Developers of the OpenBSD project release of the portable edition of the package , as part of which a fork of OpenSSL is developed, aimed at providing a higher level of security. The LibreSSL project focuses on quality support for SSL/TLS protocols by removing unnecessary functionality, adding additional protection measures, and undertaking significant cleaning and restructuring of the codebase. The release of LibreSSL 3.1.0 is considered experimental, showcasing features that will be included in OpenBSD 6.7.
Features of LibreSSL 3.1.0:
- An initial implementation of TLS 1.3 has been proposed based on a new finite state machine and a subsystem for record handling. Currently, only the client-side of TLS 1.3 is enabled by default, with the server-side expected to be activated by default in a future release.
- Code cleanup has been conducted, improving protocol parsing and memory handling.
- Methods RSA-PSS and RSA-OAEP have been ported from OpenSSL 1.1.1.
- The implementation from OpenSSL 1.1.1 has been ported and enabled by default (Cryptographic Message Syntax). The openssl utility has been updated with the 'cms' command.
- Compatibility with OpenSSL 1.1.1 has been improved by backporting some changes.
- A large set of new cryptographic function tests has been added.
- The behavior of EVP_chacha20() has been aligned with OpenSSL semantics.
- A configuration option has been added for the location of the certificate authority certificate set.
- In the openssl utility, the 'req' command has implemented the '-addext' option.
Additionally, it is worth noting cryptographic library , used in the project , a fork of GnuPG. The library provides a large collection , used in the TLS protocol, X.509 certificates, AEAD ciphers, TPM modules, PKCS#11, password hashing, and post-quantum cryptography (hash-based signatures and key agreement based on McEliece and NewHope). The library is written in C++11 and under the BSD license.
Among in the new release of Botan:
- GCM mode has been implemented The vector permutation operation for AES has been significantly accelerated for ARM and POWER systems with constant execution time.
- A new modular inversion algorithm has been proposed, which is faster and provides better protection against side-channel attacks.
- Optimizations have been made to speed up ECDSA/ECDH by reducing the NIST field.
- 🥇Release of cryptographic libraries LibreSSL 3.1.0 and Botan 2.14.0 | ProHoster
Source: opennet.ru
