1 Noteworthy changes in version 1.6.5 (2023-11-16) [C22/A14/R5]
2 ------------------------------------------------
4 * Add Brainpool curve detection using parameters with compressed base
5 point. [rKeb23f853f178]
7 * New configure option --with-libtool-modification. [T6619]
9 Release-info: https://dev.gnupg.org/T6822
12 Noteworthy changes in version 1.6.4 (2023-06-19) [C22/A14/R4]
13 ------------------------------------------------
15 * Correctly detect CMS write errors. [rK9ced7706f2]
17 Release-info: https://dev.gnupg.org/T6543
20 Noteworthy changes in version 1.6.3 (2022-12-06) [C22/A14/R3]
21 ------------------------------------------------
23 * Fix another integer overflow in the CRL parser. [T6284]
25 Release-info: https://dev.gnupg.org/T6304
28 Noteworthy changes in version 1.6.2 (2022-10-07) [C22/A14/R2]
29 ------------------------------------------------
31 * Fix integer overflow in the CRL parser. [rK4b7d9cd4a0]
33 Release-info: https://dev.gnupg.org/T6230
36 Noteworthy changes in version 1.6.1 (2022-09-16) [C22/A14/R1]
37 ------------------------------------------------
39 * Allow an OCSP server not to return the sent nonce. [rK24992a4a7a]
41 Release-info: https://dev.gnupg.org/T6210
44 Noteworthy changes in version 1.6.0 (2021-06-10) [C22/A14/R0]
45 ------------------------------------------------
47 * Limited support for the Authenticated-Enveloped-Data content type.
50 * Support password based decryption. [cb7f2484a09c]
52 * Fix build problem on macOS. (#5440)
54 * Silence warnings from static analyzers. (#5395)
56 * Interface changes relative to the 1.5.0 release:
57 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
58 KSBA_CT_AUTHENVELOPED_DATA NEW.
60 Release-info: https://dev.gnupg.org/T5479
63 Noteworthy changes in version 1.5.1 (2021-04-06) [C21/A13/R1]
64 ------------------------------------------------
66 * Support Brainpool curves specified by ECDomainParameters.
68 Release-info: https://dev.gnupg.org/T5379
71 Noteworthy changes in version 1.5.0 (2020-11-18) [C21/A13/R0]
72 ------------------------------------------------
74 * ksba_cms_identify now identifies OpenPGP keyblock content.
76 * Supports TR-03111 plain format ECDSA signature verification.
78 * Fixes a CMS signed data parser bug exhibited by a somewhat strange
79 CMS message. [b6438e768c]
81 * Interface changes relative to the 1.4.0 release:
82 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
83 KSBA_CT_OPENPGP_KEYBLOCK NEW.
85 Release-info: https://dev.gnupg.org/T5146
88 Noteworthy changes in version 1.4.0 (2020-05-19) [C20/A12/R0]
89 ------------------------------------------------
91 * Supports ECDSA and EdDSA certificate creation and parsing. [#4896]
93 * Supports ECDH enveloped data. [#4920]
95 * Supports ECDSA and EdDSA signed data. [#4920]
97 * Supports rsaPSS signature verification. [#4538]
99 * Supports standard file descriptors in ksba_reader_read. [#3072]
101 * New configure flag --disable-doc.
103 * Improves supports for reproducible builds. [#4801]
105 * Allows for optional elements in keyinfo objects. [#4892]
107 * Updates the config and M4 scripts to the latest version.
109 * Fixes error detection in the CMS parser. [#4207]
111 * Fixes memory leak in ksba_cms_identify.
113 * Fixes build warnings on macOS. [#2910]
115 * Uses --disable-new-dtags if LD_LIBRARY_PATH is defined. [#4298]
117 * New constants KSBA_VERSION and KSBA_VERSION_NUMBER.
119 * New API to make creation of DER objects easy.
