| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: bouncycastle-util | Distribution: openSUSE Tumbleweed |
| Version: 1.84 | Vendor: openSUSE |
| Release: 1.1 | Build date: Thu Apr 16 15:49:52 2026 |
| Group: Development/Libraries/Java | Build host: reproducible |
| Size: 804749 | Source RPM: bouncycastle-1.84-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://www.bouncycastle.org | |
| Summary: Bouncy Castle ASN.1 Extension and Utility APIs | |
The Bouncy Castle Java APIs for ASN.1 extension and utility APIs used to support bcpkix and bctls.
MIT
* Thu Apr 16 2026 Pedro Monreal <pmonreal@suse.com>
- Update to 1.84:
* Security Fixes:
- CVE-2025-14813: GOSTCTR implementation unable to process more than
255 blocks correctly. (bsc#1262225)
- CVE-2026-0636: LDAP Injection Vulnerability in LDAPStoreHelper.java.
(bsc#1262226)
- CVE-2026-3505: Unbounded PGP AEAD chunk size leads to pre-auth
resource exhaustion. (bsc#1262232)
- CVE-2026-5588: PKIX draft CompositeVerifier accepts empty signature
sequence as valid. (bsc#1262228)
- CVE-2026-5598: Non-constant time comparisons risk private key
leakage in FrodoKEM. (bsc#1262227)
* Additional Features and Functionality:
- In line with JVM changes, KEM support has been backported to
Java 17.
- BCJSSE: Configurable (client) early key_share groups via
BCSSLParameters.earlyKeyShares or
'org.bouncycastle.jsse.client.earlyKeyShares' system property.
- BCJSSE: Support for curveSM2MLKEM768 hybrid NamedGroup in TLS
1.3 per draft-yang-tls-hybrid-sm2-mlkem-03.
- BCJSSE: Log when default cipher suites are disabled.
- BCJSSE: Experimental support for ShangMi crypto in TLS 1.3 per
RFC 8998 (not enabled by default).
- CMS: Added CMSAuthEnvelopedDataStreamGenerator.open taking an
explicit content type.
- HKDF: Provider support for HKDFParameterSpec.Expand.
- Added initial support for RFC 9380 (Hashing to Elliptic Curves);
see org.bouncycastle.crypto.hash2curve .
- PKCS12: Added default max iteration count of 5,000,000 (configurable
via 'org.bouncycastle.pkcs12.max_it_count' property).
- TLS: Use javax.crypto.KEM API (when available) to access ML-KEM
implementation (incl. hybrids).
- A new KeyStore, PKCS12-PBMAC1, has been added which defaults to
using PBMAC1 and supports RFC 9879.
- A new property 'org.bouncycastle.asn1.max_cons_depth' has been added
to allow setting of the maximum nesting for SETs/SEQUENCESs in ASN.1.
Default is 32.
- A new property 'org.bouncycastle.asn1.max_limit' has been added
to allow setting of the stream size of ASN.1 encodings. The value can
be either in bytes, or appended with k (1 kilobyte blocks), m (1
megabyte blocks), or g (1 gigabyte blocks).
- Added NTRU+ support to the lightweight PQC API and the BCPQC provider.
- Added SM4 key wrap/unwrap mode, SM2 key exchange, and logging to SM2Signer.
- OpenPGP: Added encryption-key filtering by purpose, a new OpenPGPKey
constructor, KeyPassphraseProvider-based passphrase change, wildcard
(anonymous) recipient handling, and Web-of-Trust methods for
third-party signature chains and delegations.
- CMSSignedDataStreamGenerator can now support the generation of DER/DL
encoded SignedData objects (note memory restrictions still apply).
- It is now possible to add extra digest alorithm IDs to
CMSSignedDataStreamGenerator when required.
* Defects Fixed:
- Random numbers being generated for DSTU4145 signature calculations
were 1 bit shorter than they could be. The code has been corrected
to allow the generated numbers to occupy the full numeric range available.
- HKDF implementation has been corrected to use multiple IKMs if available.
- CompositePublic/PrivateKey builders had an issue identifying brainpool
and EdDSA curves from the algorithm names due to an error in the OID
mapping table. This has been fixed.
- S/MIME: Fix AuthEnveloped support for AES192/GCM and AES256/GCM.
- CMS: Use implicit tag for AuthEnvelopedData.authEncryptedContentInfo.encryptedContent.
- Fixed Strings.split to handle delimiters at position 0.
- Fixed FrodoKEM error sampling to be constant-time.
- Fixed PKIXNameConstraintValidator to treat a DNS name as intersecting itself.
