<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<div dir="ltr">
<div><font size="2">Hello,</font></div>
<div><font size="2"><br>
</font></div>
<div><font size="2">We have just released gnutls-3.7.5. This is a
bug fix and enhancement release on the 3.7.x branch.</font></div>
<div><font size="2"><br>
</font></div>
<div><font size="2">We would like to thank everyone who
contributed in this release:</font></div>
<div><font size="2">Tim Kosse, </font><font size="2"><span
style="font-weight: normal;"><span class="">Tatsuhiro
Tsujikawa, Brian Wickman, </span></span></font><span
style="font-weight: normal;"><font size="2">František
Krenželok, </font></span><span style="font-weight: normal;"><font
size="2"><span style="font-weight: normal;"><font size="2">Andreas
Metzler,</font></span></font></span></div>
<div><span style="font-weight: normal;"><font size="2"><span
style="font-weight: normal;"><font size="2">Benjamin
Herrenschmidt, Pedro Monreal, Tobias Heider, Sam James,
Daiki Ueno and Zoltan Fridrich<br>
</font></span></font></span></div>
<div><font size="2"><br>
</font></div>
<div><font size="2">The detailed list of changes follows:<span
id="m_6242587736977913994gmail-m_6890929345026607073m_-4122756204696642219gmail-LC8"
lang=""></span></font></div>
<div><span class="line" id="LC8" lang="mosel"><span class="p"><br>
</span></span></div>
<div><font size="2"><span class="line" id="LC8" lang="mosel"><span
class="p">*</span> <span class="k">Version</span> <span
class="m">3.7.5</span> <span class="p">(</span><span
class="n">released</span> <span class="m">2022</span><span
class="p">-</span><span class="m">05</span><span class="p">-</span><span
class="m">15</span><span class="p">)</span></span>
<br>
<span class="line" id="LC9" lang="mosel"></span>
<span class="line" id="LC10" lang="mosel"><span class="p"><br>
</span></span></font></div>
<div><font size="2"><span class="line" id="LC10" lang="mosel"><span
class="p">**</span> <span class="n">libgnutls</span><span
class="p">:</span> <span class="n">The</span> <span
class="n">GNUTLS_NO_TICKETS_TLS12</span> <span class="n">flag</span>
<span class="k">and</span> <span class="p">%</span><span
class="n">NO_TICKETS_TLS12</span> <span class="n">priority</span></span><span
class="line" id="LC11" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC11" lang="mosel"><span
class="n"> modifier</span> <span class="n">have</span>
<span class="n">been</span> <span class="n">added</span> <span
class="k">to</span> <span class="n">disable</span> <span
class="n">session</span> <span class="n">ticket</span> <span
class="n">usage</span> <span class="k">in</span> <span
class="n">TLS</span> <span class="m">1.2</span> <span
class="n">because</span></span><span class="line"
id="LC12" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC12" lang="mosel"><span
class="n"> it</span> <span class="n">does</span> <span
class="k">not</span> <span class="n">provide</span> <span
class="k">forward</span> <span class="n">secrecy</span> <span
class="p">(#</span><span class="m">477</span><span
class="p">).</span> <span class="n">On</span> <span
class="n">the</span> <span class="n">other</span> <span
class="n">hand</span><span class="p">,</span> <span
class="n">since</span> <span class="n">session</span></span><span
class="line" id="LC13" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC13" lang="mosel"><span
class="n"> tickets</span> <span class="k">in</span> <span
class="n">TLS</span> <span class="m">1.3</span> <span
class="k">do</span> <span class="n">provide</span> <span
class="k">forward</span> <span class="n">secrecy</span><span
class="p">,</span> <span class="n">the</span> <span
class="n">PFS</span> <span class="n">priority</span> <span
class="k">string</span> <span class="n">now</span></span><span
class="line" id="LC14" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC14" lang="mosel"><span
class="n"> only</span> <span class="n">disables</span>
<span class="n">session</span> <span class="n">tickets</span>
<span class="k">in</span> <span class="n">TLS</span> <span
class="m">1.2</span><span class="p">.</span> <span
class="n">Future</span> <span class="n">backward</span> <span
class="n">incompatibility</span><span class="p">:</span></span><span
class="line" id="LC15" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC15" lang="mosel"><span
class="k"> in</span> <span class="n">the</span> <span
class="k">next</span> <span class="n">major</span> <span
class="n">release</span> <span class="k">of</span> <span
