kpriv/pkgsrc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
pkgsrc/security/gnutls/PLIST

940 lines
36 KiB
Text
Raw Normal View History

Update to 3.2.2, with SunOS updates from Jörn Clausen. * Version 3.2.2 (released 2013-07-14) ** libgnutls: Several optimizations in the related to packet processing subsystems. ** libgnutls: DTLS replay detection can now be disabled (to be used in certain transport layers like SCTP). ** libgnutls: Fixes in SRTP extension generation when MKI is being used. ** libgnutls: Added ability to set hooks before or after sending or receiving any handshake message with gnutls_handshake_set_hook_function(). ** API and ABI modifications: GNUTLS_NO_REPLAY_PROTECTION: Added gnutls_certificate_set_trust_list: Added gnutls_cipher_get_tag_size: Added gnutls_record_overhead_size: Added gnutls_est_record_overhead_size: Added gnutls_handshake_set_hook_function: Added gnutls_handshake_description_get_name: Added gnutls_digest_list: Added gnutls_digest_get_id: Added gnutls_digest_get_name: Added
2013-07-15 10:19:15 +02:00
@comment $NetBSD: PLIST,v 1.45 2013/07/15 08:19:15 wiz Exp $
Updated to 1.0.0, provided by Min Sik Kim PR pkg/23661. Changes: - Exported the static SRP group parameters. - Some fixes in the certificate authenticated SRP ciphersuites. - Improved the support for draft-ietf-tls-srp-05. The two-phase handshake is now fully supported without any interaction with the application layer (except for a callback). - Some fixes in the openpgp authentication. - Removed the Twofish cipher. - The openssl compatibility layer was moved to gnutls-openssl library instead of being included in the gnutls-extra library. - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. - Building with openpgp support is now mandatory. - gnutls4 compatibility header is no longer included by default in gnutls.h. - gnutls8 function usage yelds a deprecation warning in gcc3. - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid() functions have a raw_flag parameter added. - The certtool utility can now generate PKCS #12 structures without specifying a certificate. - Added capability to read CRLs to certtool. - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER to properly set the required buffer size. - Corrected a bug in libgcrypt detection. And more...
2003-12-06 01:52:21 +01:00
bin/certtool
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
bin/danetool
Import of gnutls-0.8.7: GNU Transport Layer Security library. GnuTLS is a portable ANSI C based library which implements the TLS 1.0 and SSL 3.0 protocols. The library does not include any patented algorithms and is available under the GNU Lesser GPL license. Important features of the GnuTLS library include: - Thread safety - Support for both TLS 1.0 and SSL 3.0 protocols - Support for both X.509 and OpenPGP certificates - Support for basic parsing and verification of certificates - Support for SRP for TLS authentication - Support for TLS Extension mechanism - Support for TLS Compression Methods Additionaly GnuTLS provides an emulation API for the widely used OpenSSL library, to ease integration with existing applications. Package provided by Juan RP via pkgsrc-wip with modifications by me.
2003-05-14 05:46:44 +02:00
bin/gnutls-cli
bin/gnutls-cli-debug
bin/gnutls-serv
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
bin/ocsptool
Update to 1.3.2: * Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
2005-12-31 01:02:58 +01:00
bin/psktool
Changes 1.0.13: - Some complilation fixes. - Added the --xml parameter to the certtool utility. Changes 1.0.12: - Corrected bug in OpenPGP key loading using a callback. - Renamed gnutls-srpcrypt to srptool - Allow handshake requests by the client. * Things backported from the development branch: - Added support for authority key identifier and the extended key usage X.509 extension fields. The certtoool was updated to support them. - Added batch support to certtool. Now it can use templates. - The RC2 cipher is no more included. The one in libgcrypt is now used. Changes 1.0.11: - Added gnutls_sign_algorithm_get_name() and gnutls_pk_algorithm_get_name() - Corrected bug in TLS renegotiation. Changes 1.0.10: - Corrected bug in RSA parameters handling which could cause unexpected crashes. - Corrected bug in SSL 3.0 authentication.
2004-05-22 12:09:53 +02:00
bin/srptool
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
include/gnutls/abstract.h
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
include/gnutls/compat.h
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
include/gnutls/crypto.h
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
include/gnutls/dtls.h
Import of gnutls-0.8.7: GNU Transport Layer Security library. GnuTLS is a portable ANSI C based library which implements the TLS 1.0 and SSL 3.0 protocols. The library does not include any patented algorithms and is available under the GNU Lesser GPL license. Important features of the GnuTLS library include: - Thread safety - Support for both TLS 1.0 and SSL 3.0 protocols - Support for both X.509 and OpenPGP certificates - Support for basic parsing and verification of certificates - Support for SRP for TLS authentication - Support for TLS Extension mechanism - Support for TLS Compression Methods Additionaly GnuTLS provides an emulation API for the widely used OpenSSL library, to ease integration with existing applications. Package provided by Juan RP via pkgsrc-wip with modifications by me.
2003-05-14 05:46:44 +02:00
include/gnutls/gnutls.h
Renable and fix build of C++ library under Mac OS X. Bump package revision because of this fix.
2007-01-24 16:58:04 +01:00
include/gnutls/gnutlsxx.h
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
include/gnutls/ocsp.h
Updated to 1.0.0, provided by Min Sik Kim PR pkg/23661. Changes: - Exported the static SRP group parameters. - Some fixes in the certificate authenticated SRP ciphersuites. - Improved the support for draft-ietf-tls-srp-05. The two-phase handshake is now fully supported without any interaction with the application layer (except for a callback). - Some fixes in the openpgp authentication. - Removed the Twofish cipher. - The openssl compatibility layer was moved to gnutls-openssl library instead of being included in the gnutls-extra library. - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. - Building with openpgp support is now mandatory. - gnutls4 compatibility header is no longer included by default in gnutls.h. - gnutls8 function usage yelds a deprecation warning in gcc3. - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid() functions have a raw_flag parameter added. - The certtool utility can now generate PKCS #12 structures without specifying a certificate. - Added capability to read CRLs to certtool. - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER to properly set the required buffer size. - Corrected a bug in libgcrypt detection. And more...
2003-12-06 01:52:21 +01:00
include/gnutls/openpgp.h
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
include/gnutls/pkcs11.h
Updated to 1.0.0, provided by Min Sik Kim PR pkg/23661. Changes: - Exported the static SRP group parameters. - Some fixes in the certificate authenticated SRP ciphersuites. - Improved the support for draft-ietf-tls-srp-05. The two-phase handshake is now fully supported without any interaction with the application layer (except for a callback). - Some fixes in the openpgp authentication. - Removed the Twofish cipher. - The openssl compatibility layer was moved to gnutls-openssl library instead of being included in the gnutls-extra library. - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. - Building with openpgp support is now mandatory. - gnutls4 compatibility header is no longer included by default in gnutls.h. - gnutls8 function usage yelds a deprecation warning in gcc3. - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid() functions have a raw_flag parameter added. - The certtool utility can now generate PKCS #12 structures without specifying a certificate. - Added capability to read CRLs to certtool. - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER to properly set the required buffer size. - Corrected a bug in libgcrypt detection. And more...
2003-12-06 01:52:21 +01:00
include/gnutls/pkcs12.h
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
include/gnutls/tpm.h
Updated to 1.0.0, provided by Min Sik Kim PR pkg/23661. Changes: - Exported the static SRP group parameters. - Some fixes in the certificate authenticated SRP ciphersuites. - Improved the support for draft-ietf-tls-srp-05. The two-phase handshake is now fully supported without any interaction with the application layer (except for a callback). - Some fixes in the openpgp authentication. - Removed the Twofish cipher. - The openssl compatibility layer was moved to gnutls-openssl library instead of being included in the gnutls-extra library. - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. - Building with openpgp support is now mandatory. - gnutls4 compatibility header is no longer included by default in gnutls.h. - gnutls8 function usage yelds a deprecation warning in gcc3. - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid() functions have a raw_flag parameter added. - The certtool utility can now generate PKCS #12 structures without specifying a certificate. - Added capability to read CRLs to certtool. - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER to properly set the required buffer size. - Corrected a bug in libgcrypt detection. And more...
2003-12-06 01:52:21 +01:00
include/gnutls/x509.h
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
include/gnutls/xssl.h
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
info/gnutls-client-server-use-case.png
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
info/gnutls-guile.info
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
info/gnutls-handshake-sequence.png
info/gnutls-handshake-state.png
info/gnutls-internals.png
info/gnutls-layers.png
info/gnutls-logo.png
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
info/gnutls-modauth.png
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
info/gnutls-pgp.png
info/gnutls-x509.png
Update to 2.0.3: * Version 2.0.3 (released 2007-11-10) ** This version backports several fixes from the 2.1.x branch. ** Fixed PKCS #3 parameter export. ** Added gnutls_record_disable_padding() to allow servers talking to buggy clients that complain if the TLS 1.0 record protocol padding is used. ** Introduced gnutls_session_enable_compatibility_mode() to allow enabling all supported compatibility options (like disabling padding). ** Corrected bug which did not allow a server to run without supporting certificates. ** API and ABI modifications: gnutls_session_enable_compatibility_mode: ADDED gnutls_record_disable_padding: ADDED Add LICENSE, commented out; it contains both LGPL-2.1 and GPL2 code.
2007-11-11 20:28:27 +01:00
info/gnutls.info
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
info/pkcs11-vision.png
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
lib/libgnutls-xssl.la
Import of gnutls-0.8.7: GNU Transport Layer Security library. GnuTLS is a portable ANSI C based library which implements the TLS 1.0 and SSL 3.0 protocols. The library does not include any patented algorithms and is available under the GNU Lesser GPL license. Important features of the GnuTLS library include: - Thread safety - Support for both TLS 1.0 and SSL 3.0 protocols - Support for both X.509 and OpenPGP certificates - Support for basic parsing and verification of certificates - Support for SRP for TLS authentication - Support for TLS Extension mechanism - Support for TLS Compression Methods Additionaly GnuTLS provides an emulation API for the widely used OpenSSL library, to ease integration with existing applications. Package provided by Juan RP via pkgsrc-wip with modifications by me.
2003-05-14 05:46:44 +02:00
lib/libgnutls.la
Renable and fix build of C++ library under Mac OS X. Bump package revision because of this fix.
2007-01-24 16:58:04 +01:00
lib/libgnutlsxx.la
Update to 1.0.22: Version 1.0.22 (28/10/2004) - Print DN of certificates with unknown characters in them, but in hexform only. - Corrected bug in _gnutls_x509_get_dn_oid(), and returns the actual OID. - Added second precision to the X.509 parsing functions. - Add parameter --la-file to libgnutls-config and libgnutls-extra-config, tiny patch contributed by Joe Orton <joe@manyfish.co.uk>. - Add pkg-config meta files, suggested by Stéphane LOEUILLET <stephane.loeuillet@tiscali.fr>. - Fix memory initializaion bug in gnutls_certificate_set_x509_trust, tiny patch by Aleix Conchillo Flaque <aleix@member.fsf.org>. - Fix certtool --password for PKCS #12, back ported from 1.1.x branch. - Fix library order in libgnutls*-config --libs output, to permit static linking, reported by Yoann Vandoorselaere <yoann@prelude-ids.org>. Version 1.0.21 (07/10/2004) - Fix memory leak in gnutls_certificate_verify_peers and gnutls_certificate_free_credentials, report and patch by Simon Posnjak <simon.posnjak@cetrtapot.si>. - Fix crash in `certtool --to-p12 --load-privkey foo', i.e. exporting a key and no certificate to PKCS#12. - Fix objdir != srcdir builds, reported by "Gerrit P. Haase" <gp@familiehaase.de>. - Avoid redefining getpass if system already has it, reported by Yoann Vandoorselaere <yoann@prelude-ids.org>. - Add new example "ex-rfc2818" for certificate verification, from Nikos. - Known bug: the library require snprintf.
2004-11-08 20:34:46 +01:00
lib/pkgconfig/gnutls.pc
Updated to 1.0.0, provided by Min Sik Kim PR pkg/23661. Changes: - Exported the static SRP group parameters. - Some fixes in the certificate authenticated SRP ciphersuites. - Improved the support for draft-ietf-tls-srp-05. The two-phase handshake is now fully supported without any interaction with the application layer (except for a callback). - Some fixes in the openpgp authentication. - Removed the Twofish cipher. - The openssl compatibility layer was moved to gnutls-openssl library instead of being included in the gnutls-extra library. - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. - Building with openpgp support is now mandatory. - gnutls4 compatibility header is no longer included by default in gnutls.h. - gnutls8 function usage yelds a deprecation warning in gcc3. - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid() functions have a raw_flag parameter added. - The certtool utility can now generate PKCS #12 structures without specifying a certificate. - Added capability to read CRLs to certtool. - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER to properly set the required buffer size. - Corrected a bug in libgcrypt detection. And more...
2003-12-06 01:52:21 +01:00
man/man1/certtool.1
man/man1/gnutls-cli-debug.1
man/man1/gnutls-cli.1
man/man1/gnutls-serv.1
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man1/ocsptool.1
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man1/p11tool.1
Update to 1.3.2: * Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
2005-12-31 01:02:58 +01:00
man/man1/psktool.1
update to 1.0.20 changes: -bugfixes -adds some limits to the verification functions to avoid denial of service attacks -selftests added
2004-08-27 15:16:16 +02:00
man/man1/srptool.1
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man1/tpmtool.1
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_alert_get.3
man/man3/gnutls_alert_get_name.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_alert_get_strname.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_alert_send.3
man/man3/gnutls_alert_send_appropriate.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_alpn_get_selected_protocol.3
man/man3/gnutls_alpn_set_protocols.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_anon_allocate_client_credentials.3
man/man3/gnutls_anon_allocate_server_credentials.3
man/man3/gnutls_anon_free_client_credentials.3
man/man3/gnutls_anon_free_server_credentials.3
man/man3/gnutls_anon_set_params_function.3
man/man3/gnutls_anon_set_server_dh_params.3
Update to 1.3.2: * Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
2005-12-31 01:02:58 +01:00
man/man3/gnutls_anon_set_server_params_function.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_auth_client_get_type.3
man/man3/gnutls_auth_get_type.3
man/man3/gnutls_auth_server_get_type.3
man/man3/gnutls_bye.3
man/man3/gnutls_certificate_activation_time_peers.3
man/man3/gnutls_certificate_allocate_credentials.3
man/man3/gnutls_certificate_client_get_request_status.3
man/man3/gnutls_certificate_expiration_time_peers.3
man/man3/gnutls_certificate_free_ca_names.3
man/man3/gnutls_certificate_free_cas.3
man/man3/gnutls_certificate_free_credentials.3
man/man3/gnutls_certificate_free_crls.3
man/man3/gnutls_certificate_free_keys.3
update to 2.12.7 changes: -bugfixes -minor feature additions pkgsrc change: since the pkg was changed to build against "nettle" instead of libgcrypt (whether this was a good idea or not...), the latter isn't needed anymore, so remove the stale dependency This can cause build breakage -- in this case addition of a local dependency should restore the old state. (This dependency is technically unnecessary often, but the assumption that gnutls needs libgcrypt is sometimes hardwired in configure scripts and/or code.)