121 * Interface changes relative to the 1.3.5 release:
122 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
124 KSBA_VERSION_NUMBER NEW.
125 KSBA_CT_SPC_IND_DATA_CTX NEW.
129 ksba_der_release NEW.
130 ksba_der_builder_new NEW.
131 ksba_der_builder_reset NEW.
132 ksba_der_add_ptr NEW.
133 ksba_der_add_val NEW.
134 ksba_der_add_int NEW.
135 ksba_der_add_oid NEW.
136 ksba_der_add_bts NEW.
137 ksba_der_add_der NEW.
138 ksba_der_add_tag NEW.
139 ksba_der_add_end NEW.
140 ksba_der_builder_get NEW.
142 Release-info: https://dev.gnupg.org/T4943
145 Noteworthy changes in version 1.3.5 (2016-08-22) [C19/A11/R6]
146 ------------------------------------------------
148 * Limit the allowed size of complex ASN.1 objects (e.g. certificates)
151 * Avoid read access to unitialized memory.
153 * Improve detection of invalid RDNs.
155 * Encode the OCSP nonce value as an octet string as described by
159 Noteworthy changes in version 1.3.4 (2016-05-03) [C19/A11/R5]
160 ------------------------------------------------
162 * Fixed two OOB read access bugs which could be used to force a DoS.
164 * Fixed a crash due to faulty curve OID lookup code.
166 * Synced the list of supported curves with those of Libgcrypt.
168 * New configure option --enable-build-timestamp; a build timestamp is
169 not anymore used by default.
172 Noteworthy changes in version 1.3.3 (2015-04-10) [C19/A11/R4]
173 ------------------------------------------------
175 * Fixed an integer overflow in the DN decoder.
177 * Now returns an error instead of terminating the process for certain
180 * Improved the parsing of utf-8 strings in DNs.
182 * Allow building with newer versions of Bison.
184 * Improvement building on Windows with newer versions of Mingw.
187 Noteworthy changes in version 1.3.2 (2014-11-25) [C19/A11/R3]
188 ------------------------------------------------
190 * Fixed a buffer overflow in ksba_oid_to_str. [CVE-2014-9087]
193 Noteworthy changes in version 1.3.1 (2014-09-18)
194 ------------------------------------------------
196 * Fixed memory leak in CRL parsing.
198 * Build fixes for Windows, Android, and ppc64el.
201 Noteworthy changes in version 1.3.0 (2012-09-27)
202 ------------------------------------------------
204 * Changed the license of the library from GPLv3 to LGPLv3/GPLv2; see
205 the file AUTHORS for details.
210 Noteworthy changes in version 1.2.0 (2011-03-01)
211 ------------------------------------------------
213 * New functions to allow the creation of X.509 certificates.
215 * Interface changes relative to the 1.1.0 release:
216 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
217 ksba_certreq_set_serial NEW.
218 ksba_certreq_set_issuer NEW.
219 ksba_certreq_set_validity NEW.
220 ksba_certreq_set_siginfo NEW.
223 Noteworthy changes in version 1.1.0 (2010-10-26)
224 ------------------------------------------------
226 * New functions to fix a leak in dirmngr.
228 * Interface changes relative to the 1.0.0 release:
229 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
230 ksba_reader_set_release_notify NEW
231 ksba_writer_set_release_notify NEW
234 Noteworthy changes in version 1.0.8 (2010-07-15)
235 ------------------------------------------------
237 * Support for WindowsCE.
239 * Builds cleanly from SVN even when cross-compiling.
241 * Fixed a CMS parsing bug exhibited by Lotus Notes.
244 Noteworthy changes in version 1.0.7 (2009-07-03)
245 ------------------------------------------------
247 * Detect overflow while parsing OIDs. Map BER encoded OIDs to well
250 * Allow mixed case names in DNs.
253 Noteworthy changes in version 1.0.6 (2009-06-05)
254 ------------------------------------------------
256 * Support SHA-{384,512} based signature generation.