class="n">GnuTLS</span><span class="p">,</span> <span
class="n">we</span> <span class="n">plan</span> <span
class="k">to</span> <span class="n">remove</span> <span
class="n">those</span> <span class="n">flag</span> <span
class="k">and</span></span><span class="line" id="LC16"
lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC16" lang="mosel"><span
class="n"> modifier</span><span class="p">,</span> <span
class="k">and</span> <span class="n">make</span> <span
class="n">GNUTLS_NO_TICKETS</span> <span class="k">and</span>
<span class="p">%</span><span class="n">NO_TICKETS</span> <span
class="n">only</span> <span class="n">affect</span> <span
class="n">TLS</span> <span class="m">1.2</span><span
class="p">.</span></span><br>
</font></div>
<div><font size="2"><span class="line" id="LC18" lang="mosel"><span
class="p"><br>
</span></span></font></div>
<div><font size="2"><span class="line" id="LC18" lang="mosel"><span
class="p">**</span> <span class="n">gnutls</span><span
class="p">-</span><span class="n">cli</span><span
class="p">,</span> <span class="n">gnutls</span><span
class="p">-</span><span class="n">serv</span><span
class="p">:</span> <span class="n">Channel</span> <span
class="n">binding</span> <span class="n">for</span> <span
class="n">printing</span> <span class="n">information</span></span><span
class="line" id="LC19" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC19" lang="mosel"><span
class="n"> has</span> <span class="n">been</span> <span
class="n">changed</span> <span class="k">from</span> <span
class="n">tls</span><span class="p">-</span><span
class="n">unique</span> <span class="k">to</span> <span
class="n">tls</span><span class="p">-</span><span
class="n">exporter</span> <span class="k">as</span> <span
class="n">tls</span><span class="p">-</span><span
class="n">unique</span> <span class="n">is</span></span><span
class="line" id="LC20" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC20" lang="mosel"><span
class="k"> not</span> <span class="n">supported</span>
<span class="k">in</span> <span class="n">TLS</span> <span
class="m">1.3</span><span class="p">.</span></span><br>
</font></div>
<div><font size="2"><span class="line" id="LC21" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC21" lang="mosel"></span>
<span class="line" id="LC22" lang="mosel"><span class="p">**</span>
<span class="n">libgnutls</span><span class="p">:</span> <span
class="n">Certificate</span> <span class="n">sanity</span>
<span class="n">checks</span> <span class="n">has</span> <span
class="n">been</span> <span class="n">enhanced</span> <span
class="k">to</span> <span class="n">make</span></span><span
class="line" id="LC23" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC23" lang="mosel"><span
class="n"> gnutls</span> <span class="n">more</span> <span
class="n">RFC</span> <span class="m">5280</span> <span
class="n">compliant</span> <span class="p">(</span><span
class="c1">!1583).</span></span><span class="line"
id="LC24" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC24" lang="mosel"><span
class="n"> Following</span> <span class="n">changes</span>
<span class="n">were</span> <span class="n">included</span><span
class="p">:</span></span> <br>
</font></div>
<div><font size="2"><span class="line" id="LC25" lang="mosel">
<span class="p">-</span> <span class="n">critical</span> <span
class="n">extensions</span> <span class="n">are</span> <span
class="n">parsed</span> <span class="n">when</span> <span
class="n">loading</span> <span class="n">x509</span></span><span
class="line" id="LC26" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC26" lang="mosel"><span
class="n"> certificate</span> <span class="k">to</span>
<span class="n">prohibit</span> <span class="n">any</span>
<span class="nb">random</span> <span class="n">octet</span>
<span class="n">strings</span><span class="p">.</span></span><span
class="line" id="LC27" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC27" lang="mosel"><span
class="n"> Requires</span> <span class="n">strict</span><span
class="p">-</span><span class="n">x509</span> <span
class="n">configure</span> <span class="n">option</span>
<span class="k">to</span> <span class="n">be</span> <span
class="n">enabled</span></span><span class="line"
id="LC28" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC28" lang="mosel"><span
class="p"> -</span> <span class="n">garbage</span> <span
class="n">bits</span> <span class="k">in</span> <span
class="n">Key</span> <span class="n">Usage</span> <span
