Shall we update Nettle version requirement?

Daiki Ueno <[email protected]> Fri, 07 Nov 2025 09:59:02 +0900
Newsgroups gmane.network.gnutls.general
Message-ID <[email protected]>
Hello,

Provoked by this issue[1], I started thinking about updating the minimum
version of Nettle required by GnuTLS.  Currently it's 3.6, while 3.10
was released 1.5 years ago.  By updating it, we can eliminate the
bundled copies of RSA-OAEP, AES-GCM-SIV, and SHAKE implementations, as
well as the CVE-2021-4209 fix.  Given Nettle 3.10.2 is ABI compatible
with 3.6, I'm assuming that there is little impact to downstreams.

Any thoughts?

Footnotes:
[1]  https://gitlab.com/gnutls/gnutls/-/issues/1759

-- 
Daiki Ueno