- Fixed PKCS12 key stores not calling getInstance with the original provider
(which was forcing provider registration).
- A resource leak due to the SMIMESigned constructor leaving background
threads hanging on MessagingException has been fixed.
- OpenPGP: Fixed an issue where a custom signature creation time was
ignored when generating message signatures.
- OpenPGP: Fixed SKESK encoding for direct-S2K-encrypted messages.
* Additional Notes:
- DSA was recently deprecated by NIST and several users have requested
that we move to an RSA signing certificate for provider signing
instead of our current DSA one. We are grateful to report that Oracle
have been very supportive of this and issued us a second RSA certificate
based on a new RSA key for signing providers. Providers signed with the
previous DSA key will continue to work as before.
- This will be the last release which will recognise Dilithium and
SphincsPlus in the BC provider, the Kyber wrapper (which is just ML-KEM)
will also be removed. The algorithms won't be deleted in 1.85, but will
only be accessible via the low-level APIs and deleted in a later release.
* Tue Dec 16 2025 Pedro Monreal <pmonreal@suse.com>
- Update to 1.83:
* Defects Fixed:
- Attempting to check a password on a stripped PGP would throw an
exception. Checking the password on such a key will now always
return false.
- Fixed an issue in KangarooTwelve where premature absorption caused
erroneous 168-byte padding; absorption is now delayed so correct
final-byte padding is applied.
- BCJSSE: Fix supported_versions creation for renegotiation handshake.
- (D)TLS: Reneg info now oly offered with pre-1.3.
* Additional Features and Functionality:
- A generic "COMPOSITE" algorithm name has been added as a JCA
Signature algorithm. The algorithm will identify the composite
signature to use from the composite key passed in.
- The composite signatures implementation has been updated to the
final draft and now follows the submitted standard.
- Support for the generation and use as trust anchors has been added
for certificate signatures with id-alg-unsigned as the signature type.
- Support for CMP direct POP for encryption keys using
challenge/response has been added to the CMP/CRMF APIs.
- Support for SupportedCurves attribute to the BC provider
- BCJSSE: Added support for SLH-DSA signature schemes in TLS 1.3 per
draft-reddy-tls-slhdsa-01.
- Support has been added for the Java 25 KDF API (current algorithms,
PBKDF2, SCRYPT, and HKDF).
- Support for composite signatures is now included in CMS and timestamping.
- It is now possible to disable the Lenstra check in RSA where the public
key is not available via the system/security property
"org.bouncycastle.rsa.no_lenstra_check".
* Mon Sep 22 2025 Pedro Monreal <pmonreal@suse.com>
- Update to 1.82:
* Defects Fixed:
- SNOVA and MAYO are now correctly added to the JCA provider module-info file.
- TLS: Avoid nonce reuse error in JCE AEAD workaround for pre-Java7.
- BCJSSE: Session binding map is now shared across all stages of the
session lifecycle (SunJSSE compatibility).
- The CMCEPrivateKeyParameters#reconstructPublicKey method was returning
an empty byte array. It now returns an encoding of the public key.
- CBZip2InputStream no longer auto-closes at end-of-contents.
- The BC CertPath implementation was eliminating certificates on the
bases of the Key-ID. This is not in accordance with RFC 4158.
- Support for the previous set of libOQS Falcon OIDs has been restored.
- The BC CipherInputStream could throw an exception if asked to handle an
AEAD stream consisting of the MAC only.
- Some KeyAgreement classes were missing in the Java 11 class hierarchy.
- Fix typo in a constant name in the HPKE class and deprecate the old constant.
- Fuzzing analysis has been done on the OpenPGP API and additional code
has been added to prevent escaping exceptions.
* Additional Features and Functionality:
- SHA3Digest, CSHAKE, TupleHash, KMAC now provide support for Memoable
and EncodableService.
- BCJSSE: Added support for integrity-only cipher suites in TLS 1.3 per RFC 9150.
- BCJSSE: Added support for system properties "jdk.tls.{client,server}.maxInboundCertificateChainLength"
- BCJSSE: Added support for ML-DSA signature schemes in TLS 1.3 per draft-ietf-tls-mldsa-00.
- The Composite post-quantum signatures implementation has been updated to
the latest draft (07) draft-ietf-lamps-pq-composite-sigs.
- "_PREHASH" implementations are now provided for all composite signatures
to allow the hash of the date to be used instead of the actual data in
signature calculation.
- The gradle build can now be used to generate an Bill of Materials (BOM) file.
- It is now possible to configure the SignerInfoVerifierBuilder used by the
SignedMailValidator class.
- The Ascon family of algorithms has been updated with the latest published changes.