2011-07-11 18:10:29 +02:00
man/man3/gnutls_certificate_get_issuer.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_get_ours.3
man/man3/gnutls_certificate_get_peers.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_certificate_get_peers_subkey_id.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_send_x509_rdn_sequence.3
man/man3/gnutls_certificate_server_set_request.3
man/man3/gnutls_certificate_set_dh_params.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_certificate_set_key.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_certificate_set_ocsp_status_request_file.3
man/man3/gnutls_certificate_set_ocsp_status_request_function.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_set_openpgp_key.3
man/man3/gnutls_certificate_set_openpgp_key_file.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_certificate_set_openpgp_key_file2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_set_openpgp_key_mem.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_certificate_set_openpgp_key_mem2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_set_openpgp_keyring_file.3
man/man3/gnutls_certificate_set_openpgp_keyring_mem.3
man/man3/gnutls_certificate_set_params_function.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_certificate_set_pin_function.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_certificate_set_retrieve_function.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_certificate_set_retrieve_function2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_set_rsa_export_params.3
Update to 3.2.2, with SunOS updates from Jörn Clausen. * Version 3.2.2 (released 2013-07-14) ** libgnutls: Several optimizations in the related to packet processing subsystems. ** libgnutls: DTLS replay detection can now be disabled (to be used in certain transport layers like SCTP). ** libgnutls: Fixes in SRTP extension generation when MKI is being used. ** libgnutls: Added ability to set hooks before or after sending or receiving any handshake message with gnutls_handshake_set_hook_function(). ** API and ABI modifications: GNUTLS_NO_REPLAY_PROTECTION: Added gnutls_certificate_set_trust_list: Added gnutls_cipher_get_tag_size: Added gnutls_record_overhead_size: Added gnutls_est_record_overhead_size: Added gnutls_handshake_set_hook_function: Added gnutls_handshake_description_get_name: Added gnutls_digest_list: Added gnutls_digest_get_id: Added gnutls_digest_get_name: Added
2013-07-15 10:19:15 +02:00
man/man3/gnutls_certificate_set_trust_list.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_set_verify_flags.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_certificate_set_verify_function.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_set_verify_limits.3
man/man3/gnutls_certificate_set_x509_crl.3
man/man3/gnutls_certificate_set_x509_crl_file.3
man/man3/gnutls_certificate_set_x509_crl_mem.3
man/man3/gnutls_certificate_set_x509_key.3
man/man3/gnutls_certificate_set_x509_key_file.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_certificate_set_x509_key_file2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_set_x509_key_mem.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_certificate_set_x509_key_mem2.3
Update to 1.3.2: * Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
2005-12-31 01:02:58 +01:00
man/man3/gnutls_certificate_set_x509_simple_pkcs12_file.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_certificate_set_x509_simple_pkcs12_mem.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_certificate_set_x509_system_trust.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_set_x509_trust.3
man/man3/gnutls_certificate_set_x509_trust_file.3
man/man3/gnutls_certificate_set_x509_trust_mem.3
man/man3/gnutls_certificate_type_get.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_certificate_type_get_id.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_type_get_name.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_certificate_type_list.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_type_set_priority.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_certificate_verification_status_print.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_certificate_verify_peers2.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_certificate_verify_peers3.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_check_version.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_cipher_add_auth.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_cipher_decrypt.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_cipher_decrypt2.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_cipher_deinit.3
man/man3/gnutls_cipher_encrypt.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_cipher_encrypt2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_cipher_get.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_cipher_get_block_size.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_cipher_get_id.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_cipher_get_iv_size.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_cipher_get_key_size.3
man/man3/gnutls_cipher_get_name.3
Update to 3.2.2, with SunOS updates from Jörn Clausen. * Version 3.2.2 (released 2013-07-14) ** libgnutls: Several optimizations in the related to packet processing subsystems. ** libgnutls: DTLS replay detection can now be disabled (to be used in certain transport layers like SCTP). ** libgnutls: Fixes in SRTP extension generation when MKI is being used. ** libgnutls: Added ability to set hooks before or after sending or receiving any handshake message with gnutls_handshake_set_hook_function(). ** API and ABI modifications: GNUTLS_NO_REPLAY_PROTECTION: Added gnutls_certificate_set_trust_list: Added gnutls_cipher_get_tag_size: Added gnutls_record_overhead_size: Added gnutls_est_record_overhead_size: Added gnutls_handshake_set_hook_function: Added gnutls_handshake_description_get_name: Added gnutls_digest_list: Added gnutls_digest_get_id: Added gnutls_digest_get_name: Added
2013-07-15 10:19:15 +02:00
man/man3/gnutls_cipher_get_tag_size.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_cipher_init.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_cipher_list.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_cipher_set_iv.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_cipher_set_priority.3
man/man3/gnutls_cipher_suite_get_name.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_cipher_suite_info.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_cipher_tag.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_compression_get.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_compression_get_id.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_compression_get_name.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_compression_list.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_compression_set_priority.3
man/man3/gnutls_credentials_clear.3
man/man3/gnutls_credentials_set.3
man/man3/gnutls_db_check_entry.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_db_check_entry_time.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_db_get_ptr.3
man/man3/gnutls_db_remove_session.3
man/man3/gnutls_db_set_cache_expiration.3
man/man3/gnutls_db_set_ptr.3
man/man3/gnutls_db_set_remove_function.3
man/man3/gnutls_db_set_retrieve_function.3
man/man3/gnutls_db_set_store_function.3
man/man3/gnutls_deinit.3
man/man3/gnutls_dh_get_group.3
man/man3/gnutls_dh_get_peers_public_bits.3
man/man3/gnutls_dh_get_prime_bits.3
man/man3/gnutls_dh_get_pubkey.3
man/man3/gnutls_dh_get_secret_bits.3
man/man3/gnutls_dh_params_cpy.3
man/man3/gnutls_dh_params_deinit.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_dh_params_export2_pkcs3.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_dh_params_export_pkcs3.3
man/man3/gnutls_dh_params_export_raw.3
man/man3/gnutls_dh_params_generate2.3
man/man3/gnutls_dh_params_import_pkcs3.3
man/man3/gnutls_dh_params_import_raw.3
man/man3/gnutls_dh_params_init.3
man/man3/gnutls_dh_set_prime_bits.3
Update to 3.2.2, with SunOS updates from Jörn Clausen. * Version 3.2.2 (released 2013-07-14) ** libgnutls: Several optimizations in the related to packet processing subsystems. ** libgnutls: DTLS replay detection can now be disabled (to be used in certain transport layers like SCTP). ** libgnutls: Fixes in SRTP extension generation when MKI is being used. ** libgnutls: Added ability to set hooks before or after sending or receiving any handshake message with gnutls_handshake_set_hook_function(). ** API and ABI modifications: GNUTLS_NO_REPLAY_PROTECTION: Added gnutls_certificate_set_trust_list: Added gnutls_cipher_get_tag_size: Added gnutls_record_overhead_size: Added gnutls_est_record_overhead_size: Added gnutls_handshake_set_hook_function: Added gnutls_handshake_description_get_name: Added gnutls_digest_list: Added gnutls_digest_get_id: Added gnutls_digest_get_name: Added
2013-07-15 10:19:15 +02:00
man/man3/gnutls_digest_get_id.3
man/man3/gnutls_digest_get_name.3
man/man3/gnutls_digest_list.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_dtls_cookie_send.3
man/man3/gnutls_dtls_cookie_verify.3
man/man3/gnutls_dtls_get_data_mtu.3
man/man3/gnutls_dtls_get_mtu.3
man/man3/gnutls_dtls_get_timeout.3
man/man3/gnutls_dtls_prestate_set.3
update to 3.0.24 changes: -better IPv6 support -bugfixes -minor improvements
2012-10-10 13:44:30 +02:00
man/man3/gnutls_dtls_set_data_mtu.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_dtls_set_mtu.3
man/man3/gnutls_dtls_set_timeouts.3
man/man3/gnutls_ecc_curve_get.3
man/man3/gnutls_ecc_curve_get_name.3
man/man3/gnutls_ecc_curve_get_size.3
man/man3/gnutls_ecc_curve_list.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_error_is_fatal.3
man/man3/gnutls_error_to_alert.3
Update to 3.2.2, with SunOS updates from Jörn Clausen. * Version 3.2.2 (released 2013-07-14) ** libgnutls: Several optimizations in the related to packet processing subsystems. ** libgnutls: DTLS replay detection can now be disabled (to be used in certain transport layers like SCTP). ** libgnutls: Fixes in SRTP extension generation when MKI is being used. ** libgnutls: Added ability to set hooks before or after sending or receiving any handshake message with gnutls_handshake_set_hook_function(). ** API and ABI modifications: GNUTLS_NO_REPLAY_PROTECTION: Added gnutls_certificate_set_trust_list: Added gnutls_cipher_get_tag_size: Added gnutls_record_overhead_size: Added gnutls_est_record_overhead_size: Added gnutls_handshake_set_hook_function: Added gnutls_handshake_description_get_name: Added gnutls_digest_list: Added gnutls_digest_get_id: Added gnutls_digest_get_name: Added
2013-07-15 10:19:15 +02:00
man/man3/gnutls_est_record_overhead_size.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_fingerprint.3
man/man3/gnutls_global_deinit.3
man/man3/gnutls_global_init.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_global_set_audit_log_function.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_global_set_log_function.3
man/man3/gnutls_global_set_log_level.3
man/man3/gnutls_global_set_mem_functions.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_global_set_mutex.3
update to 2.12.7 changes: -bugfixes -minor feature additions pkgsrc change: since the pkg was changed to build against "nettle" instead of libgcrypt (whether this was a good idea or not...), the latter isn't needed anymore, so remove the stale dependency This can cause build breakage -- in this case addition of a local dependency should restore the old state. (This dependency is technically unnecessary often, but the assumption that gnutls needs libgcrypt is sometimes hardwired in configure scripts and/or code.)
2011-07-11 18:10:29 +02:00
man/man3/gnutls_global_set_time_function.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_handshake.3
Update to 3.2.2, with SunOS updates from Jörn Clausen. * Version 3.2.2 (released 2013-07-14) ** libgnutls: Several optimizations in the related to packet processing subsystems. ** libgnutls: DTLS replay detection can now be disabled (to be used in certain transport layers like SCTP). ** libgnutls: Fixes in SRTP extension generation when MKI is being used. ** libgnutls: Added ability to set hooks before or after sending or receiving any handshake message with gnutls_handshake_set_hook_function(). ** API and ABI modifications: GNUTLS_NO_REPLAY_PROTECTION: Added gnutls_certificate_set_trust_list: Added gnutls_cipher_get_tag_size: Added gnutls_record_overhead_size: Added gnutls_est_record_overhead_size: Added gnutls_handshake_set_hook_function: Added gnutls_handshake_description_get_name: Added gnutls_digest_list: Added gnutls_digest_get_id: Added gnutls_digest_get_name: Added
2013-07-15 10:19:15 +02:00
man/man3/gnutls_handshake_description_get_name.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_handshake_get_last_in.3
man/man3/gnutls_handshake_get_last_out.3
Update to 3.2.2, with SunOS updates from Jörn Clausen. * Version 3.2.2 (released 2013-07-14) ** libgnutls: Several optimizations in the related to packet processing subsystems. ** libgnutls: DTLS replay detection can now be disabled (to be used in certain transport layers like SCTP). ** libgnutls: Fixes in SRTP extension generation when MKI is being used. ** libgnutls: Added ability to set hooks before or after sending or receiving any handshake message with gnutls_handshake_set_hook_function(). ** API and ABI modifications: GNUTLS_NO_REPLAY_PROTECTION: Added gnutls_certificate_set_trust_list: Added gnutls_cipher_get_tag_size: Added gnutls_record_overhead_size: Added gnutls_est_record_overhead_size: Added gnutls_handshake_set_hook_function: Added gnutls_handshake_description_get_name: Added gnutls_digest_list: Added gnutls_digest_get_id: Added gnutls_digest_get_name: Added
2013-07-15 10:19:15 +02:00
man/man3/gnutls_handshake_set_hook_function.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_handshake_set_max_packet_length.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_handshake_set_post_client_hello_function.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_handshake_set_private_extensions.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_handshake_set_random.3
man/man3/gnutls_handshake_set_timeout.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_hash.3
man/man3/gnutls_hash_deinit.3
man/man3/gnutls_hash_fast.3
man/man3/gnutls_hash_get_len.3
man/man3/gnutls_hash_init.3
man/man3/gnutls_hash_output.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_heartbeat_allowed.3
man/man3/gnutls_heartbeat_enable.3
man/man3/gnutls_heartbeat_get_timeout.3
man/man3/gnutls_heartbeat_ping.3
man/man3/gnutls_heartbeat_pong.3
man/man3/gnutls_heartbeat_set_timeouts.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_hex2bin.3
Update to 1.3.2: * Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
2005-12-31 01:02:58 +01:00
man/man3/gnutls_hex_decode.3
man/man3/gnutls_hex_encode.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_hmac.3
man/man3/gnutls_hmac_deinit.3
man/man3/gnutls_hmac_fast.3
man/man3/gnutls_hmac_get_len.3
man/man3/gnutls_hmac_init.3
man/man3/gnutls_hmac_output.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_hmac_set_nonce.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_init.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_key_generate.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_kx_get.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_kx_get_id.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_kx_get_name.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_kx_list.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_kx_set_priority.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_load_file.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_mac_get.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_mac_get_id.3
man/man3/gnutls_mac_get_key_size.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_mac_get_name.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_mac_get_nonce_size.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_mac_list.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_mac_set_priority.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_ocsp_req_add_cert.3
man/man3/gnutls_ocsp_req_add_cert_id.3
man/man3/gnutls_ocsp_req_deinit.3
man/man3/gnutls_ocsp_req_export.3
man/man3/gnutls_ocsp_req_get_cert_id.3
man/man3/gnutls_ocsp_req_get_extension.3
man/man3/gnutls_ocsp_req_get_nonce.3
man/man3/gnutls_ocsp_req_get_version.3
man/man3/gnutls_ocsp_req_import.3
man/man3/gnutls_ocsp_req_init.3
man/man3/gnutls_ocsp_req_print.3
man/man3/gnutls_ocsp_req_randomize_nonce.3
man/man3/gnutls_ocsp_req_set_extension.3
man/man3/gnutls_ocsp_req_set_nonce.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_ocsp_resp_check_crt.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_ocsp_resp_deinit.3
man/man3/gnutls_ocsp_resp_export.3
man/man3/gnutls_ocsp_resp_get_certs.3
man/man3/gnutls_ocsp_resp_get_extension.3
man/man3/gnutls_ocsp_resp_get_nonce.3
man/man3/gnutls_ocsp_resp_get_produced.3
man/man3/gnutls_ocsp_resp_get_responder.3
man/man3/gnutls_ocsp_resp_get_response.3
man/man3/gnutls_ocsp_resp_get_signature.3
man/man3/gnutls_ocsp_resp_get_signature_algorithm.3
man/man3/gnutls_ocsp_resp_get_single.3
man/man3/gnutls_ocsp_resp_get_status.3
man/man3/gnutls_ocsp_resp_get_version.3
man/man3/gnutls_ocsp_resp_import.3
man/man3/gnutls_ocsp_resp_init.3
man/man3/gnutls_ocsp_resp_print.3
man/man3/gnutls_ocsp_resp_verify.3
man/man3/gnutls_ocsp_resp_verify_direct.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_ocsp_status_request_enable_client.3
man/man3/gnutls_ocsp_status_request_get.3
man/man3/gnutls_ocsp_status_request_is_checked.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_openpgp_crt_check_hostname.3
man/man3/gnutls_openpgp_crt_deinit.3
man/man3/gnutls_openpgp_crt_export.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_openpgp_crt_export2.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_openpgp_crt_get_auth_subkey.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_openpgp_crt_get_creation_time.3
man/man3/gnutls_openpgp_crt_get_expiration_time.3
man/man3/gnutls_openpgp_crt_get_fingerprint.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_openpgp_crt_get_key_id.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_openpgp_crt_get_key_usage.3
man/man3/gnutls_openpgp_crt_get_name.3
man/man3/gnutls_openpgp_crt_get_pk_algorithm.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_openpgp_crt_get_pk_dsa_raw.3
man/man3/gnutls_openpgp_crt_get_pk_rsa_raw.3
man/man3/gnutls_openpgp_crt_get_preferred_key_id.3
man/man3/gnutls_openpgp_crt_get_revoked_status.3
man/man3/gnutls_openpgp_crt_get_subkey_count.3
man/man3/gnutls_openpgp_crt_get_subkey_creation_time.3
man/man3/gnutls_openpgp_crt_get_subkey_expiration_time.3
man/man3/gnutls_openpgp_crt_get_subkey_fingerprint.3
man/man3/gnutls_openpgp_crt_get_subkey_id.3
man/man3/gnutls_openpgp_crt_get_subkey_idx.3
man/man3/gnutls_openpgp_crt_get_subkey_pk_algorithm.3
man/man3/gnutls_openpgp_crt_get_subkey_pk_dsa_raw.3
man/man3/gnutls_openpgp_crt_get_subkey_pk_rsa_raw.3
man/man3/gnutls_openpgp_crt_get_subkey_revoked_status.3
man/man3/gnutls_openpgp_crt_get_subkey_usage.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_openpgp_crt_get_version.3
man/man3/gnutls_openpgp_crt_import.3
man/man3/gnutls_openpgp_crt_init.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_openpgp_crt_print.3
man/man3/gnutls_openpgp_crt_set_preferred_key_id.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_openpgp_crt_verify_ring.3
man/man3/gnutls_openpgp_crt_verify_self.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_openpgp_keyring_check_id.3
man/man3/gnutls_openpgp_keyring_deinit.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_openpgp_keyring_get_crt.3
man/man3/gnutls_openpgp_keyring_get_crt_count.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_openpgp_keyring_import.3
man/man3/gnutls_openpgp_keyring_init.3
man/man3/gnutls_openpgp_privkey_deinit.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_openpgp_privkey_export.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_openpgp_privkey_export2.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_openpgp_privkey_export_dsa_raw.3
man/man3/gnutls_openpgp_privkey_export_rsa_raw.3
man/man3/gnutls_openpgp_privkey_export_subkey_dsa_raw.3
man/man3/gnutls_openpgp_privkey_export_subkey_rsa_raw.3
man/man3/gnutls_openpgp_privkey_get_fingerprint.3
man/man3/gnutls_openpgp_privkey_get_key_id.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_openpgp_privkey_get_pk_algorithm.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_openpgp_privkey_get_preferred_key_id.3
man/man3/gnutls_openpgp_privkey_get_revoked_status.3
man/man3/gnutls_openpgp_privkey_get_subkey_count.3
man/man3/gnutls_openpgp_privkey_get_subkey_creation_time.3
man/man3/gnutls_openpgp_privkey_get_subkey_fingerprint.3
man/man3/gnutls_openpgp_privkey_get_subkey_id.3
man/man3/gnutls_openpgp_privkey_get_subkey_idx.3
man/man3/gnutls_openpgp_privkey_get_subkey_pk_algorithm.3
man/man3/gnutls_openpgp_privkey_get_subkey_revoked_status.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_openpgp_privkey_import.3
man/man3/gnutls_openpgp_privkey_init.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_openpgp_privkey_sec_param.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_openpgp_privkey_set_preferred_key_id.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_openpgp_privkey_sign_hash.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_openpgp_send_cert.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_openpgp_set_recv_key_function.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_pcert_deinit.3
man/man3/gnutls_pcert_import_openpgp.3
man/man3/gnutls_pcert_import_openpgp_raw.3
man/man3/gnutls_pcert_import_x509.3
man/man3/gnutls_pcert_import_x509_raw.3
man/man3/gnutls_pcert_list_import_x509_raw.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_pem_base64_decode.3
man/man3/gnutls_pem_base64_decode_alloc.3
man/man3/gnutls_pem_base64_encode.3
man/man3/gnutls_pem_base64_encode_alloc.3
man/man3/gnutls_perror.3
man/man3/gnutls_pk_algorithm_get_name.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pk_bits_to_sec_param.3
Changes 2.6.0: * libgnutls: Correct printing and parsing of IPv6 addresses. * libgnutls-openssl: fix out of bounds access. * certtool: Use inet_pton for parsing IPv6 addresses. * Added API to replace and update the crypto backend. * certtool: can add several subject alternative names via template file. * opencdk: Parse (but not decrypt) encrypted secret keys. * more...
