Merge development commit 8e76332 into development-psa
Additional changes to temporarily enable running tests:
ssl_srv.c and test_suite_ecdh use mbedtls_ecp_group_load instead of
mbedtls_ecdh_setup
test_suite_ctr_drbg uses mbedtls_ctr_drbg_update instead of
mbedtls_ctr_drbg_update_ret
diff --git a/ChangeLog b/ChangeLog
index 010f9e8..35478b9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,23 +1,125 @@
mbed TLS ChangeLog (Sorted per branch, date)
-= mbed TLS 2.15.1 branch released 2018-11-30
+= mbed TLS 2.x.x branch released xxxx-xx-xx
+
+Bugfix
+ * Fix a compilation issue with mbedtls_ecp_restart_ctx not being defined
+ when MBEDTLS_ECP_ALT is defined. Reported by jwhui. Fixes #2242.
+ * Run the AD too long test only if MBEDTLS_CCM_ALT is not defined.
+ Raised as a comment in #1996.
+ * Reduce the stack consumption of mbedtls_mpi_fill_random() which could
+ previously lead to a stack overflow on constrained targets.
+ * Add `MBEDTLS_SELF_TEST` for the mbedtls_self_test functions
+ in the header files, which missed the precompilation check. #971
+ * Fix returning the value 1 when mbedtls_ecdsa_genkey failed.
+ * Remove a duplicate #include in a sample program. Fixed by Masashi Honma #2326.
+ * Remove the mbedtls namespacing from the header file, to fix a "file not found"
+ build error. Fixed by Haijun Gu #2319.
Changes
+ * Include configuration file in all header files that use configuration,
+ instead of relying on other header files that they include.
+ Inserted as an enhancement for #1371
+ * Add support for alternative CSR headers, as used by Microsoft and defined
+ in RFC 7468. Found by Michael Ernst. Fixes #767.
* Update the Mbed Crypto submodule to version 0.1.0b2.
-
-= mbed TLS 2.15.0 branch released 2018-11-23
-
-Features
- * Add an experimental build option, USE_CRYPTO_SUBMODULE, to enable use of
- Mbed Crypto as the source of the cryptography implementation.
- * Add an experimental configuration option, MBEDTLS_PSA_CRYPTO_C, to enable
- the PSA Crypto API from Mbed Crypto when additionally used with the
- USE_CRYPTO_SUBMODULE build option.
-
-Changes
* Add unit tests for AES-GCM when called through mbedtls_cipher_auth_xxx()
from the cipher abstraction layer. Fixes #2198.
+Features
+ * Add an experimental build option, USE_CRYPTO_SUBMODULE, to enable use of
+ Mbed Crypto as the source of the cryptography implementation.
+ * Add an experimental configuration option, MBEDTLS_PSA_CRYPTO_C, to enable
+ the PSA Crypto API from Mbed Crypto when additionally used with the
+ USE_CRYPTO_SUBMODULE build option.
+
+= mbed TLS 2.16.0 branch released 2018-12-21
+
+Features
+ * Add a new config.h option of MBEDTLS_CHECK_PARAMS that enables validation
+ of parameters in the API. This allows detection of obvious misuses of the
+ API, such as passing NULL pointers. The API of existing functions hasn't
+ changed, but requirements on parameters have been made more explicit in
+ the documentation. See the corresponding API documentation for each
+ function to see for which parameter values it is defined. This feature is
+ disabled by default. See its API documentation in config.h for additional
+ steps you have to take when enabling it.
+
+API Changes
+ * The following functions in the random generator modules have been
+ deprecated and replaced as shown below. The new functions change
+ the return type from void to int to allow returning error codes when
+ using MBEDTLS_<MODULE>_ALT for the underlying AES or message digest
+ primitive. Fixes #1798.
+ mbedtls_ctr_drbg_update() -> mbedtls_ctr_drbg_update_ret()
+ mbedtls_hmac_drbg_update() -> mbedtls_hmac_drbg_update_ret()
+ * Extend ECDH interface to enable alternative implementations.