- Composite signature keys can now be constructed from the individual keys of
the algorithms composing the composite.
- PGPSecretKey, PGPSignatureGenerator now support version 6.
- Further optimisation work has been done on ML-KEM public key validation.
- Zeroization of passwords in the JCA PKCS12 key store has been improved.
- The "org.bouncycastle.drbg.effective_256bits_entropy" property has been
added for platforms where the entropy source is not producing 1 full bit
of entropy per bit and additional bits are required (default value 282).
- OpenPGPKeyGenerator now allows for the use of empty UserIDs (version 4 compatibility).
- The HQC KEM has been updated with the latest draft updates.
* Additional Notes:
- The legacy post-quantum package has now been removed.
* Wed Jun 18 2025 Fridrich Strba <fstrba@suse.com>
- Added patch:
* bouncycastle-char-literal.patch
+ Somehow, during the build, one unicode character become too
long for being a char literal. Consider it as string then.
* Wed Jun 18 2025 Pedro Monreal <pmonreal@suse.com>
- Update to 1.81:
* Defects Fixed:
- A potention NullPointerException in the KEM KDF KemUtil class
has been removed.
- Overlapping input/output buffers in doFinal could result in
data corruption.
- Fixed Grain-128AEAD decryption incorrectly handle MAC verification.
- Add configurable header validation to prevent malicious header
injection in PGP cleartext signed messages; Fix signature packet
encoding issues in PGPSignature.join() and embedded signatures
while phasing out legacy format.
- Fixed ParallelHash initialization stall when using block size B=0.
- The PRF from the PBKDF2 function was been lost when PBMAC1 was
initialized from protectionAlgorithm. This has been fixed.
- The lowlevel DigestFactory was cloning MD5 when being asked
to clone SHA1.
* Additional Features and Functionality:
- XWing implementation updated to draft-connolly-cfrg-xwing-kem/07/
- Further support has been added for generation and use of PGP V6 keys
- Additional validation has been added for armored headers in Cleartext
Signed Messages.
- The PQC signature algorithm proposal Mayo has been added to the
low-level API and the BCPQC provider.
- The PQC signature algorithm proposal Snova has been added to the
low-level API and the BCPQC provider.
- Support for ChaCha20-Poly1305 has been added to the CMS/SMIME APIs.
- The Falcon implementation has been updated to the latest draft.
- Support has been added for generating keys which encode as seed-only
and expanded-key-only for ML-KEM and ML-DSA private keys.
- Private key encoding of ML-DSA and ML-KEM private keys now follows
the latest IETF draft.
- The Ascon family of algorithms has been updated to the initial draft
of SP 800-232. Some additional optimisation work has been done.
- Support for ML-DSA's external-mu calculation and signing has been
added to the BC provider.
- CMS now supports ML-DSA for SignedData generation.
- Introduce high-level OpenPGP API for message creation/consumption
and certificate evaluation.
- Added JDK21 KEM API implementation for HQC algorithm.
- BCJSSE: Strip trailing dot from hostname for SNI, endpointID checks.
- BCJSSE: Draft support for ML-KEM updated (draft-connolly-tls-mlkem-key-agreement-05).
- BCJSSE: Draft support for hybrid ECDHE-MLKEM (draft-ietf-tls-ecdhe-mlkem-00).
- BCJSSE: Optionally prefer TLS 1.3 server's supported_groups order
(BCSSLParameters.useNamedGroupsOrder).
* Mon Feb 03 2025 Pedro Monreal <pmonreal@suse.com>
- Update to 1.80:
* Defects Fixed:
- A splitting issue for ML-KEM led to an incorrect size for kemct
in KEMRecipientInfos. This has been fixed.
- The PKCS12 KeyStore has been adjusted to prevent accidental doubling
of the Oracle trusted certificate attribute (results in an IOException
when used with the JVM PKCS12 implementation).
- The SignerInfoGenerator copy constructor was ignoring the certHolder field.
- The getAlgorithm() method return value for a CompositePrivateKey was
not consistent with the corresponding getAlgorithm() return value for
the CompositePrivateKey. This has been fixed.
- The international property files were missing from the bcjmail distribution.
- Issues with ElephantEngine failing on processing large/multi-block messages
have been addressed.
- GCFB mode now fully resets on a reset.
- The lightweight algorithm contestants: Elephant, ISAP, PhotonBeetle,
Xoodyak now support the use of the AEADParameters class and provide
accurate update/doFinal output lengths.
- An unnecessary downcast in CertPathValidatorUtilities was resulting
in the ignoring of URLs for FTP based CRLs.
- A regression in the OpenPGP API could cause NoSuchAlgorithmException
to be thrown when attempting to use SHA-256 in some contexts.
