Shall we update Nettle version requirement?
Daiki Ueno <[email protected]> Fri, 07 Nov 2025 09:59:02 +0900
| Newsgroups | gmane.network.gnutls.general |
|---|---|
| Message-ID | <[email protected]> |
Hello, Provoked by this issue[1], I started thinking about updating the minimum version of Nettle required by GnuTLS. Currently it's 3.6, while 3.10 was released 1.5 years ago. By updating it, we can eliminate the bundled copies of RSA-OAEP, AES-GCM-SIV, and SHAKE implementations, as well as the CVE-2021-4209 fix. Given Nettle 3.10.2 is ABI compatible with 3.6, I'm assuming that there is little impact to downstreams. Any thoughts? Footnotes: [1] https://gitlab.com/gnutls/gnutls/-/issues/1759 -- Daiki Ueno