2008-10-18 13:55:11 +02:00
man/man3/gnutls_pk_get_id.3
man/man3/gnutls_pk_get_name.3
man/man3/gnutls_pk_list.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_pk_to_sign.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pkcs11_add_provider.3
man/man3/gnutls_pkcs11_copy_secret_key.3
man/man3/gnutls_pkcs11_copy_x509_crt.3
man/man3/gnutls_pkcs11_copy_x509_privkey.3
man/man3/gnutls_pkcs11_deinit.3
man/man3/gnutls_pkcs11_delete_url.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pkcs11_get_pin_function.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pkcs11_init.3
man/man3/gnutls_pkcs11_obj_deinit.3
man/man3/gnutls_pkcs11_obj_export.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pkcs11_obj_export2.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pkcs11_obj_export_url.3
man/man3/gnutls_pkcs11_obj_get_info.3
man/man3/gnutls_pkcs11_obj_get_type.3
man/man3/gnutls_pkcs11_obj_import_url.3
man/man3/gnutls_pkcs11_obj_init.3
man/man3/gnutls_pkcs11_obj_list_import_url.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pkcs11_obj_list_import_url2.3
man/man3/gnutls_pkcs11_obj_set_pin_function.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pkcs11_privkey_deinit.3
man/man3/gnutls_pkcs11_privkey_export_url.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_pkcs11_privkey_generate.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pkcs11_privkey_generate2.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pkcs11_privkey_get_info.3
man/man3/gnutls_pkcs11_privkey_get_pk_algorithm.3
man/man3/gnutls_pkcs11_privkey_import_url.3
man/man3/gnutls_pkcs11_privkey_init.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pkcs11_privkey_set_pin_function.3
man/man3/gnutls_pkcs11_privkey_status.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_pkcs11_reinit.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pkcs11_set_pin_function.3
man/man3/gnutls_pkcs11_set_token_function.3
man/man3/gnutls_pkcs11_token_get_flags.3
man/man3/gnutls_pkcs11_token_get_info.3
man/man3/gnutls_pkcs11_token_get_mechanism.3
man/man3/gnutls_pkcs11_token_get_url.3
man/man3/gnutls_pkcs11_token_init.3
man/man3/gnutls_pkcs11_token_set_pin.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_pkcs11_type_get_name.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_pkcs12_bag_decrypt.3
man/man3/gnutls_pkcs12_bag_deinit.3
man/man3/gnutls_pkcs12_bag_encrypt.3
man/man3/gnutls_pkcs12_bag_get_count.3
man/man3/gnutls_pkcs12_bag_get_data.3
man/man3/gnutls_pkcs12_bag_get_friendly_name.3
man/man3/gnutls_pkcs12_bag_get_key_id.3
man/man3/gnutls_pkcs12_bag_get_type.3
man/man3/gnutls_pkcs12_bag_init.3
man/man3/gnutls_pkcs12_bag_set_crl.3
man/man3/gnutls_pkcs12_bag_set_crt.3
man/man3/gnutls_pkcs12_bag_set_data.3
man/man3/gnutls_pkcs12_bag_set_friendly_name.3
man/man3/gnutls_pkcs12_bag_set_key_id.3
man/man3/gnutls_pkcs12_deinit.3
man/man3/gnutls_pkcs12_export.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pkcs12_export2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_pkcs12_generate_mac.3
man/man3/gnutls_pkcs12_get_bag.3
man/man3/gnutls_pkcs12_import.3
man/man3/gnutls_pkcs12_init.3
man/man3/gnutls_pkcs12_set_bag.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pkcs12_simple_parse.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_pkcs12_verify_mac.3
man/man3/gnutls_pkcs7_deinit.3
man/man3/gnutls_pkcs7_delete_crl.3
man/man3/gnutls_pkcs7_delete_crt.3
man/man3/gnutls_pkcs7_export.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pkcs7_export2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_pkcs7_get_crl_count.3
man/man3/gnutls_pkcs7_get_crl_raw.3
man/man3/gnutls_pkcs7_get_crt_count.3
man/man3/gnutls_pkcs7_get_crt_raw.3
man/man3/gnutls_pkcs7_import.3
man/man3/gnutls_pkcs7_init.3
man/man3/gnutls_pkcs7_set_crl.3
man/man3/gnutls_pkcs7_set_crl_raw.3
man/man3/gnutls_pkcs7_set_crt.3
man/man3/gnutls_pkcs7_set_crt_raw.3
Update to 1.3.2: * Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
2005-12-31 01:02:58 +01:00
man/man3/gnutls_prf.3
man/man3/gnutls_prf_raw.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_priority_certificate_type_list.3
man/man3/gnutls_priority_compression_list.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_priority_deinit.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_priority_ecc_curve_list.3
man/man3/gnutls_priority_get_cipher_suite_index.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_priority_init.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_priority_protocol_list.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_priority_set.3
man/man3/gnutls_priority_set_direct.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_priority_sign_list.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_privkey_decrypt_data.3
man/man3/gnutls_privkey_deinit.3
man/man3/gnutls_privkey_get_pk_algorithm.3
man/man3/gnutls_privkey_get_type.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_privkey_import_ext.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_privkey_import_ext2.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_privkey_import_openpgp.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_privkey_import_openpgp_raw.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_privkey_import_pkcs11.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_privkey_import_pkcs11_url.3
man/man3/gnutls_privkey_import_tpm_raw.3
man/man3/gnutls_privkey_import_tpm_url.3
man/man3/gnutls_privkey_import_url.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_privkey_import_x509.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_privkey_import_x509_raw.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_privkey_init.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_privkey_set_pin_function.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_privkey_sign_data.3
man/man3/gnutls_privkey_sign_hash.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_privkey_sign_raw_data.3
man/man3/gnutls_privkey_status.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_protocol_get_id.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_protocol_get_name.3
man/man3/gnutls_protocol_get_version.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_protocol_list.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_protocol_set_priority.3
Update to 1.3.2: * Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
2005-12-31 01:02:58 +01:00
man/man3/gnutls_psk_allocate_client_credentials.3
man/man3/gnutls_psk_allocate_server_credentials.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_psk_client_get_hint.3
Update to 1.3.2: * Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
2005-12-31 01:02:58 +01:00
man/man3/gnutls_psk_free_client_credentials.3
man/man3/gnutls_psk_free_server_credentials.3
man/man3/gnutls_psk_server_get_username.3
man/man3/gnutls_psk_set_client_credentials.3
man/man3/gnutls_psk_set_client_credentials_function.3
man/man3/gnutls_psk_set_params_function.3
man/man3/gnutls_psk_set_server_credentials_file.3
man/man3/gnutls_psk_set_server_credentials_function.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_psk_set_server_credentials_hint.3
Update to 1.3.2: * Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
2005-12-31 01:02:58 +01:00
man/man3/gnutls_psk_set_server_dh_params.3
man/man3/gnutls_psk_set_server_params_function.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_deinit.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_pubkey_encrypt_data.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_export.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pubkey_export2.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_get_key_id.3
man/man3/gnutls_pubkey_get_key_usage.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_pubkey_get_openpgp_key_id.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_get_pk_algorithm.3
man/man3/gnutls_pubkey_get_pk_dsa_raw.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_pubkey_get_pk_ecc_raw.3
man/man3/gnutls_pubkey_get_pk_ecc_x962.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_get_pk_rsa_raw.3
man/man3/gnutls_pubkey_get_preferred_hash_algorithm.3
man/man3/gnutls_pubkey_get_verify_algorithm.3
man/man3/gnutls_pubkey_import.3
man/man3/gnutls_pubkey_import_dsa_raw.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_pubkey_import_ecc_raw.3
man/man3/gnutls_pubkey_import_ecc_x962.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_import_openpgp.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pubkey_import_openpgp_raw.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_import_pkcs11.3
man/man3/gnutls_pubkey_import_pkcs11_url.3
man/man3/gnutls_pubkey_import_privkey.3
man/man3/gnutls_pubkey_import_rsa_raw.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pubkey_import_tpm_raw.3
man/man3/gnutls_pubkey_import_tpm_url.3
man/man3/gnutls_pubkey_import_url.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_import_x509.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pubkey_import_x509_crq.3
man/man3/gnutls_pubkey_import_x509_raw.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_init.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pubkey_print.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_set_key_usage.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_pubkey_set_pin_function.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_verify_data.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_pubkey_verify_data2.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_pubkey_verify_hash.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_pubkey_verify_hash2.3
man/man3/gnutls_random_art.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_range_split.3
man/man3/gnutls_record_can_use_length_hiding.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_record_check_pending.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_record_cork.3
Update to 2.0.3: * Version 2.0.3 (released 2007-11-10) ** This version backports several fixes from the 2.1.x branch. ** Fixed PKCS #3 parameter export. ** Added gnutls_record_disable_padding() to allow servers talking to buggy clients that complain if the TLS 1.0 record protocol padding is used. ** Introduced gnutls_session_enable_compatibility_mode() to allow enabling all supported compatibility options (like disabling padding). ** Corrected bug which did not allow a server to run without supporting certificates. ** API and ABI modifications: gnutls_session_enable_compatibility_mode: ADDED gnutls_record_disable_padding: ADDED Add LICENSE, commented out; it contains both LGPL-2.1 and GPL2 code.
2007-11-11 20:28:27 +01:00
man/man3/gnutls_record_disable_padding.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_record_get_direction.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_record_get_discarded.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_record_get_max_size.3
Update to 3.2.2, with SunOS updates from Jörn Clausen. * Version 3.2.2 (released 2013-07-14) ** libgnutls: Several optimizations in the related to packet processing subsystems. ** libgnutls: DTLS replay detection can now be disabled (to be used in certain transport layers like SCTP). ** libgnutls: Fixes in SRTP extension generation when MKI is being used. ** libgnutls: Added ability to set hooks before or after sending or receiving any handshake message with gnutls_handshake_set_hook_function(). ** API and ABI modifications: GNUTLS_NO_REPLAY_PROTECTION: Added gnutls_certificate_set_trust_list: Added gnutls_cipher_get_tag_size: Added gnutls_record_overhead_size: Added gnutls_est_record_overhead_size: Added gnutls_handshake_set_hook_function: Added gnutls_handshake_description_get_name: Added gnutls_digest_list: Added gnutls_digest_get_id: Added gnutls_digest_get_name: Added
2013-07-15 10:19:15 +02:00
man/man3/gnutls_record_overhead_size.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_record_recv.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_record_recv_seq.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_record_send.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_record_send_range.3
man/man3/gnutls_record_set_max_empty_records.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_record_set_max_size.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_record_set_timeout.3
man/man3/gnutls_record_uncork.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_rehandshake.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_rnd.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_rnd_refresh.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_rsa_export_get_modulus_bits.3
man/man3/gnutls_rsa_export_get_pubkey.3
man/man3/gnutls_rsa_params_cpy.3
man/man3/gnutls_rsa_params_deinit.3
man/man3/gnutls_rsa_params_export_pkcs1.3
man/man3/gnutls_rsa_params_export_raw.3
man/man3/gnutls_rsa_params_generate2.3
man/man3/gnutls_rsa_params_import_pkcs1.3
man/man3/gnutls_rsa_params_import_raw.3
man/man3/gnutls_rsa_params_init.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_safe_renegotiation_status.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_sec_param_get_name.3
man/man3/gnutls_sec_param_to_pk_bits.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_server_name_get.3
man/man3/gnutls_server_name_set.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_session_channel_binding.3
Update to 2.0.3: * Version 2.0.3 (released 2007-11-10) ** This version backports several fixes from the 2.1.x branch. ** Fixed PKCS #3 parameter export. ** Added gnutls_record_disable_padding() to allow servers talking to buggy clients that complain if the TLS 1.0 record protocol padding is used. ** Introduced gnutls_session_enable_compatibility_mode() to allow enabling all supported compatibility options (like disabling padding). ** Corrected bug which did not allow a server to run without supporting certificates. ** API and ABI modifications: gnutls_session_enable_compatibility_mode: ADDED gnutls_record_disable_padding: ADDED Add LICENSE, commented out; it contains both LGPL-2.1 and GPL2 code.
2007-11-11 20:28:27 +01:00
man/man3/gnutls_session_enable_compatibility_mode.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_session_force_valid.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_session_get_data.3
Update to 1.3.2: * Version 1.3.2 (released 2005-12-15) ** GnuTLS now support TLS Inner application (TLS/IA). This is per draft-funk-tls-inner-application-extension-01. This functionality is added to libgnutls-extra, so it is licensed under the GNU General Public License. ** New APIs to access the TLS Pseudo-Random-Function (PRF). The PRF is used by some protocols building on TLS, such as EAP-PEAP and EAP-TTLS. One function to access the raw PRF and one to access the PRF seeded with the client/server random fields are provided. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** New APIs to acceess the client and server random fields in a session. These fields can be useful by protocols using TLS. Note that these fields are typically used as input to the TLS PRF, and if this is your intended use, you should use the TLS PRF API that use the client/server random field directly. Suggested by Jouni Malinen <jkmaline@cc.hut.fi>. ** Internal type cleanups. The uint8, uint16, uint32 types have been replaced by uint8_t, uint16_t, uint32_t. Gnulib is used to guarantee the presence of correct types on platforms that lack them. The uint type have been replaced by unsigned. ** API and ABI modifications: New functions to invoke the TLS Pseudo-Random-Function (PRF): gnutls_prf gnutls_prf_raw New functions to retrieve the session's client and server random values: gnutls_session_get_server_random gnutls_session_get_client_random New function, to perform TLS/IA handshake: gnutls_ia_handshake New function to decide whether to do a TLS/IA handshake: gnutls_ia_handshake_p New functions to allocate a TLS/IA credential: gnutls_ia_allocate_client_credentials gnutls_ia_free_client_credentials gnutls_ia_allocate_server_credentials gnutls_ia_free_server_credentials New functions to handle the AVP callback: gnutls_ia_set_client_avp_function gnutls_ia_set_client_avp_ptr gnutls_ia_get_client_avp_ptr gnutls_ia_set_server_avp_function gnutls_ia_set_server_avp_ptr gnutls_ia_get_server_avp_ptr New functions, to toggle TLS/IA application phases: gnutls_ia_require_inner_phase New function to mix session keys with inner secret: gnutls_ia_permute_inner_secret Low-level API (used internally by gnutls_ia_handshake): gnutls_ia_endphase_send gnutls_ia_send gnutls_ia_recv New functions that can be used after successful TLS/IA negotiation: gnutls_ia_generate_challenge gnutls_ia_extract_inner_secret Enum type with TLS/IA modes: gnutls_ia_mode_t Enum type with TLS/IA packet types: gnutls_ia_apptype_t Enum values for TLS/IA alerts: GNUTLS_A_INNER_APPLICATION_FAILURE GNUTLS_A_INNER_APPLICATION_VERIFICATION New error codes, to signal when an application phase has finished: GNUTLS_E_WARNING_IA_IPHF_RECEIVED GNUTLS_E_WARNING_IA_FPHF_RECEIVED New error code to signal TLS/IA verify failure: GNUTLS_E_IA_VERIFY_FAILED * Version 1.3.1 (released 2005-12-08) ** Support for DHE-PSK cipher suites has been added. This method offers perfect forward secrecy. ** Fix gnutls-cli STARTTLS hang when SIGINT is sent too quickly, thanks to Otto Maddox <ottomaddox@fastmail.fm> and Nozomu Ando <nand@mac.com>. ** Corrected a bug in certtool for 64 bit machines. Reported by Max Kellermann <max@duempel.org>. ** New function to set a X.509 private key and certificate pairs, and/or CRLs, from an PKCS#12 file, suggested by Emile van Bergen <emile@e-advies.nl>. The integrity of the PKCS#12 file is protected through a password based MAC; public-key based signatures for integrity protection are not supported. PKCS#12 bags may be encrypted using password derived symmetric keys, public-key based encryption is not supported. The PKCS#8 keys may be encrypted using passwords. The API use the same password for all operations. We believe that any more flexibility create too much complexity that would hurt overall security, but may add more PKCS#12 related APIs if real-world experience indicate otherwise. ** gnutls_x509_privkey_import_pkcs8 now accept unencrypted PEM PKCS#8 keys, reported by Emile van Bergen <emile@e-advies.nl>. This will enable "certtool -k -8" to parse those keys. ** Certtool now generate keys in unencrypted PKCS#8 format for empty passwords. Use "certtool -p -8" and press press enter at the prompt. Earlier, certtool would have encrypted the key using an empty password. ** Certtool now accept --password for --key-info and encrypted PKCS#8 keys. Earlier it would have prompted the user for it, even if --password was supplied. ** Added self test of PKCS#8 parsing. Unencrypted and encrypted (pbeWithSHAAnd3-KeyTripleDES-CBC and pbeWithSHAAnd40BitRC2-CBC) formats are tested. The test is in tests/pkcs8. ** API and ABI modifications: New function to set X.509 credentials from a PKCS#12 file: gnutls_certificate_set_x509_simple_pkcs12_file New gnutls_kx_algorithm_t enum type: GNUTLS_KX_DHE_PSK New API to return session data (better data types than gnutls_session_get_data): gnutls_session_get_data2 New API to set PSK Diffie-Hellman parameters: gnutls_psk_set_server_dh_params * Version 1.3.0 (2005-11-15) ** Support for TLS Pre-Shared Key (TLS-PSK) ciphersuites have been added. This add several new APIs, see below. Read the updated manual for more information. A new self test "pskself" has been added, that will test this functionality. ** The session resumption data are now system independent. ** The code has been re-indented to conform to the GNU coding style. ** Removed the RIPEMD ciphersuites. ** Added a discussion of the internals of gnutls in manual. ** Fixes for Tru64 UNIX 4.0D that lack MAP_FAILED, from Albert Chin. ** Remove trailing comma in enums, for IBM C v6, from Albert Chin. ** Make sure config.h is included first in a few files, from Albert Chin. ** Don't use C++ comments ("//") as they are invalid, from Albert Chin. ** Don't install SRP programs and man pages if --disable-srp-authentication, from Albert Chin. ** API and ABI modifications: New gnutls_kx_algorithm_t key exchange type: GNUTLS_KX_PSK New gnutls_credentials_type_t credential type: GNUTLS_CRD_PSK New credential types: gnutls_psk_server_credentials_t gnutls_psk_client_credentials_t New functions to allocate PSK credentials: gnutls_psk_allocate_client_credentials gnutls_psk_free_client_credentials gnutls_psk_free_server_credentials gnutls_psk_allocate_server_credentials New enum type for PSK key flags: gnutls_psk_key_flags New function prototypes for credential callback: gnutls_psk_client_credentials_function gnutls_psk_server_credentials_function New function to set PSK username and key: gnutls_psk_set_client_credentials New function to set PSK passwd file: gnutls_psk_set_server_credentials_file New function to extract PSK user in server: gnutls_psk_server_get_username New functions to set PSK callback: gnutls_psk_set_server_credentials_function gnutls_psk_set_client_credentials_function Use size_t instead of int for output size parameter: gnutls_srp_base64_encode gnutls_srp_base64_decode
2005-12-31 01:02:58 +01:00
man/man3/gnutls_session_get_data2.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_session_get_desc.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_session_get_id.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_session_get_id2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_session_get_ptr.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_session_get_random.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_session_is_resumed.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_session_resumption_requested.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_session_set_data.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_session_set_id.3
update to 3.0.24 changes: -better IPv6 support -bugfixes -minor improvements
2012-10-10 13:44:30 +02:00
man/man3/gnutls_session_set_premaster.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_session_set_ptr.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_session_ticket_enable_client.3
man/man3/gnutls_session_ticket_enable_server.3
man/man3/gnutls_session_ticket_key_generate.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_set_default_export_priority.3
man/man3/gnutls_set_default_priority.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_sign_algorithm_get.3
man/man3/gnutls_sign_algorithm_get_client.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_sign_algorithm_get_requested.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_sign_callback_get.3
man/man3/gnutls_sign_callback_set.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_sign_get_hash_algorithm.3
Changes 2.6.0: * libgnutls: Correct printing and parsing of IPv6 addresses. * libgnutls-openssl: fix out of bounds access. * certtool: Use inet_pton for parsing IPv6 addresses. * Added API to replace and update the crypto backend. * certtool: can add several subject alternative names via template file. * opencdk: Parse (but not decrypt) encrypted secret keys. * more...