- EtsiTs1029411TypesAuthorization was missing an extension field.
- Interoperability issues with single depth LMS keys have been addressed.
* Additional Features and Functionality:
- CompositeSignatures now updated to draft-ietf-lamps-pq-composite-sigs-03.
- ML-KEM, ML-DSA, SLH-DSA, and Composite private keys now use raw encodings
as per the latest drafts from IETF 121: draft-ietf-lamps-kyber-certificates-06,
draft-ietf-lamps-dilithium-certificates-05, and draft-ietf-lamps-x509-slhdsa.
- Initial support has been added for RFC 9579 PBMAC1 in the PKCS API.
- Support has been added for EC-JPAKE to the lightweight API.
- Support has been added for the direct construction of S/MIME AuthEnvelopedData
objects, via the SMIMEAuthEnvelopedData class.
- An override "org.bouncycastle.asn1.allow_wrong_oid_enc" property has been
added to disable new OID encoding checks (use with caution).
- Support has been added for the PBEParemeterSpec.getParameterSpec()
method where supported by the JVM.
- ML-DSA/SLH-DSA now return null for Signature.getParameters() if no context
is provided. This allows the algorithms to be used with the existing Java key tool.
- HQC has been updated to reflect the reference implementation released on 2024-10-30.
- Support has been added to the low-level APIs for the OASIS Shamir Secret
Splitting algorithms.
- BCJSSE: System property "org.bouncycastle.jsse.fips.allowGCMCiphersIn12"
no longer used. FIPS TLS 1.2 GCM suites can now be enabled according to
JcaTlsCrypto#getFipsGCMNonceGeneratorFactory (see JavaDoc for details) if
done in alignment with FIPS requirements.
- Support has been added for OpenPGP V6 PKESK and message encryption.
- PGPSecretKey.copyWithNewPassword() now includes AEAD support.
- The ASCON family of algorithms have been updated in accordance with the
published FIPS SP 800-232 draft.
* Mon Nov 04 2024 Pedro Monreal <pmonreal@suse.com>
- Update to 1.79:
* Defects Fixed:
- Leading zeroes were sometimes dropped from Ed25519 signatures
leading to verification errors in the PGP API.
- Default version string for Armored Output is now set correctly in 18on build.
- The Elephant cipher would fail on large messages.
- CMSSignedData.replaceSigners() would re-encode the digest algorithms
block, occassionally dropping ones where NULL had been previously
added as an algorithm parameter. The method now attempts to only use
the original digest algorithm identifiers.
- ERSInputStreamData would fail to generate the correct hash if
called a second time with a different hash algorithm.
- A downcast in the CrlCache which would cause FTP based CRLs to fail
to load has been removed.
- ECUtil.getNamedCurveOid() now trims curve names of excess space
before look up.
- The PhotonBeetle and Xoodyak digests did not reset properly after
a doFinal() call.
- Malformed AlgorithmIdentifiers in CertIDs could cause caching
issues in the OCSP cache.
- With Java 21 a provider service class will now be returned with
a null class name where previously a null would have been returned
for a service. This can cause a NullPointerException to be thrown
by the BC provider if a non-existant service is requested.
- CMS: OtherKeyAttribute.keyAttr now treated as optional.
- CMS: EnvelopedData and AuthEnvelopedData could calculate the wrong versions.
- The default version header for PGP armored output did not carry
the correct version string.
- In some situations the algorithm lookup for creating PGPDigestCalculators
would fail due to truncation of the algorithm name.
* Additional Features and Functionality:
- Object Identifiers have been added for ML-KEM, ML-DSA, and SLH-DSA.
- The PQC algorithms, ML-KEM, ML-DSA (including pre-hash), and SLH-DSA
(including pre-hash) have been added to the BC provider and the lightweight API.
- A new spec, ContextParameterSpec, has been added to support
signature contexts for ML-DSA and SLH-DSA.
- BCJSSE: Added support for security property
"jdk.tls.server.defaultDHEParameters" (disabled in FIPS mode).
- BCJSSE: Added support for signature_algorithms_cert configuration via
"org.bouncycastle.jsse.client.SignatureSchemesCert" and
"org.bouncycastle.jsse.server.SignatureSchemesCert" system properties
or BCSSLParameters property "SignatureSchemesCert".
- BCJSSE: Added support for boolean system property
"org.bouncycastle.jsse.fips.allowGCMCiphersIn12" (false by default).
- (D)TLS: Remove redundant verification of self-generated RSA signatures.
- CompositePrivateKeys now support the latest revision of the composite
signature draft.
