtool -k -8' would merely ask for a password once.
3581 Reported by Daniel 'NebuchadnezzaR' Dehennin
3582 <nebuchadnezzar@asgardr.info> see
3583 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=364287>.
3585 ** certtool: When writing private keys to files, change permissions of file.
3586 Now the file which the private key is saved to is chmod'ed 0600.
3587 Reported by martin f krafft <madduck@debian.org> see
3588 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=373169>.
3590 ** guile: Fix -fgnu89-inline test.
3592 ** Removed --enable-profile-mode.
3593 The code linked gnutls with the libfc project (Function Check) which
3594 appears to have been stalled since around 2002.
3596 ** Clean up header file checks by ./configure.
3598 ** Update of gnulib files.
3600 ** API and ABI modifications:
3601 No changes since last version.
3603 * Version 2.3.8 (released 2008-04-29)
3605 ** libgnutls: Increase default handshake packet size limit to 48kb.
3606 The old limit was 16kb and some servers send huge list of trusted CAs,
3607 thus running into the limit. FYI, applications can further increase
3608 this limit using gnutls_handshake_set_max_packet_length. Thanks to
3609 Marc Haber <mh+debian-bugs@zugschlus.de> and "Marc F. Clemente"
3610 <marc@mclemente.net> for reporting and providing test servers.
3612 ** libgnutls: Add new error code: GNUTLS_E_HANDSHAKE_TOO_LARGE
3613 Returned when the handshake data size is too large. Before
3614 GNUTLS_E_MEMORY_ERROR was used, which could be confused with other
3617 ** libgnutls: Hide definitions in crypto.h.
3618 We have decided that the APIs defined in crypto.h are not stable
3619 enough for v2.4, so don't use any of those functions.
3621 ** gnutls-cli: exit when hostname doesn't match certificate.
3622 Use --insecure to avoid hostname comparison.
3624 ** certtool: --inder and --outder replaced by --inraw and --outraw.
3625 The reason is to align terminology with OpenPGP, which doesn't use
3626 DER. The old parameters will continue to work for some time.
3628 ** doc: Add section 'Index of new symbols in 2.4.0' to the GTK-DOC manual.
3630 ** doc: Many cosmetic fixes, to silence (most) gtk-doc warnings.
3632 ** Mingw32: Revert libgcrypt vasprintf work-around added in last release.
3633 Use libgcrypt 1.4.1 or later when building on MinGW32, it removes the
3634 vasprintf symbol from the libgcrypt library which caused problems.
3636 ** Update of gnulib files.
3638 ** tests: New self-test of crypto.h RNG code tests/crypto_rng.
3640 ** API and ABI modifications:
3641 GNUTLS_E_HANDSHAKE_TOO_LARGE: ADDED.
3643 * Version 2.3.7 (released 2008-04-21)
3645 ** opencdk now properly sets the key usage bits into openpgp keys.
3647 ** gnutls-cli: Fix crash on TLS handshake failures.
3648 Reported by "Marc F. Clemente" <marc@mclemente.net> in Debian BTS #466477.
3649 This is similar to <http://bugs.debian.org/429183>.
3651 ** certtool: with --generate-request and newly generated keys, print the key.
3653 ** Build fixes for MinGW.
3654 Missing rpl_fseeko symbol in lib/opencdk/. Better checks for linking
3655 with -lws2_32 when needed. Use ASCII only isprint() when printing
3656 X.509 certificate information, to avoid non-ASCII but printable
3657 characters. Thanks to Massimo Gaspari <massimo.gaspari@alice.it> for
3660 ** Update internal copy of libtasn1 to version 1.4.
3662 ** API and ABI modifications:
3663 No changes since last version.
3665 * Version 2.3.6 (released 2008-04-17)
3667 ** Make gnutls_x509_crq_sign2 set certificate request version if not set.
3668 ** Improve documentation for gnutls_x509_crq_sign2.
3669 Based on report from "John Brooks" <aspecialj@gmail.com> in
3670 <http://permalink.gmane.org/gmane.network.gnutls.general/1154>.
3672 ** tests/pathlen: run diff without parameters to improve portability.
3673 Based on HPUX build hints in
3674 <http://hpux.cs.utah.edu/hppd/cgi-bin/wwwtar?/hpux/Gnu/gnutls-2.3.4/gnutls-2.3.4-src-11.11.tar.gz+gnutls-2.3.4/HPUX.Install+text>.
3676 ** Don't use %e specifier with strftime, it doesn't work under Windows.
3677 Reported by Massimo Gaspari <massimo.gaspari@alice.it> in
3678 <http://permalink.gmane.org/gmane.network.gnutls.general/1170>.
3680 ** Remove all uses of gnutls_alloca/gnutls_afree.
3681 Use normal gnutls_malloc instead. One reason is increased portability
3682 to Windows, the other is that several of the uses may be unsafe
3683 because the size of data allocated could be large. Reported by
3684 Massimo Gaspari <massimo.gaspari@alice.it> in
3685 <http://permalink.gmane.org/gmane.network.gnutls.general/1170>.
3687 ** Build Guile code with -fgnu89-inline only when supported.
3688 Reported by Kris Karas <ktk@enterprise.bidmc.harvard.edu> in
3689 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2708>.
3691 ** Several GTK-DOC related fixes.
3693 ** Clean up OpenCDK related code.
3694 GnuTLS now requires its internal OpenCDK code rather than the external
3695 GPL library OpenCDK. Unfortunately, we don't have resources to
3696 maintain an external library (help welcome).
3698 ** API and ABI modifications:
3699 No changes since last version.
3701 * Version 2.3.5 (released 2008-04-14)
3703 ** Build fix for MinGW and --disable-shared.
3704 Reported by Massimo Gaspari <massimo.gaspari@alice.it> in
3705 <http://permalink.gmane.org/gmane.network.gnutls.general/1145>.
3707 ** Document how to generate CRLs.
3708 Suggested by "Rainer Gerhards" <rgerhards@gmail.com>.
3710 ** Documented the --priority option to gnutls-cli and gnutls-serv.
3712 ** Several minor fixes in the OpenPGP interface.
3713 Thanks to Daniel Kahn Gillmor.
3715 ** Fix fopen file descriptor leak in PSK server code.
3716 Thanks to Laurence Withers <l@lwithers.me.uk>, see
3717 <http://lists.gnu.org/archive/html/gnutls-devel/2008-04/msg00002.html>.
3719 ** Translations files not stored directly in git to avoid merge conflicts.
3721 ** New APIs to let applications replace the RNG used.
3722 Update all RNG callers in the code to use the new interface.
3724 ** Guile code now built with -fgnu89-inline to fix inline semantic problem.
3726 ** Update gnulib files.
3728 ** API and ABI modifications:
3729 gnutls_crypto_rnd_register: ADDED
3730 gnutls_rnd_level_t: ADDED
3731 GNUTLS_RND_KEY: ADDED, gnutls_rnd_level_t member
3732 GNUTLS_RND_RANDOM: ADDED, gnutls_rnd_level_t member
3733 GNUTLS_RND_NONCE: ADDED, gnutls_rnd_level_t member
3734 gnutls_crypto_rnd_st: ADDED
3735 GNUTLS_DIG_SHA224: ADDED
3736 GNUTLS_SIGN_RSA_SHA224: ADDED
3737 gnutls_openpgp_crt_get_auth_subkey: MODIFIED
3739 * Version 2.3.4 (released 2008-03-19)
3741 ** Finish renaming of gnutls_certificate_export_x509_cas etc.
3742 They weren't renamed in the public header file.
3744 ** Added functions to register a cipher/mac/digest. This allows to
3745 override the included ones.
3747 ** Fix a bunch of compiler warnings.
3749 ** API and ABI modifications:
3750 gnutls_crypto_cipher_st: ADDED
3751 gnutls_crypto_mac_st: ADDED
3752 gnutls_crypto_digest_st: ADDED
3753 gnutls_crypto_cipher_register: ADDED
3754 gnutls_crypto_mac_register: ADDED
3755 gnutls_crypto_digest_register: ADDED
3756 GNUTLS_E_CRYPTO_ALREADY_REGISTERED: ADDED
3758 * Version 2.3.3 (released 2008-03-10)
3760 ** Fix build failure in libextra/gnutls_extra.c that needed opencdk.h.
3761 Reported by Roman Bogorodskiy <novel@FreeBSD.org>.
3763 ** No longer compiled using -D_REENTRANT -D_THREAD_SAFE.
3764 We could not find any modern justification for enabling these flags by
3765 default. If you know of some platform that needs one of the flags to
3766 work properly, please let us know. (Actually introduced in v2.3.0 but
3767 not documented until now.)
3769 ** Importing many CA certificates are now considerably faster.
3770 This affect gnutls_certificate_set_x509_trust_mem,
3771 gnutls_certificate_set_x509_trust, and
3772 gnutls_certificate_set_x509_trust_file. The complexity was reduced
3773 from O(2*n^2) to O(n). When adding 206 files containing 408
3774 certificates, using gnutls_certificate_set_x509_trust_file, the time
3775 dropped from 40 seconds to 0.3 seconds. Thanks to Edgar Fuß for code
3776 to trigger the problem. See also
3777 <http://blog.josefsson.org/2008/02/27/real-world-performance-tuning-with-callgrind/>.
3779 ** Clarify documentation for gnutls_x509_crt_set_subject_alternative_name
3780 ** to be explicit that it takes zero terminated data.
3782 ** gnutls-cli --print-cert now print PKCS#3 format Diffie-Hellman parameters.
3784 ** Documentation fixes for the GTK-DOC manual.
3786 ** Fix compilation error related to __FUNCTION__ on some systems.
3787 Reported by Tim Mooney, see
3788 <https://savannah.gnu.org/support/?106267>.
3790 ** Updated translations.
3792 ** Update gnulib files.
3794 ** API and ABI modifications:
3795 gnutls_hex2bin: MODIFIED, uses size_t instead of int for string length,
3796 and char* instead of void* for output buffer.
3798 * Version 2.3.2 (released 2008-02-26)
3800 ** Fix srcdir!=objdir failure in openpgpself test.
3802 ** Improved API documentation output from GTK-DOC.
3804 ** Added gnutls_x509_dn_export(). Patch by Joe Orton.
3806 ** Renamed gnutls_certificate_export_x509_cas and friends.
3807 See <http://lists.gnu.org/archive/html/gnutls-devel/2008-02/msg00043.html>.
3809 ** Internal header files cleanup.
3811 ** API and ABI modifications:
3812 gnutls_certificate_export_x509_cas: RENAMED to gnutls_certificate_get_x509_cas
3813 gnutls_certificate_export_x509_crls: RENAMED to gnutls_certificate_get_x509_crls
3814 gnutls_certificate_export_openpgp_keyring: RENAMED to gnutls_certificate_get_openpgp_keyring
3815 gnutls_x509_dn_export: ADDED
3817 * Version 2.3.1 (released 2008-02-21)
3819 ** OpenPGP support merged into libgnutls and is now licensed under LGPL.
3820 The included copy of OpenCDK has been stripped down and re-licensed
3823 ** Cipher priority string handling now handle strings that starts with NULL.
3824 Thanks to Laurence Withers <l@lwithers.me.uk>.
3826 ** gnutls-cli: When -d is used, also prints RNG information from libgcrypt.
3828 ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported
3831 ** Increased the default certificate verification chain limits and allowed
3832 for checks without limitation.
3834 ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name()
3835 and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary
3836 strings and return the proper size.
3838 ** Add section 'On Record Padding' to the manual.
3839 This collects all problems related to record padding with
3840 Nokia/Sony-Ericsson phones that we know about.
3842 ** Several improvements in the OpenPGP authentication.
3843 Now subkeys can be used for authentication, according to
3844 draft-mavrogiannopoulos-rfc5081bis-00.txt.
3846 ** certtool can print information on OpenPGP certificates and keys.
3848 ** Added gnutls_x509_dn_import/init/deinit() to access raw DER DN.
3851 ** Added gnutls_certificate_export_x509_cas and other functions to
3852 export elements from the certificate credentials structure. Based on
3853 suggestion from Joe Orton.
3856 Clarify that srp_base64 is not the same as normal base64.
3858 ** Fix non-portable use of brace expansion in makefiles.
3860 ** API and ABI modifications:
3861 gnutls_certificate_export_x509_cas: ADDED
3862 gnutls_certificate_export_x509_crls: ADDED
3863 gnutls_certificate_export_openpgp_keyring: ADDED
3864 gnutls_openpgp_keyid_t: ADDED, instead of hard-coded 'unsigned char[8]'.
3865 gnutls_openpgp_crt_get_key_id: ADDED, obsoletes gnutls_openpgp_crt_get_id.
3866 gnutls_openpgp_crt_get_revoked_status: ADDED
3867 gnutls_openpgp_crt_get_subkey_count: ADDED
3868 gnutls_openpgp_crt_get_subkey_idx: ADDED
3869 gnutls_openpgp_crt_get_subkey_revoked_status: ADDED
3870 gnutls_openpgp_crt_get_subkey_pk_algorithm: ADDED
3871 gnutls_openpgp_crt_get_subkey_creation_time: ADDED
3872 gnutls_openpgp_crt_get_subkey_expiration_time: ADDED
3873 gnutls_openpgp_crt_get_subkey_id: ADDED
3874 gnutls_openpgp_crt_get_subkey_usage: ADDED
3875 gnutls_openpgp_privkey_get_fingerprint: ADDED
3876 gnutls_openpgp_privkey_get_key_id: ADDED
3877 gnutls_openpgp_privkey_get_subkey_count: ADDED
3878 gnutls_openpgp_privkey_get_subkey_idx: ADDED
3879 gnutls_openpgp_privkey_get_subkey_revoked_status: ADDED
3880 gnutls_openpgp_privkey_get_revoked_status: ADDED
3881 gnutls_openpgp_privkey_get_subkey_pk_algorithm: ADDED
3882 gnutls_openpgp_privkey_get_subkey_expiration_time: ADDED
3883 gnutls_openpgp_privkey_get_subkey_id: ADDED
3884 gnutls_openpgp_privkey_get_subkey_creation_time: ADDED
3885 gnutls_openpgp_crt_get_subkey_pk_dsa_raw: ADDED
3886 gnutls_openpgp_crt_get_subkey_pk_rsa_raw: ADDED
3887 gnutls_openpgp_crt_get_pk_dsa_raw: ADDED
3888 gnutls_openpgp_crt_get_pk_rsa_raw: ADDED
3889 gnutls_openpgp_privkey_export_subkey_dsa_raw: ADDED
3890 gnutls_openpgp_privkey_export_subkey_rsa_raw: ADDED
3891 gnutls_openpgp_privkey_export_dsa_raw: ADDED
3892 gnutls_openpgp_privkey_export_rsa_raw: ADDED
3893 gnutls_openpgp_privkey_export: ADDED
3894 gnutls_certificate_set_openpgp_key_file2: ADDED
3895 gnutls_certificate_set_openpgp_key_mem2: ADDED
3896 gnutls_x509_dn_init: ADDED
3897 gnutls_x509_dn_import: ADDED
3898 gnutls_x509_dn_deinit: ADDED
3899 GNUTLS_E_OPENPGP_SUBKEY_ERROR: ADDED
3900 gnutls_hex2bin: ADDED
3901 GNUTLS_CRT_PRINT_FULL: ADDED, same as old GNUTLS_X509_CRT_FULL.
3902 GNUTLS_CRT_PRINT_ONELINE: ADDED, same as old GNUTLS_X509_CRT_ONELINE.
3903 GNUTLS_CRT_PRINT_UNSIGNED_FULL: ADDED, same as
3904 old GNUTLS_X509_CRT_UNSIGNED_FULL.
3906 * Version 2.3.0 (released 2008-01-08)
3908 ** LZO compression is now disabled by default.
3909 The reason is that LZO compression is not standardized in TLS. If you
3910 wish to experiment with it, you will have to supply --with-lzo when
3911 invoking ./configure. The internal copy of minilzo is no longer
3912 included with GnuTLS, so you will need to install liblzo or liblzo2 on
3913 your system to have --with-lzo to be effective.
3915 ** More than one server name field is now sent to the server properly.
3916 Thanks to mark.phillips@virgin.net.
3918 ** Fixes the post_client_hello_function(). The extensions are now parsed
3919 in a callback friendly way.
3921 ** Fix for certificate selection in servers with certificate callbacks.
3923 ** Updated translations.
3925 ** Update gnulib files.
3927 ** API and ABI modifications:
3928 No changes since last version.
3930 * Version 2.2.5 (released 2008-05-19)
3932 ** Fix flaw in fix for GNUTLS-SA-2008-1-3.
3933 The flaw would result in incorrectly terminated sessions with the
3934 error "Decryption has failed" when the server sends a small packet
3935 (typically when the session is closed). Reported by Andreas Metzler
3936 <ametzler@downhill.at.eu.org> in
3937 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2807>.
3939 ** API and ABI modifications:
3940 No changes since last version.
3942 * Version 2.2.4 (released 2008-05-19)
3944 ** Fix three security vulnerabilities. [GNUTLS-SA-2008-1]
3945 Thanks to CERT-FI for finding the bugs and providing detailed reports,
3946 which allowed the bugs to be reproduced and fixed easily. Patches
3947 developed by Simon Josefsson and Nikos Mavrogiannopoulos. Any updates
3948 with more details about these vulnerabilities will be added to
3949 <http://www.gnu.org/software/gnutls/security.html>
3951 *** [GNUTLS-SA-2008-1-1]
3952 *** libgnutls: Fix crash when sending invalid server name.
3953 The crash can be triggered remotely before authentication, which can
3954 lead to a Daniel of Service attack to disable the server. The bug
3955 cause gnutls to store more session resumption data than what was
3956 allocated for, thus overwriting unallocated memory.
3958 *** [GNUTLS-SA-2008-1-2]
3959 *** libgnutls: Fix crash when sending repeated client hellos.
3960 The crash can be triggered remotely before authentication, which can
3961 lead to a Daniel of Service attack to disable the server. The bug
3962 triggers a null-pointer dereference.
3964 *** [GNUTLS-SA-2008-1-3]
3965 *** libgnutls: Fix crash in cipher padding decoding for invalid record lengths.
3966 The crash can be triggered remotely before authentication, which can
3967 lead to a Daniel of Service attack to disable the server. The bug
3968 cause gnutls to read memory beyond the end of the received record.
3970 ** API and ABI modifications:
3971 No changes since last version.
3973 * Version 2.2.3 (released 2008-05-06)
3975 ** Increase default handshake packet size limit to 48kb.
3976 The old limit was 16kb and some servers send huge list of trusted CAs,
3977 thus running into the limit. FYI, applications can further increase
3978 this limit using gnutls_handshake_set_max_packet_length. Thanks to
3979 Marc Haber <mh+debian-bugs@zugschlus.de> and "Marc F. Clemente"
3980 <marc@mclemente.net> for reporting and providing test servers.
3982 ** Fix compilation error related to __FUNCTION__ on some systems.
3983 Reported by Tim Mooney, see
3984 <https://savannah.gnu.org/support/?106267>.
3986 ** Documented the --priority option to gnutls-cli and gnutls-serv.
3988 ** Fix fopen file descriptor leak in PSK server code.
3989 Thanks to Laurence Withers <l@lwithers.me.uk>, see
3990 <http://lists.gnu.org/archive/html/gnutls-devel/2008-04/msg00002.html>.
3992 ** Build Guile code with -fgnu89-inline only when supported.
3993 Reported by Kris Karas <ktk@enterprise.bidmc.harvard.edu> in
3994 <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2708>.
3996 ** Make Camellia encryption work.
3997 Reported by Yoshisato YANAGISAWA <yanagisawa@csg.is.titech.ac.jp> in
3998 <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2746>.