2008-10-18 13:55:11 +02:00
man/man3/gnutls_sign_get_id.3
man/man3/gnutls_sign_get_name.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_sign_get_pk_algorithm.3
man/man3/gnutls_sign_is_secure.3
Changes 2.6.0: * libgnutls: Correct printing and parsing of IPv6 addresses. * libgnutls-openssl: fix out of bounds access. * certtool: Use inet_pton for parsing IPv6 addresses. * Added API to replace and update the crypto backend. * certtool: can add several subject alternative names via template file. * opencdk: Parse (but not decrypt) encrypted secret keys. * more...
2008-10-18 13:55:11 +02:00
man/man3/gnutls_sign_list.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_srp_allocate_client_credentials.3
man/man3/gnutls_srp_allocate_server_credentials.3
man/man3/gnutls_srp_base64_decode.3
man/man3/gnutls_srp_base64_decode_alloc.3
man/man3/gnutls_srp_base64_encode.3
man/man3/gnutls_srp_base64_encode_alloc.3
man/man3/gnutls_srp_free_client_credentials.3
man/man3/gnutls_srp_free_server_credentials.3
man/man3/gnutls_srp_server_get_username.3
man/man3/gnutls_srp_set_client_credentials.3
man/man3/gnutls_srp_set_client_credentials_function.3
Changes 2.6.0: * libgnutls: Correct printing and parsing of IPv6 addresses. * libgnutls-openssl: fix out of bounds access. * certtool: Use inet_pton for parsing IPv6 addresses. * Added API to replace and update the crypto backend. * certtool: can add several subject alternative names via template file. * opencdk: Parse (but not decrypt) encrypted secret keys. * more...
2008-10-18 13:55:11 +02:00
man/man3/gnutls_srp_set_prime_bits.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_srp_set_server_credentials_file.3
man/man3/gnutls_srp_set_server_credentials_function.3
man/man3/gnutls_srp_verifier.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_srtp_get_keys.3
man/man3/gnutls_srtp_get_mki.3
man/man3/gnutls_srtp_get_profile_id.3
man/man3/gnutls_srtp_get_profile_name.3
man/man3/gnutls_srtp_get_selected_profile.3
man/man3/gnutls_srtp_set_mki.3
man/man3/gnutls_srtp_set_profile.3
man/man3/gnutls_srtp_set_profile_direct.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_store_commitment.3
man/man3/gnutls_store_pubkey.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_strerror.3
Changes 2.6.0: * libgnutls: Correct printing and parsing of IPv6 addresses. * libgnutls-openssl: fix out of bounds access. * certtool: Use inet_pton for parsing IPv6 addresses. * Added API to replace and update the crypto backend. * certtool: can add several subject alternative names via template file. * opencdk: Parse (but not decrypt) encrypted secret keys. * more...
2008-10-18 13:55:11 +02:00
man/man3/gnutls_strerror_name.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_supplemental_get_name.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_tdb_deinit.3
man/man3/gnutls_tdb_init.3
man/man3/gnutls_tdb_set_store_commitment_func.3
man/man3/gnutls_tdb_set_store_func.3
man/man3/gnutls_tdb_set_verify_func.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_tpm_get_registered.3
man/man3/gnutls_tpm_key_list_deinit.3
man/man3/gnutls_tpm_key_list_get_url.3
man/man3/gnutls_tpm_privkey_delete.3
man/man3/gnutls_tpm_privkey_generate.3
man/man3/gnutls_transport_get_int.3
man/man3/gnutls_transport_get_int2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_transport_get_ptr.3
man/man3/gnutls_transport_get_ptr2.3
Update to 1.6.1: * Version 1.6.1 (released 2006-12-28) ** Fix the list of trusted CAs that server's send to clients. Before, the list contained issuer DN's instead of subject DN's of the trusted CAs. Reported by Max Kellermann ** Fix gnutls_certificate_set_x509_crl to initialize the CRL before using it. Reported by Max Kellermann ** Encode UID fields in DN's as DirectoryString. Before GnuTLS encoded and parsed UID fields as IA5String. This was incorrect, it should have used DirectoryString. Now it will use DirectoryString for the UID field, but for backwards compatibility it will also accept IA5String UID's. Reported by Max Kellermann ** Fix ./configure failure with non-GCC compilers. This fixes the following error message: configure: error: conditional "HAVE_LD_OUTPUT_DEF" was never defined. Reported by "Michael C. Vergallen" * Version 1.6.0 (released 2006-11-17) ** No changes since 1.5.5. The major changes compared to the 1.4.x branch are: *** A GnuTLS C++ library is part of the official distribution. Currently there are no examples or documentation, but hopefully this will change. See gnutlsxx.h for the API. *** Windows is a supported platform. There are, however, two know bugs. One is related to select() in command line tools (not, nota bene, in the library), the other is a problem with libgcrypt that causes delays. Help is needed to resolve those issues, so we feel we can't delay the release because of this. *** New APIs for custom push/pull function error reporting. The new APIs are gnutls_transport_set_errno and gnutls_transport_set_global_errno. See the release notes for version 1.5.4 for more information. *** Self tests are run under valgrind, if available. See --disable-valgrind.
2007-01-20 18:38:06 +01:00
man/man3/gnutls_transport_set_errno.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_transport_set_errno_function.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_transport_set_int.3
man/man3/gnutls_transport_set_int2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_transport_set_ptr.3
man/man3/gnutls_transport_set_ptr2.3
man/man3/gnutls_transport_set_pull_function.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_transport_set_pull_timeout_function.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_transport_set_push_function.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_transport_set_vec_push_function.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_url_is_supported.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_verify_stored_pubkey.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crl_check_issuer.3
man/man3/gnutls_x509_crl_deinit.3
man/man3/gnutls_x509_crl_export.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crl_export2.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_crl_get_authority_key_gn_serial.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crl_get_authority_key_id.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crl_get_crt_count.3
man/man3/gnutls_x509_crl_get_crt_serial.3
man/man3/gnutls_x509_crl_get_dn_oid.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crl_get_extension_data.3
man/man3/gnutls_x509_crl_get_extension_info.3
man/man3/gnutls_x509_crl_get_extension_oid.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crl_get_issuer_dn.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crl_get_issuer_dn2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crl_get_issuer_dn_by_oid.3
man/man3/gnutls_x509_crl_get_next_update.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crl_get_number.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_crl_get_raw_issuer_dn.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crl_get_signature.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crl_get_signature_algorithm.3
man/man3/gnutls_x509_crl_get_this_update.3
man/man3/gnutls_x509_crl_get_version.3
man/man3/gnutls_x509_crl_import.3
man/man3/gnutls_x509_crl_init.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_crl_list_import.3
man/man3/gnutls_x509_crl_list_import2.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crl_print.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_crl_privkey_sign.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crl_set_authority_key_id.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crl_set_crt.3
man/man3/gnutls_x509_crl_set_crt_serial.3
man/man3/gnutls_x509_crl_set_next_update.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crl_set_number.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crl_set_this_update.3
man/man3/gnutls_x509_crl_set_version.3
man/man3/gnutls_x509_crl_sign.3
man/man3/gnutls_x509_crl_sign2.3
man/man3/gnutls_x509_crl_verify.3
man/man3/gnutls_x509_crq_deinit.3
man/man3/gnutls_x509_crq_export.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crq_export2.3
Update to 1.2.1: * Version 1.2.1 (2005-04-04) - gnutls_bye() will no longer fail when RDWR is used and application data are available for reading. - Added more strict checks for the SRP parameters (g,n), when they are not in the included list. - Added warning to certtool when MD5 is being used for digital signatures. - Optimizations ("-O2 -finline-functions") are not enabled by default, instead the standard autoconf defaults are used. Use `./configure CFLAGS="-O2 -finline-functions"' to get the old optimizations. - Added the option --get-dh-params to certtool, in order to get the included in the library primes and generators. - Improved the semantics of GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, to allow only trusted Version 1 CAs and introduced GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT which has the old semantics. - Nettle self tests now build properly, reported by Pierre - Eliminated some memory leaks in DHE and RSA-EXPORT cipher suites. Reported by Yoann Vandoorselaere - Added the functions: gnutls_x509_crt_list_import(), gnutls_x509_crq_get_attribute_by_oid(), gnutls_x509_crq_set_attribute_by_oid() and gnutls_x509_crt_set_extension_by_oid(). - If the library has been compiled with features disabled, a warning is issued during the compilation of any program.
2005-04-08 17:50:41 +02:00
man/man3/gnutls_x509_crq_get_attribute_by_oid.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crq_get_attribute_data.3
man/man3/gnutls_x509_crq_get_attribute_info.3
man/man3/gnutls_x509_crq_get_basic_constraints.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crq_get_challenge_password.3
man/man3/gnutls_x509_crq_get_dn.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crq_get_dn2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crq_get_dn_by_oid.3
man/man3/gnutls_x509_crq_get_dn_oid.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crq_get_extension_by_oid.3
man/man3/gnutls_x509_crq_get_extension_data.3
man/man3/gnutls_x509_crq_get_extension_info.3
man/man3/gnutls_x509_crq_get_key_id.3
man/man3/gnutls_x509_crq_get_key_purpose_oid.3
man/man3/gnutls_x509_crq_get_key_rsa_raw.3
man/man3/gnutls_x509_crq_get_key_usage.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crq_get_pk_algorithm.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_crq_get_private_key_usage_period.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crq_get_subject_alt_name.3
man/man3/gnutls_x509_crq_get_subject_alt_othername_oid.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crq_get_version.3
man/man3/gnutls_x509_crq_import.3
man/man3/gnutls_x509_crq_init.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crq_print.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_crq_privkey_sign.3
Update to 1.2.1: * Version 1.2.1 (2005-04-04) - gnutls_bye() will no longer fail when RDWR is used and application data are available for reading. - Added more strict checks for the SRP parameters (g,n), when they are not in the included list. - Added warning to certtool when MD5 is being used for digital signatures. - Optimizations ("-O2 -finline-functions") are not enabled by default, instead the standard autoconf defaults are used. Use `./configure CFLAGS="-O2 -finline-functions"' to get the old optimizations. - Added the option --get-dh-params to certtool, in order to get the included in the library primes and generators. - Improved the semantics of GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, to allow only trusted Version 1 CAs and introduced GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT which has the old semantics. - Nettle self tests now build properly, reported by Pierre - Eliminated some memory leaks in DHE and RSA-EXPORT cipher suites. Reported by Yoann Vandoorselaere - Added the functions: gnutls_x509_crt_list_import(), gnutls_x509_crq_get_attribute_by_oid(), gnutls_x509_crq_set_attribute_by_oid() and gnutls_x509_crt_set_extension_by_oid(). - If the library has been compiled with features disabled, a warning is issued during the compilation of any program.
2005-04-08 17:50:41 +02:00
man/man3/gnutls_x509_crq_set_attribute_by_oid.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crq_set_basic_constraints.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crq_set_challenge_password.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crq_set_dn.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crq_set_dn_by_oid.3
man/man3/gnutls_x509_crq_set_key.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crq_set_key_purpose_oid.3
Changes 2.6.0: * libgnutls: Correct printing and parsing of IPv6 addresses. * libgnutls-openssl: fix out of bounds access. * certtool: Use inet_pton for parsing IPv6 addresses. * Added API to replace and update the crypto backend. * certtool: can add several subject alternative names via template file. * opencdk: Parse (but not decrypt) encrypted secret keys. * more...
2008-10-18 13:55:11 +02:00
man/man3/gnutls_x509_crq_set_key_rsa_raw.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crq_set_key_usage.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_crq_set_private_key_usage_period.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_crq_set_pubkey.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crq_set_subject_alt_name.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crq_set_version.3
man/man3/gnutls_x509_crq_sign.3
man/man3/gnutls_x509_crq_sign2.3
update to 2.12.7 changes: -bugfixes -minor feature additions pkgsrc change: since the pkg was changed to build against "nettle" instead of libgcrypt (whether this was a good idea or not...), the latter isn't needed anymore, so remove the stale dependency This can cause build breakage -- in this case addition of a local dependency should restore the old state. (This dependency is technically unnecessary often, but the assumption that gnutls needs libgcrypt is sometimes hardwired in configure scripts and/or code.)
2011-07-11 18:10:29 +02:00
man/man3/gnutls_x509_crq_verify.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_check_hostname.3
man/man3/gnutls_x509_crt_check_issuer.3
man/man3/gnutls_x509_crt_check_revocation.3
man/man3/gnutls_x509_crt_cpy_crl_dist_points.3
man/man3/gnutls_x509_crt_deinit.3
man/man3/gnutls_x509_crt_export.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crt_export2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_activation_time.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_crt_get_authority_info_access.3
man/man3/gnutls_x509_crt_get_authority_key_gn_serial.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_authority_key_id.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crt_get_basic_constraints.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_ca_status.3
man/man3/gnutls_x509_crt_get_crl_dist_points.3
man/man3/gnutls_x509_crt_get_dn.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crt_get_dn2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_dn_by_oid.3
man/man3/gnutls_x509_crt_get_dn_oid.3
man/man3/gnutls_x509_crt_get_expiration_time.3
man/man3/gnutls_x509_crt_get_extension_by_oid.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crt_get_extension_data.3
man/man3/gnutls_x509_crt_get_extension_info.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_extension_oid.3
man/man3/gnutls_x509_crt_get_fingerprint.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crt_get_issuer.3
update to 2.10.1 many fixes and API extensions, but still binary compatible afaict
2010-09-01 18:32:17 +02:00
man/man3/gnutls_x509_crt_get_issuer_alt_name.3
man/man3/gnutls_x509_crt_get_issuer_alt_name2.3
man/man3/gnutls_x509_crt_get_issuer_alt_othername_oid.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_issuer_dn.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crt_get_issuer_dn2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_issuer_dn_by_oid.3
man/man3/gnutls_x509_crt_get_issuer_dn_oid.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_crt_get_issuer_unique_id.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_key_id.3
man/man3/gnutls_x509_crt_get_key_purpose_oid.3
man/man3/gnutls_x509_crt_get_key_usage.3
man/man3/gnutls_x509_crt_get_pk_algorithm.3
man/man3/gnutls_x509_crt_get_pk_dsa_raw.3
man/man3/gnutls_x509_crt_get_pk_rsa_raw.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crt_get_policy.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_crt_get_preferred_hash_algorithm.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_crt_get_private_key_usage_period.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crt_get_proxy.3
Update to 1.6.3: * Version 1.6.3 (released 2007-05-26) ** New API functions to extract DER encoded X.509 Subject/Issuer DN. Suggested by Nate Nielsen <nielsen-list@memberwebs.com>. Backported from the 1.7.x branch, see <http://lists.gnu.org/archive/html/help-gnutls/2007-05/msg00029.html>. ** Have PKCS8 parser return better error codes. Reported by Nate Nielsen <nielsen-list@memberwebs.com>, see <http://lists.gnupg.org/pipermail/gnutls-dev/2007-May/001653.html> and <http://lists.gnupg.org/pipermail/gnutls-dev/2007-May/001654.html>. ** Fix mem leak for sessions with client authentication via certificates. Reported by Andrew W. Nosenko <andrew.w.nosenko@gmail.com>, see <http://lists.gnupg.org/pipermail/gnutls-dev/2007-April/001539.html>. ** Fix building of 'tlsia' self test. Earlier some gcc are known to build tlsia linking to $prefix/lib/libgnutls-extra.so rather than the libgnutls-extra.so in the build directory, even though command line parameters look OK. Changing order of some parameters fixes it. ** API and ABI modifications: gnutls_x509_crt_get_raw_issuer_dn: ADD. gnutls_x509_crt_get_raw_dn: ADD.
