Bouncy Castle 1.54 - (D)TLS 1.2 Security Release

This is a multi-part message in MIME format.
--------------000606000408000701050902
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit

Release 1.54 is now out.

*This is primarily a security release concerning (D)TLS 1.2.* Motivated
by CVE-2015-7575 (Common Vulnerabilities), we have added validation that
the signature algorithm received in DigitallySigned structures is
actually one of those offered (in signature_algorithms extension or
CertificateRequest). With our default TLS configuration, we do not
believe there is an exploitable vulnerability in any earlier releases.
Users that are customizing the signature_algorithms extension, or
running a server supporting client authentication, are advised to
double-check that they are not offering any signature algorithms
involving MD5.

In terms of new features, the CMS API now supports the PKCS#7 ANY type
for encapsulated content, RFC 3370, Camellia, and SEED are now supported
for key agreement in CMS, and CTR/SIC modes now provide an explicit
internal counter if initialized with a short IV. TLS/DTLS now includes a
non-blocking API. The Blake2b digests are now actually supported in the
provider (sorry, it got missed in 1.53...) and ClassCastException issues
with Cipher.getOutputSize() for IES ciphers have been fixed. Finally, in
accordance with advice from the algorithm's authors, *Serpent* has been
modified to conform to the NESSIE vector suite, the previous version of
Serpent, which conforms to the NIST submission format, is now called
Tnepres.

Further details on other additions and bug fixes can be found in the
release notes file accompanying the release or at
http://www.bouncycastle.org/releasenotes.html

For more details go to our latest releases page:

http://www.bouncycastle.org/latest_releases.html

And for those who like living on the bleeding edge, the betas for future
releases can be downloaded from:

http://www.bouncycastle.org/betas/

and changes to the code base can be tracked via:

https://github.com/bcgit

As always we are grateful to the people and organisations who have
contributed/donated to the project and you can find the updated list at
http://www.bouncycastle.org/contributors.html We would also like to
thank holders of Crypto Workshop support contracts once again we were
able to contribute additional time back to this release through left
over consulting time provided as part of the support agreements.

This release also features some work that arose out of our on-going FIPS
certification project, most particularly from work supported by our
primary sponsor Tripwire, Inc ( http://www.tripwire.com ). Thanks must
go to Tripwire as well.

Speaking of FIPS, algorithm testing is complete and we're in code
review. If you are interested in the project, the draft User Guide for
the APIs is now available at
https://www.bouncycastle.org/fips/UserGuide-20151229.pdf Please contact
us at [email protected] if you are interested in joining the early
access program for the FIPS APIs.

If you are interested helping support the Bouncy Castle project through
donation, you can find the details on how to donate via PayPal or
Bitcoin, at:

https://www.bouncycastle.org/donate

If you prefer to use direct bank transfer please feel free to discuss it
with us by contacting us at [email protected] and we'll be happy
help. The Legion of the Bouncy Castle Inc is a registered Australian
charity based in the State of Victoria, Australia.

If you wish to sponsor specific work on Bouncy Castle or get a
commercial support contract for the APIs please contact us at Crypto
Workshop ( http://www.cryptoworkshop.com )

Remember, you can also follow this project on Facebook (
https://www.facebook.com/legionofthebouncycastle ), Google+ (
https://plus.google.com/+BouncycastleOrgAPIs/posts ) and/or Twitter (
https://twitter.com/bccrypto ).

Finally, for users of the maven repositories, 1.54 is also now available
on Maven Central both for regular BC users and Android users making use
of the Spongy Castle distribution (thanks to Roberto Tyley for the
prompt attention). The GitHub repositories for both projects have been
updated as well.

Oh, and Happy New Year from all of us at BC!