4000 ** API and ABI modifications:
4001 No changes since last version.
4003 * Version 2.2.2 (released 2008-02-21)
4005 ** Cipher priority string handling now handle strings that starts with NULL.
4006 Thanks to Laurence Withers <l@lwithers.me.uk>.
4008 ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported
4011 ** Increased the default certificate verification chain limits and allowed
4012 for checks without limitation.
4014 ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name()
4015 and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary
4016 strings and return the proper size.
4018 ** API and ABI modifications:
4019 No changes since last version.
4021 * Version 2.2.1 (released 2008-01-17)
4023 ** Prevent linking libextra against previously installed libgnutls.
4024 Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see
4025 <http://bugs.gentoo.org/show_bug.cgi?id=202269>.
4027 ** Fixes the post_client_hello_function(). The extensions are now parsed
4028 in a callback friendly way.
4030 ** Fix for certificate selection in servers with certificate callbacks.
4032 ** API and ABI modifications:
4033 No changes since last version.
4035 * Version 2.2.0 (released 2007-12-14)
4037 ** Update internal copy of libtasn1 to version 1.2.
4039 ** Certtool --verify-chain now handle inputs larger than 64kb.
4040 This fixes the self-test "rsa-md5-collision" under MinGW+Wine with
4041 recent versions of libgcrypt. The problem was that Wine with the
4042 libgcrypt RNG generates huge amounts of debugging output.
4044 ** Translation updates.
4045 Added Dutch translation. Updated Polish and Swedish translation.
4047 ** Major changes compared to the v2.0 branch:
4049 *** SRP support aligned with newly published RFC 5054.
4051 *** OpenPGP support aligned with newly published RFC 5081.
4053 *** Support for DSA2 keys.
4055 *** Support for Camellia cipher.
4057 *** Support for Opaque PRF Input extension.
4059 *** PKCS#8 parser now handle DSA keys.
4061 *** Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc.
4062 Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier
4063 versions, such as 2.01 which is included with GnuTLS, is available
4064 under GPLv2 or later. If this incompatibility causes problems, we
4065 recommend you to disable LZO using --without-lzo. LZO compression is
4066 not a standard TLS compression algorithm, so the impact should be
4069 *** Functions for disabling record protocol padding.
4070 Works around bugs on Nokia/Ericsson phones.
4072 *** New functions gnutls_priority_set() for setting cipher priorities easily.
4073 Priorities like "COMPAT" also enables other work arounds, such as
4076 *** Other minor improvements and bug fixes.
4078 ** Backwards incompatible API/ABI changes in GnuTLS 2.2
4079 To adapt to changes in the TLS extension specifications for OpenPGP
4080 and SRP, the GnuTLS API had to be modified. This means breaking the
4081 API and ABI backwards compatibility. That is something we try to
4082 avoid unless it is necessary. We decided to also remove the already
4083 deprecated stub functions for X.509 to XML conversion and TLS
4084 authorization (see below) when we had the opportunity.
4086 Generally, most applications does not need to be modified. Just
4087 re-compile them against the latest GnuTLS release, and it should work
4090 Applications that use the OpenPGP or SRP features needs to be
4091 modified. Below is a list of the modified APIs and discussion of what
4092 the minimal things you need to modify in your application to make it
4093 work with GnuTLS 2.2.
4095 Note that GnuTLS 2.2 also introduces new APIs -- such as
4096 gnutls_set_priority() that is superior to
4097 gnutls_set_default_priority() -- that you may want to start using.
4098 However, using those new APIs is not required to use GnuTLS 2.2 since
4099 the old functions continue are still supported. This text only
4100 discuss what you minimally have to modify.
4102 *** XML related changes
4103 The function `gnutls_x509_crt_to_xml' has been removed. It has been
4104 deprecated and only returned an error code since GnuTLS version
4105 1.2.11. Nobody has complained, so users doesn't seem to miss the
4106 functionality. We don't know of any other library to convert X.509
4107 certificates into XML format, but we decided (long ago) that GnuTLS
4108 isn't the right place for this kind of functionality. If you want
4109 help to find some other library to use here, please explain and
4110 discuss your use case on help-gnutls@gnu.org.
4112 *** TLS Authorization related changes
4113 Everything related to TLS authorizations have been removed, they were
4114 only stub functions that returned an error code:
4116 GNUTLS_SUPPLEMENTAL_AUTHZ_DATA
4117 gnutls_authz_data_format_type_t
4118 gnutls_authz_recv_callback_func
4119 gnutls_authz_send_callback_func
4121 gnutls_authz_send_x509_attr_cert
4122 gnutls_authz_send_saml_assertion
4123 gnutls_authz_send_x509_attr_cert_url
4124 gnutls_authz_send_saml_assertion_url
4126 *** SRP related changes
4127 The callback gnutls_srp_client_credentials_function has a new
4128 prototype, and its semantic has changed. You need to rewrite the
4129 callback, see the updated function documentation and SRP example code
4130 (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more
4133 The alert codes GNUTLS_A_MISSING_SRP_USERNAME and
4134 GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP
4135 specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is
4136 used. There are #define's to map the old names to the new. You may
4137 run into problems if you have a switch-case with cases for both SRP
4138 alerts, since they are now mapped to the same value. The solution is
4139 to drop the SRP alerts from such switch cases, as they are now
4140 deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY.
4142 *** OpenPGP related changes
4143 The function `gnutls_certificate_set_openpgp_keyserver' have been
4144 removed. There is no replacement functionality inside GnuTLS. If you
4145 need keyserver functionality, consider using the GnuPG tools.
4147 All functions, types, and error codes related to OpenPGP trustdb
4148 format have been removed. The trustdb format is a non-standard
4149 GnuPG-specific format, and we recommend you to use key rings instead.
4150 The following have been removed:
4152 gnutls_certificate_set_openpgp_trustdb
4153 gnutls_openpgp_trustdb_init
4154 gnutls_openpgp_trustdb_deinit
4155 gnutls_openpgp_trustdb_import
4156 gnutls_openpgp_key_verify_trustdb
4157 gnutls_openpgp_trustdb_t
4158 GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED
4160 The following functions has an added parameter of the (new) type
4161 `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data
4162 (binary or base64). The functions are:
4163 gnutls_certificate_set_openpgp_key_file
4164 gnutls_certificate_set_openpgp_key_mem
4165 gnutls_certificate_set_openpgp_keyring_mem
4166 gnutls_certificate_set_openpgp_keyring_file
4168 To improve terminology and align with the X.509 interface, some
4169 functions have been renamed. Compatibility mappings exists. The old
4170 and new names of the affected functions and types are:
4173 gnutls_openpgp_key_t gnutls_openpgp_crt_t
4174 gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t
4175 gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t
4176 GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT
4177 GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT
4178 gnutls_openpgp_key_init gnutls_openpgp_crt_init
4179 gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit
4180 gnutls_openpgp_key_import gnutls_openpgp_crt_import
4181 gnutls_openpgp_key_export gnutls_openpgp_crt_export
4182 gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage
4183 gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint
4184 gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm
4185 gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name
4186 gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version
4187 gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time
4188 gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time
4189 gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id
4190 gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname
4191 gnutls_openpgp_send_key gnutls_openpgp_send_cert
4193 ** API and ABI modifications:
4194 No changes since last version.
4196 * Version 2.1.8 (released 2007-12-10)
4198 ** The GPL version has been changed from version 2 to version 3.
4199 This affects the self-tests, command-line tools, the libgnutls-extra
4200 library, the relevant guile parts, and the build environment.
4202 ** Added gnutls_x509_crt_get_subject_alt_name2().
4204 ** Corrected a segfault when setting an empty gnutls_priority_t
4205 at gnutls_priority_set().
4207 ** Use gettext 0.17 which updates m4/lib-*.m4 macros.
4208 Fixes a problem with spurious -L/usr/lib additions.
4210 ** API and ABI modifications:
4211 gnutls_x509_crt_get_subject_alt_name2: ADD.
4213 * Version 2.1.7 (released 2007-11-29)
4215 ** PKCS #8 parser can now encode/decode DSA keys.
4217 ** Updated gnutls_set_default_priority2() now renamed to
4218 gnutls_priority_set() and gnutls_priority_set_direct() which
4219 accept a string to indicate preferences of ciphersuite parameters.
4221 ** gnutls-cli and gnutls-serv now have a --priority option to set
4222 the priority string.
4224 ** The gnutls_*_convert_priority() functions were deprecated by
4225 the gnutls_priority_set() and gnutls_priority_set_direct().
4227 ** Internal copy of OpenCDK upgraded to version 0.6.6.
4229 ** API and ABI modifications:
4230 gnutls_priority_init: ADD.
4231 gnutls_priority_deinit: ADD.
4232 gnutls_priority_set: ADD.
4233 gnutls_priority_set_direct: ADD.
4234 gnutls_set_default_priority2: RENAMED to gnutls_priority_set_direct()
4235 gnutls_mac_convert_priority: REMOVED
4236 gnutls_compression_convert_priority: REMOVED
4237 gnutls_protocol_convert_priority: REMOVED
4238 gnutls_kx_convert_priority: REMOVED
4239 gnutls_cipher_convert_priority: REMOVED
4240 gnutls_certificate_type_convert_priority: REMOVED
4241 gnutls_set_default_priority: UNDEPRECATED
4242 gnutls_set_default_priority_export: UNDEPRECATED
4244 ** Undocumented API and ABI modifications earlier in the 2.1.x series:
4245 GNUTLS_CIPHER_UNKNOWN: ADD.
4246 GNUTLS_CIPHER_CAMELLIA_128_CBC: ADD.
4247 GNUTLS_CIPHER_CAMELLIA_256_CBC: ADD.
4248 GNUTLS_KX_UNKNOWN: ADD.
4249 GNUTLS_COMP_UNKNOWN: ADD.
4250 GNUTLS_CRT_UNKNOWN: ADD.
4251 gnutls_mac_get_id: ADD.
4252 gnutls_compression_get_id: ADD.
4253 gnutls_cipher_get_id: ADD.
4254 gnutls_kx_get_id: ADD.
4255 gnutls_protocol_get_id: ADD.
4256 gnutls_certificate_type_get_id: ADD.
4257 gnutls_handshake_post_client_hello_func: ADD.
4258 gnutls_certificate_send_x509_rdn_sequence: ADD prototype to gnutls.h.in.
4260 * Version 2.1.6 (released 2007-11-15)
4262 ** Corrected bug in decompression of expanded compression data.
4264 ** Added the --to-p8 option to certtool to convert private keys
4267 ** Introduced the GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR error code.
4269 ** gnutls_certificate_set_x509_key_* can now read PKCS #8 unencrypted
4272 ** Fixed GNUTLS_E_UNKNOWN_ALGORITHM vs GNUTLS_E_UNKNOWN_HASH_ALGORITHM.
4273 During the 2.1.x series the GNUTLS_E_UNKNOWN_HASH_ALGORITHM error code
4274 was renamed to GNUTLS_E_UNKNOWN_ALGORITHM, unfortunately without being
4275 documented. This caused some problems (e.g., debian #450854). To
4276 avoid backwards compatibility problems, this release revert this
4277 change, so that GNUTLS_E_UNKNOWN_HASH_ALGORITHM works just like it has
4278 done in GnuTLS 2.0.x and earlier, and add a new error code
4279 GNUTLS_E_UNKNOWN_ALGORITHM.
4281 ** Fixes several gtk-doc warnings.
4283 ** API and ABI modifications:
4284 GNUTLS_E_UNKNOWN_ALGORITHM: CHANGED.
4285 GNUTLS_E_UNKNOWN_HASH_ALGORITHM: CHANGED.
4286 GNUTLS_E_BASE64_UNEXPECTED_HEADER_ERROR: ADD.
4288 * Version 2.1.5 (released 2007-11-01)
4290 ** Fix PKCS#3 parameter export problem.
4292 ** Improve certtool queries, they now print the default value.
4296 ** Update gnulib files.
4298 ** API and ABI modifications:
4299 No changes since last version.
4301 * Version 2.1.4 (released 2007-10-27)
4303 ** Added the --v1 option to certtool, to allow generating X.509
4304 version 1 certificates.
4306 ** certtool: Add option --disable-quick-random to enable the old behaviour
4307 of using /dev/random to generate keys.
4309 ** Added priority functions that accept strings.
4311 ** Added gnutls_set_default_priority2() which accepts a flag to indicate
4312 priorities preferences.
4314 ** Added gnutls_record_disable_padding() to allow servers talking to
4315 buggy clients that complain if the TLS 1.0 record protocol padding is
4318 ** Introduced gnutls_session_enable_compatibility_mode() to allow enabling
4319 all supported compatibility options (like disabling padding).
4321 ** The gnutls_certificate_set_openpgp_* functions were modified to include
4322 the format. This makes the interface consistent with the x509 functions.
4324 ** Internal copy of OpenCDK upgraded to version 0.6.5.
4326 ** Update gnulib files.
4328 ** API and ABI modifications:
4329 gnutls_certificate_set_openpgp_key_mem: MODIFIED
4330 gnutls_certificate_set_openpgp_key_file: MODIFIED
4331 gnutls_certificate_set_openpgp_keyring_mem: MODIFIED
4332 gnutls_certificate_set_openpgp_keyring_file: MODIFIED
4333 gnutls_set_default_priority: DEPRECATED
4334 gnutls_set_default_priority_export: DEPRECATED
4335 gnutls_set_default_priority2: ADDED
4336 gnutls_session_enable_compatibility_mode: ADDED
4337 gnutls_record_disable_padding: ADDED
4338 gnutls_mac_convert_priority: ADDED
4339 gnutls_compression_convert_priority: ADDED
4340 gnutls_protocol_convert_priority: ADDED
4341 gnutls_kx_convert_priority: ADDED
4342 gnutls_cipher_convert_priority: ADDED
4343 gnutls_certificate_type_convert_priority: ADDED
4344 gnutls_openpgp_key_t: RENAMED to gnutls_openpgp_crt_t
4345 gnutls_openpgp_key_status_t: RENAMED to gnutls_openpgp_crt_status_t
4346 gnutls_openpgp_send_key: RENAMED to gnutls_openpgp_send_cert
4347 gnutls_openpgp_key_init: RENAMED to gnutls_openpgp_crt_init
4348 gnutls_openpgp_key_import: RENAMED to gnutls_openpgp_crt_import
4349 gnutls_openpgp_key_export: RENAMED to gnutls_openpgp_crt_export
4350 gnutls_openpgp_key_check_hostname: RENAMED to gnutls_openpgp_crt_check_hostname
4351 gnutls_openpgp_key_get_creation_time: RENAMED to gnutls_openpgp_crt_get_creation_time
4352 gnutls_openpgp_key_get_expiration_time: RENAMED to gnutls_openpgp_crt_get_expiration_time
4353 gnutls_openpgp_key_get_fingerprint: RENAMED to gnutls_openpgp_crt_get_fingerprint
4354 gnutls_openpgp_key_get_version: RENAMED to gnutls_openpgp_crt_get_version
4355 gnutls_openpgp_key_get_pk_algorithm: RENAMED to gnutls_openpgp_crt_get_pk_algorithm
4356 gnutls_openpgp_key_get_name: RENAMED to gnutls_openpgp_crt_get_name
4357 gnutls_openpgp_key_deinit: RENAMED to gnutls_openpgp_crt_deinit
4358 gnutls_openpgp_key_get_id: RENAMED to gnutls_openpgp_crt_get_id
4359 gnutls_openpgp_key_get_key_usage: RENAMED to gnutls_openpgp_crt_get_key_usage
4360 gnutls_openpgp_key_verify_ring: RENAMED to gnutls_openpgp_crt_verify_ring
4361 gnutls_openpgp_key_verify_self: RENAMED to gnutls_openpgp_crt_verify_self
4363 * Version 2.1.3 (released 2007-10-17)
4365 ** TLS authorization support removed.
4366 This technique may be patented in the future, and it is not of crucial
4367 importance for the Internet community. After deliberation we have
4368 concluded that the best thing we can do in this situation is to
4369 encourage society not to adopt this technique. We have decided to
4370 lead the way with our own actions.
4372 ** Re-enabled the 256 bit ciphers in the default priorities.
4374 ** Corrected bugs in openpgp key verification using a keyring (both in
4377 ** API and ABI modifications:
4378 gnutls_certificate_set_openpgp_keyserver: REMOVED
4379 gnutls_authz_data_format_type_t,
4380 gnutls_authz_recv_callback_func,
4381 gnutls_authz_send_callback_func,
4382 gnutls_authz_enable,
4383 gnutls_authz_send_x509_attr_cert,
4384 gnutls_authz_send_saml_assertion,
4385 gnutls_authz_send_x509_attr_cert_url,
4386 gnutls_authz_send_saml_assertion_url: REMOVED.
4387 GNUTLS_SUPPLEMENTAL_USER_MAPPING_DATA: ADDED. To avoid that the
4388 gnutls_supplemental_data_format_type_t enum type becomes empty.
4390 * Version 2.1.2 (released 2007-10-14)
4392 ** Removed all the trustdb code from openpgp authentication.
4393 We now use only the well-specified keyrings.
4395 ** The 256 bit ciphers are not enabled in the default priorities.
4397 ** Added support for DSA2 using libgcrypt 1.3.0.
4399 ** certtool: Fixed data corruption when using --outder.
4401 ** Removed all the xml related stubs and functions.
4403 ** Added capability to set a callback after the client hello is received
4404 by the server in order to adjust parameters before the handshake.
4406 ** SRP was corrected to adhere to the latest draft (published soon as RFC)
4408 ** Corrected bug which did not allow a server to run without supporting
4411 ** Updated the DN parser which now prints wrongly decoded values as hex
4414 ** certtool: Add option --quick-random.
4415 For generating low security test credentials.
4417 ** API and ABI modifications:
4418 gnutls_x509_crt_to_xml: REMOVED
4419 gnutls_openpgp_key_to_xml: REMOVED
4420 gnutls_openpgp_key_verify_trustdb: REMOVED
4421 gnutls_openpgp_trustdb_init: REMOVED
4422 gnutls_openpgp_trustdb_deinit: REMOVED
4423 gnutls_openpgp_trustdb_import: REMOVED
4424 gnutls_certificate_set_openpgp_trustdb: REMOVED
4425 gnutls_srp_client_credentials_function: CHANGED
4426 gnutls_handshake_set_post_client_hello_function: ADDED
4427 gnutls_mac_get_key_size: ADDED
4428 GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED: DEPRECATED.
4429 GNUTLS_A_MISSING_SRP_USERNAME: DEPRECATED
4430 GNUTLS_A_UNKNOWN_SRP_USERNAME: DEPRECATED
4432 * Version 2.1.1 (released 2007-09-24)
4434 ** Added support for Camellia cipher, thanks to Yoshisato YANAGISAWA.
4435 Camellia is only enabled in GnuTLS if the installed libgcrypt has been
4436 compiled with Camellia support. See the libgcrypt documentation on
4437 how to enable it. Unconditionally disable it using the configure
4438 option --disable-camellia. Fixes #1.
4440 ** Properly document in the NEWS file the API change in the last release.
4442 ** API and ABI modifications:
4443 No changes since last version.
4445 * Version 2.1.0 (released 2007-09-20)
4447 ** Support for draft-rescorla-tls-opaque-prf-input-00.txt.
4448 The support is disabled by default. Since no value has been allocated
4449 by the IANA for this extension yet, you will need to provide one
4450 yourself by invoking './configure --enable-opaque-prf-input=42'.
4453 ** Example code: Fix compilation flaw under MinGW.
4455 ** API and ABI modifications:
4456 gnutls_oprfi_callback_func: ADD, new typedef function prototype.
4457 gnutls_oprfi_enable_client: ADD, new function.
4458 gnutls_oprfi_enable_server: ADD, new function.
4460 * Version 2.0.4 (released 2007-11-16)
4462 ** Corrected bug in decompression of expanded compression data.
