The developers of the OpenBSD project have released the portable version of the LibreSSL package 3.7.0, which is a fork of OpenSSL aimed at providing a higher level of security. The LibreSSL project focuses on quality support for SSL/TLS protocols by removing unnecessary functionality, adding additional security measures, and conducting significant cleanup and reworking of the codebase. The release of LibreSSL 3.7.0 is considered experimental, in which features are developed that will be included in OpenBSD 7.3.
Features of LibreSSL 3.7.0:
- Support for the Ed25519 public key digital signature, developed by Daniel Bernstein and based on the elliptic curve Curve25519 and the SHA-512 hash, has been added. Ed25519 support is available both as a separate primitive and through the EVP interface.
- The EVP interface has added support for X25519 digital signatures, which differ from Ed25519 signatures by using only the 'X' coordinates in elliptic curve point manipulations, significantly reducing the code size required for signature creation and verification.
- A low-level API compatible with OpenSSL 1.1 for working with public and private keys has been implemented, supporting the keys EVP_PKEY_ED25519, EVP_PKEY_HMAC, and EVP_PKEY_X25519.
- Instead of the system functions timegm() and gmtime() for date conversion, POSIX functions from BoringSSL are used.
- The BN (BigNum) library has been cleaned up by removing old and unused code related to prime numbers.
- Support for HMAC PRIVATE KEY has been removed.
- The internal code for creating and verifying DSA signatures has been reworked.
- The code for key export for TLSv1.2 has been rewritten.
- Old TLS stack has been cleaned up and reworked.
- The behavior of the BIO_read() and BIO_write() functions has been aligned more closely with OpenSSL 3.
Source: opennet.ru
