Skip to content

0.12.0

Latest
Latest

Choose a tag to compare

View all tags
@ashman-p ashman-p released this 08 Oct 21:30
· 16 commits to main since this release
0.12.0
7e9d095
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

oqs-provider 0.12.0

About

The Open Quantum Safe (OQS) project has the goal of developing and prototyping quantum-resistant cryptography. More information on OQS can be found on the website: https://openquantumsafe.org/ and on Github at https://github.com/open-quantum-safe/.

oqs-provider is a standalone OpenSSL 3+ provider enabling liboqs-based quantum-safe and hybrid key exchange for TLS 1.3, as well as quantum-safe and hybrid X.509 certificate generation, CMS, CMP and dgst (signature) operations.

When deployed, the oqs-provider binary (shared library) thus adds support for quantum-safe cryptographic operations to any standard OpenSSL(v3+) installation. The ultimate goal is that all openssl functionality shall be PQC-enabled.

In general, the oqs-provider main branch is meant to be usable in conjunction with the main branch of liboqs and the master branch of OpenSSL. See Known Issues for any exceptions.

Further details on building, testing and use can be found in README.md. See in particular limitations on intended use.

What's New

  • Added both FrodoKEM variants: previous frodokem names are now ephemeral (efrodokem); current frodokem names are the salted variants (#749). See table (here).
  • Reinstated HQC with the liboqs 0.16.0 naming hqc128, hqc192 and hqc256 to hqc1, hqc3 and hqc5. (#787).
  • Added the MQOM signature algorithm (#779).
  • Added "pure" SLH-DSA algorithms (#732). Supports OpenSSL versions < 3.5.
  • Added support for OpenSSL (v3.4+) EVP_PKEY_sign_message_* (#739).
  • Removed SPHINCS+ support (#740).

What Changed

  • Reject inconsistent classical lengths in hybrid KEM public keys by @satokan in #814
  • Add security submission guidance for AI agents and humans by @baentsch in #824
  • Fix use-after-free of comp_privkey in KEM decapsulation (GHSA-g63q-c378-wphj) by @baentsch in #829
  • Change remaining 'printf' to 'fprint(stderr' by @RodriM11 in #716
  • fix issue 628 and change oqs_test_evp_pkey_params.c to use TEST_ASSERT() by @HelenHZhang in #722
  • revert from release to dev mode by @baentsch in #733
  • Add "Pure" Stateless Hash-Based Algorithms (SLH-DSA-*) Support by @pi-314159 in #732. Supported with OpenSSL version less than 3.5.
  • Disable OpenSSL algorithms in scripts/common.py by @pi-314159 in #738
  • Enable Algo Fetch Cache mechanism only for OpenSSL v3.5.0 or newer. by @woinan in #735
  • Updating Governance by @baentsch in #715
  • Expand 'oqs_test_kem' to perform encapsulation from pubkey only by @RodriM11 in #730
  • Remove SPHINCS+ by @dstebila in #740
  • Add sign/verify message API from 3.4.0 onwards by @RodriM11 in #739
  • Use accessors for ASN1_STRING types by @bob-beck in #742
  • Add support for both FrodoKEM variants by @RodriM11 in #749
  • Add test for context strings in signatures by @RodriM11 in #747
  • Fix import parameters based on 'OSSL_KEYMGMT_SELECT_KEYPAIR' by @RodriM11 in #754
  • OSSL4 fixup by @baentsch in #758
  • add @RodriM11 as maintainer [VOTE] by @baentsch in #764
  • fix: correct duplicate NULL check in oqsx_get_hybrid_params() (GHSA-mqwg-cg22-g8r8) by @iiviel in #767
  • Fix memory leak on oqsx_genkey by @synqa in #768
  • fix: deep-copy signature field in oqs_sig_dupctx() to prevent double-free by @iiviel in #766
  • Add capacity to build oqsprovider with SHARED library type by @RodriM11 in #769
  • Preserve the property query string by @ashman-p in #774
  • Include property query for classical SIGs by @RodriM11 in #776
  • Add the MQOM signature algorithm by @rben-dev in #779
  • Fix clang-formatting errors from PR #779 by @RodriM11 in #781
  • Enhance DTLS1.3 support to handle the case when DTLS1.3 is disabled. by @ashman-p in #785
  • Re-activate HQC version 2025-08-22 by @RodriM11 in #787
  • Remove algs that cannot be used in TLS from openssl list -tls-signature-algorithms by @iyanmv in #788
  • Fix build warning X509_NAME OpenSSL 4.X by @RodriM11 in #794
  • oqsprov: avoid encoder hotpath in P-curve hybrid KEM keygen by @Vishnu2707 in #778
  • Clarify standardized PQ algorithms on OpenSSL >= 3.5 by @iyanmv in #790
  • Add test algs overlap by @iyanmv in #799
  • ci: Harden GitHub Actions workflows by @jplomas in #786
  • Include back OpenSSL master testing onto CI by @RodriM11 in #806
  • ci: install build-essential in standalone_linux_intel job by @baentsch in #809
  • Fix heap buffer overflow in RSA-hybrid classical public key reconstruction (GHSA-2g5g-3c4v-v8pw) by @satokan in #810
  • Add IANA codepoints for hybrid SecP256r1MLKEM512 and MLKEM512X25519 by @ghen2 in #802
  • Update SECURITY.md [skip ci] by @RodriM11 in #813
  • oqsx_key_new() double free by @novotimo in #816
  • Fix component selection in hybrid KEM TEXT encoding by @satokan in #815
  • Reject inconsistent classical lengths in hybrid KEM public keys by @satokan in #814
  • Add security submission guidance for AI agents and humans by @baentsch in #824
  • Fix use-after-free of comp_privkey in KEM decapsulation (GHSA-g63q-c378-wphj) by @baentsch in #829
  • Classical algorithms retain the property queries from their hybrid PQ counterparts. (#774, #776).

Known Issues

This release supports version OpenSSL 4.0.3 or lower. This is due to OpenSSL commit openssl/openssl#32670 which causes a KEM name collision with SecP256r1MLKEM512.

New Contributors

Full Changelog: 0.11.0...0.12.0

Contributors

jplomas, rben-dev, and 14 other contributors
Assets 2
Loading