class="n">extension</span> <span class="n">are</span> <span
class="n">prohibited</span></span> <br>
</font></div>
<div><font size="2"><span class="line" id="LC29" lang="mosel">
<span class="p">-</span> <span class="n">empty</span> <span
class="n">DirectoryStrings</span> <span class="k">in</span>
<span class="n">Distinguished</span> <span class="n">name</span>
<span class="n">structures</span></span><span class="line"
id="LC30" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC30" lang="mosel"><span
class="k"> of</span> <span class="n">Issuer</span> <span
class="k">and</span> <span class="n">Subject</span> <span
class="n">name</span> <span class="n">are</span> <span
class="n">prohibited</span></span><span class="line"
id="LC31" lang="mosel"></span><br>
</font></div>
<div><font size="2"><span class="line" id="LC32" lang="mosel"><span
class="p"><br>
</span></span></font></div>
<div><font size="2"><span class="line" id="LC32" lang="mosel"><span
class="p">**</span> <span class="n">libgnutls</span><span
class="p">:</span> <span class="n">Removed</span> <span
class="m">3</span><span class="n">DES</span> <span
class="k">from</span> <span class="n">FIPS</span> <span
class="n">approved</span> <span class="n">algorithms</span>
<span class="p">(#</span><span class="m">1353</span><span
class="p">).</span></span><span class="line" id="LC33"
lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC33" lang="mosel"><span
class="n"> According</span> <span class="k">to</span>
<span class="n">the</span> <span class="n">section</span> <span
class="m">2</span> <span class="k">of</span> <span
class="n">SP800</span><span class="p">-</span><span
class="m">131</span><span class="n">A</span> <span
class="n">Rev</span><span class="m">.2</span><span
class="p">,</span> <span class="m">3</span><span
class="n">DES</span> <span class="n">algorithm</span></span><span
class="line" id="LC34" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC34" lang="mosel"><span
class="n"> will</span> <span class="n">be</span> <span
class="n">disallowed</span> <span class="n">for</span> <span
class="n">encryption</span> <span class="n">after</span>
<span class="n">December</span> <span class="m">31</span><span
class="p">,</span> <span class="m">2023</span><span
class="p">:</span></span><span class="line" id="LC35"
lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC35" lang="mosel"><span
class="n"> https</span><span class="p">://</span><span
class="n">csrc</span><span class="p">.</span><span
class="n">nist</span><span class="p">.</span><span
class="n">gov</span><span class="p">/</span><span
class="n">publications</span><span class="p">/</span><span
class="n">detail</span><span class="p">/</span><span
class="n">sp</span><span class="p">/</span><span class="m">800</span><span
class="p">-</span><span class="m">131</span><span
class="n">a</span><span class="p">/</span><span class="n">rev</span><span
class="p">-</span><span class="m">2</span><span class="p">/</span><span
class="n">final</span></span></font></div>
<div><font size="2"><span class="line" id="LC35" lang="mosel"><span
class="n"></span></span> <br>
</font></div>
<div><font size="2"><span class="line" id="LC37" lang="mosel"><span
class="p">**</span> <span class="n">libgnutls</span><span
class="p">:</span> <span class="n">Optimized</span> <span
class="n">support</span> <span class="n">for</span> <span
class="n">AES</span><span class="p">-</span><span
class="n">SIV</span><span class="p">-</span><span
class="n">CMAC</span> <span class="n">algorithms</span> <span
class="p">(#</span><span class="m">1217</span><span
class="p">,</span> <span class="p">#</span><span
class="m">1312</span><span class="p">).</span></span><span
class="line" id="LC38" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC38" lang="mosel"><span
class="n"> The</span> <span class="n">existing</span>
<span class="n">AEAD</span> <span class="n">API</span> <span
class="n">that</span> <span class="n">works</span> <span
class="k">in</span> <span class="n">a</span> <span
class="n">scatter</span><span class="p">-</span><span
class="n">gather</span> <span class="n">fashion</span></span><span
class="line" id="LC39" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC39" lang="mosel"><span
class="p"> (</span><span class="n">gnutls_aead_cipher_encryptv2</span><span
class="p">)</span> <span class="n">has</span> <span
class="n">been</span> <span class="n">extended</span> <span
class="k">to</span> <span class="n">support</span> <span
class="n">AES</span><span class="p">-</span><span