4464 ** API and ABI modifications:
4465 No changes since last version.
4467 * Version 2.0.3 (released 2007-11-10)
4469 ** This version backports several fixes from the 2.1.x branch.
4471 ** Fixed PKCS #3 parameter export.
4473 ** Added gnutls_record_disable_padding() to allow servers talking to
4474 buggy clients that complain if the TLS 1.0 record protocol padding is
4477 ** Introduced gnutls_session_enable_compatibility_mode() to allow enabling
4478 all supported compatibility options (like disabling padding).
4480 ** Corrected bug which did not allow a server to run without supporting
4483 ** API and ABI modifications:
4484 gnutls_session_enable_compatibility_mode: ADDED
4485 gnutls_record_disable_padding: ADDED
4487 * Version 2.0.2 (released 2007-10-17)
4489 ** TLS authorization support removed.
4490 This technique may be patented in the future, and it is not of crucial
4491 importance for the Internet community. After deliberation we have
4492 concluded that the best thing we can do in this situation is to
4493 encourage society not to adopt this technique. We have decided to
4494 lead the way with our own actions.
4496 ** certtool: Fixed data corruption when using --outder.
4498 ** Fix configure-time Guile detection.
4500 ** API and ABI modifications:
4501 GNUTLS_SUPPLEMENTAL_USER_MAPPING_DATA: ADDED. To avoid that the
4502 gnutls_supplemental_data_format_type_t enum type becomes empty.
4504 * Version 2.0.1 (released 2007-09-20)
4506 ** New directory doc/credentials/ with test credentials.
4507 This collects the test credentials from the web page and from src/.
4508 The script gnutls-http-serv has also been moved to that directory.
4510 ** Update SRP extension type and cipher suite with official IANA values.
4511 This breaks backwards compatibility with SRP in older versions of
4512 GnuTLS, but this is intentional to speed up the adoption of the
4513 official values. The old values we used were incorrect.
4515 ** Guile: Fix `x509-certificate-dn-oid'
4517 ** API and ABI modifications:
4518 No changes since last version.
4520 * Version 2.0.0 (released 2007-09-04)
4522 ** Included copy of Libtasn1 upgraded to version 1.1.
4524 ** Disable building of some examples if anonymous ciphers are disabled.
4526 ** Don't build examples for disabled features.
4528 ** API and ABI modifications:
4529 No changes since last version.
4531 * Version 1.7.19 (released 2007-08-27)
4533 ** Fix gnutls_error_is_fatal so that positive "errors" are non-critical.
4534 This solves connection problems in mutt, see
4535 <http://bugs.debian.org/439640>.
4537 ** Update gnulib files.
4538 In particular, the getpass module -- with its dependencies on getline,
4539 getdelim, fseeko etc -- where moved from the lgl/ (used by the core
4540 library) directory to the gl/ directory (only used by the command line
4541 tools). The reason is that getpass is now only used by the
4542 command-line tools, and reducing the number of gnulib modules linked
4543 to the core library helps portability and reduces size.
4547 ** Disable building of PGP examples if PGP is disabled.
4549 ** Included copy of OpenCDK upgraded to version 0.6.4.
4551 ** API and ABI modifications:
4552 No changes since last version.
4554 * Version 1.7.18 (released 2007-08-16)
4556 ** Install images for the info manual.
4557 This has a side effect of renaming the images. See
4558 <http://thread.gmane.org/gmane.comp.tex.texinfo.bugs/3533> for
4559 discussions on the approach chosen.
4561 ** Fix pointer mix to variables of different size.
4562 Patch extracted from
4563 <http://cvs.fedora.redhat.com/viewcvs/devel/gnutls/gnutls-1.6.3-incompat-pointers.patch?rev=1.1&view=auto>.
4565 ** Fix warnings during build.
4566 Thanks to Andreas Metzler <ametzler@downhill.at.eu.org>.
4568 ** API and ABI modifications:
4569 No changes since last version.
4571 * Version 1.7.17 (released 2007-08-15)
4573 ** New functions to perform external signing.
4574 Set the signing callback function (of the gnutls_sign_func prototype)
4575 using the gnutls_sign_callback_set function. In the callback, you may
4576 find the new functions gnutls_x509_privkey_sign_hash and
4577 gnutls_openpgp_privkey_sign_hash useful. A new function
4578 gnutls_sign_callback_get is also added, to retrieve the function
4579 pointer. Thanks to "Alon Bar-Lev" <alon.barlev@gmail.com> for
4580 comments and testing.
4582 ** New self test of client and server authenticated X.509 TLS sessions.
4583 See tests/x509self.c and tests/x509signself.c. The latter also tests
4584 the new external signing callback interface.
4586 ** New errors GNUTLS_E_APPLICATION_ERROR_MIN..GNUTLS_E_APPLICATION_ERROR_MAX.
4587 These two actually describe the outer limits of a range of error codes
4588 reserved to the application. All of the errors are treated as fatal
4589 by the library (it has to since it doesn't know the semantics of the
4590 error codes). This can be useful in callbacks, to signal some
4591 application-specific error condition, which will usually eventually
4592 cause some gnutls API to return the same error code as the callback,
4593 which then can be inspected by the application. Note that error codes
4596 ** gnutls_set_default_priority now disable TLS 1.2 by default.
4597 The RFC is not released yet, and we're approaching a major release so
4598 let's not enable it just yet.
4600 ** Fix namespace so that gnutls_*_t is used consistently.
4601 Before, many places in the GnuTLS code used the old deprecated type
4602 names without the '_t' suffix.
4604 ** Build fixes for Guile code.
4605 Patch from Ludovic Courtes <ludovic.courtes@laas.fr>.
4607 ** More documentation fixes.
4608 In particular, the section headings were modified for casing. By
4609 Ludovic Courtes <ludovic.courtes@laas.fr>.
4611 ** Updated Polish and Swedish translations.
4612 Thanks to Jakub Bogusz <qboosh@pld-linux.org> and Daniel Nylander
4613 <po@danielnylander.se>.
4615 ** API and ABI modifications:
4616 gnutls_sign_func: ADD, new type for sign callback.
4617 gnutls_sign_callback_set: ADD, new function to set sign callback.
4618 gnutls_sign_callback_get: ADD, new function to retrieve sign callback.
4619 gnutls_x509_privkey_sign_hash,
4620 gnutls_openpgp_privkey_sign_hash: ADD, new functions useful in sign callback.
4621 GNUTLS_E_APPLICATION_ERROR_MIN,
4622 GNUTLS_E_APPLICATION_ERROR_MAX: ADD, new CPP #defines for error codes.
4624 * Version 1.7.16 (released 2007-08-07)
4626 ** Fix sanity checks and return values in certificate selection.
4627 In some cases, GnuTLS omitted to report suitable error codes when no
4628 suitable certificate was found.
4630 ** Fix gnutls-cli starttls EOF on Mac OS X.
4631 Thanks to Hal Eden <n.mavrogiannopoulos@gmail.com>.
4633 ** Documentation fixes.
4634 In particular, the section headings were modified for casing. By
4635 Ludovic Courtes <ludovic.courtes@laas.fr>.
4637 ** Update gnulib files.
4639 ** API and ABI modifications:
4640 No changes since last version.
4642 * Version 1.7.15 (released 2007-07-02)
4644 ** Fix self-tests key-id under mingw32.
4646 ** Test that the Guile header files are recent enough to work.
4647 Before we just tested that the command line tool 'guile' was recent
4648 enough, which may not be sufficient if you still have an old
4649 libguile.h header installed.
4651 ** Guile bindings are now installed under $prefix by default.
4652 Use --without-guile-site-dir to install it under $pkgdatadir/site/
4653 where $pkgdatadir is as returned by "guile-config info pkgdatadir".
4654 Use --with-guile-site-dir=/your/own/path to specify the path manually.
4655 The default, --with-guile-site-dir, will install the Guile bindings
4656 under $datadir/guile/site. There is a new section 'Guile
4657 Preparations' in the manual that discuss these issues.
4659 ** Fix run-time library path ordering in linking the Guile bindings.
4661 ** Improved manual on downloading, installing, getting help, bug reports etc.
4662 Suggested by Ludovic Courtès <ludovic.courtes@laas.fr>.
4664 ** Add Malay message translations.
4665 Thanks to Sharuzzaman Ahmat Raslan <sharuzzaman@myrealbox.com>.
4667 ** API and ABI modifications:
4668 No changes since last version.
4670 * Version 1.7.14 (released 2007-06-26)
4672 ** Don't enable Guile bindings unless we have Guile 1.8 or later.
4673 Patch from Ludovic Courtès <ludovic.courtes@laas.fr>.
4675 ** Fix memory leak during DSA signature verification.
4676 Patch from Ludovic Courtès <ludovic.courtes@laas.fr>.
4678 ** Fix crash in gnutls-cli when TLS handshake fails.
4679 Reported by Marc Haber <mh+debian-bugs@zugschlus.de> and Andreas
4680 Metzler <ametzler@downhill.at.eu.org> via Debian BTS #429183, see
4681 <http://bugs.debian.org/429183>.
4683 ** Minor OpenPGP fixes in stream_to_datum.
4684 Patch from Timo Schulz <twoaday@freakmail.de> and Ludovic Courtès
4685 <ludovic.courtes@laas.fr>.
4687 ** Fix off-by-one in TLS 1.2 handshake.
4688 Patch from Ludovic Courtès <ludovic.courtes@laas.fr>.
4690 ** Minor Guile binding self-test cleanup.
4691 Patch from Ludovic Courtès <ludovic.courtes@laas.fr>.
4693 ** Update gnulib files.
4695 ** API and ABI modifications:
4696 No changes since last version.
4698 * Version 1.7.13 (released 2007-06-11)
4700 ** OpenCDK copy updated to version 0.6.3.
4702 ** Build fixes for GnuTLS Guile bindings.
4703 Patch from Ludovic Courtès <ludovic.courtes@laas.fr>.
4705 ** Build fix for GTK-DOC manual.
4707 ** Update gnulib files.
4709 ** API and ABI modifications:
4710 No changes since last version.
4712 * Version 1.7.12 (released 2007-06-08)
4714 ** Guile bindings for GnuTLS have been included.
4715 Contributed by Ludovic Courtès <ludovic.courtes@laas.fr>. There is a
4716 new chapter 'Guile Bindings' in the manual.
4718 ** Have PKCS8 parser return better error codes.
4719 Reported by Nate Nielsen <nielsen-list@memberwebs.com>, see
4720 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-May/001653.html> and
4721 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-May/001654.html>.
4723 ** Fix mem leak for sessions with client authentication via certificates.
4724 Reported by Andrew W. Nosenko <andrew.w.nosenko@gmail.com>, see
4725 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-April/001539.html>.
4728 Reported by Dennis Vshivkov <walrus@amur.ru>, see
4729 <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=333050>. Added
4730 self-test tests/parse_ca.c to test regressions.
4732 ** Fix build failures related to missing images in manual.
4733 Reported by Andreas Metzler <ametzler@downhill.at.eu.org>.
4735 ** Update gnulib files.
4737 ** API and ABI modifications:
4738 No changes since last version.
4740 * Version 1.7.11 (released 2007-05-26)
4742 ** Include opencdk.h in the release.
4743 Reported by Roman Bogorodskiy <novel@FreeBSD.org>.
4745 ** API and ABI modifications:
4746 No changes since last version.
4748 * Version 1.7.10 (released 2007-05-25)
4750 ** New API functions to extract DER encoded X.509 Subject/Issuer DN.
4751 Suggested by Nate Nielsen <nielsen-list@memberwebs.com>.
4753 ** Update of gnulib files.
4755 ** GnuTLS is now developed in GIT instead of CVS.
4756 See <http://repo.or.cz/w/gnutls.git> for a public repository.
4758 ** API and ABI modifications:
4759 gnutls_x509_crt_get_raw_issuer_dn: ADD.
4760 gnutls_x509_crt_get_raw_dn: ADD.
4762 * Version 1.7.9 (released 2007-05-12)
4764 ** X.509 certificates are preferred over OpenPGP keys.
4765 This is a change in the semantics of gnutls_set_default_priority.
4767 ** The included copy of OpenCDK has been updated to 0.6.1.
4768 There has been some API changes in OpenCDK, and the GnuTLS layer have
4769 been modified as well. Note that while there are API/ABI incompatible
4770 changes in OpenCDK, this does not influence GnuTLS's API/ABI because
4771 its API/ABI have not changed. From this version on, GnuTLS requires
4772 OpenCDK 0.6.0 or later.
4774 ** Fix build failure caused by missing doc/gnutls-logo.pdf.
4776 ** Change certtool's default serial number from 0 to a time-based value.
4778 ** Fix X.509 signing with RSA-PKCS#1 to set a NULL parameters fields.
4779 Before, we remove the parameters field, which resulted in a slightly
4780 different DER encoding which in turn caused signature verification
4781 failures of GnuTLS-generated RSA certificates in some other
4782 implementations (e.g., GnuPG 2.x's gpgsm). Depending on which RFCs
4783 you read, this may or may not be correct, but our new behaviour appear
4784 to be consistent with other widely used implementations.
4786 ** Fix mem leaks in gnutls_x509_crt_print.
4788 ** API and ABI modifications:
4789 No changes since last version.
4791 * Version 1.7.8 (released 2007-04-16)
4793 ** Added examples for the authorization extension.
4794 See doc/examples/ex-client-authz.c and doc/examples/ex-serv-authz.c.
4796 ** The examples only use gnutls_set_default_priority().
4797 The exception is when DH_ANON is needed.
4799 ** Improve gnutls_set_default_priority() priorities.
4800 The new approach is for it to try and negotiate all secure and
4801 standard mechanisms available. Currently, DH_ANON ciphersuites and
4802 LZO compressions are not enabled by default, because they are,
4803 respectively, insecure and non-standardized. Note that TLS 1.2 will
4804 not be enabled by default in non-experimental release until it has
4805 been approved by the IETF.
4807 ** gnutls-cli and gnutls-serv now uses the library's default priorities.
4808 This means that to get DH_ANON and LZO compression, you'll need to
4809 specify that manually using '--kx anon' or '--comp lzo'.
4811 ** Minor fixes to the human display format of X.509 certificates.
4813 ** New APIs to extract Distinguished Name's from X.509 certificates.
4814 Based on patch from Howard Chu <hyc@symas.com>.
4816 ** Improved library searching for opencdk.
4817 It will now add the appropriate -R or -Wl,-rpath flags as necessary.
4818 The deprecated opencdk.m4 is no longer used.
4820 ** New APIs to list supported algorithms in the library.
4821 The APIs are gnutls_cipher_list, gnutls_mac_list,
4822 gnutls_compression_list, gnutls_protocol_list,
4823 gnutls_certificate_type_list, gnutls_kx_list, and
4824 gnutls_cipher_suite_info. Suggested by Howard Chu <hyc@symas.com>.
4826 ** The gnutls_x509_crt_get_key_id API now handle non-RSA/DSA keys.
4828 ** New configure option --disable-tls-authorization to disable tls-authz.
4830 ** Fix prototype for `gnutls_psk_set_client_credentials'.
4831 The last parameter was renamed from 'flags' to 'format' and the type
4832 changed from 'unsigned int' to 'gnutls_psk_key_flags' (an enum type),
4833 which shouldn't cause any ABI changes. Reported by ludo@chbouib.org
4836 ** Fix allocation in gnutls_certificate_set_openpgp_key.
4837 Tiny patch from ludo@chbouib.org (Ludovic Courtès).
4839 ** API and ABI modifications:
4840 gnutls_x509_dn_t: ADD.
4841 gnutls_x509_ava_st: ADD.
4842 gnutls_x509_crt_get_subject,
4843 gnutls_x509_crt_get_issuer: ADD.
4844 gnutls_x509_dn_get_rdn_ava: ADD.
4845 gnutls_cipher_list: ADD.
4846 gnutls_mac_list: ADD.
4847 gnutls_compression_list: ADD.
4848 gnutls_protocol_list: ADD.
4849 gnutls_certificate_type_list: ADD.
4850 gnutls_kx_list: ADD.
4851 gnutls_cipher_suite_info: ADD.
4853 * Version 1.7.7 (released 2007-02-22)
4855 ** Support for supplemental handshake messages and authorization data.
4856 Supplemental data is described in RFC 4680 and the authorization
4857 extensions in draft-housley-tls-authz-extns-07.
4859 ** Support for authorization data in gnutls-cli and gnutls-serv.
4860 New parameters --authz-x509-attr-cert and --authz-saml-assertion.
4862 ** Fix for gnutls_x509_crt_check_hostname.
4863 Before it would have reported that the certificate matched a hostname
4864 when it did not have any dNSName or any CN field. Report and tiny
4865 patch from "Richard W.M. Jones" <rjones@redhat.com>.
4867 ** New self test for RFC 2818 comparison in gnutls_x509_crt_check_hostname.
4868 Tests regressions of the bug, and several other features.
4870 ** GnuTLS now matches URI's with IP Addresses against iPAddress SAN's.
4871 Before there were no support for iPAddress SAN's during comparison.
4873 ** New API to print information about CRL's.
4874 The function is gnutls_x509_crl_print.
4876 ** New API to extract signature value from CRL's.
4877 The function is gnutls_x509_crl_get_signature.
4879 ** Support for directoryName Subject Alternative Name's.
4880 The gnutls_x509_crt_get_subject_alt_name function returns the DN as a
4881 string in the provided buffer.
4883 ** Internal improvements to certtool.
4884 It uses gnutls_x509_crl_print to print CRL information. It uses some
4885 more gnulib modules to simplify error handling.
4887 ** API and ABI modifications:
4888 GNUTLS_HANDSHAKE_SUPPLEMENTAL: ADD, new gnutls_handshake_description_t element.
4889 gnutls_supplemental_data_format_type_t: ADD.
4890 gnutls_authz_data_format_type_t: ADD.
4891 gnutls_supplemental_get_name: ADD.
4892 gnutls_authz_recv_callback_func,
4893 gnutls_authz_send_callback_func: ADD, callback prototypes.
4894 gnutls_authz_enable: ADD.
4895 gnutls_authz_send_x509_attr_cert,
4896 gnutls_authz_send_saml_assertion,
4897 gnutls_authz_send_x509_attr_cert_url,
4898 gnutls_authz_send_saml_assertion_url: ADD.
4899 GNUTLS_SAN_DN: ADD, new gnutls_x509_subject_alt_name_t element.
4900 gnutls_x509_crl_print: ADD.
4901 gnutls_x509_crl_get_signature: ADD.
4903 * Version 1.7.6 (released 2007-02-12)
4905 ** Support for 'otherName' Subject Alternative Names.
4906 The existing API gnutls_x509_crt_get_subject_alt_name may now return
4907 the new type GNUTLS_SAN_OTHERNAME together with the otherName value.
4908 To find out the otherName OID (necessary for proper parsing of the
4909 value), use the new API gnutls_x509_crt_get_subject_alt_othername_oid.
4910 For known OIDs, gnutls_x509_crt_get_subject_alt_othername_oid will
4911 return "virtual" SAN values, e.g., GNUTLS_SAN_OTHERNAME_XMPP to
4912 simplify OID matching. Suggested by Matthias Wimmer <m@tthias.eu>.
4914 ** Certtool can print otherName SAN values for certificates.
4915 For known otherName OIDs (currently only id-on-xmppAddr as defined by
4916 RFC 3920), it will also print the name.
4918 ** Fix TLS 1.2 RSA signing in servers.
4919 Before it used the old-style MD5+SHA1 signature, but the TLS
4920 signatures should be normal PKCS#1 signatures. FYI, we use and
4921 require that DigestInfo parameters are present and NULL for TLS 1.2.
4923 ** Add APIs to access X.509 extensions sequentially.
4924 The existing APIs gnutls_x509_crt_get_extension_oid() and
4925 gnutls_x509_crt_get_extension_by_oid() does not permit callers to
4926 inspect the extensions in the order defined by the certificate.