- Delta Certificates now support the latest revision of the delta
certificate extension draft.
- A general KeyIdentifier class, encapsulating both PGP KeyID and the
PGP key fingerprint has been added to the PGP API.
- Support for the LibrePGP PreferredEncryptionModes signature subpacket
has been added to the PGP API.
- Support for Version 6 signatures, including salts, has been added to the PGP API.
- Support for the PreferredKeyServer signature supacket has been added to the PGP API.
- Support for RFC 9269, "Using KEMs in Cryptographic Message Syntax (CMS)",
has been added to the CMS API.
- Support for the Argon2 S2K has been added to the PGP API.
- The system property "org.bouncycastle.pemreader.lax" has been introduced
for situations where the BC PEM parsing is now too strict.
- The system property "org.bouncycastle.ec.disable_f2m" has been introduced
to allow F2m EC support to be disabled.
* Rebase bouncycastle-notests.patch
* Mon Apr 29 2024 Fridrich Strba <fstrba@suse.com>
- Update to version 1.78.1
* Defects Fixed:
- The new dependency of the the PGP API on the bcutil jar was
missing from the module jar, the OSGi manifest, and the Maven
POM. This has been fixed.
- Missing exports and duplicate imports have been added/removed
from the OSGi manifests.
- The OSGi manifests now have the same bundle IDs as 1.77 and
lock down dependencies to the equivalent variations
- A check in the X.509 Extensions class preventing the parsing
of empty extensions has been removed.
* Mon Apr 29 2024 Pedro Monreal <pmonreal@suse.com>
- Update to version 1.78: [bsc#1223252, CVE-2024-30171]
[bsc#1224304, CVE-2024-30172] [bsc#1224299, CVE-2024-29857]
* Security Advisories.
- CVE-2024-29857: Importing an EC certificate with specially crafted
F2m parameters can cause high CPU usage during parameter evaluation.
- CVE-2024-30171: Possible timing based leakage in RSA based handshakes
due to exception processing eliminated.
- CVE-2024-30172: Crafted signature and public key can be used to
trigger an infinite loop in the Ed25519 verification code.
- CVE-2024-301XX: When endpoint identification is enabled in the BCJSSE
and an SSL socket is not created with an explicit hostname (as happens
with HttpsURLConnection), hostname verification could be performed
against a DNS-resolved IP address. This has been fixed.
* Defects Fixed:
- Issues with a dangling weak reference causing intermittent
NullPointerExceptions in the OcspCache have been fixed.
- Issues with non-constant time RSA operations in TLS handshakes.
- Issue with Ed25519, Ed448 signature verification causing intermittent
infinite loop have been fixed.
- Issues with non-constant time ML-KEM implementation ("Kyber Slash").
- Align ML-KEM input validation with FIPS 203 IPD requirements.
- Make PEM parsing more forgiving of whitespace to align with RFC 7468.
- Fix CCM length checks with large nonce sizes (n=12, n=13).
- EAC: Fixed the CertificateBody ASN.1 type to support an optional
Certification Authority Reference in a Certificate Request.
- ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized
and the contents octets for both types are now limited to 4096 bytes.
- BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(),
which could cause issues for HSM RSA keys.
- BCJSSE: When endpoint identification is enabled and an SSL socket is not
created with an explicit hostname (as happens with HttpsURLConnection),
hostname verification could be performed against a DNS-resolved IP address.
- The missing module import of java.logging to the provider module has been added.
- GOST ASN.1 public key alg parameters are now compliant with RFC 9215.
- An off-by-one error in the encoding for EccP256CurvePoint for ITS.
- PEM Parser now enforces PEM headers to start at the beginning of the line
to be meaningful.
* Additional Features and Functionality.
- An implementation of MLS (RFC 9420 - The Messaging Layer Security Protocol)
has been added as a new module.
- NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.
- Improvements to PGP support, including Camellia key wrapping and Curve25519,
Curve448 key types (including XDH with HKDF).
- Added initial support for ML-KEM in TLS.
- Added XWing hybrid KEM construction (X25519 + ML-KEM-768).
- Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.
- Introduced initial composite signature support for X509 Certificates.
- PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM,
PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.
- The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set
using the org.bouncycastle.pkcs12.default system/security property.
- The PGP SExpParser will now handle Ed25519 and Ed448 keys.
- Dilithium and Kyber key encoding updated to latest Draft RFCs
(draft-ietf-lamps-dilithium-certificates and draft-ietf-lamps-kyber-certificates)
- Support has been added for encryption key derivation using HKDF in CMS, see
draft-housley-lamps-cms-cek-hkdf-sha256.
- X500Name now recognises jurisdiction{C,ST,L} DNs.