258 * The RSA algorithmIdentifier ASN.1 sequence is now emitted with an
259 explicit NULL parameter. Despite the interop testing we did in the
260 past, some software still requires this and thus we better follow
261 the best current practise.
264 Noteworthy changes in version 1.0.5 (2009-01-09)
265 ------------------------------------------------
270 Noteworthy changes in version 1.0.4 (2008-09-22)
271 ------------------------------------------------
273 * Write smimeCapabilities according to RFC3851 to help Mozilla.
277 * The visibility attribute is now used if supported by the toolchain.
280 Noteworthy changes in version 1.0.3 (2008-02-12)
281 ------------------------------------------------
285 * Include the used hash algorithm in sig-val structures.
287 * Fix for unknown tags in issuerAltName and subjectAltName.
290 Noteworthy changes in version 1.0.2 (2007-07-04)
291 ------------------------------------------------
295 * Fixed a couple of memory leaks.
297 * Experimental support for ECDSA.
299 * Minor portability fixes.
304 Noteworthy changes in version 1.0.1 (2006-11-29)
305 ------------------------------------------------
307 * Fixes for certificates lacking certain objects.
309 * Fixes to allow building on systems with a broken ar.
312 Noteworthy changes in version 1.0.0 (2006-08-31)
313 ------------------------------------------------
315 * OCSP nonces are now checked to detect replay attacks.
317 * OCSP extensions may no be retrieved.
319 * Implemented ksba_ocsp_get_responder_id which used to always return
320 an error code not_implemented. Thus we can assume that the
321 function has never been used and we don't need to see this as an
324 * Interface changes relative to the 0.9.16 release:
325 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
326 ksba_ocsp_get_extension NEW
327 ksba_ocsp_get_responder_id CHANGED: No ABI break.
330 Noteworthy changes in version 0.9.16 (2006-08-01)
331 -------------------------------------------------
333 * Fixed a character set conversion bug in BMPStrings.
335 * New function for better error reporting of DNs.
337 * Interface changes relative to the 0.9.13 release:
338 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
344 Noteworthy changes in version 0.9.15 (2006-06-20)
345 -------------------------------------------------
347 * Fixed BER parser which was broken in the last release.
350 Noteworthy changes in version 0.9.14 (2006-05-16)
351 -------------------------------------------------
353 * Fixed broken OCSP requests.
355 * Ignore invalid bytes appended to a certificate.
358 Noteworthy changes in version 0.9.13 (2005-11-24)
359 -------------------------------------------------
361 * New functions to associate user data with a certificate object.
363 * Interface changes relative to the 0.9.12 release:
364 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
365 ksba_cert_set_user_data NEW
366 ksba_cert_get_user_data NEW
369 Noteworthy changes in version 0.9.12 (2005-08-01)
370 -------------------------------------------------
372 * GeneralNames types dNSName and Uri are now supported.
374 * Minor changes to some function declarations. This should not
375 affect any compilation.
377 * Interface changes relative to the 0.9.7 release:
378 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
379 ksba_certreq_add_extension CHANGED: Argument DER is now a void*.
380 ksba_cms_set_content_enc_algo CHANGED: Argument IV is now void*.
381 ksba_cms_get_content_enc_iv CHANGED: Argument IV is now void*.
382 ksba_cms_set_message_digest CHANGED: Argument DIGEST is now
386 Noteworthy changes in version 0.9.11 (2005-04-20)
387 -------------------------------------------------
389 * New convenience API function for the subjectKeyIdentifier.
391 * Implemented the keyIdentifier part for authorityKeyIdentifier of
392 CRLs and certificates.
394 * Reason codes for CRL items are now returned.
396 * Interface changes relative to the 0.9.7 release:
397 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
398 ksba_cert_get_subj_key_id NEW.
401 Noteworthy changes in version 0.9.10 (2004-12-03)
402 -------------------------------------------------
404 * Fixed a CMS parsing bug.