4928 ** Add API to extract signature value from X.509 certificates.
4929 The function is gnutls_x509_crt_get_signature.
4931 ** Fix crash when generating proxy certificates in batch mode.
4932 If you don't specify a proxy policy in batch mode, it will use
4935 ** Add API to print information about X.509 certificates.
4936 The function is gnutls_x509_crt_print.
4938 ** Certtool uses the new API gnutls_x509_crt_print to print certificate info.
4939 One consequence of this is that the output syntax has changed
4940 slightly. Some more fields are printed.
4944 ** API and ABI modifications:
4945 gnutls_x509_crt_print: ADD
4946 gnutls_certificate_print_formats_t: ADD, new enum.
4947 gnutls_x509_crt_get_signature: ADD.
4948 gnutls_x509_crt_get_extension_data: ADD.
4949 gnutls_x509_crt_get_extension_info: ADD.
4950 gnutls_x509_crt_get_subject_alt_othername_oid: ADD.
4951 GNUTLS_SAN_OTHERNAME: ADD, new gnutls_x509_subject_alt_name_t element.
4952 GNUTLS_SAN_OTHERNAME_XMPP: ADD, new gnutls_x509_subject_alt_name_t element.
4954 * Version 1.7.5 (released 2007-02-06)
4956 ** Servers won't negotiate SRP RSA/DSS cipher suites if no SRP credential
4959 ** Default behaviour for the gnutls-cli and gnutls-serv tools improved.
4961 ** Fix --list output for gnutls-cli and gnutls-serv.
4962 Mention TLS1.2, SHA512 etc.
4964 ** Manual contains new section on setting up a test HTTP server.
4965 A server set up following those descriptions are available online via
4966 <http://www.gnutls.org/server.html>.
4968 ** Update of gnulib files.
4970 ** API and ABI modifications:
4971 No changes since last version.
4973 * Version 1.7.4 (released 2007-02-05)
4975 ** Support for RSA signing using SHA-256/384/512.
4976 A new self test "sha2" tries to build a long X.509 certificate chain
4977 testing all new hashes.
4979 ** The gnutls-serv tool now use static DH parameters if none are supplied.
4981 ** Discuss proxy certificates in the manual.
4983 ** Improve bibliographical citations in the manual.
4985 ** Update of gnulib files.
4987 ** Fix certtool template handling of pathLenConstraints.
4988 It now defaults to -1 instead of 0, which causes the field to be
4989 missing unless the template specify it.
4991 ** API and ABI modifications:
4994 GNUTLS_MAC_SHA512: New gnutls_mac_algorithm_t values.
4997 GNUTLS_DIG_SHA512: New gnutls_digest_algorithm_t values.
4998 GNUTLS_SIGN_RSA_SHA256,
4999 GNUTLS_SIGN_RSA_SHA384,
5000 GNUTLS_SIGN_RSA_SHA512: New gnutls_sign_algorithm_t values.
5002 * Version 1.7.3 (released 2007-02-01)
5004 ** New option to certtool: --generate-proxy.
5005 This will generate a Proxy Certificate from an end entity certificate.
5006 Proxy Certificates are documented in RFC 3820. You will need to
5007 specify the proxy certificate's private key with --load-privkey, the
5008 user certificate with --load-certificate and the private key used to
5009 sign the new proxy certificate with --load-ca-privkey. Certtool will
5010 query for proxy path length and the policy language OID. Currently
5011 only OIDs that have an empty policy are supported (which includes the
5012 two OIDs defined by RFC 3820).
5014 ** Certtool --certificate-info now prints information for Proxy Certificates.
5015 Before the proxy extension was just printed as DER encoded data.
5017 ** New APIs to set proxy subject names and get/set proxy cert extension.
5019 ** Fix parsing of pathLenConstraints in BasicConstraints with missing cA.
5021 ** Added self-test to test for regressions of pathLenConstraint bug.
5022 Incidentally, this also test (some) other regressions or changes in
5023 the output from certtool --certificate-info.
5025 ** When certtool generates CA certificates, pressing enter on the path
5026 ** length constraint query will now remove the field.
5027 Before it set the path length constraint to 0, which is a rather poor
5030 ** Certtool now print times in UTC when printing certificate/CRL info.
5032 ** Add better fix to work around C++ compiler bug on Mac OS X.
5033 Reported and tiny patch provided by Matthias Scheler <tron@NetBSD.org>.
5035 ** Fix import of ASCII armored OpenPGP keys.
5036 Patch by ludovic.courtes@laas.fr (Ludovic Courtès).
5038 ** Update of gnulib files.
5040 ** API and ABI modifications:
5041 gnutls_x509_crt_set_proxy_dn: ADD.
5042 gnutls_x509_crt_set_proxy: ADD.
5043 gnutls_x509_crt_get_proxy: ADD.
5045 * Version 1.7.2 (released 2007-01-14)
5047 ** Certtool now print the value of the pathLenConstraints field for certs.
5049 ** Certtool now query for path length constraints when generating CA certs.
5050 For batch uses, the certtool configuration name is "path_len".
5051 Suggested by Sascha Ziemann <sascha.ziemann@secunet.com>.
5053 ** Add new API to get/set pathLenConstraint in the Basic Constraints.
5054 The new functions gnutls_x509_crt_get_basic_constraints and
5055 gnutls_x509_crt_set_basic_constraints provide a superset of the
5056 functionality in the old gnutls_x509_crt_get_ca_status and
5057 gnutls_x509_crt_set_ca_status (respectively), but the old functions
5058 will continue to be supported.
5060 ** Add new API in OpenCDK to extract public/secret OpenPGP key to S-expr.
5061 The functions are cdk_pubkey_to_sexp and cdk_seckey_to_sexp. A proper
5062 OpenCDK release with this patch will be made soon, which should bump
5063 the OpenCDK version number. Patch by Mario Lenz <mario.lenz@gmx.net>.
5065 ** Certtool --to-p12 can now store more than one certificate in the blob.
5066 Before it could only store one certificate, but now it will read and
5067 store as many certificate there are from the --load-certificate file.
5068 Suggested by Sascha Ziemann <sascha.ziemann@secunet.com>.
5070 ** Clean up separation of gnutls and gnutls-extra for OpenPGP.
5071 In particular, the OpenPGP function variables are no longer part of
5072 the exported libgnutls interface, and no header files from
5073 libgnutls-extra (GPL) are needed by libgnutls (LGPL). The variables
5074 were never intended for non-internal purposes, and thus this does not
5075 imply a change in the external API/ABI.
5077 ** Print URL to gaa when missing, and fix srcdir!=builddir for GAA files.
5078 Reported by ludovic.courtes@laas.fr (Ludovic Courtès).
5080 ** GnuTLS no longer uses -mms-bitfields --enable-runtime-pseudo-reloc.
5081 Before these parameters were set to make GnuTLS build under mingw32,
5082 however, they appear to no longer be necessary.
5084 ** A minor fix to the C++ library to make it build.
5085 Reported by Pavlov Konstantin <thresh@altlinux.ru>.
5087 ** Update of gnulib files.
5089 ** API and ABI modifications:
5090 gnutls_x509_crt_get_basic_constraints: ADD.
5091 gnutls_x509_crt_set_basic_constraints: ADD.
5092 cdk_pubkey_to_sexp: ADD (in opencdk).
5093 cdk_seckey_to_sexp: ADD (in opencdk).
5095 * Version 1.7.1 (released 2006-12-28)
5097 ** TLS 1.2 server side fix.
5098 The Certificate Request sent did not contain the list of supported
5099 hashes field, thus violating the protocol. It will now contain an
5100 empty list. Reported by ludovic.courtes@laas.fr (Ludovic Courtès).
5102 ** TLS 1.2 DSA signature verification fix.
5103 Reported by ludovic.courtes@laas.fr (Ludovic Courtès).
5105 ** Fix the list of trusted CAs that server's send to clients.
5106 Before, the list contained issuer DN's instead of subject DN's of the
5107 trusted CAs. Reported by Max Kellermann <max@duempel.org>.
5109 ** Fix gnutls_certificate_set_x509_crl to initialize the CRL before using it.
5110 Also added a self-test in tests/certificate_set_x509_crl.c to test the
5111 function. Reported by Max Kellermann <max@duempel.org>.
5113 ** Encode UID fields in DN's as DirectoryString.
5114 Before GnuTLS encoded and parsed UID fields as IA5String. This was
5115 incorrect, it should have used DirectoryString. Now it will use
5116 DirectoryString for the UID field, but for backwards compatibility it
5117 will also accept IA5String UID's. Reported by Max Kellermann
5120 ** Improve out-of-sourcedir builds from CVS.
5121 Reported by ludovic.courtes@laas.fr (Ludovic Courtès).
5123 ** Bootstrap tools changed.
5124 We now require autoconf 2.61, automake 1.10, and gettext 0.16, when
5125 building GnuTLS from CVS. Libtool 1.5.22 is used.
5127 ** Fixed a syntax error in lib/gnutls.asn.
5128 Reported by Paul Millar <p.millar@physics.gla.ac.uk>.
5130 ** Added German translation of GnuTLS messages.
5132 ** Update of gnulib files.
5134 ** API and ABI modifications:
5135 No changes since last version.
5137 * Version 1.7.0 (released 2006-11-29)
5139 ** The default protocol priority try TLS 1.1 and TLS 1.2 too.
5140 The details is that the protocol priority set by
5141 `gnutls_set_default_priority' has been changed from TLS 1.0 and SSL
5142 3.0 to TLS 1.2, TLS 1.1, TLS 1.0 and SSL 3.0.
5144 ** Preliminary support for TLS 1.2.
5145 The client has been successfully tested against
5146 https://www.mikestoolbox.org:4433/.
5148 ** Anonself test now print a lot of debugging info, including TLS version.
5150 ** Doc fixes in OpenCDK, to avoid some gtk-doc warnings.
5152 ** Update of gnulib files.
5154 ** API and ABI modifications:
5155 GNUTLS_TLS1_2: New gnutls_protocol_t enum member.
5157 *** Pulled up from stable 1.6.x branch:
5159 ** Fix ./configure failure with non-GCC compilers.
5160 This fixes the following error message:
5161 configure: error: conditional "HAVE_LD_OUTPUT_DEF" was never defined.
5162 Reported by "Michael C. Vergallen" <mvergall@telenet.be>.
5164 * Version 1.6.3 (released 2007-05-26)
5166 ** New API functions to extract DER encoded X.509 Subject/Issuer DN.
5167 Suggested by Nate Nielsen <nielsen-list@memberwebs.com>. Backported
5168 from the 1.7.x branch, see
5169 <http://lists.gnu.org/archive/html/help-gnutls/2007-05/msg00029.html>.
5171 ** Have PKCS8 parser return better error codes.
5172 Reported by Nate Nielsen <nielsen-list@memberwebs.com>, see
5173 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-May/001653.html> and
5174 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-May/001654.html>.
5176 ** Fix mem leak for sessions with client authentication via certificates.
5177 Reported by Andrew W. Nosenko <andrew.w.nosenko@gmail.com>, see
5178 <http://lists.gnupg.org/pipermail/gnutls-dev/2007-April/001539.html>.
5180 ** Fix building of 'tlsia' self test.
5181 Earlier some gcc are known to build tlsia linking to
5182 $prefix/lib/libgnutls-extra.so rather than the libgnutls-extra.so in
5183 the build directory, even though command line parameters look OK.
5184 Changing order of some parameters fixes it.
5186 ** API and ABI modifications:
5187 gnutls_x509_crt_get_raw_issuer_dn: ADD.
5188 gnutls_x509_crt_get_raw_dn: ADD.
5190 * Version 1.6.2 (released 2007-04-18)
5192 ** Fix X.509 signing with RSA-PKCS#1 to set a NULL parameters fields.
5193 Before, we remove the parameters field, which resulted in a slightly
5194 different DER encoding which in turn caused signature verification
5195 failures of GnuTLS-generated RSA certificates in some other
5196 implementations (e.g., GnuPG 2.x's gpgsm). Depending on which RFCs
5197 you read, this may or may not be correct, but our new behaviour appear
5198 to be consistent with other widely used implementations.
5200 ** Regenerate the PKIX ASN.1 syntax tree.
5201 For some reason, after changing the ASN.1 type of ldap-UID in the last
5202 release, the generated C file built from the ASN.1 schema was not
5203 refreshed. This can cause problems when reading/writing UID
5204 components inside X.500 Distinguished Names. Reported by devel
5205 <dev001@pas-world.com>.
5207 ** Updated translations.
5209 ** API and ABI modifications:
5210 No changes since last version.
5212 * Version 1.6.1 (released 2006-12-28)
5214 ** Fix the list of trusted CAs that server's send to clients.
5215 Before, the list contained issuer DN's instead of subject DN's of the
5216 trusted CAs. Reported by Max Kellermann <max@duempel.org>.
5218 ** Fix gnutls_certificate_set_x509_crl to initialize the CRL before using it.
5219 Reported by Max Kellermann <max@duempel.org>.
5221 ** Encode UID fields in DN's as DirectoryString.
5222 Before GnuTLS encoded and parsed UID fields as IA5String. This was
5223 incorrect, it should have used DirectoryString. Now it will use
5224 DirectoryString for the UID field, but for backwards compatibility it
5225 will also accept IA5String UID's. Reported by Max Kellermann
5228 ** Fix ./configure failure with non-GCC compilers.
5229 This fixes the following error message:
5230 configure: error: conditional "HAVE_LD_OUTPUT_DEF" was never defined.
5231 Reported by "Michael C. Vergallen" <mvergall@telenet.be>.
5233 ** API and ABI modifications:
5234 No changes since last version.
5236 * Version 1.6.0 (released 2006-11-17)
5238 ** No changes since 1.5.5.
5239 The major changes compared to the 1.4.x branch are:
5241 *** A GnuTLS C++ library is part of the official distribution.
5242 Currently there are no examples or documentation, but hopefully this
5243 will change. See gnutlsxx.h for the API.
5245 *** Windows is a supported platform.
5246 There are, however, two know bugs. One is related to select() in
5247 command line tools (not, nota bene, in the library), the other is a
5248 problem with libgcrypt that causes delays. Help is needed to resolve
5249 those issues, so we feel we can't delay the release because of this.
5251 *** New APIs for custom push/pull function error reporting.
5252 The new APIs are gnutls_transport_set_errno and
5253 gnutls_transport_set_global_errno. See the release notes for version
5254 1.5.4 for more information.
5256 *** Self tests are run under valgrind, if available. See --disable-valgrind.
5258 * Version 1.5.5 (released 2006-11-16)
5260 ** Correctly bump shared library version after adding new APIs.
5261 This was forgotten in the last release.
5263 ** Fix unsigned vs signed problem in ex-x509-info.c example.
5264 Reported by Tim Kosse <tim.kosse@filezilla-project.org>.
5266 ** Fix the rsa-md5-collision self test to work for MinGW+Wine.
5268 ** Update of gnulib files.
5270 ** API and ABI modifications:
5271 No changes since last version.
5273 * Version 1.5.4 (released 2006-11-07)
5275 ** New API functions to set errno in push/pull functions.
5276 Under Windows, setting the errno variable in a push/pull replacement
5277 may end up setting the wrong errno variable, and GnuTLS send/recv
5278 functions become confused about the real errno returned from a failed
5279 push/pull function. Therefor, we have added two APIs to set the errno
5280 variable used by GnuTLS. The APIs can also help to keep things
5281 thread-safe, by avoiding potentially global variables. Typically,
5282 instead of setting errno in your push/pull function, you will call one
5283 of these functions. It is recommended to use
5284 gnutls_transport_set_errno, but if you don't have the session variable
5285 easily accessible in the push/pull replacement function, you can use
5286 gnutls_transport_set_global_errno. Suggested by Tim Kosse
5287 <tim.kosse@filezilla-project.org>.
5289 void gnutls_transport_set_errno (gnutls_session_t session, int err);
5290 void gnutls_transport_set_global_errno (int err);
5292 ** When calling `recv' or `send' Windows errors are handled properly.
5293 The Windows recv/send functions doesn't use errno, and GnuTLS now use
5294 WSAGetLastError to access the error condition instead.
5296 ** Several OpenPGP API fixes.
5297 All suggested by ludovic.courtes@laas.fr (Ludovic Courtès). The most
5298 important fix is to change the return value of
5299 gnutls_openpgp_privkey_get_pk_algorithm and
5300 gnutls_openpgp_key_get_pk_algorithm from 'int' to
5301 'gnutls_pk_algorithm_t', which is an enum type (and thus API/ABI
5302 compatible with 'int').
5304 ** When a GnuTLS server receive a SSLv2 Client Hello for an unknown TLS
5305 ** version, try to negotiate the highest version support by the GnuTLS server,
5306 ** instead of the lowest.
5307 Reported by <Pasi.Eronen@nokia.com>.
5309 ** Replace old constructs with use of gnulib modules.
5310 For example, we can now assume unistd.h, sys/stat.h, sys/socket.h in
5311 the code. If the headers doesn't exist on the target system, gnulib
5312 will make sure its replacement header files are used instead.
5314 ** Fix SOVERSION computation for *.def files.
5315 This fixes build errors similar to "No rule to make target
5316 `libgnutls-`expr', needed by `all-am'." when building for Windows.
5318 ** gnutls_check-version uses strverscmp from gnulib.
5320 ** Update of gnulib files.
5322 ** API and ABI modifications:
5323 gnutls_transport_set_errno: ADD
5324 gnutls_transport_set_global_errno: ADD
5326 * Version 1.5.3 (released 2006-10-26)
5328 ** Add new self-test of RSA-MD5 signature chains.
5329 Note that we already, since GnuTLS 1.2.9, reject RSA-MD5 signatures
5330 when verifying X.509 chains. The code is in tests/rsa-md5-collision/
5331 and is based on the work by Marc Stevens et al, see
5332 <http://www.win.tue.nl/hashclash/TargetCollidingCertificates/>.
5334 ** Re-factor self tests.
5336 ** The include copy of Libtasn1 is updated to version 0.3.7.
5338 ** The included copy of OpenCDK is updated to version 0.5.11.
5340 ** Fix the filename of the *.def file on Windows after library version bump.
5342 ** Separated the gnulib directory into one for LGPL modules and one for GPL.
5343 This allows the GPL'd part of GnuTLS to take advantage of the GPL'd
5344 gnulib modules. Earlier we could only use the LGPL'ed module from
5345 gnulib, because two gnulib directories in the same project didn't
5348 ** API and ABI modifications:
5349 No changes since last version.
5351 * Version 1.5.2 (released 2006-10-03)
5353 ** Decrement the shared library version back to 13 (as in the 1.4.x branch).
5354 Note that if you installed 1.5.0 or 1.5.1, they will have a higher
5355 shared library version than this version, so you'll have to remove
5356 them and possibly relink your applications. The reason for this is
5357 that no API/ABI changes have been made since the 1.4.x branch, and
5358 that incrementing the shared library version was a mistake. Reported
5359 by Andreas Metzler <ametzler@downhill.at.eu.org>.
5361 ** Fix off-by-one error when computing length to malloc.
5362 The code is used by gnutls_openpgp_add_keyring_file and
5363 gnutls_openpgp_add_keyring_mem. Reported by "Adam Langley"
5364 <agl@imperialviolet.org>.
5366 ** Add version script for the GnuTLS C++ library.
5367 Reported by Andreas Metzler <ametzler@downhill.at.eu.org>.
5369 ** Fix the C++ compiler detection logic.
5370 Reported by Andreas Metzler <ametzler@downhill.at.eu.org>.
5372 ** Update of gnulib files.
5374 ** API and ABI modifications:
5375 No changes since last version.
5377 * Version 1.5.1 (released 2006-09-21)
5379 ** Fix PKCS#1 verification to avoid a variant of Bleichenbacher's
5380 ** Crypto 06 rump session attack.