+ * Deprecate error codes of the form MBEDTLS_ERR_xxx_INVALID_KEY_LENGTH for
+ ARIA, CAMELLIA and Blowfish. These error codes will be replaced by
+ the more generic per-module error codes MBEDTLS_ERR_xxx_BAD_INPUT_DATA.
+ * Additional parameter validation checks have been added for the following
+ modules - AES, ARIA, Blowfish, CAMELLIA, CCM, GCM, DHM, ECP, ECDSA, ECDH,
+ ECJPAKE, SHA, Chacha20 and Poly1305, cipher, pk, RSA, and MPI.
+ Where modules have had parameter validation added, existing parameter
+ checks may have changed. Some modules, such as Chacha20 had existing
+ parameter validation whereas other modules had little. This has now been
+ changed so that the same level of validation is present in all modules, and
+ that it is now optional with the MBEDTLS_CHECK_PARAMS flag which by default
+ is off. That means that checks which were previously present by default
+ will no longer be.
+
+New deprecations
+ * Deprecate mbedtls_ctr_drbg_update and mbedtls_hmac_drbg_update
+ in favor of functions that can return an error code.
+
+Bugfix
+ * Fix for Clang, which was reporting a warning for the bignum.c inline
+ assembly for AMD64 targets creating string literals greater than those
+ permitted by the ISO C99 standard. Found by Aaron Jones. Fixes #482.
+ * Fix runtime error in `mbedtls_platform_entropy_poll()` when run
+ through qemu user emulation. Reported and fix suggested by randombit
+ in #1212. Fixes #1212.
+ * Fix an unsafe bounds check when restoring an SSL session from a ticket.
+ This could lead to a buffer overflow, but only in case ticket authentication
+ was broken. Reported and fix suggested by Guido Vranken in #659.
+ * Add explicit integer to enumeration type casts to example program
+ programs/pkey/gen_key which previously led to compilation failure
+ on some toolchains. Reported by phoenixmcallister. Fixes #2170.
+ * Fix double initialization of ECC hardware that made some accelerators
+ hang.
+ * Clarify documentation of mbedtls_ssl_set_own_cert() regarding the absence
+ of check for certificate/key matching. Reported by Attila Molnar, #507.
+
+= mbed TLS 2.14.1 branch released 2018-11-30
+
+Security
+ * Fix timing variations and memory access variations in RSA PKCS#1 v1.5
+ decryption that could lead to a Bleichenbacher-style padding oracle
+ attack. In TLS, this affects servers that accept ciphersuites based on
+ RSA decryption (i.e. ciphersuites whose name contains RSA but not
+ (EC)DH(E)). Discovered by Eyal Ronen (Weizmann Institute), Robert Gillham
+ (University of Adelaide), Daniel Genkin (University of Michigan),
+ Adi Shamir (Weizmann Institute), David Wong (NCC Group), and Yuval Yarom
+ (University of Adelaide, Data61). The attack is described in more detail
+ in the paper available here: http://cat.eyalro.net/cat.pdf CVE-2018-19608
+ * In mbedtls_mpi_write_binary(), don't leak the exact size of the number
+ via branching and memory access patterns. An attacker who could submit
+ a plaintext for RSA PKCS#1 v1.5 decryption but only observe the timing
+ of the decryption and not its result could nonetheless decrypt RSA
+ plaintexts and forge RSA signatures. Other asymmetric algorithms may
+ have been similarly vulnerable. Reported by Eyal Ronen, Robert Gillham,
+ Daniel Genkin, Adi Shamir, David Wong and Yuval Yarom.
+ * Wipe sensitive buffers on the stack in the CTR_DRBG and HMAC_DRBG
+ modules.
+
+API Changes
+ * The new functions mbedtls_ctr_drbg_update_ret() and
+ mbedtls_hmac_drbg_update_ret() are similar to mbedtls_ctr_drbg_update()
+ and mbedtls_hmac_drbg_update() respectively, but the new functions
+ report errors whereas the old functions return void. We recommend that
+ applications use the new functions.
+>>>>>>> development
+
= mbed TLS 2.14.0 branch released 2018-11-19
Security