Visitar URL original
Changelog for crypton-2.2.6 | Hackage
Hackage :: [Package]

Changelog for crypton-2.2.6

CHANGELOG for crypton

2.2.6

Fixes from a security review. Inputs that are invalid by the specifications are now refused rather than accepted: an OCB IV longer than 15 bytes (#357), a P-384 or P-521 point whose coordinates are not of fixed length (#362), and a CCM message given in pieces or with AAD twice (#356).

2.2.5

RSA private-key operations check their CRT result. A fault in one half of the computation could hand out a signature that reveals a prime of the key; the result is now raised back to the public exponent first, as OpenSSL does, at a cost of two or three per cent on signing.

2.2.4

New module Crypto.PubKey.RSA.Blinded. A BlindedKey carries RSA blinding from one signature or decryption to the next. The existing *Safer functions use it through a small process-wide table, and verification keeps R^2 per modulus in another.

2.2.3

crypton builds on Windows again. 2.2.2's tarball lacked a header that only Windows includes, so it built from git but not from Hackage. With 2.2.2, -f-support_s2n_bignum works around it.

2.2.2

crypton builds on an Intel Mac again. From 2.1.2 onwards, Apple's assembler rejected one of the vendored RSA assembly files, so the default configuration did not build on x86-64 macOS. With an older release, -f-support_s2n_bignum works around it.

2.2.1

A binary built on one x86-64 machine runs on another again. Since 2.1.8 the -mavx2 -mbmi2 written for the ML-KEM and ML-DSA backends have been compiling every C file in the library -- cc-options in a conditional block belong to the component, not to the block -- so the compiler put AVX2 and BMI2 into ordinary code that has no dispatch and asks nothing at runtime: Ed25519, Argon2, Curve25519, P-256, Ed448, and the older hashes among them. A binary built where AVX2 exists then died with SIGILL where it does not, in Ed25519 rather than in anything post-quantum.

The two backends also chose their implementation when the library was compiled and called it unchecked. They ask the processor now, as everything else in crypton that uses an instruction beyond the baseline already did, and fall back to the portable C where the answer is no. AArch64 asks about the ARMv8.4 Keccak instructions for the same reason.

Nothing in the API changes.

2.2.0

ProcessorOption is no longer a sum of constructors. It is a number with pattern synonyms for the names it knows, so it has Ord now and has lost Enum and Data, and a case over the names needs a catch-all. RDRAND is gone from it, and with it the support_rdrand flag. An AArch64 machine reports ARMAES and ARMPMULL where it used to report AESNI and PCLMUL.

Two more things change under a caller without the type checker saying so: MonadRandom IO draws from a per-thread generator rather than reading the system on every call, and a missing or failing entropy source raises EntropyError rather than an ErrorCall or an IOException.

2.1.10

2.1.9

2.1.8

2.1.7

RSA-PSS verification was accepting an encoding RFC 8017 says to refuse. It is a conformance fault rather than a forgery: producing such a signature takes the private key, so a third party holding a valid signature cannot turn it into one of these.

2.1.6

The license: field now says what the tree holds -- BSD-3-Clause AND MIT AND ISC -- and license-files: lists all five texts. Nothing is required of a user that was not required before; the field was simply incomplete.

2.1.5

2.1.3 and 2.1.4 cannot be built with GCC 14 or newer. This release is that fix.

2.1.4

2.1.3 could not be built from Hackage in the default configuration, and is deprecated there. This release is that fix.

2.1.3

2.1.2

2.1.1

2.1.0

2.0.1

2.0.0

Breaking changes. Input that used to be accepted is now refused: a value at or above an RSA or Rabin modulus, a signature of the wrong length or out of range, a digest too short for HOTP's dynamic truncation, a non-canonical Ed25519 signature, a PKCS#7 block size outside 1..255, and block cipher input that is not a whole number of blocks. A refused KDF, Argon2 or bcrypt parameter is reported as a CryptoError rather than raised as an ErrorCall, and CryptoError_ParameterInvalid is appended to CryptoError; tryGetShared is added beside getShared. No exported function changed its signature.

Deprecated. The eighteen curves over a binary field in Crypto.ECC.Simple.Types. They are obsolete, they are the curves whose cofactor is not 1, and they will go in a later major version. Prefer a prime curve, or X25519.

1.1.5

1.1.4

1.1.3

1.1.2

1.1.1

1.1.0

1.0.7

1.0.6

1.0.5

1.0.4

1.0.3

1.0.2

1.0.1

1.0.0

0.34

0.33

0.32

0.31

0.30

0.29

0.28

0.27

0.26

0.25

0.24

API CHANGES:

0.23

0.22

0.21

0.20

0.19

0.18

0.17

0.16

0.15

0.14

0.13

0.12

0.11

0.10

0.9

0.8

0.7

0.6

0.5

0.4

0.3

0.2

0.1