5381 In particular, we check that the digestAlgorithm.parameters field is
5382 missing or empty, to avoid that it can contain "garbage" that may be
5383 used to alter the numeric properties of the signature. See
5384 <http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html> (which is
5385 not exactly the same as the problem we fix here). Reported by Yutaka
5386 OIWA <y.oiwa@aist.go.jp>.
5388 See GNUTLS-SA-2006-4 on http://www.gnutls.org/security.html for more
5389 up to date information.
5391 ** Add self test to test for above flaw.
5393 ** Fix gnutls-cli-debug regarding resume support detection.
5394 Earlier, if the session-id from the server had a length of 0, it would
5395 indicate that the server supports resumption, which isn't the case.
5396 Reported by Kataja Kai <kai.kataja@op.fi>.
5398 ** Fix building of examples on FreeBSD by including netinet/in.h.
5399 Reported by Roman Bogorodskiy <novel@FreeBSD.org>.
5401 ** Fix certtool bug that caused the private key to not be loaded when
5402 generating a certificate with --load-request, which in turn triggered
5403 another unrelated bug in gnutls_x509_crt_sign2 (also fixed). Reported
5404 by Sascha Ziemann <sascha.ziemann@secunet.com>.
5406 ** gnutls-cli and gnutls-serv works on Windows.
5407 The problem was the select() call that doesn't work on file
5408 descriptors (stdin) on Windows. We borrowed some code from plibc to
5409 solve this. It appears to be somewhat unreliable though.
5411 ** Autoconf 2.60 is now used.
5413 ** API and ABI modifications:
5414 No changes since last version.
5416 * Version 1.5.0 (released 2006-08-13)
5418 ** Change SRP and Cert-Type extensions to match IANA registry.
5420 ** Fixed bug in OpenPGP authentication handshake.
5422 ** Improvements for building under MinGW.
5423 Provides internal inet_ntop and inet_pton functions and arpa/inet.h
5424 header. Calls WSAStartup and WSACleanup in gnutls_global_init and
5425 gnutls_global_deinit, respectively. Loads getaddrinfo and getnameinfo
5426 at run-time from ws2_32.dll, and falls back on a simple replacement if
5427 it is not available. Builds the library with -mms-bitfields
5428 -Wl,--enable-runtime-pseudo-reloc. Links with --output-def, to
5429 create *.def files, which are installed.
5431 ** The examples now (conditionally) include config.h and link to gnulib.
5432 No other source changes were necessary, so the examples should
5433 continue to be possible to use stand-alone without any autoconf or
5436 ** Added C++ header "gnutlsxx.h" and library "libgnutlsxx".
5437 You may unconditionally disable it with --disable-cxx. See
5438 includes/gnutls/gnutlsxx.h and lib/gnutlsxx.cpp for the
5441 ** Made command line tool '--version' behave according to GNU Standards.
5442 This enables 'make distcheck' to succeed.
5444 ** OpenCDK updated to 0.5.9 to fix some problems with OpenPGP support.
5446 ** Make --without-included-libtasn1 work.
5447 Reported by Daniel Black <dragonheart@gentoo.org>.
5449 ** Fix a crash (strcmp() on a NULL value) in the certificate verification logic.
5450 See http://www.gnu.org/software/gnutls/security.html regardging
5451 GNUTLS-SA-2006-2 for more up to date information. Reported by
5452 satyakumar <satyam_kkd@hyd.hellosoft.com>.
5454 ** API and ABI modifications:
5455 No changes since last version.
5457 * Version 1.4.5 (released 2006-11-06)
5459 ** When a GnuTLS server receive a SSLv2 Client Hello for an unknown TLS
5460 ** version, try to negotiate the highest version support by the GnuTLS server,
5461 ** instead of the lowest.
5462 Reported by <Pasi.Eronen@nokia.com>.
5464 ** Fix typo in doc/examples/ex-serv-pgp.c.
5465 Reported by Adam Langley" <agl@imperialviolet.org>.
5467 ** API and ABI modifications:
5468 No changes since last version.
5470 * Version 1.4.4 (released 2006-09-12)
5472 ** Relax the test that caught signatures that exploit the variant of
5473 ** Bleichenbacher's Crypto 06 rump session attack on our
5474 ** verification logic flaw.
5475 In particular, we now permit the digestAlgorithm.parameters field to
5476 be present but empty, whereas in 1.4.3 we actually checked that the
5479 ** Revert the removal of debug information for the GNUTLS-SA-2006-3 problem.
5480 The messages are only printed in debug mode, which is not recommended
5481 for normal use, and thus logging this situation cannot be abused as an
5482 oracle in typical recommended situations.
5484 ** API and ABI modifications:
5485 No changes since last version.
5487 * Version 1.4.3 (released 2006-09-08)
5489 ** Fix PKCS#1 verification to avoid a variant of Bleichenbacher's
5490 ** Crypto 06 rump session attack.
5491 In particular, we check that the digestAlgorithm.parameters field is
5492 empty, to avoid that it can contain "garbage" that may be used to
5493 alter the numeric properties of the signature. See
5494 <http://www.imc.org/ietf-openpgp/mail-archive/msg14307.html> (which is
5495 not exactly the same as the problem we fix here). Reported by Yutaka
5496 OIWA <y.oiwa@aist.go.jp>.
5498 See GNUTLS-SA-2006-4 on http://www.gnutls.org/security.html for more
5499 up to date information.
5501 ** Fix PKCS#1 decryption to avoid Bleichenbacher's Crypto 98 attack.
5502 See <http://www.bell-labs.com/user/bleichen/papers/pkcs.ps.gz>.
5503 Reported by Werner Koch <wk@gnupg.org>.
5505 See GNUTLS-SA-2006-3 on http://www.gnutls.org/security.html for more
5506 up to date information.
5508 ** Fix crash in gnutls_x509_crt_sign2 if passed a NULL issuer_key.
5510 ** API and ABI modifications:
5511 No changes since last version.
5513 * Version 1.4.2 (released 2006-08-12)
5515 ** Fix a crash (strcmp() on a NULL value) in the certificate verification logic.
5516 This can happen if you call gnutls_certificate_verify_peers2 and have
5517 a certain mix of local CA certificates and the peer send special
5518 certificates, that together trigger certain behaviour. It is not
5519 known at this point whether the crash can be triggered without the
5520 special local CA certificate, and thus turn this into a remote crash
5521 of clients that verify server certificates when they talk to a server
5522 with the special server certificate. See GNUTLS-SA-2006-2 on
5523 http://www.gnu.org/software/gnutls/security.html for more up to date
5524 information. Reported by satyakumar <satyam_kkd@hyd.hellosoft.com>.
5526 ** Change SRP and Cert-Type extensions to match IANA registry.
5528 ** OpenCDK updated to 0.5.9 to fix some problems with OpenPGP support.
5530 ** Make --without-included-libtasn1 work.
5531 Reported by Daniel Black <dragonheart@gentoo.org>.
5533 ** API and ABI modifications:
5534 No changes since last version.
5536 * Version 1.4.1 (released 2006-06-14)
5538 ** Replaced inactive ifdefs to enable openpgp support in test programs.
5540 ** Fixed bug in OpenPGP authentication handshake.
5542 ** Fixed typographical in man pages.
5544 ** Build fixes of the manual.
5546 ** Added Swedish translation.
5548 ** API and ABI modifications:
5549 No changes since last version.
5551 * Version 1.4.0 (released 2006-05-15)
5553 ** Remove GnuTLS 0.8.x compatibility functions.
5555 ** The libgcrypt RNG is initialized in gnutls_global_init().
5557 ** TLS/IA API changes from Emile van Bergen.
5558 A dummy credential structure is not needed now, if you wish to use the
5559 low-level TLS/IA API, simply call gnutls_ia_enable to enable TLS/IA on
5562 ** The self-tests are now run under valgrind, if it is installed.
5564 ** Libtasn1 is updated to 0.3.4, and that version is now required.
5566 ** The command line tools now use getaddrinfo and support IPv6.
5568 ** API and ABI modifications:
5569 _gnutls_x509_get_raw_crt_activation_time,
5570 _gnutls_x509_get_raw_crt_expiration_time: Removed.
5571 gnutls_ia_require_inner_phase: Removed, replaced by gnutls_ia_enable.
5572 gnutls_ia_enable: Added.
5574 * Version 1.3.5 (released 2006-03-08)
5576 ** Error messages are now translated using GNU Gettext.
5578 ** The function gnutls_x509_crt_to_xml now return an internal error.
5579 This means that the code to convert X.509 certificates to XML format
5580 does not work any more. The reason is that the function called
5581 libtasn1 internal functions. It seems unclean for libtasn1 to export
5582 the APIs needed here. Instead it would be better to implement XML
5583 support inside libtasn1 properly. If you need this functionality
5584 strongly, please consider looking into implementing this suggested
5585 approach instead. As a workaround, you may also modify lib/x509/xml.c
5586 (change '#if 1' to '#if 0') and build using --with-included-libtasn1.
5588 ** Libraries are now built with libtool's -no-undefined.
5589 This helps producing libraries for Windows using mingw32.
5591 ** Doc fixes to explain that gnutls_record_send can block.
5593 ** Libtasn1 0.3.1 or later is now required.
5594 The include copy has been updated too.
5596 ** gnutls-cli can now recognize services and port numbers with the -p option.
5598 ** API and ABI modifications:
5599 No changes since last version.
5601 * Version 1.3.4 (released 2006-02-09)
5603 ** Fix read of out bounds bug in DER parser.
5604 Reported by Evgeny Legerov <admin@gleg.net>, and debugging help from
5605 Protover SSL. Libtasn1 0.2.18 is now required, which contains the
5606 previous bug fix. The included libtasn1 version in GnuTLS has been
5609 ** Fixed bug in non-blocking gnutls_bye(). gnutls_record_send() will no
5610 longer invalidate a session if the underlying send fails, but it will
5611 prevent future writes. That is to allow reading the already received data.
5612 Patches and bug reports by Yoann Vandoorselaere <yoann@prelude-ids.org>
5614 ** Corrected bugs in gnutls_certificate_set_x509_crl() and
5615 gnutls_certificate_set_x509_trust(), that caused memory corruption if
5616 more than one certificates were added. Report and patch by Max Kellermann.
5618 ** Fix build problems of OpenCDK on AIX.
5619 Thanks to "Heiden, John" <JHeiden@UTNet.UToledo.Edu>.
5621 ** API and ABI modifications:
5622 No changes since last version.
5624 * Version 1.3.3 (released 2006-01-12)
5626 ** New API to access the TLS master secret.
5627 When possible, you should use the TLS PRF functions instead.
5628 Suggested by Jouni Malinen <jkmaline@cc.hut.fi>.
5630 ** Improved handling when multiple libraries use GnuTLS at the same time.
5631 Now gnutls_global_init() can be called multiple times, and
5632 gnutls_global_deinit() will only deallocate the structure when it has
5633 been called as many times as gnutls_global_init() was called.
5635 ** Added a self test of TLS resume functionality.
5637 ** Fix crash in TLS resume code, caused by TLS/IA changes.
5639 ** Documentation fixes about thread unsafety, prompted by
5640 ** discussion with bryanh@giraffe-data.com (Bryan Henderson).
5641 In particular, gnutls_global_init() and gnutls_global_deinit() are not
5642 thread safe. Careful callers may want to protect the call using a
5643 mutex. The problem could also be ignored, which would cause a memory
5644 leak under rare conditions when two threads invoke the function
5645 roughly at the same time.
5647 ** Add 'const' keywords in various places, from Frediano ZIGLIO.
5649 ** The code was indented again, including the external header files.
5651 ** API and ABI modifications:
5652 New functions to retrieve the master secret value:
5653 gnutls_session_get_master_secret
5655 Add a 'const' keyword to existing API:
5656 gnutls_x509_crq_get_challenge_password
5658 * Version 1.3.2 (released 2005-12-15)
5660 ** GnuTLS now support TLS Inner application (TLS/IA).
5661 This is per draft-funk-tls-inner-application-extension-01. This
5662 functionality is added to libgnutls-extra, so it is licensed under the
5663 GNU General Public License.
5665 ** New APIs to access the TLS Pseudo-Random-Function (PRF).
5666 The PRF is used by some protocols building on TLS, such as EAP-PEAP
5667 and EAP-TTLS. One function to access the raw PRF and one to access
5668 the PRF seeded with the client/server random fields are provided.
5669 Suggested by Jouni Malinen <jkmaline@cc.hut.fi>.
5671 ** New APIs to acceess the client and server random fields in a session.
5672 These fields can be useful by protocols using TLS. Note that these
5673 fields are typically used as input to the TLS PRF, and if this is your
5674 intended use, you should use the TLS PRF API that use the
5675 client/server random field directly. Suggested by Jouni Malinen
5676 <jkmaline@cc.hut.fi>.
5678 ** Internal type cleanups.
5679 The uint8, uint16, uint32 types have been replaced by uint8_t,
5680 uint16_t, uint32_t. Gnulib is used to guarantee the presence of
5681 correct types on platforms that lack them. The uint type have been
5682 replaced by unsigned.
5684 ** API and ABI modifications:
5685 New functions to invoke the TLS Pseudo-Random-Function (PRF):
5689 New functions to retrieve the session's client and server random values:
5690 gnutls_session_get_server_random
5691 gnutls_session_get_client_random
5693 New function, to perform TLS/IA handshake:
5696 New function to decide whether to do a TLS/IA handshake:
5697 gnutls_ia_handshake_p
5699 New functions to allocate a TLS/IA credential:
5700 gnutls_ia_allocate_client_credentials
5701 gnutls_ia_free_client_credentials
5702 gnutls_ia_allocate_server_credentials
5703 gnutls_ia_free_server_credentials
5705 New functions to handle the AVP callback:
5706 gnutls_ia_set_client_avp_function
5707 gnutls_ia_set_client_avp_ptr
5708 gnutls_ia_get_client_avp_ptr
5709 gnutls_ia_set_server_avp_function
5710 gnutls_ia_set_server_avp_ptr
5711 gnutls_ia_get_server_avp_ptr
5713 New functions, to toggle TLS/IA application phases:
5714 gnutls_ia_require_inner_phase
5716 New function to mix session keys with inner secret:
5717 gnutls_ia_permute_inner_secret
5719 Low-level API (used internally by gnutls_ia_handshake):
5720 gnutls_ia_endphase_send
5724 New functions that can be used after successful TLS/IA negotiation:
5725 gnutls_ia_generate_challenge
5726 gnutls_ia_extract_inner_secret
5728 Enum type with TLS/IA modes:
5731 Enum type with TLS/IA packet types:
5734 Enum values for TLS/IA alerts:
5735 GNUTLS_A_INNER_APPLICATION_FAILURE
5736 GNUTLS_A_INNER_APPLICATION_VERIFICATION
5738 New error codes, to signal when an application phase has finished:
5739 GNUTLS_E_WARNING_IA_IPHF_RECEIVED
5740 GNUTLS_E_WARNING_IA_FPHF_RECEIVED
5742 New error code to signal TLS/IA verify failure:
5743 GNUTLS_E_IA_VERIFY_FAILED
5745 * Version 1.3.1 (released 2005-12-08)
5747 ** Support for DHE-PSK cipher suites has been added.
5748 This method offers perfect forward secrecy.
5750 ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to
5751 Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>.
5753 ** Corrected a bug in certtool for 64 bit machines. Reported
5754 by Max Kellermann <max@duempel.org>.
5756 ** New function to set a X.509 private key and certificate pairs, and/or
5757 CRLs, from an PKCS#12 file, suggested by Emile van Bergen
5758 <emile@e-advies.nl>.
5760 The integrity of the PKCS#12 file is protected through a password
5761 based MAC; public-key based signatures for integrity protection are
5762 not supported. PKCS#12 bags may be encrypted using password derived
5763 symmetric keys, public-key based encryption is not supported. The
5764 PKCS#8 keys may be encrypted using passwords. The API use the same
5765 password for all operations. We believe that any more flexibility
5766 create too much complexity that would hurt overall security, but may
5767 add more PKCS#12 related APIs if real-world experience indicate
5770 ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys,
5771 reported by Emile van Bergen <emile@e-advies.nl>.
5772 This will enable "certtool -k -8" to parse those keys.
5774 ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords.
5775 Use "certtool -p -8" and press press enter at the prompt. Earlier,
5776 certtool would have encrypted the key using an empty password.
5778 ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys.
5779 Earlier it would have prompted the user for it, even if --password was
5782 ** Added self test of PKCS#8 parsing.
5783 Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and
5784 pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in
5787 ** API and ABI modifications:
5788 New function to set X.509 credentials from a PKCS#12 file:
5789 gnutls_certificate_set_x509_simple_pkcs12_file
5791 New gnutls_kx_algorithm_t enum type:
5794 New API to return session data (basically same as gnutls_session_get_data):
5795 gnutls_session_get_data2
5797 New API to set PSK Diffie-Hellman parameters:
5798 gnutls_psk_set_server_dh_params
5800 * Version 1.3.0 (2005-11-15)
5802 ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added.
5803 This add several new APIs, see below. Read the updated manual for
5804 more information. A new self test "pskself" has been added, that will
5805 test this functionality.
5807 ** The session resumption data are now system independent.
5809 ** The code has been re-indented to conform to the GNU coding style.
5811 ** Removed the RIPEMD ciphersuites.
5813 ** Added a discussion of the internals of gnutls in manual.
5815 ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin.
5817 ** Remove trailing comma in enums, for IBM C v6, from Albert Chin.
5819 ** Make sure config.h is included first in a few files, from Albert Chin.
5821 ** Don't use C++ comments ("//") as they are invalid, from Albert Chin.
5823 ** Don't install SRP programs and man pages if --disable-srp-authentication,
5826 ** API and ABI modifications:
5827 New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK
5829 New gnutls_credentials_type_t credential type:
5832 New credential types:
5833 gnutls_psk_server_credentials_t
5834 gnutls_psk_client_credentials_t
5836 New functions to allocate PSK credentials:
5837 gnutls_psk_allocate_client_credentials
5838 gnutls_psk_free_client_credentials
5839 gnutls_psk_free_server_credentials
5840 gnutls_psk_allocate_server_credentials
5842 New enum type for PSK key flags:
5843 gnutls_psk_key_flags
5845 New function prototypes for credential callback:
5846 gnutls_psk_client_credentials_function
5847 gnutls_psk_server_credentials_function
5849 New function to set PSK username and key:
5850 gnutls_psk_set_client_credentials
5852 New function to set PSK passwd file:
5853 gnutls_psk_set_server_credentials_file
5855 New function to extract PSK user in server:
5856 gnutls_psk_server_get_username
5858 New functions to set PSK callback:
5859 gnutls_psk_set_server_credentials_function
5860 gnutls_psk_set_client_credentials_function
5862 Use size_t instead of int for output size parameter:
5863 gnutls_srp_base64_encode
5864 gnutls_srp_base64_decode
5866 * Version 1.2.11 (2006-05-11)
5867 - The function gnutls_x509_crt_to_xml is not supported any more, and
5868 return an internal error. The reason is that the function called
5869 internal libtasn1 functions which are no longer exported from
5871 - Updated libtasn1 requirement to 0.3.4 and refreshed internal mintiasn1.
5872 - Updated gnulib compatibility files.
5873 - Fixed _gnutls_x509_get_raw_crt_expiration_time and
5874 _gnutls_x509_get_raw_crt_activation_time to return (time_t)-1 on errors.
5875 - API and ABI modifications:
5876 No changes since last version.
5878 * Version 1.2.10 (2006-02-09)
5879 - Fix read out bounds bug in DER parser. Reported by Evgeny Legerov
5880 <admin@gleg.net>, and debugging help from Protover SSL.