- CertPathValidationContext and CertificatePoliciesValidation now include
implementations of Memoable.
- The Composite post-quantum signatures implementation has been updated to the
latest draft draft-ounsworth-pq-composite-sigs.
* Full release notes: bouncycastle.org/releasenotes.html#r1rv78
* Rebase bouncycastle-notests.patch
* Mon Dec 04 2023 Pedro Monreal <pmonreal@suse.com>
- Update to version 1.77:
* Defects Fixed:
- Using an unescaped '=' in an X.500 RDN would result in the
RDN being truncated silently. The issue is now detected and
an exception is thrown.
- asn1.eac.CertificateBody was returning certificateEffectiveDate
from getCertificateExpirationDate(). This has been fixed to
return certificateExpirationDate.
- DTLS: Fixed retransmission in response to re-receipt of an
aggregated ChangeCipherSpec.
- (D)TLS: Fixed compliance for supported_groups extension.
Server will no longer negotiate an EC cipher suite using a
default curve when the ClientHello includes the supported_groups
extension but it contains no curves in common with the server.
Similarly, a DH cipher suite will not be negotiated when the
ClientHello includes supported_groups, containing at least one
FFDHE group, but none in common with the server.
- IllegalStateException was being thrown by Ed25519/Ed448 SignatureSpi.
- TLS: class annotation issues that could occur between the BC
provider and the TLS API for the GCMParameterSpec class when
the jars were loaded on the boot class path have been addressed.
- Attempt to create an ASN.1 OID from a zero length byte array
is now caught at construction time.
- Attempt to create an X.509 extension block which is empty will
now be blocked cause an exception.
- IES implementation will now accept a null ParameterSpec if no
nonce is needed.
- An internal method in Arrays was failing to construct its
failure message correctly on an error.
- HSSKeyPublicParameters.generateLMSContext() would fail for a
unit depth key.
* Additional Features and Functionality:
- BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension
and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean
system properties to control (for client and server resp.) whether
the signature_algorithms_cert extension should be omitted if it
would be identical to signature_algorithms. Defaults to true, the
historical behaviour.
- The low-level HPKE API now allows the sender to specify an
ephemeral key pair.
- Support has been added for the delta-certificate requests in line
with the current Chameleon Cert draft from the IETF.
- Some accommodation has been added for historical systems to
accommodate variations in the SHA-1 digest OID for CMS SignedData.
- TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as
the newer RSAPSS algorithm names when used with the JCA.
- TLS: RSA key exchange cipher suites are now disabled by default.
- Support has been added for PKCS#10 requests to allow certificates
using the altSignature/altPublicKey extensions.
* Notes:
- Kyber and Dilithium have been updated according to the latest
draft of the standard. Dilithium-AES and Kyber-AES have now been
removed. Kyber now produces 256 bit secrets for all parameter sets
(in line with the draft standard).
- NTRU has been updated to produce 256 bit secrets in line with Kyber.
- SPHINCS+ can now be used to generate certificates in line with
those used by (Open Quantum Safe) OQS.
- Falcon object idenitifiers are now in line with OQS as well.
- PQC CMS SignedData now defaults to SHA-256 for signed attributes
rather than SHAKE-256. This is also a compatibility change, but may
change further again as the IETF standard for CMS is updated.
* Wed Oct 18 2023 Pedro Monreal <pmonreal@suse.com>
- Update to version 1.76:
* Defects Fixed:
- Service allocation in the provider could fail due to the lack
of a permission block. This has been fixed.
- JceKeyFingerPrintCalculator has been generalised for different
providers by using "SHA-256" for the algorithm string.
- BCJSSE: Fixed a regression in 1.74 (NullPointerException) that
prevents a BCJSSE server from negotiating TLSv1.1 or earlier.
- DTLS: Fixed server support for client_certificate_type extension.
- Cipher.unwrap() for HQC could fail due to a miscalculation of
the length of the KEM packet. This has been fixed.
- There was exposure to a Java 7 method in the Java 5 to Java 8
BCTLS jar which could cause issues with some TLS 1.2 cipher
suites running on older JVMs. This is now fixed.
* Additional Features and Functionality:
- BCJSSE: Following OpenJDK, finalizers have been removed from
SSLSocket subclasses. Applications should close sockets and
not rely on garbage collection.
- BCJSSE: Added support for boolean system property
"jdk.tls.client.useCompatibilityMode" (default "true").
- DTLS: Added server support for session resumption.
- JcaPKCS10CertificationRequest will now work with EC on the
OpenJDK provider.
- TimeStamp generation now supports the SHA3 algorithm set.