Regards,

David



--------------000606000408000701050902
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    Release 1.54 is now out.
    <br>
    <br>
    <b>This is primarily a security release concerning (D)TLS 1.2.</b>
    Motivated by CVE-2015-7575 (Common Vulnerabilities), we have added
    validation that the signature algorithm received in DigitallySigned
    structures is actually one of those offered (in signature_algorithms
    extension or CertificateRequest). With our default TLS
    configuration, we do not believe there is an exploitable
    vulnerability in any earlier releases. Users that are customizing
    the signature_algorithms extension, or running a server supporting
    client authentication, are advised to double-check that they are not
    offering any signature algorithms involving MD5.
    <p>In terms of new features, the CMS API now supports the PKCS#7 ANY
      type for encapsulated content, RFC 3370, Camellia, and SEED are
      now supported for key agreement in CMS, and CTR/SIC modes now
      provide an explicit internal counter if initialized with a short
      IV. TLS/DTLS now includes a non-blocking API. The Blake2b digests
      are now actually supported in the provider (sorry, it got missed
      in 1.53...) and ClassCastException issues with
      Cipher.getOutputSize() for IES ciphers have been fixed. Finally,
      in accordance with advice from the algorithm's authors, <b>Serpent</b>
      has been modified to conform to the NESSIE vector suite, the
      previous version of Serpent, which conforms to the NIST submission
      format, is now called Tnepres.</p>
    Further details on other additions and bug fixes can be found in the
    release notes file accompanying the release or at <a
      class="moz-txt-link-freetext"
      href="http://www.bouncycastle.org/releasenotes.html"><a class="moz-txt-link-freetext" href="http://www.bouncycastle.org/releasenotes.html">http://www.bouncycastle.org/releasenotes.html</a></a>
    <br>
    <br>
    For more details go to our latest releases page:
    <br>
    <br>
    <a class="moz-txt-link-freetext"
      href="http://www.bouncycastle.org/latest_releases.html">http://www.bouncycastle.org/latest_releases.html</a>
    <br>
    <br>
    And for those who like living on the bleeding edge, the betas for
    future releases can be downloaded from:
    <br>
    <br>
    <a class="moz-txt-link-freetext"
      href="http://www.bouncycastle.org/betas/">http://www.bouncycastle.org/betas/</a>
    <br>
    <br>
    and changes to the code base can be tracked via:
    <br>
    <br>
    <a class="moz-txt-link-freetext" href="https://github.com/bcgit">https://github.com/bcgit</a>
    <br>
    <br>
    As always we are grateful to the people and organisations who have
    contributed/donated to the project and you can find the updated list
    at <a class="moz-txt-link-freetext"
      href="http://www.bouncycastle.org/contributors.html">http://www.bouncycastle.org/contributors.html</a>
    We would also like to thank holders of Crypto Workshop support
    contracts once again we were able to contribute additional time back
    to this release through left over consulting time provided as part
    of the support agreements.
    <br>
    <br>
    This release also features some work that arose out of our on-going
    FIPS certification project, most particularly from work supported by
    our primary sponsor Tripwire, Inc ( <a
      class="moz-txt-link-freetext" href="http://www.tripwire.com"><a class="moz-txt-link-freetext" href="http://www.tripwire.com">http://www.tripwire.com</a></a>
    ). Thanks must go to Tripwire as well.<br>
    <br>
    Speaking of FIPS, algorithm testing is complete and we're in code
    review. If you are interested in the project, the draft User Guide
    for the APIs is now available at
    <a class="moz-txt-link-freetext" href="https://www.bouncycastle.org/fips/UserGuide-20151229.pdf">https://www.bouncycastle.org/fips/UserGuide-20151229.pdf</a> Please
    contact us at <a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a> if you are interested in
    joining the early access program for the FIPS APIs. <a
      class="moz-txt-link-freetext"
href="http://www.bouncycastle.org/wiki/display/JA1/Frequently+Asked+Questions"></a><br>
    <br>
    If you are interested helping support the Bouncy Castle project
    through donation, you can find the details on how to donate via
    PayPal or Bitcoin, at:
    <br>
    <br>
    <a class="moz-txt-link-freetext"
      href="https://www.bouncycastle.org/donate">https://www.bouncycastle.org/donate</a>
    <br>
    <br>
    If you prefer to use direct bank transfer please feel free to
    discuss it with us by contacting us at <a
      class="moz-txt-link-abbreviated"
      href="mailto:[email protected]"><a class="moz-txt-link-abbreviated" href="mailto:[email protected]">[email protected]</a></a>
    and we'll be happy help. The Legion of the Bouncy Castle Inc is a
    registered Australian charity based in the State of Victoria,
    Australia.
    <br>
    <br>
    If you wish to sponsor specific work on Bouncy Castle or get a
    commercial support contract for the APIs please contact us at Crypto
    Workshop ( <a class="moz-txt-link-freetext"
      href="http://www.cryptoworkshop.com">http://www.cryptoworkshop.com</a>
    )
    <br>
    <br>
    Remember, you can also follow this project on Facebook ( <a
      class="moz-txt-link-freetext"
      href="https://www.facebook.com/legionofthebouncycastle"><a class="moz-txt-link-freetext" href="https://www.facebook.com/legionofthebouncycastle">https://www.facebook.com/legionofthebouncycastle</a></a>
    ), Google+ ( <a class="moz-txt-link-freetext"
      href="https://plus.google.com/+BouncycastleOrgAPIs/posts">https://plus.google.com/+BouncycastleOrgAPIs/posts</a>
    ) and/or Twitter ( <a class="moz-txt-link-freetext"
      href="https://twitter.com/bccrypto">https://twitter.com/bccrypto</a>
    ).
    <br>
    <br>
    Finally, for users of the maven repositories, 1.54 is also now
    available on Maven Central both for regular BC users and Android
    users making use of the Spongy Castle distribution (thanks to
    Roberto Tyley for the prompt attention). The GitHub repositories for
    both projects have been updated as well.<br>
    <br>
    Oh, and Happy New Year from all of us at BC!<br>
    <br>
    Regards,<br>
    <br>
    David<br>
    <br>
    <br>
  </body>
</html>

--------------000606000408000701050902--