5881 - Libtasn1 0.2.18 is now required (contains the previous bug fix).
5882 The included version has been updated too.
5883 - Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to
5884 Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>.
5885 - Corrected a bug in certtool for 64 bit machines. Reported
5886 by Max Kellermann <max@duempel.org>.
5887 - Corrected bugs in gnutls_certificate_set_x509_crl() and
5888 gnutls_certificate_set_x509_trust(), that caused memory corruption if
5889 more than one certificates were added. Report and patch by Max Kellermann.
5890 - Fixed bug in non-blocking gnutls_bye(). gnutls_record_send() will no
5891 longer invalidate a session if the underlying send fails, but it will
5892 prevent future writes. That is to allow reading the already received data.
5893 Patches and bug reports by Yoann Vandoorselaere <yoann@prelude-ids.org>
5895 * Version 1.2.9 (2005-11-07)
5896 - Documentation was updated and improved.
5897 - RSA-MD2 is now supported for verifying digital signatures.
5898 - Due to cryptographic advances, verifying untrusted X.509
5899 certificates signed with RSA-MD2 or RSA-MD5 will now fail with a
5900 GNUTLS_CERT_INSECURE_ALGORITHM verification output. For
5901 applications that must remain interoperable, you can use the
5902 GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2 or GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5
5903 flags when verifying certificates. Naturally, this is not
5904 recommended default behaviour for applications. To enable the
5905 broken algorithms, call gnutls_certificate_set_verify_flags with the
5906 proper flag, to change the verification mode used by
5907 gnutls_certificate_verify_peers2.
5908 - Make it possible to send empty data through gnutls_record_send,
5909 to align with the send(2) API.
5910 - Some changes in the certificate receiving part of handshake to prevent
5911 some possible errors with non-blocking servers.
5912 - Added numeric version symbols to permit simple CPP-based feature
5913 tests, suggested by Daniel Stenberg <daniel@haxx.se>.
5914 - The (experimental) low-level crypto alternative to libgcrypt used
5915 earlier (Nettle) has been replaced with crypto code from gnulib.
5916 This leads to easier re-use of these components in other projects,
5917 leading to more review and simpler maintenance. The new configure
5918 parameter --with-builtin-crypto replace the old --with-nettle, and
5919 must be used if you wish to enable this functionality. See README
5920 under "Experimental" for more information. Internally, GnuTLS has
5921 been updated to use the new "Generic Crypto" API in gl/gc.h. The
5922 API is similar to the old crypto/gc.h, because the gnulib code were
5923 based on GnuTLS's gc.h.
5924 - Fix compiler warning in the "anonself" self test.
5925 - API and ABI modifications:
5926 gnutls_x509_crt_list_verify: Added 'const' to prototype in <gnutls/x509.h>.
5927 This doesn't reflect a change in behaviour,
5928 so we don't break backwards compatibility.
5929 GNUTLS_MAC_MD2: New gnutls_mac_algorithm_t value.
5930 GNUTLS_DIG_MD2: New gnutls_digest_algorithm_t value.
5931 GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD2,
5932 GNUTLS_VERIFY_ALLOW_SIGN_RSA_MD5: New gnutls_certificate_verify_flags values.
5934 gnutls_x509_crt_list_verify,
5935 gnutls_x509_crt_verify, or
5936 gnutls_certificate_set_verify_flags.
5937 GNUTLS_CERT_INSECURE_ALGORITHM: New gnutls_certificate_status_t value,
5938 used when broken signature algorithms
5939 is used (currently RSA-MD2/MD5).
5940 LIBGNUTLS_VERSION_MAJOR,
5941 LIBGNUTLS_VERSION_MINOR,
5942 LIBGNUTLS_VERSION_PATCH,
5943 LIBGNUTLS_VERSION_NUMBER: New CPP symbols, indicating the GnuTLS
5944 version number, can be used for feature existence
5947 * Version 1.2.8 (2005-10-07)
5948 - Libgcrypt 1.2.2 is required to fix a bug for forking GnuTLS servers.
5949 - Don't install the auxilliary libexamples library used by the
5950 examples in doc/examples/ on "make install", report and tiny patch
5951 from Thomas Klausner <tk@giga.or.at>.
5952 - If you pass a X.509 CA or PGP trust database to the command line
5953 tool, it will now abort the connection if the server certificate
5954 validation fails. Use the parameter --insecure to continue even
5955 after certificate validation failures. Inspired from discussion
5956 with Alexander Kotelnikov <sacha@myxomop.com>.
5957 - The test for socklen_t has been moved to gnulib.
5958 - Link failures for duplicate or missing "program_name" symbol has been fixed,
5959 patch from Martin Lambers <marlam@marlam.de>.
5960 - The command line tool and the examples no longer uses mmap or bzero,
5961 to make them more portable, patch from Martin Lambers
5963 - Made the PKCS #12 API handle null passwords. Based on patch by
5964 Anton Altaparmakov <aia21@cam.ac.uk>.
5965 - The GTK-DOC manual should build with current released tools.
5966 (But a copy of the output is included, so the tools are not required.)
5967 - The inet_ntop function is now used through gnulib.
5968 - API and ABI modifications:
5969 No changes since last version.
5971 * Version 1.2.7 (2005-09-09)
5972 - The GnuTLS and GnuTLS-extra libraries are now built with versioned symbols.
5973 - Certtool now complains when reading out-of-range X.509 serial
5974 numbers, suggested by Fran <e_agf@yahoo.es>.
5975 - Certtool now uses the readline library (when available) when reading
5976 X.509 serial numbers.
5977 - Fixed build problems in getpass on uClibc and Mingw32 platforms.
5978 - Fixed compile warning regarding socklen_t on Mingw32, reported by
5979 Martin Lambers <marlam@marlam.de>.
5980 - Fixed examples in doc/examples/, suggested by Fran <e_agf@yahoo.es>.
5981 - Gnulib is now used for the core library, enabling future code cleanups.
5982 - The gnutls-cli tool now use gnutls_certificate_verify_peers2,
5983 suggested by Daniel Stenberg <daniel@haxx.se>.
5984 - Doc fixes for gnutls_transport_set_push and gnutls_transport_set_pull.
5985 - Minilibtasn1 is now 0.2.17 (removed optional use of C99 macros).
5986 - Disable zlib support if zlib.h is not present.
5987 - A number of internal cleanups.
5988 - API and ABI modifications:
5989 No changes since last version.
5991 * Version 1.2.6 (2005-07-16)
5992 - MiniLZO updated to version 2.01 and moved to separate directory.
5993 - Collision between system LZO header files and MiniLZO header file
5994 fixed, reported by Matthias Urlichs <smurf@smurf.noris.de>.
5995 - Will now test for liblzo functionality in liblzo2 too, reported by
5996 Thomas Klausner <tk@giga.or.at>.
5997 - Minilibtasn1 is now 0.2.14 (no code changes).
5998 - Some code changes to avoid GTK-DOC warnings.
5999 - API and ABI modifications:
6000 No changes since last version.
6002 * Version 1.2.5 (2005-07-03)
6003 - More builddir != srcdir fixes, reported by Mike Castle
6004 <dalgoda@ix.netcom.com>.
6005 - Fixed off-by-one bug in the size parameter of gnutls_x509_crt_get*_dn,
6006 reported by Adam Langley <alangley@gmail.com>.
6007 - Corrected some stuff in minilzo detection. Pointed out by
6009 - MiniLZO updated to version 2.00.
6010 - gnutls_x509_crt_list_import now accept a DER formatted CRL.
6011 - API and ABI modifications:
6012 No changes since last version.
6014 * Version 1.2.4 (2005-05-28)
6015 - Corrected some bugs that could affect 64 bit systems.
6016 - Some corrections in the header files to include the prototype
6017 of memmem properly (affected 64 bit systems). Report and patch
6018 by Yoann Vandoorselaere <yoann@prelude-ids.org>.
6019 - Introduced the --fix-key option to certtool, which can be used to
6020 regenerate the (optional) parameters in a private key. It should
6021 be used together with --key-info.
6022 - Corrected a bug in certificate chain verification that could lead
6023 to marking a trusted chain as non trusted, if the last certificate in
6024 the chain was a self signed one.
6025 - Gnulib portability files were updated.
6026 - License were updated to reflect new FSF address.
6027 - API and ABI modifications:
6028 No changes since last version.
6030 * Version 1.2.3 (2005-04-28)
6031 - Corrected bug in record packet parsing that could lead
6032 to a denial of service attack.
6033 - Corrected bug in RSA key export. Previously exported keys
6034 can be fixed using certtool. Use certtool -k <infile >outfile
6035 - API and ABI modifications:
6036 gnutls_x509_privkey_fix(): Add.
6038 * Version 1.2.2 (2005-04-25)
6039 - gnutls_error_to_alert() now considers
6040 GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET.
6041 - Fixed error in session resuming that could cause a crash in a session.
6042 - Fixed pkcs12 friendly name and local key identifier decoding.
6043 - Internal cleanups, removed duplicate typedef/struct definitions,
6044 and made source code include external include file, to check
6045 function prototypes during compile time.
6046 - API and ABI modifications:
6047 No changes since last version. At least not intentional, but due
6048 to the include header changes, there may be inadvertant changes,
6049 please let us know if you find any.
6051 * Version 1.2.1 (2005-04-04)
6052 - gnutls_bye() will no longer fail when RDWR is used and application
6053 data are available for reading.
6054 - Added more strict checks for the SRP parameters (g,n), when they
6055 are not in the included list.
6056 - Added warning to certtool when MD5 is being used for digital
6058 - Optimizations ("-O2 -finline-functions") are not enabled by default,
6059 instead the standard autoconf defaults are used. Use `./configure
6060 CFLAGS="-O2 -finline-functions"' to get the old optimizations.
6061 - Added the option --get-dh-params to certtool, in order to get the
6062 parameters included in the library primes and generators.
6063 - Improved the semantics of GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, to
6064 allow only trusted Version 1 CAs and introduced
6065 GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT which has the old semantics.
6066 - Nettle self tests now build properly, reported by Pierre
6067 <pierre42d@9online.fr>.
6068 - Eliminated some memory leaks in DHE and RSA-EXPORT cipher suites.
6069 Reported by Yoann Vandoorselaere <yoann@prelude-ids.org>.
6070 - If the library has been compiled with features disabled, a warning is
6071 issued during the compilation of any program.
6072 - API and ABI modifications:
6073 gnutls_x509_crt_list_import(): Add
6074 gnutls_x509_crq_get_attribute_by_oid(): Add.
6075 gnutls_x509_crq_set_attribute_by_oid(): Add
6076 gnutls_x509_crt_set_extension_by_oid(): Add.
6077 GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT: Modify semantics.
6078 GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT: Add, old behaviour.
6080 * Version 1.2.0 (2005-01-27)
6081 - Added the definitions and OIDs for the RIPEMD-160 hash algorithm.
6082 - Introduced gnutls_x509_crt_sign2(), gnutls_x509_crq_sign2() and
6083 gnutls_x509_crl_sign2().
6084 - Fixed license header in source code files.
6086 * Version 1.1.23 (2005-01-18)
6087 - It is now possible to generate PKCS#12 structures without private
6088 keys using "certtool --to-p12", suggested by Fabian Fagerholm
6090 - Certtool now prints information for the RSA and DSA parameters of
6091 certificates and private keys.
6092 - Corrected the write of CRL distribution points.
6093 - The certificate chain verification function now checks certificates
6094 in the reverse order to minimize the spent resources.
6095 - Corrected several bugs found by Marcin Garski <mgarski@post.pl>
6096 - The functions gnutls_x509_crl_get_issuer_dn, gnutls_x509_crq_get_dn,
6097 gnutls_x509_crt_get_issuer_dn, gnutls_x509_crt_get_dn, and
6098 gnutls_x509_rdn_get now set *sizeof_buf to the buffer length that is
6099 required, instead of the string length. That is, the value has been
6100 incremented by 1 to account for the terminating zero. Reported by
6101 Martin Lambers <marlam@web.de>.
6102 - Debug output shouldn't crash on platforms that doesn't handle NULL
6103 printf %s values. Reported by Michael.Ringe@aachen.utimaco.de.
6104 - Sync included copy of libtasn1 with version 0.2.13.
6105 - Client X.509 authenticated connections via gnutls-cli should now work again.
6107 * Version 1.1.22 (2004-11-04)
6108 - Replace GNU LD version script with Libtool -export-symbols-regex,
6109 from Joe Orton <joe@manyfish.co.uk>.
6110 - Documentation improvements.
6111 - Code indented using 'indent -i4 -kr'.
6112 - The API manual is included in Devhelp format. (Was in last release too,
6113 but the NEWS entry was forgotten.)
6114 - The OpenSSL compatibility code now use the internal crypto interface.
6115 - Added simple self test of OpenSSL compatibility library.
6116 - Internally, libtool convenience libraries are used.
6117 - Cleanups to configure.ac.
6119 * Version 1.1.21 (2004-10-27)
6120 - Print DN of certificates with unknown characters in them, but in hexform
6122 - Added second precision to the X.509 parsing and generation functions.
6123 - Corrected bug in _gnutls_x509_get_dn_oid(), and returns the
6125 - Add parameter --la-file to libgnutls-config and libgnutls-extra-config,
6126 tiny patch contributed by Joe Orton <joe@manyfish.co.uk>.
6127 - Add pkg-config meta files, suggested by Stéphane LOEUILLET
6128 <stephane.loeuillet@tiscali.fr>.
6129 - Fix memory initializaion bug in gnutls_certificate_set_x509_trust,
6130 tiny patch by Aleix Conchillo Flaque <aleix@member.fsf.org>.
6131 - Add self test of PKCS#12 functionality in "certtool", based on test
6132 vectors from Joe Orton <joe@manyfish.co.uk>.
6133 - Fix library order in libgnutls*-config --libs output, to permit
6134 static linking, reported by Yoann Vandoorselaere
6135 <yoann@prelude-ids.org>.
6137 * Version 1.1.20 (2004-10-12)
6138 - Fix compile problem in gl/getpass.c on some systems.
6140 * Version 1.1.19 (2004-10-07)
6141 - Fix memory leak in gnutls_certificate_verify_peers and
6142 gnutls_certificate_free_credentials, report and patch by Simon
6143 Posnjak <simon.posnjak@cetrtapot.si>.
6144 - Fix crash in `certtool --to-p12 --load-privkey foo', i.e. exporting
6145 a key and no certificate to PKCS#12.
6146 - Fix objdir != srcdir builds, reported by "Gerrit P. Haase"
6147 <gp@familiehaase.de>.
6148 - Fixes faulty getpass implementation in libextra/opencdk/, reported
6149 by Yoann Vandoorselaere <yoann@prelude-ids.org>.
6150 - Uses memmem instead of strnstr in lib/.
6151 - Using more GNULib portability files, although not yet inside lib/.
6152 - Added gnutls_certificate_verify_peers to gnutls/compat.h.
6153 Nikos deprecated gnutls_certificate_verify_peers in favor of
6154 gnutls_certificate_verify_peers2 earlier in the 1.1 branch.
6155 - Improvements to the manual.
6156 - Add new example "ex-rfc2818" for certificate verification, from Nikos.
6157 - Known bug: the library require snprintf. This has not yet been
6158 fixed, but will be handled via GNULib later on.
6160 * Version 1.1.18 (2004-08-24)
6161 - Corrected handling of certificate with dates after year 2038.
6162 - Corrected DER decoder which could incorrectly treat input as BER and fail.
6163 - Correct certtool --smime-to-p7 end of line character handling.
6164 - Added example client and server for anonymous authentication.
6165 - Added self test that tests anonymous TLS client and server.
6166 - Added self tests of Nettle and generic crypto layer.
6167 - Added API reference manual in HTML format in doc/reference/ using GTK-DOC.
6168 Online version at <http://www.gnu.org/software/gnutls/reference/>.
6169 - Assume C89 or better; removed checks for size_t, ptrdiff_t and time_t.
6170 - Man pages for API functions are included.
6172 * Version 1.1.17 (2004-08-18)
6173 - Bug fix of padding string in RSA PKCS#1 v1.5 type 2 encryption,
6174 reported by Robey Pointer <robey@danger.com>.
6175 - Generic crypto interface for secret key ciphers, hashes and randomness added.
6176 See section "Experimental" within section "COMPILATION ISSUES" in README.
6177 - Removed length limit on passwords read by 'certtool'.
6178 - Documentation fixes.
6180 * Version 1.1.16 (2004-08-15)
6181 - Fix missing gnulib linker parameter when building certtool.
6182 - Add gnulib module 'progname', needed by module 'error'.
6183 - Improve building with srcdir != objdir.
6185 * Version 1.1.15 (2004-08-15)
6186 - Certtool has simplistic --smime-to-p7 to translate RFC 2633 messages into
6188 - Ported to Mac OS X / Darwin.
6189 - Ported to FreeBSD.
6191 * Version 1.1.14 (2004-08-09)
6192 - Documentation converted to Texinfo format.
6193 - Bug fix of test suite.
6194 - Configure now print build information, used by Autobuild.
6196 * Version 1.1.13 (2004-08-05)
6197 - Added simple self test suite.
6199 * Version 1.1.12 (2004-08-02)
6200 - Updated the SRP authentication to conform to the
6201 latest (yet unreleased) draft. Unfortunately this breaks
6202 compatibility with previous versions.
6203 - Changed the makefiles to be more portable.
6204 - SRP ciphersuites were moved to the gnutls library.
6205 - Added some default limits in the verification of certificate
6206 chains, to avoid denial of service attacks. Also added
6207 gnutls_certificate_set_verify_limits() to override them.
6208 Issue pointed out by Patrik Hornik <patrik@hornik.sk>.
6209 - Added gnutls_certificate_verify_peers2().
6211 * Version 1.1.11 (2004-07-16)
6212 - Added the '_t' suffix to all exported symbols.
6213 - Fixed bug in RSA encryption, report and patch by Martijn Koster
6214 <mak@greenhills.co.uk>.
6215 - Corrected a bug in certificate verification. Pointed out by
6216 Yoann Vandoorselaere <yoann@prelude-ids.org>
6217 - Added the GNUTLS_VERIFY_DO_NOT_ALLOW_SAME flags to the
6218 verification functions.
6219 - The ephemeral DH and RSA parameters are no longer stored in the
6221 - Do not free the SRP (prime and generator) parameters obtained from the
6222 callback if they are the static ones defined in extra.h
6223 - Eliminated some memory leaks. Reported by Yoann Vandoorselaere.
6225 * Version 1.1.10 (2004-06-12)
6226 - Added gnutls_sign_algorithm_get_name() and gnutls_pk_algorithm_get_name()
6227 - Corrected bug in TLS renegotiation.
6228 - Corrected bug in OpenPGP key loading using a callback.
6229 - gnutls-srpcrypt was renamed to srptool
6230 - Allow handshake requests by the client.
6231 - Automatically disable certificate types that do not have corresponding
6233 - Added gnutls_auth_client_get_type() and gnutls_auth_server_get_type()
6234 - Opencdk library is being included if not found.
6235 - certtool can now add ip address SAN extension.
6236 - certtool has now support for more X.520 DN attribute types.
6237 - Better handling of EOF in gnutls_record_recv().
6238 - _gnutls_deinit() is no longer used. Sessions are not
6239 automatically removed any more, on abnormal termination.
6240 - Corrected session resuming in SRP ciphersuites.
6241 - Updated to conform to the latest srp draft (draft-ietf-tls-srp-07)
6242 - Added new functions to allow access to the ephemeral
6243 Diffie Hellman parameters.
6244 - Added the functions gnutls_x509_crt_get_pk_rsa_raw() and
6245 gnutls_x509_crt_get_pk_dsa_raw() to retrieve parameters from certificates.