2007-06-01 22:12:44 +02:00
man/man3/gnutls_x509_crt_get_raw_dn.3
man/man3/gnutls_x509_crt_get_raw_issuer_dn.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_serial.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crt_get_signature.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_signature_algorithm.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crt_get_subject.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_subject_alt_name.3
Update to 2.2.2: * Version 2.2.2 (released 2008-02-21) ** Cipher priority string handling now handle strings that starts with NULL. Thanks to Laurence Withers <l@lwithers.me.uk>. ** Corrected memory leaks in session resuming and DHE ciphersuites. Reported by Daniel Stenberg. ** Increased the default certificate verification chain limits and allowed for checks without limitation. ** Corrected the behaviour of gnutls_x509_crt_get_subject_alt_name() and gnutls_x509_crt_get_subject_alt_name() to not null terminate binary strings and return the proper size. ** API and ABI modifications: No changes since last version. * Version 2.2.1 (released 2008-01-17) ** Prevent linking libextra against previously installed libgnutls. Tiny patch from "Alon Bar-Lev" <alon.barlev@gmail.com>, see <http://bugs.gentoo.org/show_bug.cgi?id=202269>. ** Fixes the post_client_hello_function(). The extensions are now parsed in a callback friendly way. ** Fix for certificate selection in servers with certificate callbacks. ** API and ABI modifications: No changes since last version. * Version 2.2.0 (released 2007-12-14) Major changes compared to the v2.0 branch: * SRP support aligned with newly published RFC 5054. * OpenPGP support aligned with newly published RFC 5081. * Support for DSA2 keys. * Support for Camellia cipher. * Support for Opaque PRF Input extension. * PKCS#8 parser now handle DSA keys. * Change from GPLv2 to GPLv3 for command-line tools, libgnutls-extra, etc. Notice that liblzo2 2.02 is licensed under GPLv2 only. Earlier versions, such as 2.01 which is included with GnuTLS, is available under GPLv2 or later. If this incompatibility causes problems, we recommend you to disable LZO using --without-lzo. LZO compression is not a standard TLS compression algorithm, so the impact should be minimal. * Functions for disabling record protocol padding. Works around bugs on Nokia/Ericsson phones. * New functions gnutls_priority_set() for setting cipher priorities easily. Priorities like "COMPAT" also enables other work arounds, such as disabling padding. * Other minor improvements and bug fixes. Minor changes compared to the latest v2.1.8 release candidate: * Update internal copy of libtasn1 to version 1.2. * Certtool --verify-chain now handle inputs larger than 64kb. This fixes the self-test "rsa-md5-collision" under MinGW+Wine with recent versions of libgcrypt. The problem was that Wine with the libgcrypt RNG generates huge amounts of debugging output. * Translation updates. Added Dutch translation. Updated Polish and Swedish translation. Backwards incompatible API/ABI changes in GnuTLS 2.2 ==================================================== To adapt to changes in the TLS extension specifications for OpenPGP and SRP, the GnuTLS API had to be modified. This means breaking the API and ABI backwards compatibility. That is something we try to avoid unless it is necessary. We decided to also remove the already deprecated stub functions for X.509 to XML conversion and TLS authorization (see below) when we had the opportunity. Generally, most applications does not need to be modified. Just re-compile them against the latest GnuTLS release, and it should work fine. Applications that use the OpenPGP or SRP features needs to be modified. Below is a list of the modified APIs and discussion of what the minimal things you need to modify in your application to make it work with GnuTLS 2.2. Note that GnuTLS 2.2 also introduces new APIs -- such as gnutls_set_priority() that is superior to gnutls_set_default_priority() -- that you may want to start using. However, using those new APIs is not required to use GnuTLS 2.2 since the old functions continue are still supported. This text only discuss what you minimally have to modify. XML related changes ------------------- The function `gnutls_x509_crt_to_xml' has been removed. It has been deprecated and only returned an error code since GnuTLS version 1.2.11. Nobody has complained, so users doesn't seem to miss the functionality. We don't know of any other library to convert X.509 certificates into XML format, but we decided (long ago) that GnuTLS isn't the right place for this kind of functionality. If you want help to find some other library to use here, please explain and discuss your use case on help-gnutls <at> gnu.org. TLS Authorization related changes --------------------------------- Everything related to TLS authorizations have been removed, they were only stub functions that returned an error code: GNUTLS_SUPPLEMENTAL_AUTHZ_DATA gnutls_authz_data_format_type_t gnutls_authz_recv_callback_func gnutls_authz_send_callback_func gnutls_authz_enable gnutls_authz_send_x509_attr_cert gnutls_authz_send_saml_assertion gnutls_authz_send_x509_attr_cert_url gnutls_authz_send_saml_assertion_url SRP related changes ------------------- The callback gnutls_srp_client_credentials_function has a new prototype, and its semantic has changed. You need to rewrite the callback, see the updated function documentation and SRP example code (doc/examples/ex-client-srp.c and doc/examples/ex-serv-srp.c) for more information. The alert codes GNUTLS_A_MISSING_SRP_USERNAME and GNUTLS_A_UNKNOWN_SRP_USERNAME are no longer used by the SRP specification, instead the GNUTLS_A_UNKNOWN_PSK_IDENTITY alert is used. There are #define's to map the old names to the new. You may run into problems if you have a switch-case with cases for both SRP alerts, since they are now mapped to the same value. The solution is to drop the SRP alerts from such switch cases, as they are now deprecated in favor of GNUTLS_A_UNKNOWN_PSK_IDENTITY. OpenPGP related changes ----------------------- The function `gnutls_certificate_set_openpgp_keyserver' have been removed. There is no replacement functionality inside GnuTLS. If you need keyserver functionality, consider using the GnuPG tools. All functions, types, and error codes related to OpenPGP trustdb format have been removed. The trustdb format is a non-standard GnuPG-specific format, and we recommend you to use key rings instead. The following have been removed: gnutls_certificate_set_openpgp_trustdb gnutls_openpgp_trustdb_init gnutls_openpgp_trustdb_deinit gnutls_openpgp_trustdb_import gnutls_openpgp_key_verify_trustdb gnutls_openpgp_trustdb_t GNUTLS_E_OPENPGP_TRUSTDB_VERSION_UNSUPPORTED The following functions has an added parameter of the (new) type `gnutls_openpgp_crt_fmt_t'. The type specify the format of the data (binary or base64). The functions are: gnutls_certificate_set_openpgp_key_file gnutls_certificate_set_openpgp_key_mem gnutls_certificate_set_openpgp_keyring_mem gnutls_certificate_set_openpgp_keyring_file To improve terminology and align with the X.509 interface, some functions have been renamed. Compatibility mappings exists. The old and new names of the affected functions and types are: Old name New name gnutls_openpgp_key_t gnutls_openpgp_crt_t gnutls_openpgp_key_fmt_t gnutls_openpgp_crt_fmt_t gnutls_openpgp_key_status_t gnutls_openpgp_crt_status_t GNUTLS_OPENPGP_KEY GNUTLS_OPENPGP_CERT GNUTLS_OPENPGP_KEY_FINGERPRINT GNUTLS_OPENPGP_CERT_FINGERPRINT gnutls_openpgp_key_init gnutls_openpgp_crt_init gnutls_openpgp_key_deinit gnutls_openpgp_crt_deinit gnutls_openpgp_key_import gnutls_openpgp_crt_import gnutls_openpgp_key_export gnutls_openpgp_crt_export gnutls_openpgp_key_get_key_usage gnutls_openpgp_crt_get_key_usage gnutls_openpgp_key_get_fingerprint gnutls_openpgp_crt_get_fingerprint gnutls_openpgp_key_get_pk_algorithm gnutls_openpgp_crt_get_pk_algorithm gnutls_openpgp_key_get_name gnutls_openpgp_crt_get_name gnutls_openpgp_key_get_version gnutls_openpgp_crt_get_version gnutls_openpgp_key_get_creation_time gnutls_openpgp_crt_get_creation_time gnutls_openpgp_key_get_expiration_time gnutls_openpgp_crt_get_expiration_time gnutls_openpgp_key_get_id gnutls_openpgp_crt_get_id gnutls_openpgp_key_check_hostname gnutls_openpgp_crt_check_hostname gnutls_openpgp_send_key gnutls_openpgp_send_cert * Version 2.0.0 (released 2007-09-04) The following changes have been made since GnuTLS 1.6: * Support for external RSA/DSA signing for TLS client authentication. This allows you to secure the private key better, for example by using privilege-separation techniques between the private key and the network client/server. * Support for signing X.509 certificates using RSA with SHA-256/384/512. * Experimental support for TLS 1.2 (disabled by default). The TLS 1.2 specification is not finalized yet, but we implement a draft version for testing. * Support for X.509 Proxy Certificates (RFC 3820) * Support for Supplemental handshakes messages (RFC 4680). * Support for TLS authorization extension (draft-housley-tls-authz-extns-07). * Support for the X.509 'otherName' Subject Altnerative Names (for XMPP). * Guile bindings for GnuTLS have been added, thanks to Ludovic Courtes. * Improve logic of gnutls_set_default_priority() which can now be more recommended. * New APIs to enumerate supported algorithms in the library. * New APIs to access X.509 Certificate extension sequentially. * New APIs to print X.509 Certificates and CRLs in human readable formats. * New APIs to extract X.509 Distinguished Names from certificates. * New APIs to handle pathLenConstraint in X.509 Basic Constraints. * Certtool can export more than one certificate to PKCS#12. * Several message translation improvements. * Instructions and improvements to easily set up a HTTPS test server. * Included copies updated to Libtasn1 1.1 and OpenCDK 0.6.4. * Build improvements for Windows, Mac OS X, uClinux, etc. * GnuTLS is now developed in GIT. * Improved manual * Many bugfixes and minor improvements.
2008-03-06 15:52:12 +01:00
man/man3/gnutls_x509_crt_get_subject_alt_name2.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crt_get_subject_alt_othername_oid.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_subject_key_id.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_crt_get_subject_unique_id.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crt_get_verify_algorithm.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_get_version.3
man/man3/gnutls_x509_crt_import.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_crt_import_pkcs11.3
man/man3/gnutls_x509_crt_import_pkcs11_url.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_init.3
Update to 1.2.1: * Version 1.2.1 (2005-04-04) - gnutls_bye() will no longer fail when RDWR is used and application data are available for reading. - Added more strict checks for the SRP parameters (g,n), when they are not in the included list. - Added warning to certtool when MD5 is being used for digital signatures. - Optimizations ("-O2 -finline-functions") are not enabled by default, instead the standard autoconf defaults are used. Use `./configure CFLAGS="-O2 -finline-functions"' to get the old optimizations. - Added the option --get-dh-params to certtool, in order to get the included in the library primes and generators. - Improved the semantics of GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, to allow only trusted Version 1 CAs and introduced GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT which has the old semantics. - Nettle self tests now build properly, reported by Pierre - Eliminated some memory leaks in DHE and RSA-EXPORT cipher suites. Reported by Yoann Vandoorselaere - Added the functions: gnutls_x509_crt_list_import(), gnutls_x509_crq_get_attribute_by_oid(), gnutls_x509_crq_set_attribute_by_oid() and gnutls_x509_crt_set_extension_by_oid(). - If the library has been compiled with features disabled, a warning is issued during the compilation of any program.
2005-04-08 17:50:41 +02:00
man/man3/gnutls_x509_crt_list_import.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_crt_list_import2.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_crt_list_import_pkcs11.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_list_verify.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crt_print.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_crt_privkey_sign.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_set_activation_time.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_crt_set_authority_info_access.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_set_authority_key_id.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crt_set_basic_constraints.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_set_ca_status.3
man/man3/gnutls_x509_crt_set_crl_dist_points.3
Changes 2.6.0: * libgnutls: Correct printing and parsing of IPv6 addresses. * libgnutls-openssl: fix out of bounds access. * certtool: Use inet_pton for parsing IPv6 addresses. * Added API to replace and update the crypto backend. * certtool: can add several subject alternative names via template file. * opencdk: Parse (but not decrypt) encrypted secret keys. * more...
2008-10-18 13:55:11 +02:00
man/man3/gnutls_x509_crt_set_crl_dist_points2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_set_crq.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crt_set_crq_extensions.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crt_set_dn.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_set_dn_by_oid.3
man/man3/gnutls_x509_crt_set_expiration_time.3
Update to 1.2.1: * Version 1.2.1 (2005-04-04) - gnutls_bye() will no longer fail when RDWR is used and application data are available for reading. - Added more strict checks for the SRP parameters (g,n), when they are not in the included list. - Added warning to certtool when MD5 is being used for digital signatures. - Optimizations ("-O2 -finline-functions") are not enabled by default, instead the standard autoconf defaults are used. Use `./configure CFLAGS="-O2 -finline-functions"' to get the old optimizations. - Added the option --get-dh-params to certtool, in order to get the included in the library primes and generators. - Improved the semantics of GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, to allow only trusted Version 1 CAs and introduced GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT which has the old semantics. - Nettle self tests now build properly, reported by Pierre - Eliminated some memory leaks in DHE and RSA-EXPORT cipher suites. Reported by Yoann Vandoorselaere - Added the functions: gnutls_x509_crt_list_import(), gnutls_x509_crq_get_attribute_by_oid(), gnutls_x509_crq_set_attribute_by_oid() and gnutls_x509_crt_set_extension_by_oid(). - If the library has been compiled with features disabled, a warning is issued during the compilation of any program.
2005-04-08 17:50:41 +02:00
man/man3/gnutls_x509_crt_set_extension_by_oid.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crt_set_issuer_dn.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_set_issuer_dn_by_oid.3
man/man3/gnutls_x509_crt_set_key.3
man/man3/gnutls_x509_crt_set_key_purpose_oid.3
man/man3/gnutls_x509_crt_set_key_usage.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_crt_set_pin_function.3
man/man3/gnutls_x509_crt_set_policy.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_crt_set_private_key_usage_period.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_crt_set_proxy.3
man/man3/gnutls_x509_crt_set_proxy_dn.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_crt_set_pubkey.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_set_serial.3
Changes 2.6.0: * libgnutls: Correct printing and parsing of IPv6 addresses. * libgnutls-openssl: fix out of bounds access. * certtool: Use inet_pton for parsing IPv6 addresses. * Added API to replace and update the crypto backend. * certtool: can add several subject alternative names via template file. * opencdk: Parse (but not decrypt) encrypted secret keys. * more...
2008-10-18 13:55:11 +02:00
man/man3/gnutls_x509_crt_set_subject_alt_name.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_crt_set_subject_alternative_name.3
man/man3/gnutls_x509_crt_set_subject_key_id.3
man/man3/gnutls_x509_crt_set_version.3
man/man3/gnutls_x509_crt_sign.3
man/man3/gnutls_x509_crt_sign2.3
man/man3/gnutls_x509_crt_verify.3
man/man3/gnutls_x509_crt_verify_data.3
Update to 2.8.0: * Version 2.8.0 (released 2009-05-27) ** doc: Fix gnutls_dh_get_prime_bits. Fix error codes and algorithm lists. ** Major changes compared to the v2.4 branch: *** lib: Linker version scripts reduces number of exported symbols. *** lib: Limit exported symbols on systems without LD linker scripts. *** libgnutls: Fix namespace issue with version symbols. *** libgnutls: Add functions to verify a hash against a certificate. gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED *** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. *** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. *** certtool: Query for multiple dnsName subjectAltName in interactive mode. *** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. *** gnutls-serv: No longer disable MAC padding by default. *** gnutls-cli: Certificate information output format changed. *** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 *** and %VERIFY_ALLOW_X509_V1_CA_CRT. *** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. *** libgnutls: gnutls_openpgp_crt_print supports oneline mode. *** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. *** libgnutls: New interface to get key id for certificate requests. gnutls_x509_crq_get_key_id: ADDED. *** libgnutls: gnutls_x509_crq_print will now also print public key id. *** certtool: --verify-chain now prints results of using library verification. *** libgnutls: Libgcrypt initialization changed. *** libgnutls: Small byte reads via gnutls_record_recv() optimized. *** gnutls-cli: Return non-zero exit code on error conditions. *** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. *** certtool: allow setting arbitrary key purpose object identifiers. *** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. *** Fix warnings and build GnuTLS with more warnings enabled. *** New API to set X.509 credentials from PKCS#12 memory structure. gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED *** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. *** libgnutls: Added functions to handle CRL extensions. gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED *** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED *** certtool: Print and set CRL and CRQ extensions. *** minitasn1: Internal copy updated to libtasn1 v2.1. *** examples: Now released into the public domain. *** The Texinfo and GTK-DOC manuals were improved. *** Several self-tests were added and others improved. *** API/ABI changes in GnuTLS 2.8 compared to GnuTLS 2.6.x No offically supported interfaces have been modified or removed. The library should be completely backwards compatible on both the source and binary level. The shared library no longer exports some symbols that have never been officially supported, i.e., not mentioned in any of the header files. The symbols are: _gnutls* gnutls_asn1_tab Normally when symbols are removed, the shared library version has to be incremented. This leads to a significant cost for everyone using the library. Because none of the above symbols have ever been intended for use by well-behaved applications, we decided that the it would be better for those applications to pay the price rather than incurring problems on the majority of applications. If it turns out that applications have been using unofficial interfaces, we will need to release a follow-on release on the v2.8 branch to exports additional interfaces. However, initial testing suggests that few if any applications have been using any of the internal symbols. Although not a new change compared to 2.6.x, we'd like to remind you interfaces have been modified so that X.509 chain verification now also checks activation/expiration times on certificates. The affected functions are: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. This change in behaviour was made during the GnuTLS 2.6.x cycle, and we gave our rationale for it in earlier release notes. The following symbols have been added to the library: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_key_id: ADDED. gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED gnutls_x509_crt_set_crq_extensions: ADDED gnutls_x509_crt_verify_hash: ADDED The following interfaces have been added to the header files: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. GNUTLS_EXTRA_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. The following interfaces have been deprecated: LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.14 (released 2009-05-26) ** libgnutls: Fix namespace issue with version symbol for libgnutls-extra. The symbol LIBGNUTLS_EXTRA_VERSION were renamed to GNUTLS_EXTRA_VERSION. The old symbol will continue to work but is deprecated. ** Doc: Several typo fixes in documentation. Reported by Peter Hendrickson <pdh@wiredyne.com>. ** API and ABI modifications: GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_EXTRA_VERSION. LIBGNUTLS_EXTRA_VERSION: DEPRECATED. * Version 2.7.13 (released 2009-05-25) ** libgnutls: Fix version of some exported symbols in the shared library. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3576>. ** tests: Handle recently expired certificates in chainverify self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3580>. ** API and ABI modifications: No changes since last version. * Version 2.7.12 (released 2009-05-20) ** gnutls-serv, gnutls-cli-debug: Make them work on Windows. ** tests/crq_key_id: Don't read entropy from /dev/random in self-test. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3570>. ** Fix build failures. Missing sa_family_t and vsnprintf on IRIX. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3571>. ** minitasn1: Internal copy updated to libtasn1 v2.2. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** API and ABI modifications: No changes since last version. * Version 2.7.11 (released 2009-05-18) ** minitasn1: Fix build failure when using internal libtasn1. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3548>. ** libgnutls: Fix build failure with --disable-cxx. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3557>. ** gnutls-serv: Fix build failure for unportable NI_MAXHOST/NI_MAXSERV. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3560> ** Building with many warning flags now requires --enable-gcc-warnings. This avoids crying wolf for normal compiles. ** API and ABI modifications: No changes since last version. * Version 2.7.10 (released 2009-05-13) ** examples: Now released into the public domain. This makes the license of the example code compatible with more licenses, including the (L)GPL. ** minitasn1: Internal copy updated to libtasn1 v2.1. GnuTLS should work fine with libtasn1 v1.x and that is still supported. ** libgnutls: Fix crash in signature verification The fix for the CVE-2009-1415 problem wasn't merged completely. ** doc: Fixes for GTK-DOC output. ** API and ABI modifications: No changes since last version. * Version 2.7.9 (released 2009-05-11) ** doc: Fix strings in man page of gnutls_priority_init. ** doc: Fix tables of error codes and supported algorithms. ** Fix build failure when cross-compiled using MinGW. ** Fix build failure when LZO is enabled. Reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3522>. ** Fix build failure on systems without AF_INET6, e.g., Solaris 2.6. Reported by "Tom G. Christensen" <tgc@jupiterrise.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3524>. ** Fix warnings in self-tests. ** API and ABI modifications: No changes since last version. * Version 2.7.8 (released 2009-05-03) ** libgnutls: Fix DSA key generation. Merged from stable branch. [GNUTLS-SA-2009-2] [CVE-2009-1416] ** libgnutls: Check expiration/activation time on untrusted certificates. Merged from stable branch. Reported by Romain Francoise <romain@orebokech.com>. This changes the semantics of gnutls_x509_crt_list_verify, which in turn is used by gnutls_certificate_verify_peers and gnutls_certificate_verify_peers2. We add two new gnutls_certificate_status_t codes for reporting the new error condition, GNUTLS_CERT_NOT_ACTIVATED and GNUTLS_CERT_EXPIRED. We also add a new gnutls_certificate_verify_flags flag, GNUTLS_VERIFY_DISABLE_TIME_CHECKS, that can be used to disable the new behaviour. [GNUTLS-SA-2009-3] [CVE-2009-1417] ** lib: Linker version scripts reduces number of exported symbols. The linker version script now lists all exported ABIs explicitly, to avoid accidentally exporting unintended functions. Compared to before, most symbols beginning with _gnutls* are no longer exported. These functions have never been intended for use by applications, and there were no prototypes for these function in the public header files. Thus we believe it is possible to do this without incrementing the library ABI version which normally has to be done when removing an interface. ** lib: Limit exported symbols on systems without LD linker scripts. Before all symbols were exported. Now we limit the exported symbols to (for libgnutls and libgnutls-extra) gnutls* and (for libgnutls) _gnutls*. This is a superset of the actual supported ABI, but still an improvement compared to before. This is implemented using Libtool -export-symbols-regex. It is more portable than linker version scripts. ** libgnutls: Incremented CURRENT/AGE libtool version to reflect new symbols. This should have been done in the last release. ** gnutls-serv: Listen on all interfaces, including both IPv4 and IPv6. Reported by Peter Hendrickson <pdh@wiredyne.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3476>. ** doc: Improved sections for the info manual. We now follow the advice given by the texinfo manual on which directory categories to use. In particular, libgnutls moved from the 'GNU Libraries' section to the 'Software libraries' and the command line tools moved from 'Network Applications' to 'System Administration'. ** API and ABI modifications: gnutls_x509_crt_list_verify: CHANGED, checks activation/expiration times. gnutls_certificate_verify_peers: Likewise. gnutls_certificate_verify_peers2: Likewise. GNUTLS_CERT_NOT_ACTIVATED: ADDED. GNUTLS_CERT_EXPIRED: ADDED. GNUTLS_VERIFY_DISABLE_TIME_CHECKS: ADDED. * Version 2.7.7 (released 2009-04-20) ** libgnutls: Applied patch by Cedric Bail to add functions gnutls_x509_crt_verify_hash() and gnutls_x509_crt_get_verify_algorithm(). ** gnutls.pc: Add -ltasn1 to 'pkg-config --libs --static gnutls' output. Reported by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3467>. ** minitasn1: Internal copy updated to libtasn1 v1.8. GnuTLS is also internally ready to be used with libtasn1 v2.0. ** doc: Fix build failure of errcodes/printlist. Reported by Roman Bogorodskiy <novel@FreeBSD.org> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3435>. ** i18n: The GnuTLS gettext domain is now 'libgnutls' instead of 'gnutls'. It is currently only used by the core library. This will enable a new domain 'gnutls' for translations of the command line tools. ** Corrected possible memory corruption on signature verification failure. Reported by Miroslav Kratochvil <exa.exa@gmail.com> ** API and ABI modifications: gnutls_x509_crt_verify_hash: ADDED gnutls_x509_crt_get_verify_algorithm: ADDED * Version 2.7.6 (released 2009-02-27) ** certtool: Query for multiple dnsName subjectAltName in interactive mode. This applies both to generating certificates and certificate requests. ** pkix.asn: Removed unneeded definitions to reduce memory usage. ** gnutls-cli: No longer accepts V1 CAs by default during X.509 chain verify. Use --priority NORMAL:%VERIFY_ALLOW_X509_V1_CA_CRT to permit V1 CAs to be used for chain verification. ** gnutls-serv: No longer disable MAC padding by default. Use --priority NORMAL:%COMPAT to disable MAC padding again. ** gnutls-cli: Certificate information output format changed. The tool now uses libgnutls' functions to print certificate information. This avoids code duplication. ** libgnutls: New priority strings %VERIFY_ALLOW_SIGN_RSA_MD5 ** and %VERIFY_ALLOW_X509_V1_CA_CRT. They can be used to override the default certificate chain validation behaviour. ** libgnutls: Added %SSL3_RECORD_VERSION priority string that allows to specify the client hello message record version. Used to overcome buggy TLS servers. Report by Martin von Gagern. ** libgnutls: gnutls_x509_crt_print prints signature algorithm in oneline mode. ** libgnutls: gnutls_openpgp_crt_print supports oneline mode. ** doc: Update gnutls-cli and gnutls-serv --help output descriptions. ** API and ABI modifications: No changes since last version. * Version 2.7.5 (released 2009-02-06) ** libgnutls: Accept chains where intermediary certs are trusted. Before GnuTLS needed to validate the entire chain back to a self-signed certificate. GnuTLS will now stop looking when it has found an intermediary trusted certificate. The new behaviour is useful when chains, for example, contains a top-level CA, an intermediary CA signed using RSA-MD5, and an end-entity certificate. To avoid chain validation errors due to the RSA-MD5 cert, you can explicitly add the intermediary RSA-MD5 cert to your trusted certs. The signature on trusted certificates are not checked, so the chain has a chance to validate correctly. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** libgnutls: result_size in gnutls_hex_encode now holds the size of the result. Report by John Brooks <special@dereferenced.net>. ** libgnutls: gnutls_handshake when sending client hello during a rehandshake, will not offer a version number larger than the current. Reported by Tristan Hill <stan@saticed.me.uk>. ** libgnutls: Permit V1 Certificate Authorities properly. Before they were mistakenly rejected even though GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT and/or GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT were supplied. Reported by "Douglas E. Engert" <deengert@anl.gov> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351>. ** API and ABI modifications: No changes since last version. * Version 2.7.4 (released 2009-01-07) ** libgnutls: deprecate X.509 validation chains using MD5 and MD2 signatures. This is a bugfix -- the previous attempt to do this from internal x509 certificate verification procedures did not return the correct value for certificates using a weak hash. Reported by Daniel Kahn Gillmor <dkg@fifthhorseman.net> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3332>, debugged and patch by Tomas Mraz <tmraz@redhat.com> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. ** libgnutls: New interface to get key id for certificate requests. Patch from David Marín Carreño <davefx@gmail.com> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3321>. ** libgnutls: gnutls_x509_crq_print will now also print public key id. ** certtool: --verify-chain now prints results of using library verification. Earlier, certtool --verify-chain used its own validation algorithm which wasn't guaranteed to give the same result as the libgnutls internal validation algorithm. Now this command print a new final line with header 'Chain verification output:' that contains the result from using the internal verification algorithm on the same chain. ** tests: Add crq_key_id self-test of gnutls_x509_crq_get_key_id. ** API and ABI modifications: gnutls_x509_crq_get_key_id: ADDED. * Version 2.7.3 (released 2008-12-10) ** libgnutls: Fix chain verification for chains that ends with RSA-MD2 CAs. Reported by Michael Kiefer <Michael-Kiefer@web.de> in <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507633> forwarded by Andreas Metzler <ametzler@downhill.at.eu.org> in <http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3309>. ** libgnutls: Libgcrypt initialization changed. If libgcrypt has not already been initialized, GnuTLS will now initialize libgcrypt with disabled secure memory. Initialize libgcrypt explicitly in your application if you want to enable secure memory. Before GnuTLS initialized libgcrypt to use GnuTLS's memory allocation functions, which doesn't use secure memory, so there is no real change in behaviour. ** libgnutls: Fix memory leak in PSK authentication. Reported by Michael Weiser <michael@weiser.dinsnail.net> in <http://permalink.gmane.org/gmane.network.gnutls.general/1465>. ** libgnutls: Small byte reads via gnutls_record_recv() optimized. ** certtool: Move gcry_control(GCRYCTL_ENABLE_QUICK_RANDOM, 0) call earlier. It needs to be invoked before libgcrypt is initialized. ** gnutls-cli: Return non-zero exit code on error conditions. ** gnutls-cli: Corrected bug which caused a rehandshake request to be ignored. ** tests: Added chainverify self-test that tests X.509 chain verifications. ** API and ABI modifications: No changes since last version. * Version 2.7.2 (released 2008-11-18) ** libgnutls: Fix X.509 certificate chain validation error. [GNUTLS-SA-2008-3] The flaw makes it possible for man in the middle attackers (i.e., active attackers) to assume any name and trick GNU TLS clients into trusting that name. Thanks for report and analysis from Martin von Gagern <Martin.vGagern@gmx.net>. [CVE-2008-4989] Any updates with more details about this vulnerability will be added to <http://www.gnu.org/software/gnutls/security.html> ** libgnutls: Fix namespace issue with version symbols. The symbols LIBGNUTLS_VERSION, LIBGNUTLS_VERSION_MAJOR, LIBGNUTLS_VERSION_MINOR, LIBGNUTLS_VERSION_PATCH, and LIBGNUTLS_VERSION_NUMBER were renamed to GNUTLS_VERSION_NUMBER, GNUTLS_VERSION_MAJOR, GNUTLS_VERSION_MINOR, GNUTLS_VERSION_PATCH, and GNUTLS_VERSION_NUMBER respectively. The old symbols will continue to work but are deprecated. ** certtool: allow setting arbitrary key purpose object identifiers. ** libgnutls: Fix detection of C99 macros, to make debug logging work again. ** libgnutls: Add missing prototype for gnutls_srp_set_prime_bits. Reported by Kevin Quick <quick@sparq.org> in <https://savannah.gnu.org/support/index.php?106454>. ** libgnutls-extra: Make building with LZO compression work again. Build failure reported by Arfrever Frehtes Taifersar Arahesis <arfrever.fta@gmail.com> in <http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3194>. ** libgnutls: Change detection of when to use a linker version script. Use --enable-ld-version-script or --disable-ld-version-script to override auto-detection logic. ** doc: Change license on the manual to GFDLv1.3+. ** doc: GTK-DOC fixes for new splitted configuration system. ** doc: Texinfo stylesheet uses white background. ** tests: Add cve-2008-4989.c self-test. Tests regressions of the GNUTLS-SA-2008-3 security problem, and the follow-on problem with crashes on length 1 certificate chains. ** gnulib: Deprecated modules removed. Modules include memchr and memcmp. ** Fix warnings and build GnuTLS with more warnings enabled. ** minitasn1: Internal copy updated to libtasn1 v1.7. ** API and ABI modifications: gnutls_certificate_set_x509_simple_pkcs12_mem: ADDED GNUTLS_VERSION: ADDED, replaces LIBGNUTLS_VERSION. GNUTLS_VERSION_MAJOR: ADDED, replaces LIBGNUTLS_VERSION_MAJOR. GNUTLS_VERSION_MINOR: ADDED, replaces LIBGNUTLS_VERSION_MINOR. GNUTLS_VERSION_PATCH: ADDED, replaces LIBGNUTLS_VERSION_PATCH. GNUTLS_VERSION_NUMBER: ADDED, replaces LIBGNUTLS_VERSION_NUMBER. LIBGNUTLS_VERSION: DEPRECATED. LIBGNUTLS_VERSION_MAJOR: DEPRECATED. LIBGNUTLS_VERSION_MINOR: DEPRECATED. LIBGNUTLS_VERSION_PATCH: DEPRECATED. LIBGNUTLS_VERSION_NUMBER: DEPRECATED. * Version 2.7.1 (released 2008-10-31) ** certtool: print a PKCS #8 key even if it is not encrypted. ** Old libgnutls.m4 and libgnutls-config scripts removed. Please use pkg-config instead. ** Configuration system modified. There is now a configure script in lib/ and libextra/ as well, because gnulib works better with a config.h per gnulib directory. ** API and ABI modifications: No changes since last version. * Version 2.7.0 (released 2008-10-16) ** libgnutls: Added functions to handle CRL extensions. ** libgnutls: Added functions to handle X.509 extensions in Certificate Requests. ** libgnutls: Improved error string for GNUTLS_E_AGAIN. Suggested by "Lavrentiev, Anton (NIH/NLM/NCBI) [C]" <lavr@ncbi.nlm.nih.gov>. ** certtool: Print and set CRL and CRQ extensions. ** libgnutls-extra: Protect internal symbols with static. Fixes problem when linking certtool statically. Tiny patch from Aaron Ucko <ucko@ncbi.nlm.nih.gov>. ** libgnutls-openssl: fix out of bounds access. Problem in X509_get_subject_name and X509_get_issuer_name. Tiny patch from Thomas Viehmann <tv@beamnet.de>. ** libgnutlsxx: Define server_session::get_srp_username even if no SRP. ** tests: Make tests compile when using internal libtasn1. Patch by ludo@gnu.org (Ludovic Courtès). ** Changed detection of libtasn1 and libgcrypt to avoid depending on *-config. We now require a libgcrypt that has Camellia constants declared in gcrypt.h, which means v1.3.0 or later. ** API and ABI modifications: gnutls_x509_crl_get_authority_key_id: ADDED gnutls_x509_crl_get_number: ADDED gnutls_x509_crl_get_extension_oid: ADDED gnutls_x509_crl_get_extension_info: ADDED gnutls_x509_crl_get_extension_data: ADDED gnutls_x509_crl_set_authority_key_id: ADDED gnutls_x509_crl_set_number: ADDED gnutls_x509_crq_get_key_rsa_raw: ADDED gnutls_x509_crq_get_attribute_info: ADDED gnutls_x509_crq_get_attribute_data: ADDED gnutls_x509_crq_get_extension_info: ADDED gnutls_x509_crq_get_extension_data: ADDED gnutls_x509_crq_get_key_usage: ADDED gnutls_x509_crq_get_basic_constraints: ADDED gnutls_x509_crq_get_subject_alt_name: ADDED gnutls_x509_crq_get_subject_alt_othername_oid: ADDED gnutls_x509_crq_get_extension_by_oid: ADDED gnutls_x509_crq_set_subject_alt_name: ADDED gnutls_x509_crq_set_basic_constraints: ADDED gnutls_x509_crq_set_key_usage: ADDED gnutls_x509_crq_get_key_purpose_oid: ADDED gnutls_x509_crq_set_key_purpose_oid: ADDED gnutls_x509_crq_print: ADDED gnutls_x509_crt_set_crq_extensions: ADDED
2009-06-09 20:56:37 +02:00
man/man3/gnutls_x509_crt_verify_hash.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_x509_dn_deinit.3
man/man3/gnutls_x509_dn_export.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_dn_export2.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_dn_get_rdn_ava.3
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
man/man3/gnutls_x509_dn_import.3
man/man3/gnutls_x509_dn_init.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_dn_oid_known.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_dn_oid_name.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_policy_release.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_privkey_cpy.3
man/man3/gnutls_x509_privkey_deinit.3
man/man3/gnutls_x509_privkey_export.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_privkey_export2.3
man/man3/gnutls_x509_privkey_export2_pkcs8.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_privkey_export_dsa_raw.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_privkey_export_ecc_raw.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_privkey_export_pkcs8.3
man/man3/gnutls_x509_privkey_export_rsa_raw.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_privkey_export_rsa_raw2.3
Update to 1.2.3: * Version 1.2.3 - Corrected bug in record packet parsing that could lead to a denial of service attack. - Corrected bug in RSA key export. Previously exported keys can be fixed using certtool. Use certtool -k <infile >outfile - API and ABI modifications: gnutls_x509_privkey_fix(): Add. * Version 1.2.2 (2005-04-25) - gnutls_error_to_alert() now considers GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET. - Fixed error in session resuming that could cause a crash in a session. - Fixed pkcs12 friendly name and local key identifier decoding. - Internal cleanups, removed duplicate typedef/struct definitions, and made source code include external include file, to check function prototypes during compile time. - API and ABI modifications: No changes since last version. At least not intentional, but due to the include header changes, there may be inadvertant changes, please let us know if you find any.
2005-05-02 14:59:24 +02:00
man/man3/gnutls_x509_privkey_fix.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_privkey_generate.3
man/man3/gnutls_x509_privkey_get_key_id.3
man/man3/gnutls_x509_privkey_get_pk_algorithm.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_privkey_get_pk_algorithm2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_privkey_import.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_privkey_import2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_privkey_import_dsa_raw.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_privkey_import_ecc_raw.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_privkey_import_openssl.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_privkey_import_pkcs8.3
man/man3/gnutls_x509_privkey_import_rsa_raw.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_privkey_import_rsa_raw2.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_privkey_init.3
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
man/man3/gnutls_x509_privkey_sec_param.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_privkey_sign_data.3
update to 2.0.0 While an update to a .0 version is somehow risky, it finishes the unfortunate state that the pkgsrc gnutls didn't work with the pkgsrc opencdk, which I wouldn't like to go into the next stable branch. Release candidates have worked for me, and there is some time left before the Q3 branch, so I'm confident. changes: * Support for external RSA/DSA signing for TLS client authentication -many X.509 enhancements Support for Supplemental handshakes messages (RFC 4680) * Support for TLS authorization extension (draft-housley-tls-authz-extns-07) * Improve logic of gnutls_set_default_priority() * New APIs to enumerate supported algorithms in the library * Certtool can export more than one certificate to PKCS#12 * Several message translation improvements * Improved manual * Many bugfixes and minor improvements
2007-09-05 23:51:21 +02:00
man/man3/gnutls_x509_privkey_sign_hash.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_privkey_verify_params.3
Update to 1.2.0. From the release announcement: We are pleased to announce the availability of GnuTLS 1.2.0! This release is the result of the 23 development releases made on the development branch (1.1.x). Major changes compared to the 1.0 branch include: * Moved SRP password authentication from the GnuTLS-extra library (licensed under GPL) to the core library (licensed under LGPL). * The API has been cleaned up, and data types now use a '_t' suffix. * Fixes to handle denial of service problem when verifying long certificate chains. * The manual has been converted to Texinfo and is consequently available in many formats, see: <http://josefsson.org/gnutls/manual/> * A reference API manual has been added, and is available in HTML and DevHelp formats, thanks to GTK-DOC, see: <http://josefsson.org/gnutls/reference/gnutls-gnutls.html> The 1.2.0 version is intended to be stable, and to be a drop-in replacement of the stable 1.0.x branch. We encourage developers to move to the 1.2 branch as soon as possible, since we will now spend less time improving version 1.0.x. We are not planning to open a 1.3 development branch soon, because there are no plans to start work on any major new feature today. Instead, we will continue to carefully improve the quality of this release over time. Improving GnuTLS is costly, but you can help! We are looking for organizations that find GnuTLS useful and wish to contribute back. You can contribute by reporting bugs, improve the software, or donate money or equipment.