407 Noteworthy changes in version 0.9.9 (2004-09-27)
408 ------------------------------------------------
410 * Fixed a couple of bugs which caused parsing errors with some
414 Noteworthy changes in version 0.9.8 (2004-07-22)
415 ------------------------------------------------
417 * Fixed a bug in the OCSP request generation.
420 Noteworthy changes in version 0.9.7 (2004-06-08)
421 ------------------------------------------------
423 * New API function to add arbitrary extensions to pkcs#10 requests.
425 * Interface changes relative to the 0.9.6 release:
426 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
427 ksba_certreq_add_extension NEW.
430 Noteworthy changes in version 0.9.6 (2004-04-29)
431 ------------------------------------------------
433 * New API functions to support v2 CRLs.
435 * Interface changes relative to the 0.9.5 release:
436 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
437 ksba_crl_get_extension NEW.
438 ksba_crl_get_auth_key_id NEW.
439 ksba_crl_get_crl_number NEW.
441 Noteworthy changes in version 0.9.5 (2004-04-06)
442 ------------------------------------------------
444 * New APIs to get hands on some more information.
446 * Interface changes relative to the 0.9.4 release:
447 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
448 ksba_ocsp_get_responder_id NEW.
449 ksba_ocsp_get_cert NEW.
450 ksba_cert_get_authority_info_access NEW.
451 ksba_cert_get_subject_info_access NEW.
452 ksba_cms_add_smime_capability NEW.
455 Noteworthy changes in version 0.9.4 (2004-02-20)
456 ------------------------------------------------
458 * Support for Extended Key Usage.
460 * ksba_cms_identify may no return a pseudo content type for pkcs#12
463 * Interface changes relative to the 0.9.3 release:
464 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
465 ksba_reader_clear NEW.
466 ksba_cert_get_ext_key_usages NEW.
470 Noteworthy changes in version 0.9.3 (2004-01-30)
471 ------------------------------------------------
473 * Fixed a serious bug shortly after the last release :-(.
476 Noteworthy changes in version 0.9.2 (2004-01-29)
477 ------------------------------------------------
479 * Cleaned up the DN label table.
481 * Fixed a bug in creating CMS signed data.
484 Noteworthy changes in version 0.9.1 (2003-12-19)
485 ------------------------------------------------
487 * Support for OCSP (rfc2560).
489 * The new function ksba_set_hash_buffer_function may be used during
490 intialization to register a simple hash fucntion for internal use
493 * Changed the license of the manual to GPL.
495 * Interface changes relative to the 0.9.0 release:
496 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
499 ksba_ocsp_response_status_t NEW.
501 void ksba_ocsp_release NEW.
502 ksba_ocsp_set_digest_algo NEW.
503 ksba_ocsp_set_requestor NEW.
504 ksba_ocsp_add_target NEW.
505 ksba_ocsp_set_nonce NEW.
506 ksba_ocsp_prepare_request NEW.
507 ksba_ocsp_hash_request NEW.
508 ksba_ocsp_set_sig_val NEW.
509 ksba_ocsp_add_cert NEW.
510 ksba_ocsp_build_request NEW.
511 ksba_ocsp_parse_response NEW.
512 ksba_ocsp_get_digest_algo NEW.
513 ksba_ocsp_hash_respons NEW.
514 ksba_ocsp_get_sig_val NEW.
515 ksba_ocsp_get_status NEW.
516 ksba_set_hash_buffer_function NEW.
519 Noteworthy changes in version 0.9.0 (2003-11-17)
520 ------------------------------------------------
522 * The time is not any longer described by time_t but through the new
523 type ksba_isotime_t which is string of excactly 15 characters in
524 ISO 8601 format (e.g. "19611107T152010") and always stored as
525 UTC. This is to allow representation of dates beyond the year 2038.
526 Comparing is a mere strcmp.
528 * All type names are nom conforming to the GNU coding standards, the
529 old names are still available as aliases but flagged as deprecated.