6246 - Added the functions gnutls_dh_get_group(), gnutls_dh_get_pubkey() and
6247 gnutls_rsa_export_get_pubkey() to retrieve parameters of the DH or
6248 RSA-EXPORT key exchange.
6249 - Some fixes in the session resuming code.
6250 - Added gnutls_openpgp_keyring_check_id().
6252 * Version 1.1.9 (2004-04-14)
6253 - Added support for authority key identifier and the extended key usage
6254 X.509 extension fields. The certtoool was updated to support them.
6255 - The RC2 cipher is no more included. The one in libgcrypt is now used.
6256 - Added batch support to certtool. Now it can use templates.
6258 * Version 1.1.8 (2004-04-07)
6259 - Implemented all the tests for the SRP group parameters in
6260 client side. This may lead to incompatibility with very
6262 - Corrected bug in RSA parameters handling which could cause
6264 - Optimized the copying of rsa_params.
6266 * Version 1.1.7 (2004-03-29)
6267 - Added gnutls_certificate_set_params_function() and
6268 gnutls_anon_set_params_function() that set the RSA or DH
6269 parameters using a callback.
6270 - Added functions gnutls_rsa_params_cpy(), gnutls_dh_params_cpy()
6271 and gnutls_x509_privkey_cpy().
6272 - Corrected a compilation issue when opencdk was installed in a
6273 non standard directory.
6274 - Deprecated: gnutls_srp_server_set_select_function(),
6275 gnutls_certificate_client_set_select_function(), gnutls_srp_server_set_select_function().
6277 * Version 1.1.6 (2004-02-24)
6278 - Several bug fixes, by Arne Thomassen.
6279 - Fixed a bug where 'server name' extension was always sent.
6281 * Version 1.1.5 (2004-01-06)
6282 - Added the gnutls_sign_algorithm type.
6284 * Version 1.1.4 (2004-01-04)
6285 - Improved gnutls-cli's SRP behaviour in SRP ciphersuites.
6286 If they are of highest priority then the abbreviated handshake
6288 - Removed all references of missing files.
6289 - Changed handshake behaviour to send the lowest TLS version
6290 when an unsupported version was advertized. The current behaviour
6291 is to send the maximum version we support.
6292 - Corrected problem printing the DC attributes in a DN.
6294 * Version 1.1.3 (2003-12-30)
6295 - Implemented TLS 1.1 (and also obsoleted the TLS 1.0 CBC protection
6298 * Version 1.1.2 (2003-12-28)
6299 - Added CRL verification functionality to certtool.
6300 - Corrected the CRL distribution point extension handling.
6302 * Version 1.1.1 (2003-12-26)
6303 - Added PKCS #7 support to certtool utility.
6304 - Added support for reading and generating CRL distribution
6305 points extensions in certificates.
6306 - Added support for generating CRLs in the library and the
6308 - Added support for the Subject Key ID PKIX extension.
6310 * Version 1.1.0 (2003-12-21)
6311 - The error codes GNUTLS_E_NO_TEMPORARY_DH_PARAMS and GNUTLS_E_NO_TEMPORARY_RSA_PARAMS
6312 are no longer returned by the handshake function. Ciphersuites that
6313 require temporary parameters are removed when such parameters do not exist.
6314 - Added the callbacks gnutls_certificate_client_retrieve_function() and
6315 gnutls_certificate_server_retrieve_function(), to allow a client or a server
6316 to specify certificates for the handshake without storing them to the
6317 credentials structure.
6318 - Added support for generating and exporting DSA private keys.
6319 - Added gnutls_x509_crt_set_key_usage() and certtool can now set the
6320 certificate's key usage.
6321 - Added gnutls_openpgp_key_get_key_usage().
6323 * Version 1.0.25 (2005-04-27)
6324 - Corrected bug in record packet parsing that could lead
6325 to a denial of service attack.
6326 - Corrected bug in RSA key export.
6328 * Version 1.0.24 (2005-01-18)
6329 - Corrected several bugs found by Marcin Garski <mgarski@post.pl>
6331 * Version 1.0.23 (2004-11-13)
6332 - Replace GNU LD version script with Libtool -export-symbols-regex,
6333 from Joe Orton <joe@manyfish.co.uk>.
6334 - Copy libtasn1 has been updated to version 0.2.11.
6335 - Corrected the write of CRL distribution points.
6336 - It is now possible to generate PKCS#12 structures without private
6337 keys using "certtool --to-p12", suggested by Fabian Fagerholm
6340 * Version 1.0.22 (2004-10-28)
6341 - Print DN of certificates with unknown characters in them, but in hexform
6343 - Corrected bug in _gnutls_x509_get_dn_oid(), and returns the
6345 - Added second precision to the X.509 parsing functions.
6346 - Add parameter --la-file to libgnutls-config and libgnutls-extra-config,
6347 tiny patch contributed by Joe Orton <joe@manyfish.co.uk>.
6348 - Add pkg-config meta files, suggested by Stéphane LOEUILLET
6349 <stephane.loeuillet@tiscali.fr>.
6350 - Fix memory initializaion bug in gnutls_certificate_set_x509_trust,
6351 tiny patch by Aleix Conchillo Flaque <aleix@member.fsf.org>.
6352 - Fix certtool --password for PKCS #12, back ported from 1.1.x branch.
6353 - Fix library order in libgnutls*-config --libs output, to permit
6354 static linking, reported by Yoann Vandoorselaere
6355 <yoann@prelude-ids.org>.
6357 * Version 1.0.21 (2004-10-07)
6358 - Fix memory leak in gnutls_certificate_verify_peers and
6359 gnutls_certificate_free_credentials, report and patch by Simon
6360 Posnjak <simon.posnjak@cetrtapot.si>.
6361 - Fix crash in `certtool --to-p12 --load-privkey foo', i.e. exporting
6362 a key and no certificate to PKCS#12.
6363 - Fix objdir != srcdir builds, reported by "Gerrit P. Haase"
6364 <gp@familiehaase.de>.
6365 - Avoid redefining getpass if system already has it, reported by
6366 Yoann Vandoorselaere <yoann@prelude-ids.org>.
6367 - Add new example "ex-rfc2818" for certificate verification, from Nikos.
6368 - Known bug: the library require snprintf.
6370 * Version 1.0.20 (2004-08-18)
6371 - Bug fix of padding string in RSA PKCS#1 v1.5 type 2 encryption,
6372 reported by Robey Pointer <robey@danger.com>.
6374 * Version 1.0.19 (2004-08-09)
6375 - Bug fix of test suite.
6377 * Version 1.0.18 (2004-08-05)
6378 - Added simple self test suite.
6380 * Version 1.0.17 (2004-08-02)
6381 - Updated the SRP authentication to conform to the
6382 latest (yet unreleased) draft. Unfortunately this breaks
6383 compatibility with previous versions.
6384 - Changed the makefiles to be more portable.
6385 - Added some default limits in the verification of certificate
6386 chains, to avoid denial of service attacks. Also added
6387 gnutls_certificate_set_verify_limits() to override them.
6388 Issue pointed out by Patrik Hornik <patrik@hornik.sk>.
6389 - Added gnutls_certificate_verify_peers2().
6391 * Version 1.0.16 (2004-07-10)
6392 - Do not free the SRP (prime and generator) parameters obtained from the
6393 callback if they are the static ones defined in extra.h.
6394 - Eliminated some memory leaks. Reported by Yoann Vandoorselaere.
6395 - Some fixes in the makefiles.
6397 * Version 1.0.15 (2004-06-29)
6398 - Fixed bug in RSA encryption, report and patch by Martijn Koster
6399 <mak@greenhills.co.uk>.
6400 - Corrected a bug in certificate verification. Pointed out by
6401 Yoann Vandoorselaere <yoann@prelude-ids.org>.
6403 * Version 1.0.14 (2004-06-12)
6404 - Automatically disable certificate types that do not have corresponding
6406 - Updates in the documentation.
6407 - certtool can now add ip address SAN extension.
6408 - certtool has now support for more X.520 DN attribute types.
6409 - Opencdk library is being included if not found.
6410 - Added gnutls_openpgp_keyring_check_id().
6411 - Corrected a serious bug in the included libtasn1 library.
6412 - Corrected session resuming in SRP ciphersuites.
6413 - Updated to conform to the latest srp draft (draft-ietf-tls-srp-07)
6414 - Added the functions gnutls_x509_crt_get_pk_rsa_raw() and
6415 gnutls_x509_crt_get_pk_dsa_raw() to retrieve parameters from certificates.
6416 - Some fixes in the session resuming code.
6418 * Version 1.0.13 (2004-04-29)
6419 - Some complilation fixes.
6420 - Added the --xml parameter to the certtool utility.
6422 * Version 1.0.12 (2004-04-23)
6423 - Corrected bug in OpenPGP key loading using a callback.
6424 - Renamed gnutls-srpcrypt to srptool
6425 - Allow handshake requests by the client.
6426 * Things backported from the development branch:
6427 - Added support for authority key identifier and the extended key usage
6428 X.509 extension fields. The certtoool was updated to support them.
6429 - Added batch support to certtool. Now it can use templates.
6430 - The RC2 cipher is no more included. The one in libgcrypt is now used.
6432 * Version 1.0.11 (2004-04-17)
6433 - Added gnutls_sign_algorithm_get_name() and gnutls_pk_algorithm_get_name()
6434 - Corrected bug in TLS renegotiation.
6436 * Version 1.0.10 (2004-04-03)
6437 - Corrected bug in RSA parameters handling which could cause
6439 - Corrected bug in SSL 3.0 authentication.
6441 * Version 1.0.9 (2004-03-29)
6442 - Added gnutls_certificate_set_params_function() and
6443 gnutls_anon_set_params_function() that set the RSA or DH
6444 parameters using a callback.
6445 - Added functions gnutls_rsa_params_cpy(), gnutls_dh_params_cpy()
6446 and gnutls_x509_privkey_cpy().
6447 - Corrected a compilation issue when opencdk was installed in a
6448 non standard directory.
6449 - Documented the changes need in multi-threaded application due
6450 to the new libgcrypt.
6452 * Version 1.0.8 (2004-02-28)
6453 - Corrected bug in mutual certificate authentication in SSL 3.0.
6455 * Version 1.0.7 (2004-02-25)
6456 - Implemented TLS 1.1 (and also obsoleted the TLS 1.0 CBC protection
6458 - Some updates in the documentation.
6460 * Version 1.0.6 (2004-02-12)
6461 * Backported things from the development branch (while maintaining
6462 backwards compatibility):
6463 - Improved gnutls-cli's SRP behaviour in SRP ciphersuites.
6464 If they are of highest priority then the abbreviated handshake
6466 - The error codes GNUTLS_E_NO_TEMPORARY_DH_PARAMS and GNUTLS_E_NO_TEMPORARY_RSA_PARAMS
6467 are no longer returned by the handshake function. Ciphersuites that
6468 require temporary parameters are removed when such parameters do not exist.
6469 - Added the callbacks gnutls_certificate_client_retrieve_function() and
6470 gnutls_certificate_server_retrieve_function(), to allow a client or a server
6471 to specify certificates for the handshake without storing them to the
6472 credentials structure.
6473 - Added support for generating and exporting DSA private keys.
6475 * Version 1.0.5 (2004-02-11)
6476 - Fixed a bug where 'server name' extension was always sent.
6477 * Backported things from the development branch:
6478 - Added CRL verification functionality to certtool.
6479 - Corrected the CRL distribution point extension handling.
6480 - Added PKCS #7 support to certtool utility.
6481 - Added support for reading and generating CRL distribution
6482 points extensions in certificates.
6483 - Added support for generating CRLs in the library and the
6485 - Added support for the Subject Key ID PKIX extension.
6486 - Added the gnutls_sign_algorithm type.
6488 * Version 1.0.4 (2004-01-04)
6489 - Changed handshake behaviour to send the lowest TLS version
6490 when an unsupported version was advertized. The current behaviour
6491 is to send the maximum version we support.
6492 - certtool no longer asks the password in unencrypted private
6494 - The source is now compiled to use the reentrant libc functions.
6496 * Version 1.0.3 (2003-12-21)
6497 - Corrected bug in gnutls_bye() which made it return an error code
6498 of INVALID_REQUEST instead of success.
6499 - Corrected a bug in the GNUTLS_KEY key usage definitions.
6501 * Version 1.0.2 (2003-12-18)
6502 - Corrected a bug in the RSA key generation. This was
6503 generating unusable RSA keys.
6505 * Version 1.0.1 (2003-12-10)
6506 - Some minor fixes in the makefiles. They now include CFLAGS
6507 from libgcrypt or opencdk if installed in a non standard directory.
6508 - Fixed the SRP detection test in gnutls-cli-debug.
6509 - Added gnutls_rsa_params_export_pkcs1() and gnutls_rsa_params_import_pkcs1().
6511 * Version 1.0.0 (2003-12-04)
6512 - Exported the static SRP group parameters.
6513 - Some fixes in the certificate authenticated SRP ciphersuites.
6514 - Improved the support for draft-ietf-tls-srp-05. The two-phase
6515 handshake is now fully supported without any interaction with
6516 the application layer (except for a callback).
6518 * Version 0.9.99 (2003-11-28)
6519 - Some fixes in the gnutls.h header for the gnutls_server_name_set()
6520 and gnutls_server_name_get() prototypes.
6521 - Exported the gnutls_x509_privkey_sign_data(), gnutls_x509_privkey_verify_data()
6522 and gnutls_x509_crt_verify_data().
6523 - Some fixes in the openpgp authentication.
6524 - Removed the Twofish cipher.
6526 * Version 0.9.98 (2003-11-16)
6527 - The openssl compatibility layer was moved to gnutls-openssl
6528 library instead of being included in the gnutls-extra library.
6529 - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04.
6530 - Building with openpgp support is now mandatory.
6531 - gnutls4 compatibility header is no longer included by default in
6533 - gnutls8 function usage yelds a deprecation warning in gcc3.
6534 - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid()
6535 functions have a raw_flag parameter added.
6536 - Added gnutls_x509_*_get_dn_oid() and gnutls_x509_crt_get_extension_oid()
6537 functions which return the available OIDs.
6539 * Version 0.9.97 (2003-11-11)
6540 - The certtool utility can now generate PKCS #12 structures
6541 without specifying a certificate.
6542 - Added capability to read CRLs to certtool.
6543 - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER
6544 to properly set the required buffer size.
6545 - Corrected a bug in libgcrypt detection.
6547 * Version 0.9.96 (2003-11-09)
6548 - Some changes to allow compilation with mingw32.
6549 - Several code cleanups.
6551 * Version 0.9.95 (2003-11-02)
6552 - Improved the verification functions. Added new verification
6553 output flags and removed the unused and redundant ones.
6554 - Improved the OpenPGP key support.
6555 - The prime utility was removed, and its functionality was moved
6558 * Version 0.9.94 (2003-10-30)
6559 - Added manpages for the included programs.
6560 - Documented and improved the certtool utility.
6561 - Added PKCS #12 support to certtool utility.
6563 * Version 0.9.93 (2003-10-26)
6564 - Corrected some compilation issues.
6565 - Improved the certtool command line utility.
6567 * Version 0.9.92 (2003-10-25)
6568 - The RFC2818 hostname verification is now case insensitive.
6569 - Added support for generating X.509 certificates.
6570 - Added the certtool, a tool for generating X.509 certificates
6572 * Version 0.9.91 (2003-10-17)
6573 - Fixed a compilation issue in the openpgp authentication part.
6575 * Version 0.9.90 (2003-10-08)
6576 - Updated the openpgp key API (depends on the unreleased new
6579 * Version 0.9.8 (2003-10-02)
6580 - Updated the SRP implementation to follow the latest draft
6581 (draft-ietf-tls-srp-05).
6582 - Improved the gnutls-cli behaviour in error handling,
6583 and added a check for the peer's hostname.
6584 - Use versioned symbols in the library (where available).
6585 - RIJNDAEL ciphersuites were renamed to AES.
6587 * Version 0.9.7 (2003-08-25)
6588 - The tex files are now included in the distribution.
6589 - The library can now decrypt PKCS #12 files encrypted with
6591 - The missing rfc2818_hostname object is now included.
6592 - Several corrections and bug fixes in the library by
6593 Arne Thomassen <arne@arne-thomassen.de>.
6594 - CR is now allowed in the base64 decoder.
6596 * Version 0.9.6 (2003-06-28)
6597 - Added gnutls_x509_privkey_get_key_id() and gnutls_x509_crt_get_key_id()
6598 functions which return a unique (per public key) ID. These can
6599 be used to check if the private key corresponds to a given certificate.
6600 - Corrections in the TLS layer openpgp certificate packet parser.
6601 - Corrected a bug in the record layer buffering, which affected
6602 the case where external pull function was used. Report and patch
6603 by Sergey Poznyakoff <gray@Mirddin.farlep.net>.
6604 - Corrected a bug in gnutls-srpcrypt where a non allocated variable
6606 - SRP programs are now built by default.
6607 - Added API to read and write to PKCS #12 structures. Prototypes
6609 - The gnutls_transport_ptr type was changed to a pointer type (void*).
6611 * Version 0.9.5 (2003-04-06)
6612 - Several improvements in the PKCS #7 handling
6613 - Eliminated several hard coded constants in MPI parameters.
6615 * Version 0.9.4 (2003-03-28)
6616 - Corrected a parsing error in the Certificate request message.
6617 - Corrected behaviour when a certificate request message is received.
6618 Now a certificate packet is always sent, and in SSL 3.0 cipher suites
6619 a no_certificate alert is sent instead.
6620 - Added functionality to generate PKCS #7 structures (with certificates).
6622 * Version 0.9.3 (2003-03-24)
6623 - Support for MD2 was dropped.
6624 - Improved the error logging functions, by adding a level, and
6625 by allowing debugging messages just by increasing the level.
6626 - The diffie Hellman ciphersuites are now of higher priority than
6628 - The RSA premaster secret version check can no longer be disabled.
6629 - Implemented the counter measure discussed in the paper "Attacking
6630 RSA-based Sessions in SSL/TLS", against the attack described in the
6632 - Added the functions: gnutls_handshake_get_last_in(),
6633 gnutls_handshake_get_last_out().
6634 - The gnutls_certificate_set_rsa_params() was renamed to
6635 gnutls_certificate_set_rsa_export_params().
6636 - Added the new functions: gnutls_certificate_set_x509_key()
6637 gnutls_certificate_set_x509_trust(), gnutls_certificate_set_x509_crl(),
6638 gnutls_x509_crt_export(), gnutls_x509_crl_export().
6639 - Added support for encoding and decoding PKCS #8 2.0 encrypted
6642 * Version 0.9.2 (2003-03-15)
6643 - Some corrections in the memory mapping code (file is unmapped after
6645 - Added support for PKCS#10 certificate requests generation.
6647 * Version 0.9.1 (2003-03-12)
6648 - Corrected a bug in 64 bit architectures, which affected the
6649 serial number calculation in the record layer.
6650 - Added gnutls_certificate_free_keys() which deletes all the
6651 private keys and certificates from the credentials structure.
6652 - Corrected a broken buffer check in _gnutls_io_read_buffered(),
6653 which caused some unexpected packet length errors. Report and patch
6654 by Ian Peters <itp@ximian.com>.
6655 - Added ability to generate RSA keys.
6656 - Increased the maximum parameter size in order to read some large keys
6657 by some CAs. Patch by Ian Peters <itp@ximian.com>.
6658 - Added an strnstr() function and the requirement in some functions to
6659 use null terminated PEM structures is no more.
6660 - Use mmap() if available to read files.
6661 - Fixed a memory leak in SRP code reported by Rupert Kittinger
6662 <r.kittinger@efkon.com>.
6664 * Version 0.9.0 (2003-03-03)
6665 - This version is not binary compatible with the previous ones.
6666 - The library notifies the application on empty and illegal SRP usernames,
6667 so that proper notification (via an alert) is sent to the peer.