2005-02-19 01:14:23 +01:00
man/man3/gnutls_x509_rdn_get.3
man/man3/gnutls_x509_rdn_get_by_oid.3
man/man3/gnutls_x509_rdn_get_oid.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_trust_list_add_cas.3
man/man3/gnutls_x509_trust_list_add_crls.3
man/man3/gnutls_x509_trust_list_add_named_crt.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_trust_list_add_system_trust.3
man/man3/gnutls_x509_trust_list_add_trust_file.3
man/man3/gnutls_x509_trust_list_add_trust_mem.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_trust_list_deinit.3
man/man3/gnutls_x509_trust_list_get_issuer.3
man/man3/gnutls_x509_trust_list_init.3
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
man/man3/gnutls_x509_trust_list_remove_cas.3
man/man3/gnutls_x509_trust_list_remove_trust_file.3
man/man3/gnutls_x509_trust_list_remove_trust_mem.3
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
man/man3/gnutls_x509_trust_list_verify_crt.3
man/man3/gnutls_x509_trust_list_verify_named_crt.3
Import of gnutls-0.8.7: GNU Transport Layer Security library. GnuTLS is a portable ANSI C based library which implements the TLS 1.0 and SSL 3.0 protocols. The library does not include any patented algorithms and is available under the GNU Lesser GPL license. Important features of the GnuTLS library include: - Thread safety - Support for both TLS 1.0 and SSL 3.0 protocols - Support for both X.509 and OpenPGP certificates - Support for basic parsing and verification of certificates - Support for SRP for TLS authentication - Support for TLS Extension mechanism - Support for TLS Compression Methods Additionaly GnuTLS provides an emulation API for the widely used OpenSSL library, to ease integration with existing applications. Package provided by Juan RP via pkgsrc-wip with modifications by me.
2003-05-14 05:46:44 +02:00
share/examples/gnutls/ex-alert.c
Changes 2.12.3: * libgnutls: Several minor bugfixes. * libgnutls: Restored HMAC-MD5 for compatibility. Although considered weak, several sites require it for connection. It is enabled for "NORMAL" and "PERFORMANCE" priority strings. * libgnutls: depend on libdl. * libgnutls: gnutls_transport_set_global_errno() was deprecated. Use your system's errno fascility or gnutls_transport_set_errno(). * gnutls-cli: Correction with usage of select to check for pending data in gnutls sessions. It now uses gnutls_record_check_pending(). * tests: More fixes and updates for win32. Patches by LRN. * libgnutls: Several files unnecessarily included <gcrypt.h>; this has been fixed. ** API and ABI modifications: gnutls_transport_set_global_errno: DEPRECATED Changes 2.12.2: * libgnutls: Several updates and fixes for win32. Patches by LRN. * libgnutls: Several bug and memory leak fixes. * srptool: Accepts the -d option to enable debugging. * libgnutls: Corrected bug in gnutls_srp_verifier() that prevented the allocation of a verifier. Reported by Andrew Wiseman. Changes 2.12.1: * certtool: Generated certificate request with stricter permissions. * libgnutls: Bug fixes in opencdk code. Reported by Vitaly Kruglikov. * libgnutls: Corrected windows system_errno() function prototype. * libgnutls: C++ compatibility fix for compat.h. Reported by Mark Brand. * libgnutls: Fix size of gnutls_openpgp_keyid_t by using the GNUTLS_OPENPGP_KEYID_SIZE definition. Reported by Andreas Metzler.
2011-04-26 12:35:29 +02:00
share/examples/gnutls/ex-cert-select-pkcs11.c
Updated to 1.0.0, provided by Min Sik Kim PR pkg/23661. Changes: - Exported the static SRP group parameters. - Some fixes in the certificate authenticated SRP ciphersuites. - Improved the support for draft-ietf-tls-srp-05. The two-phase handshake is now fully supported without any interaction with the application layer (except for a callback). - Some fixes in the openpgp authentication. - Removed the Twofish cipher. - The openssl compatibility layer was moved to gnutls-openssl library instead of being included in the gnutls-extra library. - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. - Building with openpgp support is now mandatory. - gnutls4 compatibility header is no longer included by default in gnutls.h. - gnutls8 function usage yelds a deprecation warning in gcc3. - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid() functions have a raw_flag parameter added. - The certtool utility can now generate PKCS #12 structures without specifying a certificate. - Added capability to read CRLs to certtool. - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER to properly set the required buffer size. - Corrected a bug in libgcrypt detection. And more...
2003-12-06 01:52:21 +01:00
share/examples/gnutls/ex-cert-select.c
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
share/examples/gnutls/ex-client-anon.c
share/examples/gnutls/ex-client-dtls.c
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
share/examples/gnutls/ex-client-psk.c
Import of gnutls-0.8.7: GNU Transport Layer Security library. GnuTLS is a portable ANSI C based library which implements the TLS 1.0 and SSL 3.0 protocols. The library does not include any patented algorithms and is available under the GNU Lesser GPL license. Important features of the GnuTLS library include: - Thread safety - Support for both TLS 1.0 and SSL 3.0 protocols - Support for both X.509 and OpenPGP certificates - Support for basic parsing and verification of certificates - Support for SRP for TLS authentication - Support for TLS Extension mechanism - Support for TLS Compression Methods Additionaly GnuTLS provides an emulation API for the widely used OpenSSL library, to ease integration with existing applications. Package provided by Juan RP via pkgsrc-wip with modifications by me.
2003-05-14 05:46:44 +02:00
share/examples/gnutls/ex-client-resume.c
share/examples/gnutls/ex-client-srp.c
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
share/examples/gnutls/ex-client-x509.c
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
share/examples/gnutls/ex-client-xssl1.c
share/examples/gnutls/ex-client-xssl2.c
Updated to 1.0.0, provided by Min Sik Kim PR pkg/23661. Changes: - Exported the static SRP group parameters. - Some fixes in the certificate authenticated SRP ciphersuites. - Improved the support for draft-ietf-tls-srp-05. The two-phase handshake is now fully supported without any interaction with the application layer (except for a callback). - Some fixes in the openpgp authentication. - Removed the Twofish cipher. - The openssl compatibility layer was moved to gnutls-openssl library instead of being included in the gnutls-extra library. - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. - Building with openpgp support is now mandatory. - gnutls4 compatibility header is no longer included by default in gnutls.h. - gnutls8 function usage yelds a deprecation warning in gcc3. - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid() functions have a raw_flag parameter added. - The certtool utility can now generate PKCS #12 structures without specifying a certificate. - Added capability to read CRLs to certtool. - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER to properly set the required buffer size. - Corrected a bug in libgcrypt detection. And more...
2003-12-06 01:52:21 +01:00
share/examples/gnutls/ex-crq.c
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
share/examples/gnutls/ex-ocsp-client.c
share/examples/gnutls/ex-pkcs11-list.c
Updated to 1.0.0, provided by Min Sik Kim PR pkg/23661. Changes: - Exported the static SRP group parameters. - Some fixes in the certificate authenticated SRP ciphersuites. - Improved the support for draft-ietf-tls-srp-05. The two-phase handshake is now fully supported without any interaction with the application layer (except for a callback). - Some fixes in the openpgp authentication. - Removed the Twofish cipher. - The openssl compatibility layer was moved to gnutls-openssl library instead of being included in the gnutls-extra library. - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. - Building with openpgp support is now mandatory. - gnutls4 compatibility header is no longer included by default in gnutls.h. - gnutls8 function usage yelds a deprecation warning in gcc3. - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid() functions have a raw_flag parameter added. - The certtool utility can now generate PKCS #12 structures without specifying a certificate. - Added capability to read CRLs to certtool. - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER to properly set the required buffer size. - Corrected a bug in libgcrypt detection. And more...
2003-12-06 01:52:21 +01:00
share/examples/gnutls/ex-pkcs12.c
Update to 1.2.3: * Version 1.2.3 - Corrected bug in record packet parsing that could lead to a denial of service attack. - Corrected bug in RSA key export. Previously exported keys can be fixed using certtool. Use certtool -k <infile >outfile - API and ABI modifications: gnutls_x509_privkey_fix(): Add. * Version 1.2.2 (2005-04-25) - gnutls_error_to_alert() now considers GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET. - Fixed error in session resuming that could cause a crash in a session. - Fixed pkcs12 friendly name and local key identifier decoding. - Internal cleanups, removed duplicate typedef/struct definitions, and made source code include external include file, to check function prototypes during compile time. - API and ABI modifications: No changes since last version. At least not intentional, but due to the include header changes, there may be inadvertant changes, please let us know if you find any.
2005-05-02 14:59:24 +02:00
share/examples/gnutls/ex-serv-anon.c
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
share/examples/gnutls/ex-serv-dtls.c
Import of gnutls-0.8.7: GNU Transport Layer Security library. GnuTLS is a portable ANSI C based library which implements the TLS 1.0 and SSL 3.0 protocols. The library does not include any patented algorithms and is available under the GNU Lesser GPL license. Important features of the GnuTLS library include: - Thread safety - Support for both TLS 1.0 and SSL 3.0 protocols - Support for both X.509 and OpenPGP certificates - Support for basic parsing and verification of certificates - Support for SRP for TLS authentication - Support for TLS Extension mechanism - Support for TLS Compression Methods Additionaly GnuTLS provides an emulation API for the widely used OpenSSL library, to ease integration with existing applications. Package provided by Juan RP via pkgsrc-wip with modifications by me.
2003-05-14 05:46:44 +02:00
share/examples/gnutls/ex-serv-pgp.c
update to gnutls-2.4.1 Changes: ** libgnutls: Fix local crash in gnutls_handshake. [GNUTLS-SA-2008-2] ** libgnutls: Fix memory leaks when doing a re-handshake. ** Fix compiler warnings. ** Fix ordering of -I's to avoid opencdk.h conflict with system headers. ** srptool: Fix a problem where --verify check does not succeed.
2008-07-30 19:17:21 +02:00
share/examples/gnutls/ex-serv-psk.c
Import of gnutls-0.8.7: GNU Transport Layer Security library. GnuTLS is a portable ANSI C based library which implements the TLS 1.0 and SSL 3.0 protocols. The library does not include any patented algorithms and is available under the GNU Lesser GPL license. Important features of the GnuTLS library include: - Thread safety - Support for both TLS 1.0 and SSL 3.0 protocols - Support for both X.509 and OpenPGP certificates - Support for basic parsing and verification of certificates - Support for SRP for TLS authentication - Support for TLS Extension mechanism - Support for TLS Compression Methods Additionaly GnuTLS provides an emulation API for the widely used OpenSSL library, to ease integration with existing applications. Package provided by Juan RP via pkgsrc-wip with modifications by me.
2003-05-14 05:46:44 +02:00
share/examples/gnutls/ex-serv-srp.c
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
share/examples/gnutls/ex-serv-x509.c
Updated to 1.0.0, provided by Min Sik Kim PR pkg/23661. Changes: - Exported the static SRP group parameters. - Some fixes in the certificate authenticated SRP ciphersuites. - Improved the support for draft-ietf-tls-srp-05. The two-phase handshake is now fully supported without any interaction with the application layer (except for a callback). - Some fixes in the openpgp authentication. - Removed the Twofish cipher. - The openssl compatibility layer was moved to gnutls-openssl library instead of being included in the gnutls-extra library. - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. - Building with openpgp support is now mandatory. - gnutls4 compatibility header is no longer included by default in gnutls.h. - gnutls8 function usage yelds a deprecation warning in gcc3. - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid() functions have a raw_flag parameter added. - The certtool utility can now generate PKCS #12 structures without specifying a certificate. - Added capability to read CRLs to certtool. - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER to properly set the required buffer size. - Corrected a bug in libgcrypt detection. And more...
2003-12-06 01:52:21 +01:00
share/examples/gnutls/ex-session-info.c
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
share/examples/gnutls/ex-verify-ssh.c
update to 1.0.20 changes: -bugfixes -adds some limits to the verification functions to avoid denial of service attacks -selftests added
2004-08-27 15:16:16 +02:00
share/examples/gnutls/ex-verify.c
Updated to 1.0.0, provided by Min Sik Kim PR pkg/23661. Changes: - Exported the static SRP group parameters. - Some fixes in the certificate authenticated SRP ciphersuites. - Improved the support for draft-ietf-tls-srp-05. The two-phase handshake is now fully supported without any interaction with the application layer (except for a callback). - Some fixes in the openpgp authentication. - Removed the Twofish cipher. - The openssl compatibility layer was moved to gnutls-openssl library instead of being included in the gnutls-extra library. - Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. - Building with openpgp support is now mandatory. - gnutls4 compatibility header is no longer included by default in gnutls.h. - gnutls8 function usage yelds a deprecation warning in gcc3. - gnutls_x509_*_set_dn_by_oid() and gnutls_x509_*_get_*_dn_by_oid() functions have a raw_flag parameter added. - The certtool utility can now generate PKCS #12 structures without specifying a certificate. - Added capability to read CRLs to certtool. - Corrected some functions which return GNUTLS_E_SHORT_MEMORY_BUFFER to properly set the required buffer size. - Corrected a bug in libgcrypt detection. And more...
