gnutls 3.8.9

--===============7840392512828734401==
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha256; protocol="application/pgp-signature"

--=-=-=
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

Hello,

We have just released gnutls-3.8.9. This is a bug fix and enhancement
release on the 3.8.x branch.

We would like to thank everyone who contributed in this release:
Angel Yankov, Daiki Ueno, David Dudas, Loganaden Velvindron, Maxim
Cournoyer, pohsingwu, Sahil Siddiq, Stanislav Zidek, and Zoltan
Fridrich.

The detailed list of changes follows:

* Version 3.8.9 (released 2025-02-07)

** libgnutls: leancrypto was added as an interim option for PQC
   The library can now be built with leancrypto instead of liboqs for
   post-quantum cryptography (PQC), when configured with
   --with-leancrypto option instead of --with-liboqs.

** libgnutls: Experimental support for ML-DSA signature algorithm
   The library and certtool now support ML-DSA signature algorithm as
   defined in FIPS 204 and based on
   draft-ietf-lamps-dilithium-certificates-04. This feature is
   currently marked as experimental and can only be enabled when
   compiled with --with-leancrypto or --with-liboqs.
   Contributed by David Dudas.

** libgnutls: Support for ML-KEM-1024 key encapsulation mechanism
   The support for ML-KEM post-quantum key encapsulation mechanisms
   has been extended to cover ML-KEM-1024, in addition to ML-KEM-768.
   MLKEM1024 is only offered as SecP384r1MLKEM1024 hybrid as per
   draft-kwiatkowski-tls-ecdhe-mlkem-03.

** libgnutls: Fix potential DoS in handling certificates with numerous name
   constraints, as a follow-up of CVE-2024-12133 in libtasn1. The
   bundled copy of libtasn1 has also been updated to the latest 4.20.0
   release to complete the fix.  Reported by Bing Shi (#1553).
   [GNUTLS-SA-2025-02-07, CVSS: medium] [CVE-2024-12243]

** API and ABI modifications:
GNUTLS_PK_MLDSA44: New enum member of gnutls_pk_algorithm_t
GNUTLS_PK_MLDSA65: New enum member of gnutls_pk_algorithm_t
GNUTLS_PK_MLDSA87: New enum member of gnutls_pk_algorithm_t
GNUTLS_SIGN_MLDSA44: New enum member of gnutls_sign_algorithm_t
GNUTLS_SIGN_MLDSA65: New enum member of gnutls_sign_algorithm_t
GNUTLS_SIGN_MLDSA87: New enum member of gnutls_sign_algorithm_t

Getting the Software
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

GnuTLS may be downloaded directly from
https://www.gnupg.org/ftp/gcrypt/
A list of GnuTLS mirrors can be found at
http://www.gnutls.org/download.html

Here are the XZ compressed sources:
https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.9.tar.xz

Here are OpenPGP detached signatures signed using key:
5D46CB0F763405A7053556F47A75A648B3F9220C
https://www.gnupg.org/ftp/gcrypt/gnutls/v3.8/gnutls-3.8.9.tar.xz.sig

Note that it has been signed with my openpgp key:
pub   rsa4096 2009-07-23 [SC] [expires: 2026-06-29]
      462225C3B46F34879FC8496CD605848ED7E69871
uid           [ultimate] Daiki Ueno <[email protected]>
uid           [ultimate] Daiki Ueno <[email protected]>
sub   rsa4096 2010-02-04 [E]

Regards,
=2D-=20
Daiki Ueno

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEERiIlw7RvNIefyEls1gWEjtfmmHEFAmem9EgACgkQ1gWEjtfm
mHH5FQ//V3JfNVtidGVQ3/AlGrYZVnOCI7mUSV3+CJud2kMJCJOpWFLaIXYPjY7m
lz1BsvXlUWqTdKhhKYM399XwSsG6PdpJnD1KzMZ1KOdB8lLTT0YCxxCySWcxSth3
d4NHJFIa+NeLRS5q1MJQSqTEty3Xjl032pEHFp2qEJwTNabACknJFHpTgsvEF8MO
577PUqoWetWPCFYgjcq7wGnEjjmuE5gs3tFqWoJZQrKfTCDidN2BLS2DqMQl0q2v
LXrIBuoDf2L9IExpjrP+jTTS0FjJwwEAvdqlBj/qKjjWzmVynjBE+dMxXCdmRk4f
daiimc4KBp9uT3YtSZRH6Gejt3xuEfyJTkCSoWnOm9HD99FI0WULq1TiUfvaw5b+
1IP/v35KPwbRUKy/X2sqUF/T0dJDF3pby8fBYPtuTgSiW064TyFq0/SqIgXsWvM6
EeoCWNJlR2ySrtijtXC/cijc+XYjgsFdpxtAX7wQW+9WmoUenSJG0jp4iEqVQEop
PCEfFSS+NW/DRpXXLSl9GHckHW0kPcZpXNFzeK+RSV7tRvSSRHvHG2wsywgnZkOi
jbfwDedEYcSmOJR475vkibba5tpUb65EM9E4ZnKeWG0vRe3GBUIK6xVVnwatpLxP
9f8LEN/i9b8fhHmgCzgSSSn63OF9yCTqJk3T6PDFHDgwMYPc+ik=
=xzQ6
-----END PGP SIGNATURE-----
--=-=-=--


--===============7840392512828734401==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Gnutls-help mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnutls-help

--===============7840392512828734401==--