6668 - Added ability to send some messages back to the application using
6669 the gnutls_global_set_log_function().
6670 - gnutls_dh_params_generate() and gnutls_rsa_params_generate() now use
6671 gnutls_malloc() to allocate the output parameters.
6672 - Added support for MD2 algorithm in certificate signature verification.
6673 - The RSA and DH parameter generation interface was changed. Added
6674 ability to import and export from and to PKCS3 structures. This
6675 was needed to read parameters generated using the openssl dhparam tool.
6676 - Several changes in the temporary (DH/RSA) parameter codebase. No DH
6677 parameters are now included in the library. Also the credentials structure
6678 can now hold only one temporary parameter of a kind.
6679 - Added a new Certificate, CRL, Private key and PKCS7 structures handling
6680 API, defined in gnutls/x509.h
6681 - Added gnutls_certificate_set_verify_flags() function to allow setting the
6682 verification flags in the credentials structure. They will be used in the
6683 *verify_peers functions.
6684 - Added protection against the new TLS 1.0 record layer timing attack.
6685 - Added support for Certificate revocation lists. Functions defined
6687 - The only functions that were removed are:
6688 gnutls_x509_certificate_to_xml()
6689 gnutls_x509_extract_dn_string()
6690 - Ported to libtasn1 0.2.x
6692 * Version 0.8.1 (2003-01-22)
6693 - Improved the SRP support, to prevent attackers guessing the
6694 available usernames by brute force.
6695 - Improved the SRP detection in gnutls-cli-debug
6696 - Some fixes which now allow compilation.
6698 * Version 0.8.0 (2003-01-20)
6699 - Added gnutls_x509_extract_dn_string() which returns a
6700 distinguished name in a single string.
6701 - Added gnutls_openpgp_extract_key_name_string() which returns
6702 an openpgp user ID in a single string.
6703 - Added gnutls_x509_extract_certificate_ca_status() which returns
6704 the CA status of the given certificate.
6705 - Added SRP-6 support. Follows draft-ietf-tls-srp-04.
6706 - If libtasn1 is not present in the system, it is included in
6707 the main gnutls library.
6708 - If liblzo is present in the system, then the included minilzo
6709 will not be used, and libgnutls-extra will depend on liblzo.
6710 - GNUTLS_E_PARSING_ERROR error code was replaced by GNUTLS_E_BASE64_DECODING_ERROR,
6711 and GNUTLS_E_SRP_PWD_PARSING_ERROR. GNUTLS_E_ASCII_ARMOR_ERROR was also
6712 replaced by GNUTLS_E_BASE64_DECODING_ERROR.
6714 * Version 0.6.0 (2002-12-08)
6715 - Added "gnutls/compat4.h" header. This is included in gnutls.h
6716 to emulate the old 0.4.x API.
6717 - Example programs are now stored in doc/examples/
6718 - Several improvements and updates in the documentation.
6719 - Added the certificate authenticated SRP cipher suites.
6720 - gnutls_x509_extract_certificate_dn_string() was updated to return
6721 an RFC2253 conforming string.
6722 - Added the SRP related functions:
6723 gnutls_srp_verifier()
6724 gnutls_srp_base64_encode()
6725 gnutls_srp_base64_decode()
6726 - Added the function gnutls_srp_set_server_credentials_function()
6727 to allow retrieving SRP parameters from an external backend - other
6728 than password files.
6729 - Added the function gnutls_openpgp_set_recv_key_function()
6730 which can be used to set a callback, to get OpenPGP keys.
6731 - Exported the functions:
6734 which should be used by callback functions.
6735 - Changed the semantics of gnutls_pem_base64_encode_alloc()
6736 and gnutls_pem_base64_decode_alloc(). In the default case
6737 were the gnutls library is used with malloc/realloc/free,
6738 these are binary compatible.
6740 * Version 0.5.11 (2002-11-05)
6741 - Some fixes in 'gnutls-cli' client program to prevent some segmentation
6743 - Example programs found in the documentation can now be generated by
6744 running "make examples" in doc/tex directory.
6745 - Added more descriptive error strings, to gnutls_strerror().
6746 - Documented error codes, and the function reference list is now sorted.
6747 - Optimized buffering code.
6748 - gnutls_x509_extract_certificate_dn_string() was rewritten.
6749 - Added GNUTLS_E_SHORT_MEMORY_BUFFER error code, which is returned in the
6750 case where the memory buffer provided is not long enough.
6751 - Depends on the new OpenCDK 0.3.2.
6753 * Version 0.5.10 (2002-10-13)
6754 - Updated documentation.
6755 - Added server name extension. This allows clients to specify the
6756 name of the server they connect to. Useful to HTTPS.
6757 - Several corrections in the code base, mostly in signed/unsigned,
6760 * Version 0.5.9 (2002-10-10)
6761 - Corrected some code which worked fine in gcc 3.2, but not with any
6763 - Updated 'gnutls-cli' with the '--starttls' option, to allow testing
6764 starttls implementations.
6765 - Added gnutls_x509_extract_key_pk_algorithm() function which extracts
6766 the private key type, of a DER encoded key.
6767 - Added gnutls_x509_extract_certificate_dn_string() which returns the
6768 certificate's distinguished name in a single string.
6769 - Added gnutls_set_default_priority() and gnutls_set_default_export_priority()
6770 functions, to avoid calling all the *_priority() functions if the defaults
6772 - Added int gnutls_x509_check_certificates_hostname() which check whether
6773 the given hostname matches the owner of the given X.509 certificate.
6775 * Version 0.5.8 (2002-09-25)
6776 - Updated documentation.
6777 - Added gnutls_record_get_direction() which replaces the obsolete
6778 gnutls_handshake_get_direction().
6779 - Added function to convert error codes to alert descriptions
6780 - Added LZO compression
6782 * Version 0.5.7 (2002-09-11)
6783 - Some fixes in the memory allocation functions (realloc).
6784 - Improved the string functions used in XML certificate generation.
6785 - Removed dependency on libgdbm.
6786 - Corrected bug in gnutls_dh_params_set() which affected
6787 gnutls_dh_params_deinit().
6788 - Corrected bug in session resuming code in server side.
6790 * Version 0.5.6 (2002-09-06)
6791 - Corrected bugs in SRP implementation, which prevented gnutls
6792 to interoperate with other implementations. (interoperability testing
6793 was done by David Taylor)
6794 - Corrected bug in cert_type extension.
6795 - Corrected extension type checks which used an 8 bit extension size,
6797 - Added versioning in the XML output of certificate functions.
6798 - Removed the X.509 test suite.
6800 * Version 0.5.5 (2002-09-03)
6801 - Updated the SRP implementation to the latest draft. The blowfish
6802 crypt implementation was removed, since the new draft does not allow
6803 other hash algorithms except for the srpsha.
6804 - Renamed all the constructed types in order to have more consistent
6806 - Improved the certificate and key read functions. Now they can read
6807 the certificate and the private key from the same file.
6808 - Updated and corrected documentation.
6810 * Version 0.5.4 (2002-08-27)
6811 - Fixes in TLS 1.0 PRF and SSL3 random functions.
6812 - gnutls_handshake_set_exportable_detection() was obsoleted.
6813 - Added gnutls_openpgp_extract_key_id() which returns the key ID.
6814 - Corrected bug in DHE key exchange
6815 - Added support for temporary RSA keys which are needed for the
6816 export cipher suites.
6817 - Added the TLS_RSA_EXPORT_ARCFOUR_40_MD5 ciphersuite.
6819 * Version 0.5.3 (2002-08-23)
6820 - No changes. Replaces the tarball of 0.5.2 which accidentally contained
6821 code from the unstable branch.
6823 * Version 0.5.2 (2002-08-22)
6824 - Added an error code that is returned in clients which connect
6825 to export only servers. This must be enabled using the
6826 gnutls_handshake_set_exportable_detection() function.
6827 - Updated openssl compatibility layer.
6828 - Added gnutls_handshake_get_direction() function which returns
6829 the state of the handshake when interrupted.
6831 * Version 0.5.1 (2002-07-17)
6832 - Corrected the m4 macros which used <gnutls.h> instead of
6834 - Documentation fixes
6835 - Added gnutls_transport_set_ptr2() function, which accepts two
6836 different pointers, to be used while receiving, and
6838 - Semantic changes in gnutls_record_set_max_size(). The requested
6839 size is now immediately enforced at the output buffers.
6840 - gnutls_global_init_extra() now fails if the library versions do
6842 - Fixes in client and server example programs. Null encryption can
6843 be used in these programs, to assist in debuging.
6844 - Fixes in zlib compression code.
6846 * Version 0.5.0 (2002-07-06)
6847 - Added X.509 certificate tests in tests/ directory
6848 - Removed stubs for SRP and Anonymous authentication. They served
6849 no purpose since they are always included, unless it was requested
6851 - Added gnutls_handshake_set_private_extensions() function. This
6852 function can be used to enable private (gnutls specific) cipher suites
6853 and compression algorithms.
6854 - Added check for C99 macro support by the compiler.
6855 - Added functions gnutls_b64_encode_fmt2() and gnutls_b64_decode_fmt2()
6856 - Added the new libtasn1 library.
6857 - Removed the gdbm backend. Applications are now responsible for the
6858 session resuming backend. The gnutls-serv application contains an
6859 simple example on how to use gdbm for resuming.
6860 - Headers for the gnutls library are now installed in $(includedir)/gnutls
6861 - Added an OpenSSL compatible interface (with some limitations).
6862 - Added functions to convert DER encoded certificates to XML format.
6864 * Version 0.4.4 (2002-06-24)
6865 - Corrected bug in PKCS-1 RSA encryption which prevented gnutls to encrypt
6866 using keys of some specific size.
6868 * Version 0.4.3 (2002-05-23)
6869 - The gnutls-extra library now compiles fine, if the opencdk library is
6871 - Several bug fixes.
6872 - Added gnutls_global_set_mem_func() function, to set the memory allocation
6873 functions, if other than the defaults are to be used.
6874 - The default memory allocation functions are now the ones in libc.
6876 * Version 0.4.2 (2002-05-21)
6877 - Separated ASN.1 structures parser documentation and TLS library
6879 - Added gnutls_handshake_set_rsa_pms() function, which disables the
6880 version check in RSA premaster secret.
6881 - Added gnutls_session_is_resumed() function, which reports if a session
6883 - Added gnutls_state_set_ptr() and gnutls_state_get_ptr() functions, to
6884 assist in callback functions.
6885 - Replaced the included 1024 bit prime for Diffie Hellman, with a new
6887 - Relicensed the library under the GNU Lesser General Public License
6888 - Added gnutls-extra library which contains the GPL covered code of gnutls.
6890 * Version 0.4.1 (2002-04-07)
6891 - Now uses alloca() for temporary variables
6892 - Optimized RSA signing
6893 - Added functions to return the peer's certificate activation and
6895 - Corrected time function's behaviour (the time value returned no longer
6896 relate to local timezone).
6898 * Version 0.4.0 (2002-04-01)
6899 - Added support for RFC2630 (PKCS7) X.509 certificate sets
6900 - Added new functions: gnutls_x509_extract_certificate_pk_algorithm(),
6901 gnutls_openpgp_extract_key_pk_algorithm().
6902 - Several optimizations in the Handshake protocol
6903 - Several optimizations in RSA algorithm
6904 - Unified the return values because of small buffers.
6906 * Version 0.3.92 (2002-03-23)
6907 - Updated documentation
6908 - Combined error codes of ASN.1 parser and gnutls
6909 - Removed GNUTLS_CERT_TRUSTED from the CertificateStatus enumeration
6910 - Added protection against CBC chosen plaintext attack (disabled by default)
6911 - Improved and optimized compression support
6913 * Version 0.3.91 (2002-03-03)
6914 - Added gnutls-cli-debug program
6915 - Corrections in session resumption
6916 - Rehandshake can now handle negotiation of different authentication
6918 - gnutls-cli, gnutls-serv, gnutls-srpcrypt and gnutls-cli-debug are
6919 now being installed.
6921 * Version 0.3.90 (2002-02-24)
6922 - Handshake messages are not kept in memory any more. Now we use
6923 less memory during a handshake
6924 - Added support for certificates with DSA parameters
6925 - Added DHE_DSS cipher suites
6926 - Key exchange methods changed so they do not depend on the
6927 certificate type. Added certificate type negotiation TLS extension.
6928 - Added openpgp key support (EXPERIMENTAL)
6929 - Improved Diffie Hellman key exchange support.
6930 - Bug fixes in the RSA key exchange.
6931 - Added check for the requested TLS extensions
6932 - TLS extensions now use a 16 bit type field.
6933 - Added a minimal string library to assist in ASN.1 parsing
6934 - Changes in ASN.1 parser to work with the new bison
6935 - Added gnutls_x509_extract_subject_alt_name(), which deprecates
6936 gnutls_x509_extract_subject_dns_name()
6937 - gnutls_x509_set_trust_(file/mem) can now be called multiple times
6938 - gnutls_srp_server_set_cred_file() can now be called multiple times
6940 * Version 0.3.5 (2002-01-25)
6941 - Corrected the RSA key exchange method, to avoid attacks against
6944 * Version 0.3.4 (2002-01-20)
6945 - Corrected bugs in DHE_RSA key exchange method
6947 * Version 0.3.3 (2002-01-19)
6948 - Added gnutls_x509pki_verify_certificate()
6949 - Added gnutls_x509pki_set_trust_mem() and gnutls_x509pki_set_key_mem()
6950 - Bug fixes in srpcrypt (based on patch by Marc Huber)
6951 - Bug fixes in the Handshake protocol (based on patch by Guillaume Morin)
6952 - Corrected library versioning
6954 * Version 0.3.2 (2002-01-05)
6955 - Corrected bug which did not allow a client to accept multiple CA names
6956 - Added gnutls_fingerprint()
6957 - Added gnutls_x509pki_extract_certificate_serial()
6958 - Added gnutls_b64_encode_fmt() and gnutls_b64_decode_fmt()
6959 - Corrected behaviour in version advertizing
6960 - Updated documentation
6961 - Prefixed all types in gnutls.h with 'GNUTLS_' to avoid namespace collisions
6963 * Version 0.3.1 (2001-12-21)
6964 - Corrections in the configuration files
6965 - Fixes a bug in anonymous authentication
6967 * Version 0.3.0 (2001-12-17)
6968 - Corrected bug in new integer formatting (now we use the old format again)
6969 - Several corrections and usual cleanups
6971 * Version 0.2.91 (2001-12-10)
6972 - Fixes in MPI handling (fixes possible bug with signed integers)
6973 - Removed name indication extension
6974 - Added gnutls_transport_get_ptr() and gnutls_db_get_ptr()
6975 - Optimizations in server certificate callback.
6976 - Fixes in anonymous authentication
6977 - Corrections in client ciphersuite selection
6979 * Version 0.2.90 (2001-12-07)
6980 - gnutls_handshake(), gnutls_read() etc. functions no longer require
6981 the 'SOCKET cd' argument. This argument is set using the function
6982 gnutls_set_transport_ptr().
6983 - introduced gnutls_x509pki_get_peer_certificate_list(). This function returns
6984 a list containing peer's certificate and issuers DER encoded.
6985 - Updated X.509 certificate handling API
6986 - Added callback to select the server certificate
6987 - More consistent function naming (changes in several function names)
6988 - Buffer overflow checking in ASN.1 structures parser
6989 - Updated documentation
6991 * Version 0.2.11 (2001-11-16)
6992 - Changed the meaning of GNUTLS_E_REHANDSHAKE value. If this value
6993 is returned, then the caller should perform a handshake or send
6994 an alert to the peer.
6995 - Made receive buffer dynamic. Normally if no large chunks are received
6996 it occupies less space.
6997 - Added max_record_size extension
6998 - Bugfixes in session handling
6999 - Improved non blocking IO support in the Handshake Protocol
7000 - Usual bugfixes and cleanups
7001 - Documentation updated (includes ASN.1 documentation)
7003 * Version 0.2.10 (2001-11-05)
7004 - Corrected bugs and improved non blocking IO
7005 - Added hooks to use external database to store sessions
7008 * Version 0.2.9 (2001-10-27)
7009 - AUTH_INFO types and structures were moved to library internals
7010 - AUTH_FAILED is no longer returned in SRP authentication
7011 (any fatal error in SRP means auth failed)
7012 - Introduced GNUTLS_E_INTERRUPTED
7013 - Added support for non blocking IO
7014 - gnutls_recv() and gnutls_send() are now obsolete
7015 - Changed semantics of gnutls_rehandshake()
7017 * Version 0.2.4 (2001-10-12)
7018 - Better handling of X.509 certificate extensions
7019 - Added DHE_RSA ciphersuites
7020 - Updated the Name Indication (dnsname) extension
7021 - Improvements in Diffie Hellman primes handling
7023 * Version 0.2.3 (2001-09-19)
7024 - Memory optimizations in gnutls_recv()
7025 - Fixed several memory leaks
7026 - Added ability to specify callback for x509 client certificate selection
7027 - Better documentation
7029 * Version 0.2.2 (2001-08-21)
7030 - Several bugfixes (library and documentation)
7032 * Version 0.2.1 (2001-08-07)
7035 * Version 0.2.0 (2001-08-07)
7036 - Partial support for X.509v3 Certificate extensions.
7037 - Added Internal memory handlers
7038 - Removed gnutls_x509_set_cn()
7039 - Added X.509 client authentication
7040 - Several bug fixes and protocol fixes
7042 * Version 0.1.9 (2001-07-30)
7043 - Corrected bug(s) in ChangeCipherSpec packet (fixes renegotiate)
7044 - SRP is updated to conform to the newest draft.
7045 - Added support for DNSNAME extension.
7046 - Reentracy fixes in ASN.1 Parsing.
7047 - Optimizations in hash/hmac functions
7048 - (Error) message handling has changed
7049 - Better Protocol Version handling
7050 - Added X.509 Certificate Verification
7051 - gnutls_read() semantics are now closer to read(2) - added EOF
7052 - Documented some part of gnutls in doc/tex/ using Latex
7054 * Version 0.1.4 (2001-06-22)
7055 - Corrected (srp) base64 encoding.
7056 - Changed bcrypt algorithm to include username.
7057 - Added RSA Ciphersuites (no certificate checking).
7058 - Fixes in SSL 2.0 client hello parsing.
7059 - Added ASN.1 and DER parsers.
7060 - Bugfixes in session resuming
7061 - Updated Ciphersuite selection algorithm
7062 - Added internal representation of X.509 structures.
7063 - Added global state
7065 * Version 0.1.3 (2001-06-01)
7066 - Updated API (and the way it is documented - we use inline documentation)
7067 - Added function to access alert messages.
7068 - Added support for renegotiating parameters.
7069 - Better and Faster Resume Database handling.
7072 * Version 0.1.2 (2001-05-14)
7074 - Fixes in extension handling
7076 * Version 0.1.1 (2001-05-13)
7077 - Added compatibility with Stanford's libsrp library
7079 * Version 0.1.0 (2001-05-09)
7080 - Added SSL 2.0 client hello support
7081 - GNUTLS is a gnu library
7082 - Added support for TLS extensions.
7083 - Added support for SRP
7085 * Version 0.0.7 (2001-01-11)
7086 - Added server side session resuming (using gdbm)
7087 - Added twofish algorithm
7089 * Version 0.0.6 (2000-12-20)
7090 - Added client side session resuming
7091 - Better documentation (check doc/API)
7092 - Better socket handling (gnutls can be used with select())
7093 - Some primitive support for non blocking IO and socket options has been added.
7095 * Version 0.0.5 (2000-12-07)
7096 - Added Compression (using ZLIB)
7097 - Added SSL 3.0 support
7099 ----------------------------------------------------------------------
7100 Copying and distribution of this file, with or without modification,
7101 are permitted in any medium without royalty provided the copyright
7102 notice and this notice are preserved.