Release AWS-LC-FIPS v2.0.2

What's Changed

• [fips-2022-11-02] Only update thread_states_list if freed state is head when prev is NULL by @skmcgrail in #1298

Full Changelog: AWS-LC-FIPS-2.0.1...AWS-LC-FIPS-2.0.2

Release AWS-LC-FIPS v1.1.4

What's Changed

• [fips-2021-10-20] Only update thread_states_list if freed state is head when prev is NULL by @skmcgrail in #1296

Full Changelog: AWS-LC-FIPS-1.1.3...AWS-LC-FIPS-1.1.4

Release v1.17.2

What's Changed

• EVP_PKEY assert that method is found by @justsmth in #1279
• Rearrange X509 symbols for Monit support by @samuel40791765 in #1272
• Update gha windows instance type names by @samuel40791765 in #1283
• Use uint8_t not u_int8_t by @justsmth in #1287
• Update create_image.sh for formal verification to fetch the updated Dockerfile by @pennyannn in #1281
• Ensure rand_thread_state is always zerod in the event that CRYPTO_set_thread_local needs to call the deconstructor by @skmcgrail in #1288
• Don't use expired certificates if possible. by @samuel40791765 in #1282
• Bump version to 1.17.2 by @skmcgrail in #1290

Full Changelog: v1.17.1...v1.17.2

Release AWS-LC FIPS v2.0.1

What's Changed

• Backport rand_thread_state zero patch to 2022-11-02, bump version to 2.0.1. by @skmcgrail in #1289

Full Changelog: AWS-LC-FIPS-2.0.0...AWS-LC-FIPS-2.0.1

Release AWS-LC-FIPS v1.1.3

What's Changed

• Backport rand_thread_state zero patch to 2021-10-20, bump version to 1.1.3 by @skmcgrail in #1291

Full Changelog: AWS-LC-FIPS-1.1.2...AWS-LC-FIPS-1.1.3

Release v1.17.1

What's Changed

• Document Ed25519 verification operation by @torben-hansen in #1256
• Fix AES on PPCBE (32-bit and 64-bit). by @nebeid in #1213
• Upstream merge 2023-10-23 by @nebeid in #1262
• Create dirs in cmake build dir with default permissions by @sfod in #1269
• Refactor ED25519_keypair into hw and nohw backend by @torben-hansen in #1271
• Run basic test run in GHA before using expensive runners by @samuel40791765 in #1270
• Bump version to v1.17.1 by @justsmth in #1280

New Contributors

• @sfod made their first contribution in #1269

Full Changelog: v1.17.0...v1.17.1

Release v1.17.0

What's Changed

• Add a FFDH benchmark to demonstrate how slow it is by @andrewhop in #1202
• Add missing NULL check in conf test by @torben-hansen in #1208
• Add EVP support for SHA512-224 by @WillChilds-Klein in #1170
• Handle x30 target register in delocator for aarch64 to avoid clobbering the register by @torben-hansen in #1204
• Elaborate on whiten factor for passive entropy by @torben-hansen in #1209
• Implement SSL_get_client_ciphers by @WillChilds-Klein in #1159
• Add ARM dimensions for integration test CI by @samuel40791765 in #1206
• Add back support for SSL_build_cert_chain by @samuel40791765 in #1200
• Add BIGNUM support for big-endian architectures by @justsmth in #1205
• For Issue-1185: Avoid 'may be used uninitialized' warning by @justsmth in #1212
• Use s2n-bignum's constant-time table lookup for copy_from_prebuf by @aqjune-aws in #1189
• No external conditioning by @torben-hansen in #1216
• Don't build FFDH benchmarks with AWS-LC API versions less than 22 by @andrewhop in #1218
• Add TLS Transfer Support Caller Responsibilities by @skmcgrail in #1223
• EC support for PPC64 big endian by @justsmth in #1214
• Update bio_info_cb to align with OpenSSL 3.x by @justsmth in #1222
• bump version to 2.0 for FIPS by @samuel40791765 in #1225
• Revert "Bump version to 2.0 for FIPS" by @samuel40791765 in #1227
• Abstract some ec2 CI logic and add support for c7g by @samuel40791765 in #1220
• Fix AppleClang 15 FIPS Shared Library Build by @skmcgrail in #1224
• Update rsa service indicator test vectors by @billbo-yang in #1230
• Expose SHAKE through the EVP API by @WillChilds-Klein in #1199
• Add support for RSA KeyGen AFT tests for FIPS186-5 to ACVP tool by @billbo-yang in #1234
• Fix Blake2b for BigEndian by @justsmth in #1235
• Upstream merge 2023-10-02 by @dkostic in #1221
• self destruct ec2 instances after certain amount of time by @samuel40791765 in #1233
• Fix bad cast in SSHKDF by @justsmth in #1241
• Add Github actions job pruner by @samuel40791765 in #1242
• Ensure array length assumption agree by @torben-hansen in #1246
• Use scoped version of EVP_MD_CTX in test by @samuel40791765 in #1244
• Resolve aws-lc-rs CI build issues by @skmcgrail in #1231
• Completely remove Jitter CPU from library artifact if not enabled by @torben-hansen in #1249
• Fix Spake25519 for big-endian by @justsmth in #1243
• Slight build fix and migrate to GHA for MacOS ARM CI by @samuel40791765 in #1245
• Fix 32-bit big-endian p521 bug by @justsmth in #1240
• Add support for BIO_FP_TEXT in file BIOs by @WillChilds-Klein in #1153
• Fix GCC 13.x compiler error by @justsmth in #1259
• Fix XChaCha20Poly1305 for big-endian by @justsmth in #1257
• Fix scrypt for big-endian by @justsmth in #1253
• Fix SipHash for big-endian by @justsmth in #1251
• Upstream merge 2023-10-15 by @andrewhop in #1250
• Add CRT integration test by @andrewhop in #1248
• Update patch for nginx integration CI by @samuel40791765 in #1260
• Add SDE+ASAN CI dimension by @samuel40791765 in #1254
• Add CI for Windows MSVC2019, MSVC2022, and SDE 32/64-bit by @samuel40791765 in #1228
• Test fixes by @nebeid in #1263
• Add a build option to the assembler to retain local symbols. by @nebeid in #1252
• Remove -mavx512vbmi2 clang compiler argument by @skmcgrail in #1266