class="n">SIV</span><span class="p">-</span><span
class="n">CMAC</span><span class="p">.</span></span><span
class="line" id="LC40" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC40" lang="mosel"><span
class="n"> For</span> <span class="n">further</span> <span
class="n">optimization</span><span class="p">,</span> <span
class="n">new</span> <span class="k">function</span> <span
class="p">(</span><span class="n">gnutls_aead_cipher_set_key</span><span
class="p">)</span> <span class="n">has</span> <span
class="n">been</span></span><span class="line" id="LC41"
lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC41" lang="mosel"><span
class="n"> added</span> <span class="k">to</span> <span
class="k">set</span> <span class="n">key</span> <span
class="n">on</span> <span class="n">the</span> <span
class="n">existing</span> <span class="n">AEAD</span> <span
class="n">handle</span> <span class="n">without</span> <span
class="n">re</span><span class="p">-</span><span class="n">allocation</span><span
class="p">.</span></span><br>
</font></div>
<div><font size="2"><span class="line" id="LC43" lang="mosel"><span
class="p"><br>
</span></span></font></div>
<div><font size="2"><span class="line" id="LC43" lang="mosel"><span
class="p">**</span> <span class="n">libgnutls</span><span
class="p">:</span> <span class="n">HKDF</span> <span
class="k">and</span> <span class="n">AES</span><span
class="p">-</span><span class="n">GCM</span> <span
class="n">algorithms</span> <span class="n">are</span> <span
class="n">now</span> <span class="n">approved</span> <span
class="k">in</span> <span class="n">FIPS</span><span
class="p">-</span><span class="m">140</span> <span
class="n">mode</span></span><span class="line" id="LC44"
lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC44" lang="mosel"><span
class="n"> when</span> <span class="n">used</span> <span
class="k">in</span> <span class="n">TLS</span> <span
class="p">(#</span><span class="m">1311</span><span
class="p">).</span></span><br>
</font></div>
<div><font size="2"><span class="line" id="LC46" lang="mosel"><span
class="p"><br>
</span></span></font></div>
<div><font size="2"><span class="line" id="LC46" lang="mosel"><span
class="p"></span></span><span class="line" id="LC46"
lang="mosel"><span class="p">**</span> <span class="n">The</span>
<span class="n">configure</span> <span class="n">arguments</span>
<span class="n">for</span> <span class="n">Brotli</span> <span
class="k">and</span> <span class="n">Zstandard</span> <span
class="p">(</span><span class="n">zstd</span><span
class="p">)</span> <span class="n">support</span></span><span
class="line" id="LC47" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC47" lang="mosel"><span
class="n"> have</span> <span class="n">changed</span>
<span class="k">to</span> <span class="n">reflect</span> <span
class="n">the</span> <span class="n">previous</span> <span
class="n">help</span> <span class="n">text</span><span
class="p">:</span> <span class="n">they</span> <span
class="n">are</span> <span class="n">now</span></span><span
class="line" id="LC48" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC48" lang="mosel"><span
class="p"> --</span><span class="k">with</span><span
class="p">-</span><span class="n">brotli</span><span
class="p">/--</span><span class="k">with</span><span
class="p">-</span><span class="n">zstd</span> <span
class="n">respectively</span> <span class="p">(#</span><span
class="m">1342</span><span class="p">).</span></span><span
class="line" id="LC49" lang="mosel"></span><br>
</font></div>
<div><font size="2"><span class="line" id="LC50" lang="mosel"><span
class="p"><br>
</span></span></font></div>
<div><font size="2"><span class="line" id="LC50" lang="mosel"><span
class="p">**</span> <span class="n">Detecting</span> <span
class="n">the</span> <span class="n">Zstandard</span> <span
class="p">(</span><span class="n">zstd</span><span
class="p">)</span> <span class="n">library</span> <span
class="k">in</span> <span class="n">configure</span> <span
class="n">has</span> <span class="n">been</span></span><span
class="line" id="LC51" lang="mosel"><br>
</span></font></div>
<div><font size="2"><span class="line" id="LC51" lang="mosel"><span
class="n"> fixed</span> <span class="p">(#</span><span
class="m">1343</span><span class="p">).</span></span></font></div>
<div><font size="2"><span class="line" id="LC51" lang="mosel"><span
class="p"></span></span>
<span class="line" id="LC52" lang="mosel"></span><br>
</font></div>