- The SPHINCS+ simple parameters are now fully supported in the
BCPQC provider.
- Kyber, Classic McEliece, HQC, and Bike now supported by the
CRMF/CMS/CMP APIs.
- Builder classes have been add for PGP ASCII Armored streams
allowing CRCs and versions to now be optional.
- An UnknownPacket type has been added to the PGP APIs to allow
for forwards compatibility with upcoming revisions to the standard.
* Rebase patch bouncycastle-notests.patch
- Update to version 1.75:
* Defects Fixed:
- Several Java 8 method calls were accidentally introduced in
the Java 5 to Java 8 build. The affected classes have been
refactored to remove this.
- (D)TLS: renegotiation after resumption now fixed to avoid
breaking connection.
* Notes:
- The ASN.1 core package has had some dead and retired methods
cleaned up and removed.
* Mon Jun 19 2023 Pedro Monreal <pmonreal@suse.com>
- Update to version 1.74: [bsc#1212508, CVE-2023-33201]
* Defects Fixed:
- AsconEngine: Fixed a buffering bug when decrypting across
multiple processBytes calls (ascon128a unaffected).
- Context based sanity checking on PGP signatures has been added.
- The ParallelHash clone constructor was not copying all fields.
- The maximimum number of blocks for CTR/SIC modes was 1 block
less than it should have been.
* Additional Features and Functionality:
- The PGP API now supports wildcard key IDs for public key
based data encryption.
- LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256
(the additional SP 8000-208 parameter sets).
- The PGP API now supports V5 and V6 AEAD encryption for
encrypted data packets.
- The PGP examples have been updated to reflect key size and algorithm
changes that have occurred since they were first written (10+ years...).
- (D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called
when the connection is closed (including by failure).
- BCJSSE: Improved logging of connection events and include unique IDs
in connection-specific log messages.
- BCJSSE: Server now logs the offered cipher suites when it fails to
select one.
- BCJSSE: Added support for SSLParameters namedGroups and
signatureSchemes properties (can also be used via BCJSSE
extension API in earlier Java versions).
- DTLS: The initial handshake re-send time is now configurable by
overriding 'TlsPeer.getHandshakeResendTimeMillis'.
- DTLS: Added support for connection IDs per RFC 9146.
- DTLS: Performance of DTLSVerifier has been improved so that it can
reasonably be used for all incoming packets.
- Initial support has been added for A Mechanism for Encoding
Differences in Paired Certificates.
- The PGP API now supports parsing, encoding, and fingerprinting
of V6 EC/EdEC keys.
- A thread safe verifier API has been added to the PGP API to support
multi-threaded verification of certifications on keys and user IDs.
- The number of keys/sub-keys in a PGPKeyRing can now be found by
calling PGPKeyRing.size().
- The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU
are now supported directly by the BC provider.
* Notes:
- The now defunct PQC SIKE algorithm has been removed, this has also
meant the removal of its resource files so the provider is now quite
a bit smaller.
- As a precaution, HC128 now enforces a 128 bit IV, previous behaviour
for shorter IVs can be supported where required by padding the IV to
the 128 bits with zero.
- PGP encrypted data generation now uses integrity protection by default.
Previous behaviour for encrypted data can be supported where required
by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when
data encryption is set up.
- There are now additional sanity checks in place to prevent accidental
mis-use of PGPSignature objects. If this change causes any issues, you
might want to check what your code is up to as there is probably a bug.
* Security Advisories:
- CVE-2023-33201: this release fixes an issue with the X509LDAPCertStoreSpi
where a specially crafted certificate subject could be used to try and
extract extra information out of an LDAP server with wild-card matthing
enabled.
* Rebase bouncycastle-javadoc.patch
* Add bouncycastle-notests.patch
* Tue Apr 25 2023 Pedro Monreal <pmonreal@suse.com>
- Update to version 1.73: [jsc#PED-3756]
* Defects Fixed:
- BCJSSE: Instantiating a JSSE provider in some contexts could
cause an AccessControl exception.
- The EC key pair generator can generate out of range private
keys when used with SM2. A specific SM2KeyPairGenerator has
been added to the low-level API and is used by
KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has
been updated to check for out of range keys as well..
- The attached signature type byte was still present in Falcon
signatures as well as the detached signature byte.
- There was an off-by-one error in engineGetOutputSize() for ECIES.
- The method for invoking read() internally in BCPGInputStream
could result in inconsistent behaviour if the class was extended.
- Fixed a rounding issue with FF1 Format Preserving Encryption
algorithm for certain radices.
- Fixed RFC3394WrapEngine handling of 64 bit keys.