531 * All error codes have been replaced by libgpg-error ones. Libksba
532 now depends on this package. Remember to use the gpg_err_code
533 function when testing for error values other than success.
535 * Interface changes relative to the 0.4.7 release:
536 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
537 ksba_cert_get_validity CHANGED: Uses ksba_isotime_t instead of time_t.
538 ksba_crl_get_update_times CHANGED: Uses ksba_isotime_t instead of time_t.
539 ksba_crl_get_item CHANGED: Uses ksba_isotime_t instead of time_t.
540 ksba_cms_get_signing_time CHANGED: Uses ksba_isotime_t instead of time_t.
541 ksba_cms_set_signing_time CHANGED: Uses ksba_isotime_t instead of time_t.
542 ksba_cert_new CHANGED: Returns an error code now.
543 ksba_cms_new CHANGED: Returns an error code now.
544 ksba_name_new CHANGED: Returns an error code now.
545 ksba_writer_new CHANGED: Returns an error code now.
546 ksba_reader_new CHANGED: Returns an error code now.
547 ksba_certreq_new CHANGED: Returns an error code now.
548 ksba_crl_new CHANGED: Returns an error code now.
550 ksba_error_t NEW: Should be used instead of KsbaError.
551 ksba_cert_t NEW: Should be used instead of KsbaCert.
552 ksba_certreq_t NEW: Should be used instead of KsbaCertreq.
553 ksba_cms_t NEW: Should be used instead of KsbaCMS.
554 ksba_crl_t NEW: Should be used instead of KsbaCRL.
555 ksba_name_t NEW: Should be used instead of KsbaName.
556 ksba_sexp_t NEW: Should be used instead of KsbaSexp.
557 ksba_reader_t NEW: Should be used instead of KsbaReader.
558 ksba_writer_t NEW: Should be used instead of KsbaWriter.
559 ksba_strerror REMOVED: use gpg_strerror instead.
561 Noteworthy changes in version 0.4.7 (2003-03-17)
562 ------------------------------------------------
564 * Fixed type detection in creating DNs.
567 Noteworthy changes in version 0.4.6 (2002-12-04)
568 ------------------------------------------------
570 * DNs in pkcs#10 request are now created in reversed order as
571 specified by rfc2253.
573 * The content-type signed attribute is created.
575 * Fixed a parser bug with a id-aa-encrypKeyPref attribute.
577 * Interface changes relative to the 0.4.3 release:
578 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
579 ksba_cms_get_sigattr_oids NEW
580 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
582 Noteworthy changes in version 0.4.5 (2002-08-23)
583 ------------------------------------------------
585 * Removed some debugging output.
587 * Added an autoconf macro.
590 Noteworthy changes in version 0.4.4 (2002-08-09)
591 ------------------------------------------------
593 * Multiple signatures can now be created and parsed.
596 Noteworthy changes in version 0.4.3 (2002-06-25)
597 ------------------------------------------------
601 * Interface changes relative to the 0.4.2 release:
602 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
603 ksba_writer_write_octet_string NEW
604 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
606 Noteworthy changes in version 0.4.2 (2002-06-04)
607 ------------------------------------------------
609 * Some bug fixes and a new function.
611 * Interface changes relative to the 0.4.1 release:
612 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
613 ksba_cms_identify NEW
614 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
616 Noteworthy changes in version 0.4.1 (2002-05-03)
617 ------------------------------------------------
621 Noteworthy changes in version 0.4.0 (2002-04-15)
622 ------------------------------------------------
624 * Nearly all stuff needed for the Aegypten project is now in place.
627 Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008,
630 This file is free software; as a special exception the author gives
631 unlimited permission to copy and/or distribute it, with or without
632 modifications, as long as this notice is preserved.
634 This file is distributed in the hope that it will be useful, but
635 WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
636 implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.