<div><font size="2"><span class="line" id="LC53" lang="mosel"><span
class="p">**</span> <span class="n">API</span> <span
class="k">and</span> <span class="n">ABI</span> <span
class="n">modifications</span><span class="p">:</span></span><br>
</font></div>
<div><font size="2"><span class="line" id="LC54" lang="mosel"><span
class="n">GNUTLS_NO_TICKETS_TLS12</span><span class="p">:</span>
<span class="n">New</span> <span class="n">flag</span></span><br>
</font></div>
<div><font size="2"><span class="line" id="LC55" lang="mosel"><span
class="n">gnutls_aead_cipher_set_key</span><span class="p">:</span>
<span class="n">New</span> <span class="k">function</span></span>
<br>
<span
id="m_6242587736977913994gmail-m_6890929345026607073m_-4122756204696642219gmail-LC8"
lang=""></span></font></div>
<br>
<font size="2">Getting the Software<br>
================</font></div>
<div dir="ltr"><font size="2"><br>
</font></div>
<div dir="ltr"><font size="2">GnuTLS may be downloaded directly from
<br>
<a href="https://www.gnupg.org/ftp/gcrypt/" target="_blank"
data-saferedirecturl="https://www.google.com/url?q=https://www.gnupg.org/ftp/gcrypt/&source=gmail&ust=1652432968350000&usg=AOvVaw3njjTg_V6cIskMjpkmAg7X"
moz-do-not-send="true">https://www.gnupg.org/ftp/<wbr>gcrypt/</a>
<br>
</font></div>
<div dir="ltr"><font size="2">A list of GnuTLS mirrors can be found
at</font></div>
<div dir="ltr"><font size="2">
<a href="http://www.gnutls.org/download.html" target="_blank"
data-saferedirecturl="https://www.google.com/url?q=http://www.gnutls.org/download.html&source=gmail&ust=1652432968350000&usg=AOvVaw1J-wc5GojHL2n94ox7b_09"
moz-do-not-send="true">http://www.gnutls.org/<wbr>download.html</a>
<br>
</font></div>
<div dir="ltr"><font size="2"><br>
</font></div>
<div dir="ltr"><font size="2">
Here are the XZ compressed sources:<br>
<a
href="https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.5.tar.xz"
target="_blank"
data-saferedirecturl="https://www.google.com/url?q=https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.4.tar.xz&source=gmail&ust=1652432968350000&usg=AOvVaw3ybeveKudYmPlqI6U8OXIO"
moz-do-not-send="true">https://www.gnupg.org/ftp/<wbr>gcrypt/gnutls/v3.7/gnutls-3.7.<wbr>5.tar.xz</a>
<br>
</font></div>
<div dir="ltr"><font size="2"><br>
</font></div>
<div dir="ltr"><font size="2">Here are OpenPGP detached signatures
signed using keys:</font></div>
<div dir="ltr"><font size="2">5D46CB0F763405A7053556F47A75A6<wbr>48B3F9220C</font></div>
<div dir="ltr"><font size="2">and</font><br>
<font size="2"><font size="2">462225C3B46F34879FC8496CD60584<wbr>8ED7E69871</font></font></div>
<div dir="ltr"><font size="2"><a
href="https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.5.tar.xz.sig"
target="_blank"
data-saferedirecturl="https://www.google.com/url?q=https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.4.tar.xz.sig&source=gmail&ust=1652432968350000&usg=AOvVaw1J49sWnCfoI9B3ou7WbdQ6"
moz-do-not-send="true">https://www.gnupg.org/ftp/<wbr>gcrypt/gnutls/v3.7/gnutls-3.7.<wbr>5.tar.xz.sig</a>
<br>
</font></div>
<div dir="ltr"><font size="2"><br>
</font></div>
<div dir="ltr"><font size="2">
Note that it has been signed with my openpgp key:<br>
pub ed25519 2021-12-23 [SC] [expires: 2023-12-23]<br>
5D46CB0F763405A7053556F47A75A6<wbr>48B3F9220C<br>
uid [ultimate] Zoltan Fridrich <<a
href="mailto:zfridric@redhat.com" target="_blank"
class="moz-txt-link-freetext">zfridric@redhat.com</a>><br>
sub cv25519 2021-12-23 [E] [expires: 2023-12-23]<br>
</font><br>
<font size="2">and Daiki Uenos openpgp key:<br>
pub rsa4096 2009-07-23 [SC] [expires: 2023-09-25]</font></div>
<div dir="ltr"><font size="2"> 462225C3B46F34879FC8496CD60584<wbr>8ED7E69871</font></div>
<div dir="ltr"><font size="2">uid [ultimate] Daiki Ueno
<<a
href="http://lists.gnupg.org/mailman/listinfo/gnutls-help"
target="_blank"
data-saferedirecturl="https://www.google.com/url?q=http://lists.gnupg.org/mailman/listinfo/gnutls-help&source=gmail&ust=1652432968350000&usg=AOvVaw18rxrVXHJCQuhzQT8ikMTN">ueno
at unixuser.org</a>></font></div>
<div dir="ltr"><font size="2">uid [ultimate] Daiki Ueno
<<a
href="http://lists.gnupg.org/mailman/listinfo/gnutls-help"
target="_blank"
data-saferedirecturl="https://www.google.com/url?q=http://lists.gnupg.org/mailman/listinfo/gnutls-help&source=gmail&ust=1652432968350000&usg=AOvVaw18rxrVXHJCQuhzQT8ikMTN">ueno
at gnu.org</a>></font></div>
<div dir="ltr"><font size="2">sub rsa4096 2010-02-04 [E]</font><br>
<font size="2"><br>
Regards,<br>
Zoltan</font></div>
</body>
</html>