- Internal buffer for blake2sp was too small and could result in
an ArrayIndexOutOfBoundsException.
- JCA PSS Signatures using SHAKE128 and SHAKE256 now support
encoding of algorithm parameters.
- PKCS10CertificationRequest now checks for empty extension
parameters.
- Parsing errors in the processing of PGP Armored Data now throw
an explicit exception ArmoredInputException.
- PGP AEAD streams could occassionally be truncated.
- The ESTService class now supports processing of chunked HTTP data.
- A constructed ASN.1 OCTET STRING with a single member would
sometimes be re-encoded as a definite-length OCTET STRING. The
encoding has been adjusted to preserve the BER status of the object.
- PKIXCertPathReviewer could fail if the trust anchor was also
included in the certificate store being used for path analysis.
- UTF-8 parsing of an array range ignored the provided length.
- IPAddress has been written to provide stricter checking and
avoid the use of Integer.parseInt().
- A Java 7 class snuck into the Java 5 to Java 8 build.
* Additional Features and Functionality:
- The Rainbow NIST Post Quantum Round-3 Candidate has been added to
the low-level API and the BCPQC provider (level 3 and level 5
parameter sets only).
- The GeMSS NIST Post Quantum Round-3 Candidate has been added to
the low-level API.
- The org.bouncycastle.rsa.max_mr_tests property check has been
added to allow capping of MR tests done on RSA moduli.
- Significant performance improvements in PQC algorithms,
especially BIKE, CMCE, Frodo, HQC, Picnic.
- EdDSA verification now conforms to the recommendations of Taming
the many EdDSAs, in particular cofactored verification. As a side
benefit, Pornin's basis reduction is now used for EdDSA
verification, giving a significant performance boost.
- Major performance improvements for Anomalous Binary (Koblitz) Curves.
- The lightweight Cryptography finalists Ascon, ISAP, Elephant,
PhotonBeetle, Sparkle, and Xoodyak have been added to the
light-weight cryptography API.
- BLAKE2bp and BLAKE2sp have been added to the light-weight
cryptography API.
- Support has been added for X.509, Section 9.8, hybrid certificates
and CRLs using alternate public keys and alternate signatures.
- The property "org.bouncycastle.emulate.oracle" has been added to
signal the provider should return algorithm names on some algorithms
in the same manner as the Oracle JCE provider.
- An extra replaceSigners method has been added to CMSSignedData
which allows for specifying the digest algorithm IDs to be used
in the new CMSSignedData object.
- Parsing and re-encoding of ASN.1 PEM data has been further
optimized to prevent unecessary conversions between basic encoding,
definite length, and DER.
- Support has been added for KEM ciphers in CMS in accordance with
draft-ietf-lamps-cms-kemri
- Support has been added for certEncr in CRMF to allow issuing of
certificates for KEM public keys.
- Further speedups have been made to CRC24.
- GCMParameterSpec constructor caching has been added to improve
performance for JVMs that have the class available.
- The PGPEncrytedDataGenerator now supports injecting the session
key to be used for PGP PBE encrypted data.
- The CRMF CertificateRequestMessageBuilder now supports optional
attributes.
- Improvements to the s calculation in JPAKE.
- A general purpose PQCOtherInfoGenerator has been added which
supports all Kyber and NTRU.
- An implementation of HPKE (RFC 9180 - Hybrid Public Key
Encryption) has been added to the light-weight cryptography API.
* Security Advisories:
- The PQC implementations have now been subject to formal review for
secret leakage and side channels, there were issues in BIKE, Falcon,
Frodo, HQC which have now been fixed. Some weak positives also
showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last
set has been ignored as the algorithms will either be updated if
they reappear in the Signature Round, or deleted, as is already the
case for SIKE (it is now in the legacy package). Details on the
group responsible for the testing can be found in the CONTRIBUTORS
file.
- For at least some ECIES variants (e.g. when using CBC) there is
an issue with potential malleability of a nonce (implying silent
malleability of the plaintext) that must be sent alongside the
ciphertext but is outside the IES integrity check. For this reason
the automatic generation of nonces with IED is now disabled and
they have to be passed in using an IESParameterSpec. The current
advice is to agree on a nonce between parties and then rely on the
use of the ephemeral key component to allow the nonce (rather the
so called nonce) usage to be extended.
/usr/share/java/bcutil.jar /usr/share/licenses/bouncycastle-util /usr/share/licenses/bouncycastle-util/LICENSE.html /usr/share/maven-metadata/bouncycastle-bcutil.xml /usr/share/maven-poms/bcutil.pom
Generated by rpm2html 1.8.1
Fabrice Bellet, Fri Jul 24 16:18:25 2026