Full Changelog: v1.16.0...v1.17.0

Release AWS-LC FIPS v2.0.0

• FIPS module can be statically built.
• More KDFs are now approved.

Release v1.16.0

What's Changed

• Upstream merge 2023 08 25 by @nebeid in #1169
• Add support for LoongArch. by @liuxiang88 in #1137
• Lower returned number for SSL_CTX_get_security_level by @samuel40791765 in #1157
• Add AWS-LC version number to both OpenSSL_version and OPENSSL_VERSION_TEXT by @andrewhop in #767
• Simplify HAProxy integration tests by using built in filters by @andrewhop in #1174
• Fix and add CI for postgres build on arm by @samuel40791765 in #1176
• Align with OpenSSL on TLS 1.3 cipher suite constants. by @andrewhop in #1175
• Fix Compiler Error on GCC 13 by @skmcgrail in #1184
• add integration CI dimension for nginx by @samuel40791765 in #1143
• Alias RAND_priv_bytes to RAND_bytes by @geedo0 in #1180
• Add BN_CTX_secure_new alias for BN_CTX_new by @geedo0 in #1179
• Simplify Prefix Build Support by @skmcgrail in #1178
• Check for unset certificates in servers by @samuel40791765 in #1181
• Add prefix symbols for Windows FIPS Shared Build by @skmcgrail in #1191
• MSVC 2022 - Ignore C5266 and C5267 by @justsmth in #1190
• Fix AVX512 capability check by @justsmth in #1193
• Disable XTS use of AVX512 on Windows by @justsmth in #1195
• Use passive entropy source method by default for FIPS build mode by @torben-hansen in #1188
• add patch and integration CI dimension for sslproxy by @samuel40791765 in #1183
• Pull in the latest changes from s2n-bignum (2023-09-17) by @aqjune-aws in #1197
• Upstream Merge - Remove unions in EC_SCALAR and EC_FELEM. by @justsmth in #1177
• Remove a few lingering references to Rust bindings by @justsmth in #1203
• Calibrate BN_window_bits_for_ctime_exponent_size to use 5 by @aqjune-aws in #1166
• Bump release version to v1.16.0 by @torben-hansen in #1207

New Contributors

• @liuxiang88 made their first contribution in #1137

Full Changelog: v1.15.0...v1.16.0

v1.15.0

Main changes

Reduced RSA sign/verify latency on Graviton 2 for sizes 2048-4096. For example, RSA 2048 signing reduced from ~3.3 ms to 2 ms

What's Changed

• Add EVP_MD_do_all by @WillChilds-Klein in #1154
• error: '%s' directive argument is null by @justsmth in #1158
• Fix build on gcc 4.8.3 by @samuel40791765 in #1156
• Remove duplicate handling of OPENSSL_NO_ASM from CMake. by @PiotrSikora in #1149
• Add -DBUILD_TOOL=OFF to CMake. by @PiotrSikora in #1148
• Upstream merge 2023 08 09 by @justsmth in #1152, #1160, #1161
• Add missing symbols for SSLProxy support by @samuel40791765 in #1155
• RSA performance improvement on Graviton 2 - part 1: Update montgomery multiplication to use s2n-bignum's verified scalar bignum functions by @aqjune-aws in #1135
• Add more ssl runner tests for multiple certificate support by @samuel40791765 in #1141
• CVE-2023-3446 and CVE-2023-3817 by @dkostic in #1163
• Minor fix in aead test by @dkostic in #1165
• RSA performance improvement on Graviton 2 - part 2: Conditionally enable Neon version of s2n-bignum implementations for montgomery multiplications by @aqjune-aws in #1164
• Fix build for ppc64le by @justsmth in #1167
• Add additional documentation for X509 headers by @samuel40791765 in #1142
• Preparing for release v1.15.0 by @nebeid in #1171

New Contributors

• @PiotrSikora made their first contribution in #1149

Full Changelog: v1.14.0...v1.15.0