2003-12-06 01:52:21 +01:00
share/examples/gnutls/ex-x509-info.c
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
share/examples/gnutls/print-ciphersuites.c
Update to 1.2.7: * Version 1.2.7 (2005-09-09) - The GNUTLS and GNUTLS-EXTRA libraries are now built with versioned symbols. - Certtool now complains when reading out-of-range X.509 serial numbers, suggested by Fran - Certtool now uses the readline library (when available) when reading X.509 serial numbers. - Fixed build problems in getpass on uClibc and Mingw32 platforms. - Fixed compile warning regarding socklen_t on Mingw32, reported by Martin Lambers - Fixed examples in doc/examples/, suggested by Fran - Gnulib is now used for the core library, enabling future code cleanups. - The gnutls-cli tool now use gnutls_certificate_verify_peers2, suggested by Daniel Stenberg - Doc fixes for gnutls_transport_set_push and gnutls_transport_set_pull. - Minilibtasn1 is now 0.2.17 (removed optional use of C99 macros). - Disable zlib support if zlib.h is not present. - A number of internal cleanups. - API and ABI modifications: No changes since last version. pkgsrc change: do not install libexamples (looks like a bug)
2005-09-30 15:11:34 +02:00
share/examples/gnutls/tcp.c
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
share/examples/gnutls/udp.c
share/examples/gnutls/verify.c
share/locale/cs/LC_MESSAGES/gnutls.mo
share/locale/de/LC_MESSAGES/gnutls.mo
share/locale/en@boldquot/LC_MESSAGES/gnutls.mo
share/locale/en@quot/LC_MESSAGES/gnutls.mo
Update to 3.2.1. * Version 3.2.1 (released 2013-06-01) ** libgnutls: Allow ECC when in SSL 3.0 to work-around a bug in certain openssl versions. ** libgnutls: Fixes in interrupted function resumption. Report and patch by Tim Kosse. ** libgnutls: Corrected issue when receiving client hello verify requests in DTLS. ** libgnutls: Fixes in DTLS record overhead size calculations. ** libgnutls: gnutls_handshake_get_last_in() was fixed. Reported by Mann Ern Kang. ** API and ABI modifications: gnutls_session_set_id: Added * Version 3.2.0 (released 2013-05-10) ** libgnutls: Use nettle's elliptic curve implementation. ** libgnutls: Added Salsa20 cipher ** libgnutls: Added UMAC-96 and UMAC-128 ** libgnutls: Added ciphersuites involving Salsa20 and UMAC-96. As they are not standardized they are defined using private ciphersuite numbers. ** libgnutls: Added support for DTLS 1.2. ** libgnutls: Added support for the Application Layer Protocol Negotiation (ALPN) extension. ** libgnutls: Removed support for the RSA-EXPORT ciphersuites. ** libgnutls: Avoid linking to librt (that also avoids unnecessary linking to pthreads if p11-kit isn't used). ** API and ABI modifications: gnutls_cipher_get_iv_size: Added gnutls_hmac_set_nonce: Added gnutls_mac_get_nonce_size: Added * Version 3.1.10 (released 2013-03-22) ** certtool: When generating PKCS #12 files use by default the ARCFOUR (RC4) cipher to be compatible with devices that don't support AES with PKCS #12. ** libgnutls: Load CA certificates in android 4.x systems. ** libgnutls: Optimized CA certificate loading. ** libgnutls: Private keys are overwritten on deinitialization. ** libgnutls: PKCS #11 slots are scanned only when needed, not on initialization. This speeds up gnutls initialization when smart cards are present. ** libgnutls: Corrected issue in the (deprecated) external key signing interface, when used with TLS 1.2. Reported by Bjorn H. Christensen. ** libgnutls: Fixes in openpgp handshake with fingerprints. Reported by Joke de Buhr. ** libgnutls-dane: Updated DANE verification options. ** configure: Trust store file must be explicitly set or unset when cross compiling. ** API and ABI modifications: gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added gnutls_x509_trust_list_remove_trust_mem: Added gnutls_x509_trust_list_remove_trust_file: Added gnutls_x509_trust_list_remove_cas: Added gnutls_session_get_desc: Added gnutls_privkey_sign_raw_data: Added gnutls_privkey_status: Added * Version 3.1.9 (released 2013-02-27) ** certtool: Option --to-p12 will now ask for a password to generate a PKCS #12 file from an encrypted key file. Reported by Yan Fiz. ** libgnutls: Corrected issue in gnutls_pubkey_verify_data(). ** libgnutls: Corrected parsing issue in XMPP within a subject alternative name. Reported by James Cloos. ** libgnutls: gnutls_pkcs11_reinit() will reinitialize all PKCS #11 modules, and not only the ones loaded via p11-kit. ** libgnutls: Added function to check whether the private key is still available (inserted). ** libgnutls: Try to detect fork even during nonce generation. ** API and ABI modifications: gnutls_handshake_set_random: Added gnutls_transport_set_int2: Added gnutls_transport_get_int2: Added gnutls_transport_get_int: Added gnutls_record_cork: Exported gnutls_record_uncork: Exported gnutls_pkcs11_privkey_status: Added * Version 3.1.8 (released 2013-02-10) ** libgnutls: Fixed issue in gnutls_x509_privkey_import2() which didn't return GNUTLS_E_DECRYPTION_FAILED in all cases, and affect certtool operation with encrypted keys. Reported by Yan Fiz. ** libgnutls: The minimum DH bits accepted by priorities NORMAL and PERFORMANCE was set to previous defaults 727 bits. Reported by Diego Elio Petteno. ** libgnutls: Corrected issue which prevented gnutls_pubkey_verify_hash() to operate with long keys. Reported by Erik A Jensen. ** API and ABI modifications: No changes since last version. * Version 3.1.7 (released 2013-02-04) ** certtool: Added option "dn" which allows to directly set the DN in a template from an RFC4514 string. ** danetool: Added options: --dlv and --insecure. Suggested by Paul Wouters. ** libgnutls-xssl: Added a new library to simplify GnuTLS usage. ** libgnutls-dane: Added function to specify a DLV file. ** libgnutls: Heartbeat code was made optional. ** libgnutls: Fixes in server side of DTLS-0.9. ** libgnutls: DN variable 'T' was expanded to 'title'. ** libgnutls: Fixes in record padding parsing to prevent a timing attack. Issue reported by Kenny Paterson and Nadhem Alfardan. ** libgnutls: Added functions to directly set the DN in a certificate or request from an RFC4514 string. ** libgnutls: Optimizations in the random generator. The re-seeding of it is now explicitly done on every session deinit. ** libgnutls: Simplified the DTLS sliding window implementation. ** libgnutls: The minimum DH bits accepted by a client are now set by the specified priority string. The current values correspond to the previous defaults (727 bits), except for the SECURE128 and SECURE192 strings which increase the minimum to 1248 and 1776 respectively. ** libgnutls: Added the gnutls_record_cork() and uncork API to enable buffering in sending application data. ** libgnutls: Removed default random padding, and added a length-hiding interface instead. Both the server and the client must support this extension. Whether length-hiding can be used on a given session can be checked using gnutls_record_can_use_length_hiding(). Contributed by Alfredo Pironti. ** libgnutls: Added the experimental %NEW_PADDING priority string. It enables a new padding mechanism in TLS allowing arbitrary padding in TLS records in all ciphersuites, which makes length-hiding more efficient and solves the issues with timing attacks on CBC ciphersuites. ** libgnutls: Corrected gnutls_cipher_decrypt2() when used with AEAD ciphers (i.e., AES-GCM). Reported by William McGovern. ** API and ABI modifications: gnutls_db_check_entry_time: Added gnutls_record_set_timeout: Added gnutls_record_get_random_padding_status: Added gnutls_x509_crt_set_dn: Added gnutls_x509_crt_set_issuer_dn: Added gnutls_x509_crq_set_dn: Added gnutls_range_split: Added gnutls_record_send_range: Added gnutls_record_set_max_empty_records: Added gnutls_record_can_use_length_hiding: Added gnutls_rnd_refresh: Added xssl_deinit: Added xssl_flush: Added xssl_read: Added xssl_getdelim: Added xssl_write: Added xssl_printf: Added xssl_sinit: Added xssl_client_init: Added xssl_server_init: Added xssl_get_session: Added xssl_get_verify_status: Added xssl_cred_init: Added xssl_cred_deinit: Added dane_state_set_dlv_file: Added GNUTLS_SEC_PARAM_EXPORT: Added GNUTLS_SEC_PARAM_VERY_WEAK: Added * Version 3.1.6 (released 2013-01-02) ** libgnutls: Fixed record padding parsing issue. Reported by Kenny Patterson and Nadhem Alfardan. ** libgnutls: Several updates in the ASN.1 string handling subsystem. ** libgnutls: gnutls_x509_crt_get_policy() allows for a list of zero policy qualifiers. ** libgnutls: Ignore heartbeat messages when received out-of-order, instead of issuing an error. ** libgnutls: Stricter RSA PKCS #1 1.5 encoding and decoding. Reported by Kikuchi Masashi. ** libgnutls: TPM support is disabled by default because GPL programs cannot link with it. Use --with-tpm to enable it. ** libgnutls-guile: Fixed parallel compilation issue. ** gnutls-cli: It will try to connect to all possible returned addresses before failing. ** API and ABI modifications: No changes since last version. * Version 3.1.5 (released 2012-11-24) ** libgnutls: Added functions to parse the certificates policies extension. ** libgnutls: Handle BMPString (UCS-2) encoding in the Distinguished Name by translating it to UTF-8 (works on windows or systems with iconv). ** libgnutls: Added PKCS #11 key generation function that returns the public key on generation. ** libgnutls: Corrected bug in priority string parsing, that mostly affected combined levels. Patch by Tim Kosse. ** certtool: The --pubkey-info option can be combined with the --load-privkey or --load-request to print the corresponding public keys. ** certtool: It is able to set certificate policies via a template. ** certtool: Added --hex-numbers option which prints big numbers in an easier to parse format. ** p11tool: After key generation, outputs the public key (useful in tokens that do not store the public key). ** danetool: It is being built even without libgnutls-dane (the --check functionality is disabled though). ** API and ABI modifications: gnutls_pkcs11_privkey_generate2: Added gnutls_x509_crt_get_policy: Added gnutls_x509_crt_set_policy: Added gnutls_x509_policy_release: Added gnutls_pubkey_import_x509_crq: Added gnutls_pubkey_print: Added GNUTLS_CRT_PRINT_FULL_NUMBERS: Added * Version 3.1.4 (released 2012-11-10) ** libgnutls: gnutls_certificate_verify_peers2() will set flags depending on the available revocation data validity. ** libgnutls: Added gnutls_certificate_verification_status_print(), a function to print the verification status code in human readable text. ** libgnutls: Added priority string %VERIFY_DISABLE_CRL_CHECKS. ** libgnutls: Simplified certificate verification by adding gnutls_certificate_verify_peers3(). ** libgnutls: Added support for extension to establish keys for SRTP. Contributed by Martin Storsjo. ** libgnutls: The X.509 verification functions check the key usage bits and pathlen constraints and on failure output GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE. ** libgnutls: gnutls_x509_crl_verify() includes the time checks. ** libgnutls: Added verification flag GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN and made GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN the default. ** libgnutls: Always tolerate key usage violation errors from the side of the peer, but also notify via an audit message. ** gnutls-cli: Added --local-dns option. ** danetool: Corrected bug that prevented loading PEM files. ** danetool: Added --check option to allow querying and verifying a site's DANE data. ** libgnutls-dane: Added pkg-config file for the library. ** API and ABI modifications: gnutls_session_get_id2: Added gnutls_sign_is_secure: Added gnutls_certificate_verify_peers3: Added gnutls_ocsp_status_request_is_checked: Added gnutls_certificate_verification_status_print: Added gnutls_srtp_set_profile: Added gnutls_srtp_set_profile_direct: Added gnutls_srtp_get_selected_profile: Added gnutls_srtp_get_profile_name: Added gnutls_srtp_get_profile_id: Added gnutls_srtp_get_keys: Added gnutls_srtp_get_mki: Added gnutls_srtp_set_mki: Added gnutls_srtp_profile_t: Added dane_cert_type_name: Added dane_match_type_name: Added dane_cert_usage_name: Added dane_verification_status_print: Added GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED: Added GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE: Added GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE: Added GNUTLS_CERT_UNEXPECTED_OWNER: Added GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN: Added * Version 3.1.3 (released 2012-10-12) ** libgnutls: Added support for the OCSP Certificate Status extension. ** libgnutls: gnutls_certificate_verify_peers2() will use the OCSP certificate status extension in verification. ** libgnutls: Bug fixes in gnutls_x509_privkey_import_openssl(). ** libgnutls: Increased maximum password length in the PKCS #12 functions. ** libgnutls: Fixed the receipt of session tickets during session resumption. Reported by danblack at http://savannah.gnu.org/support/?108146 ** libgnutls: Added functions to export structures in an allocated buffer. ** libgnutls: Added gnutls_ocsp_resp_check_crt() to check whether the OCSP response corresponds to the given certificate. ** libgnutls: In client side gnutls_init() enables the session ticket and OCSP certificate status request extensions by default. The flag GNUTLS_NO_EXTENSIONS can be used to prevent that. ** libgnutls: Several updates in the OpenPGP code. The generating code is fully RFC6091 compliant and RFC5081 support is only supported in client mode. ** libgnutls-dane: Added. It is a library to provide DANE with DNSSEC certificate verification. ** gnutls-cli: Added --dane option to enable DANE certificate verification. ** danetool: Added tool to generate DANE TLSA Resource Records (RR). ** API and ABI modifications: gnutls_certificate_get_peers_subkey_id: Added gnutls_certificate_set_ocsp_status_request_function: Added gnutls_certificate_set_ocsp_status_request_file: Added gnutls_ocsp_status_request_enable_client: Added gnutls_ocsp_status_request_get: Added gnutls_ocsp_resp_check_crt: Added gnutls_dh_params_export2_pkcs3: Added gnutls_pubkey_export2: Added gnutls_x509_crt_export2: Added gnutls_x509_dn_export2: Added gnutls_x509_crl_export2: Added gnutls_pkcs7_export2: Added gnutls_x509_privkey_export2: Added gnutls_x509_privkey_export2_pkcs8: Added gnutls_x509_crq_export2: Added gnutls_openpgp_crt_export2: Added gnutls_openpgp_privkey_export2: Added gnutls_pkcs11_obj_export2: Added gnutls_pkcs12_export2: Added gnutls_pubkey_import_openpgp_raw: Added gnutls_pubkey_import_x509_raw: Added dane_state_init: Added dane_state_deinit: Added dane_query_tlsa: Added dane_query_status: Added dane_query_entries: Added dane_query_data: Added dane_query_deinit: Added dane_verify_session_crt: Added dane_verify_crt: Added dane_strerror: Added * Version 3.1.2 (released 2012-09-26) ** libgnutls: Fixed bug in gnutls_x509_trust_list_add_system_trust() and gnutls_x509_trust_list_add_trust_mem() that prevented the loading of certificates in the windows platform. ** libgnutls: Corrected bug in OpenPGP subpacket encoding. ** libgnutls: Added support for DTLS/TLS heartbeats by Olga Smolenchuk. (the work was done during Google Summer of Code). ** libgnutls: Added X.509 certificate verification flag GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN. This flag allows the verification of unsorted certificate chains and is enabled by default for TLS certificate verification (if gnutls_certificate_set_verify_flags() does not override it). ** libgnutls: Prints warning on certificates that contain keys of an insecure level. If the %COMPAT priority flag is not specified the TLS connection fails. ** libgnutls: Correctly restore gnutls_record_recv() in DTLS mode if interrupted during the retrasmition of handshake data. ** libgnutls: Better mingw32 support (patch by LRN). ** libgnutls: The %COMPAT keyword, if specified, will tolerate key usage violation errors (they are far too common to ignore). ** libgnutls: Added GNUTLS_STATELESS_COMPRESSION flag to gnutls_init(), which provides a tool to counter compression-related attacks where parts of the data are controlled by the attacker _and_ are placed in separate records (use with care - do not use compression if not sure). ** libgnutls: Depends on libtasn1 2.14 or later. ** certtool: Prints the number of bits of the public key algorithm parameter in a private key. ** API and ABI modifications: gnutls_x509_privkey_get_pk_algorithm2: Added gnutls_heartbeat_ping: Added gnutls_heartbeat_pong: Added gnutls_heartbeat_allowed: Added gnutls_heartbeat_enable: Added gnutls_heartbeat_set_timeouts: Added gnutls_heartbeat_get_timeout: Added GNUTLS_SEC_PARAM_WEAK: Added GNUTLS_SEC_PARAM_INSECURE: Added * Version 3.1.1 (released 2012-09-02) ** gnutls-serv: Listens on IPv6. Patch by Bernhard R. Link. ** certtool: Changes in password handling of certtool. Ask password when required and only if the '--password' option is not given. If the '--password' option is given during key generation then assume the PKCS #8 file format, instead of ignoring the password. ** tpmtool: No longer asks for key password in registered keys. ** libgnutls: Elliptic curve code was optimized by Ilya Tumaykin. wmNAF is now used for point multiplication and other optimizations. (the major part of the work was done during Google Summer of Code). ** libgnutls: The default pull_timeout_function only uses select instead of a combination of select() and recv() to prevent issues when used in stream sockets in some systems. ** libgnutls: Be tolerant in ECDSA signature violations (e.g. using SHA256 with a SECP384 curve instead of SHA-384), to interoperate with openssl. ** libgnutls: Fixed DSA and ECDSA signature generation in smart cards. Thanks to Andreas Schwier from cardcontact.de for providing me with ECDSA capable smart cards. ** API and ABI modifications: gnutls_sign_algorithm_get: Added gnutls_sign_get_hash_algorithm: Added gnutls_sign_get_pk_algorithm: Added * Version 3.1.0 (released 2012-08-15) ** libgnutls: Added direct support for TPM as a cryptographic module in gnutls/tpm.h. TPM keys can be used in functions accepting files using URLs of the following types: tpmkey:file=/path/to/file tpmkey:uuid=7f468c16-cb7f-11e1-824d-b3a4f4b20343;storage=user ** libgnutls: Priority string level keywords can be combined. For example the string "SECURE256:+SUITEB128" is now allowed. ** libgnutls: requires libnettle 2.5. ** libgnutls: Use the PKCS #1 1.5 encoding provided by nettle (2.5) for encryption and signatures. ** libgnutls: Added GNUTLS_CERT_SIGNATURE_FAILURE to differentiate between generic errors and signature verification errors in the verification functions. ** libgnutls: Added gnutls_pkcs12_simple_parse() as a helper function to simplify parsing in most PKCS #12 use cases. ** libgnutls: gnutls_certificate_set_x509_simple_pkcs12_file() adds the whole certificate chain (if any) to the credentials structure, instead of only the end-user certificate. ** libgnutls: Key import functions such as gnutls_pkcs12_simple_parse() and gnutls_x509_privkey_import_pkcs8(), return consistently GNUTLS_E_DECRYPTION_FAILED if the input structure is encrypted but no password was provided. ** libgnutls: Added gnutls_handshake_set_timeout() a function that allows to set the maximum time spent in a handshake. ** libgnutlsxx: Added session::set_transport_vec_push_function. Patch by Alexandre Bique. ** tpmtool: Added. It is a tool to generate private keys in the TPM. ** gnutls-cli: --benchmark-tls was split to --benchmark-tls-kx and --benchmark-tls-ciphers ** certtool: generated PKCS #12 structures may hold more than one private key. Patch by Lucas Fisher. ** certtool: Added option --null-password to generate/decrypt keys that use a NULL password (in schemas that distinguish between NULL an empty passwords). ** minitasn1: Upgraded to libtasn1 version 2.13. ** API and ABI modifications: GNUTLS_CERT_SIGNATURE_FAILURE: Added GNUTLS_CAMELLIA_192_CBC: Added GNUTLS_PKCS_NULL_PASSWORD: Added gnutls_url_is_supported: Added gnutls_pkcs11_obj_list_import_url2: Added gnutls_pkcs11_obj_set_pin_function: Added gnutls_pkcs11_privkey_set_pin_function: Added gnutls_pkcs11_get_pin_function: Added gnutls_privkey_import_tpm_raw: Added gnutls_privkey_import_tpm_url: Added gnutls_privkey_import_pkcs11_url: Added gnutls_privkey_import_openpgp_raw: Added gnutls_privkey_import_x509_raw: Added gnutls_privkey_import_ext2: Added gnutls_privkey_import_url: Added gnutls_privkey_set_pin_function: Added gnutls_tpm_privkey_generate: Added gnutls_tpm_key_list_deinit: Added gnutls_tpm_key_list_get_url: Added gnutls_tpm_get_registered: Added gnutls_tpm_privkey_delete: Added gnutls_pubkey_import_tpm_raw: Added gnutls_pubkey_import_tpm_url: Added gnutls_pubkey_import_url: Added gnutls_pubkey_verify_hash2: Added gnutls_pubkey_set_pin_function: Added gnutls_x509_privkey_import2: Added gnutls_x509_privkey_import_openssl: Added gnutls_x509_crt_set_pin_function: Added gnutls_load_file: Added gnutls_pkcs12_simple_parse: Added gnutls_certificate_set_x509_system_trust: Added gnutls_certificate_set_pin_function: Added gnutls_x509_trust_list_add_system_trust: Added gnutls_x509_trust_list_add_trust_file: Added gnutls_x509_trust_list_add_trust_mem: Added gnutls_pk_to_sign: Added gnutls_handshake_set_timeout: Added gnutls_pubkey_verify_hash: Deprecated (use gnutls_pubkey_verify_hash2) gnutls_pubkey_verify_data: Deprecated (use gnutls_pubkey_verify_data2)
2013-07-08 10:30:01 +02:00
share/locale/eo/LC_MESSAGES/gnutls.mo
update to 3.0,20 This switches to the new stable release branch.
2012-07-02 20:53:02 +02:00
share/locale/fi/LC_MESSAGES/gnutls.mo
share/locale/fr/LC_MESSAGES/gnutls.mo
share/locale/it/LC_MESSAGES/gnutls.mo
share/locale/ms/LC_MESSAGES/gnutls.mo
share/locale/nl/LC_MESSAGES/gnutls.mo
share/locale/pl/LC_MESSAGES/gnutls.mo
share/locale/sv/LC_MESSAGES/gnutls.mo
share/locale/uk/LC_MESSAGES/gnutls.mo
share/locale/vi/LC_MESSAGES/gnutls.mo
share/locale/zh_CN/LC_MESSAGES/gnutls.mo
Reference in a new issue Copy permalink