From zfridric at redhat.com Wed Nov 15 14:05:59 2023 From: zfridric at redhat.com (Zoltan Fridrich) Date: Wed, 15 Nov 2023 14:05:59 +0100 Subject: [gnutls-help] gnutls 3.8.2 Message-ID: <5157436c-bafd-80e8-70ee-36124a3f33bb@redhat.com> Hello, We have just released gnutls-3.8.2. This is a bug fix and enhancement release on the 3.8.x branch. We would like to thank everyone who contributed in this release: Samuel Thibault, Adrian Bunk, Sam James, Miroslav Lichvar, Dimitri Papadopoulos Orfanos, Yongye Zhu, xuraoqing, Clemens Lang, Frediano Ziglio, Ajit Singh, Daiki Ueno and Zoltan Fridrich The detailed list of changes follows: * Version 3.8.2 (released 2023-11-14) ** libgnutls: Fix timing side-channel inside RSA-PSK key exchange. [GNUTLS-SA-2023-10-23, CVSS: medium] [CVE-2023-5981] ** libgnutls: Add API functions to perform ECDH and DH key agreement. The functionality has been there for a long time though they were not available as part of the public API. This enables applications to implement custom protocols leveraging non-interactive key agreement with ECDH and DH. ** libgnutls: Added support for AES-GCM-SIV ciphers (RFC 8452). The new algorithms GNUTLS_CIPHER_AES_128_SIV_GCM and GNUTLS_CIPHER_AES_256_SIV_GCM have been added to be used through the AEAD interface. Note that, unlike GNUTLS_CIPHER_AES_{128,256}_SIV_GCM, the authentication tag is appended to the ciphertext, not prepended. ** libgnutls: transparent KTLS support is extended to FreeBSD kernel. The kernel TLS feature can now be enabled on FreeBSD as well as Linux when compiled with the --enable-ktls configure option. ** gnutls-cli: New option --starttls-name Depending on deployment, application protocols such as XMPP may require a different origin address than the external address to be presented prior to STARTTLS negotiation. The --starttls-name can be used to specify the addresses separately. ** API and ABI modifications: gnutls_pubkey_import_dh_raw: New function gnutls_privkey_import_dh_raw: New function gnutls_pubkey_export_dh_raw: New function gnutls_privkey_export_dh_raw: New function gnutls_x509_privkey_import_dh_raw: New function gnutls_privkey_derive_secret: New function GNUTLS_KEYGEN_DH: New enum member of gnutls_keygen_types_t GNUTLS_CIPHER_AES_128_SIV_GCM: Added GNUTLS_CIPHER_AES_256_SIV_GCM: Added Getting the Software ================ GnuTLS may be downloaded directly from https://www.gnupg.org/ftp/gcrypt/ A list of GnuTLS mirrors can be found at http://www.gnutls.org/download.html Here are the XZ compressed sources: https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.2.tar.xz Here are OpenPGP detached signatures signed using keys: 5D46CB0F763405A7053556F47A75A648B3F9220C and 462225C3B46F34879FC8496CD605848ED7E69871 https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.2.tar.xz.sig Note that it has been signed with my openpgp key: pub ? ed25519 2021-12-23 [SC] [expires: 2023-12-23] ? ? ? 5D46CB0F763405A7053556F47A75A648B3F9220C uid ? ? ? ? ? [ultimate] Zoltan Fridrich sub ? cv25519 2021-12-23 [E] [expires: 2023-12-23] and Daiki Uenos openpgp key: pub rsa4096 2009-07-23 [SC] [expires: 2023-09-25] 462225C3B46F34879FC8496CD605848ED7E69871 uid ?? ? ???? [ultimate] Daiki Ueno > uid?? ??? ??? [ultimate] Daiki Ueno > sub rsa4096 2010-02-04 [E] Regards, Zoltan -------------- next part -------------- An HTML attachment was scrubbed... URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_0x7A75A648B3F9220C.asc Type: application/pgp-keys Size: 669 bytes Desc: OpenPGP public key URL: -------------- next part -------------- A non-text attachment was scrubbed... Name: OpenPGP_signature Type: application/pgp-signature Size: 236 bytes Desc: OpenPGP digital signature URL: