CHANGELOG.rst 63 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636
  1. Changelog
  2. =========
  3. .. _v3-3-2:
  4. 3.3.2 - 2021-02-07
  5. ~~~~~~~~~~~~~~~~~~
  6. * **SECURITY ISSUE:** Fixed a bug where certain sequences of ``update()`` calls
  7. when symmetrically encrypting very large payloads (>2GB) could result in an
  8. integer overflow, leading to buffer overflows. *CVE-2020-36242*
  9. .. _v3-3-1:
  10. 3.3.1 - 2020-12-09
  11. ~~~~~~~~~~~~~~~~~~
  12. * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` users.
  13. .. _v3-3:
  14. 3.3 - 2020-12-08
  15. ~~~~~~~~~~~~~~~~
  16. * **BACKWARDS INCOMPATIBLE:** Support for Python 3.5 has been removed due to
  17. low usage and maintenance burden.
  18. * **BACKWARDS INCOMPATIBLE:** The
  19. :class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` and
  20. :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM` now require
  21. 64-bit to 1024-bit (8 byte to 128 byte) initialization vectors. This change
  22. is to conform with an upcoming OpenSSL release that will no longer support
  23. sizes outside this window.
  24. * **BACKWARDS INCOMPATIBLE:** When deserializing asymmetric keys we now
  25. raise ``ValueError`` rather than ``UnsupportedAlgorithm`` when an
  26. unsupported cipher is used. This change is to conform with an upcoming
  27. OpenSSL release that will no longer distinguish between error types.
  28. * **BACKWARDS INCOMPATIBLE:** We no longer allow loading of finite field
  29. Diffie-Hellman parameters of less than 512 bits in length. This change is to
  30. conform with an upcoming OpenSSL release that no longer supports smaller
  31. sizes. These keys were already wildly insecure and should not have been used
  32. in any application outside of testing.
  33. * Updated Windows, macOS, and ``manylinux`` wheels to be compiled with
  34. OpenSSL 1.1.1i.
  35. * Python 2 support is deprecated in ``cryptography``. This is the last release
  36. that will support Python 2.
  37. * Added the
  38. :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey.recover_data_from_signature`
  39. function to
  40. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`
  41. for recovering the signed data from an RSA signature.
  42. .. _v3-2-1:
  43. 3.2.1 - 2020-10-27
  44. ~~~~~~~~~~~~~~~~~~
  45. * Disable blinding on RSA public keys to address an error with some versions
  46. of OpenSSL.
  47. .. _v3-2:
  48. 3.2 - 2020-10-25
  49. ~~~~~~~~~~~~~~~~
  50. * **SECURITY ISSUE:** Attempted to make RSA PKCS#1v1.5 decryption more constant
  51. time, to protect against Bleichenbacher vulnerabilities. Due to limitations
  52. imposed by our API, we cannot completely mitigate this vulnerability and a
  53. future release will contain a new API which is designed to be resilient to
  54. these for contexts where it is required. Credit to **Hubert Kario** for
  55. reporting the issue. *CVE-2020-25659*
  56. * Support for OpenSSL 1.0.2 has been removed. Users on older version of OpenSSL
  57. will need to upgrade.
  58. * Added basic support for PKCS7 signing (including SMIME) via
  59. :class:`~cryptography.hazmat.primitives.serialization.pkcs7.PKCS7SignatureBuilder`.
  60. .. _v3-1-1:
  61. 3.1.1 - 2020-09-22
  62. ~~~~~~~~~~~~~~~~~~
  63. * Updated Windows, macOS, and ``manylinux`` wheels to be compiled with
  64. OpenSSL 1.1.1h.
  65. .. _v3-1:
  66. 3.1 - 2020-08-26
  67. ~~~~~~~~~~~~~~~~
  68. * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
  69. :term:`U-label` parsing in various X.509 classes. This support was originally
  70. deprecated in version 2.1 and moved to an extra in 2.5.
  71. * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
  72. the OpenSSL project. The next version of ``cryptography`` will drop support
  73. for it.
  74. * Deprecated support for Python 3.5. This version sees very little use and will
  75. be removed in the next release.
  76. * ``backend`` arguments to functions are no longer required and the
  77. default backend will automatically be selected if no ``backend`` is provided.
  78. * Added initial support for parsing certificates from PKCS7 files with
  79. :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
  80. and
  81. :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
  82. .
  83. * Calling ``update`` or ``update_into`` on
  84. :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
  85. longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
  86. also resolves the same issue in :doc:`/fernet`.
  87. .. _v3-0:
  88. 3.0 - 2020-07-20
  89. ~~~~~~~~~~~~~~~~
  90. * **BACKWARDS INCOMPATIBLE:** Removed support for passing an
  91. :class:`~cryptography.x509.Extension` instance to
  92. :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`,
  93. as per our deprecation policy.
  94. * **BACKWARDS INCOMPATIBLE:** Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has
  95. been removed (2.9.1+ is still supported).
  96. * **BACKWARDS INCOMPATIBLE:** Dropped support for macOS 10.9, macOS users must
  97. upgrade to 10.10 or newer.
  98. * **BACKWARDS INCOMPATIBLE:** RSA
  99. :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key`
  100. no longer accepts ``public_exponent`` values except 65537 and 3 (the latter
  101. for legacy purposes).
  102. * **BACKWARDS INCOMPATIBLE:** X.509 certificate parsing now enforces that the
  103. ``version`` field contains a valid value, rather than deferring this check
  104. until :attr:`~cryptography.x509.Certificate.version` is accessed.
  105. * Deprecated support for Python 2. At the time there is no time table for
  106. actually dropping support, however we strongly encourage all users to upgrade
  107. their Python, as Python 2 no longer receives support from the Python core
  108. team.
  109. If you have trouble suppressing this warning in tests view the :ref:`FAQ
  110. entry addressing this issue <faq-howto-handle-deprecation-warning>`.
  111. * Added support for ``OpenSSH`` serialization format for
  112. ``ec``, ``ed25519``, ``rsa`` and ``dsa`` private keys:
  113. :func:`~cryptography.hazmat.primitives.serialization.load_ssh_private_key`
  114. for loading and
  115. :attr:`~cryptography.hazmat.primitives.serialization.PrivateFormat.OpenSSH`
  116. for writing.
  117. * Added support for ``OpenSSH`` certificates to
  118. :func:`~cryptography.hazmat.primitives.serialization.load_ssh_public_key`.
  119. * Added :meth:`~cryptography.fernet.Fernet.encrypt_at_time` and
  120. :meth:`~cryptography.fernet.Fernet.decrypt_at_time` to
  121. :class:`~cryptography.fernet.Fernet`.
  122. * Added support for the :class:`~cryptography.x509.SubjectInformationAccess`
  123. X.509 extension.
  124. * Added support for parsing
  125. :class:`~cryptography.x509.SignedCertificateTimestamps` in OCSP responses.
  126. * Added support for parsing attributes in certificate signing requests via
  127. :meth:`~cryptography.x509.CertificateSigningRequest.get_attribute_for_oid`.
  128. * Added support for encoding attributes in certificate signing requests via
  129. :meth:`~cryptography.x509.CertificateSigningRequestBuilder.add_attribute`.
  130. * On OpenSSL 1.1.1d and higher ``cryptography`` now uses OpenSSL's
  131. built-in CSPRNG instead of its own OS random engine because these versions of
  132. OpenSSL properly reseed on fork.
  133. * Added initial support for creating PKCS12 files with
  134. :func:`~cryptography.hazmat.primitives.serialization.pkcs12.serialize_key_and_certificates`.
  135. .. _v2-9-2:
  136. 2.9.2 - 2020-04-22
  137. ~~~~~~~~~~~~~~~~~~
  138. * Updated the macOS wheel to fix an issue where it would not run on macOS
  139. versions older than 10.15.
  140. .. _v2-9-1:
  141. 2.9.1 - 2020-04-21
  142. ~~~~~~~~~~~~~~~~~~
  143. * Updated Windows, macOS, and ``manylinux`` wheels to be compiled with
  144. OpenSSL 1.1.1g.
  145. .. _v2-9:
  146. 2.9 - 2020-04-02
  147. ~~~~~~~~~~~~~~~~
  148. * **BACKWARDS INCOMPATIBLE:** Support for Python 3.4 has been removed due to
  149. low usage and maintenance burden.
  150. * **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.0.1 has been removed.
  151. Users on older version of OpenSSL will need to upgrade.
  152. * **BACKWARDS INCOMPATIBLE:** Support for LibreSSL 2.6.x has been removed.
  153. * Removed support for calling
  154. :meth:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey.public_bytes`
  155. with no arguments, as per our deprecation policy. You must now pass
  156. ``encoding`` and ``format``.
  157. * **BACKWARDS INCOMPATIBLE:** Reversed the order in which
  158. :meth:`~cryptography.x509.Name.rfc4514_string` returns the RDNs
  159. as required by :rfc:`4514`.
  160. * Updated Windows, macOS, and ``manylinux`` wheels to be compiled with
  161. OpenSSL 1.1.1f.
  162. * Added support for parsing
  163. :attr:`~cryptography.x509.ocsp.OCSPResponse.single_extensions` in an OCSP
  164. response.
  165. * :class:`~cryptography.x509.NameAttribute` values can now be empty strings.
  166. .. _v2-8:
  167. 2.8 - 2019-10-16
  168. ~~~~~~~~~~~~~~~~
  169. * Updated Windows, macOS, and ``manylinux`` wheels to be compiled with
  170. OpenSSL 1.1.1d.
  171. * Added support for Python 3.8.
  172. * Added class methods
  173. :meth:`Poly1305.generate_tag
  174. <cryptography.hazmat.primitives.poly1305.Poly1305.generate_tag>`
  175. and
  176. :meth:`Poly1305.verify_tag
  177. <cryptography.hazmat.primitives.poly1305.Poly1305.verify_tag>`
  178. for Poly1305 sign and verify operations.
  179. * Deprecated support for OpenSSL 1.0.1. Support will be removed in
  180. ``cryptography`` 2.9.
  181. * We now ship ``manylinux2010`` wheels in addition to our ``manylinux1``
  182. wheels.
  183. * Added support for ``ed25519`` and ``ed448`` keys in the
  184. :class:`~cryptography.x509.CertificateBuilder`,
  185. :class:`~cryptography.x509.CertificateSigningRequestBuilder`,
  186. :class:`~cryptography.x509.CertificateRevocationListBuilder` and
  187. :class:`~cryptography.x509.ocsp.OCSPResponseBuilder`.
  188. * ``cryptography`` no longer depends on ``asn1crypto``.
  189. * :class:`~cryptography.x509.FreshestCRL` is now allowed as a
  190. :class:`~cryptography.x509.CertificateRevocationList` extension.
  191. .. _v2-7:
  192. 2.7 - 2019-05-30
  193. ~~~~~~~~~~~~~~~~
  194. * **BACKWARDS INCOMPATIBLE:** We no longer distribute 32-bit ``manylinux1``
  195. wheels. Continuing to produce them was a maintenance burden.
  196. * **BACKWARDS INCOMPATIBLE:** Removed the
  197. ``cryptography.hazmat.primitives.mac.MACContext`` interface. The ``CMAC`` and
  198. ``HMAC`` APIs have not changed, but they are no longer registered as
  199. ``MACContext`` instances.
  200. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  201. OpenSSL 1.1.1c.
  202. * Removed support for running our tests with ``setup.py test``. Users
  203. interested in running our tests can continue to follow the directions in our
  204. :doc:`development documentation</development/getting-started>`.
  205. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  206. when using OpenSSL 1.1.1 or newer.
  207. * Support serialization with ``Encoding.OpenSSH`` and ``PublicFormat.OpenSSH``
  208. in
  209. :meth:`Ed25519PublicKey.public_bytes
  210. <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>`
  211. .
  212. * Correctly allow passing a ``SubjectKeyIdentifier`` to
  213. :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  214. and deprecate passing an ``Extension`` object. The documentation always
  215. required ``SubjectKeyIdentifier`` but the implementation previously
  216. required an ``Extension``.
  217. .. _v2-6-1:
  218. 2.6.1 - 2019-02-27
  219. ~~~~~~~~~~~~~~~~~~
  220. * Resolved an error in our build infrastructure that broke our Python3 wheels
  221. for macOS and Linux.
  222. .. _v2-6:
  223. 2.6 - 2019-02-27
  224. ~~~~~~~~~~~~~~~~
  225. * **BACKWARDS INCOMPATIBLE:** Removed
  226. ``cryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature``
  227. and
  228. ``cryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature``,
  229. which had been deprecated for nearly 4 years. Use
  230. :func:`~cryptography.hazmat.primitives.asymmetric.utils.encode_dss_signature`
  231. and
  232. :func:`~cryptography.hazmat.primitives.asymmetric.utils.decode_dss_signature`
  233. instead.
  234. * **BACKWARDS INCOMPATIBLE**: Removed ``cryptography.x509.Certificate.serial``,
  235. which had been deprecated for nearly 3 years. Use
  236. :attr:`~cryptography.x509.Certificate.serial_number` instead.
  237. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  238. OpenSSL 1.1.1b.
  239. * Added support for :doc:`/hazmat/primitives/asymmetric/ed448` when using
  240. OpenSSL 1.1.1b or newer.
  241. * Added support for :doc:`/hazmat/primitives/asymmetric/ed25519` when using
  242. OpenSSL 1.1.1b or newer.
  243. * :func:`~cryptography.hazmat.primitives.serialization.load_ssh_public_key` can
  244. now load ``ed25519`` public keys.
  245. * Add support for easily mapping an object identifier to its elliptic curve
  246. class via
  247. :func:`~cryptography.hazmat.primitives.asymmetric.ec.get_curve_for_oid`.
  248. * Add support for OpenSSL when compiled with the ``no-engine``
  249. (``OPENSSL_NO_ENGINE``) flag.
  250. .. _v2-5:
  251. 2.5 - 2019-01-22
  252. ~~~~~~~~~~~~~~~~
  253. * **BACKWARDS INCOMPATIBLE:** :term:`U-label` strings were deprecated in
  254. version 2.1, but this version removes the default ``idna`` dependency as
  255. well. If you still need this deprecated path please install cryptography
  256. with the ``idna`` extra: ``pip install cryptography[idna]``.
  257. * **BACKWARDS INCOMPATIBLE:** The minimum supported PyPy version is now 5.4.
  258. * Numerous classes and functions have been updated to allow :term:`bytes-like`
  259. types for keying material and passwords, including symmetric algorithms, AEAD
  260. ciphers, KDFs, loading asymmetric keys, and one time password classes.
  261. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  262. OpenSSL 1.1.1a.
  263. * Added support for :class:`~cryptography.hazmat.primitives.hashes.SHA512_224`
  264. and :class:`~cryptography.hazmat.primitives.hashes.SHA512_256` when using
  265. OpenSSL 1.1.1.
  266. * Added support for :class:`~cryptography.hazmat.primitives.hashes.SHA3_224`,
  267. :class:`~cryptography.hazmat.primitives.hashes.SHA3_256`,
  268. :class:`~cryptography.hazmat.primitives.hashes.SHA3_384`, and
  269. :class:`~cryptography.hazmat.primitives.hashes.SHA3_512` when using OpenSSL
  270. 1.1.1.
  271. * Added support for :doc:`/hazmat/primitives/asymmetric/x448` when using
  272. OpenSSL 1.1.1.
  273. * Added support for :class:`~cryptography.hazmat.primitives.hashes.SHAKE128`
  274. and :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` when using
  275. OpenSSL 1.1.1.
  276. * Added initial support for parsing PKCS12 files with
  277. :func:`~cryptography.hazmat.primitives.serialization.pkcs12.load_key_and_certificates`.
  278. * Added support for :class:`~cryptography.x509.IssuingDistributionPoint`.
  279. * Added ``rfc4514_string()`` method to
  280. :meth:`x509.Name <cryptography.x509.Name.rfc4514_string>`,
  281. :meth:`x509.RelativeDistinguishedName
  282. <cryptography.x509.RelativeDistinguishedName.rfc4514_string>`, and
  283. :meth:`x509.NameAttribute <cryptography.x509.NameAttribute.rfc4514_string>`
  284. to format the name or component an :rfc:`4514` Distinguished Name string.
  285. * Added
  286. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.from_encoded_point`,
  287. which immediately checks if the point is on the curve and supports compressed
  288. points. Deprecated the previous method
  289. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers.from_encoded_point`.
  290. * Added :attr:`~cryptography.x509.ocsp.OCSPResponse.signature_hash_algorithm`
  291. to ``OCSPResponse``.
  292. * Updated :doc:`/hazmat/primitives/asymmetric/x25519` support to allow
  293. additional serialization methods. Calling
  294. :meth:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey.public_bytes`
  295. with no arguments has been deprecated.
  296. * Added support for encoding compressed and uncompressed points via
  297. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.public_bytes`. Deprecated the previous method
  298. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers.encode_point`.
  299. .. _v2-4-2:
  300. 2.4.2 - 2018-11-21
  301. ~~~~~~~~~~~~~~~~~~
  302. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  303. OpenSSL 1.1.0j.
  304. .. _v2-4-1:
  305. 2.4.1 - 2018-11-11
  306. ~~~~~~~~~~~~~~~~~~
  307. * Fixed a build breakage in our ``manylinux1`` wheels.
  308. .. _v2-4:
  309. 2.4 - 2018-11-11
  310. ~~~~~~~~~~~~~~~~
  311. * **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL 2.4.x.
  312. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by
  313. the OpenSSL project. At this time there is no time table for dropping
  314. support, however we strongly encourage all users to upgrade or install
  315. ``cryptography`` from a wheel.
  316. * Added initial :doc:`OCSP </x509/ocsp>` support.
  317. * Added support for :class:`~cryptography.x509.PrecertPoison`.
  318. .. _v2-3-1:
  319. 2.3.1 - 2018-08-14
  320. ~~~~~~~~~~~~~~~~~~
  321. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  322. OpenSSL 1.1.0i.
  323. .. _v2-3:
  324. 2.3 - 2018-07-18
  325. ~~~~~~~~~~~~~~~~
  326. * **SECURITY ISSUE:**
  327. :meth:`~cryptography.hazmat.primitives.ciphers.AEADDecryptionContext.finalize_with_tag`
  328. allowed tag truncation by default which can allow tag forgery in some cases.
  329. The method now enforces the ``min_tag_length`` provided to the
  330. :class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` constructor.
  331. *CVE-2018-10903*
  332. * Added support for Python 3.7.
  333. * Added :meth:`~cryptography.fernet.Fernet.extract_timestamp` to get the
  334. authenticated timestamp of a :doc:`Fernet </fernet>` token.
  335. * Support for Python 2.7.x without ``hmac.compare_digest`` has been deprecated.
  336. We will require Python 2.7.7 or higher (or 2.7.6 on Ubuntu) in the next
  337. ``cryptography`` release.
  338. * Fixed multiple issues preventing ``cryptography`` from compiling against
  339. LibreSSL 2.7.x.
  340. * Added
  341. :class:`~cryptography.x509.CertificateRevocationList.get_revoked_certificate_by_serial_number`
  342. for quick serial number searches in CRLs.
  343. * The :class:`~cryptography.x509.RelativeDistinguishedName` class now
  344. preserves the order of attributes. Duplicate attributes now raise an error
  345. instead of silently discarding duplicates.
  346. * :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap` and
  347. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap_with_padding`
  348. now raise :class:`~cryptography.hazmat.primitives.keywrap.InvalidUnwrap` if
  349. the wrapped key is an invalid length, instead of ``ValueError``.
  350. .. _v2-2-2:
  351. 2.2.2 - 2018-03-27
  352. ~~~~~~~~~~~~~~~~~~
  353. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  354. OpenSSL 1.1.0h.
  355. .. _v2-2-1:
  356. 2.2.1 - 2018-03-20
  357. ~~~~~~~~~~~~~~~~~~
  358. * Reverted a change to ``GeneralNames`` which prohibited having zero elements,
  359. due to breakages.
  360. * Fixed a bug in
  361. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap_with_padding`
  362. that caused it to raise ``InvalidUnwrap`` when key length modulo 8 was
  363. zero.
  364. .. _v2-2:
  365. 2.2 - 2018-03-19
  366. ~~~~~~~~~~~~~~~~
  367. * **BACKWARDS INCOMPATIBLE:** Support for Python 2.6 has been dropped.
  368. * Resolved a bug in ``HKDF`` that incorrectly constrained output size.
  369. * Added :class:`~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP256R1`,
  370. :class:`~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP384R1`, and
  371. :class:`~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP512R1` to
  372. support inter-operating with systems like German smart meters.
  373. * Added token rotation support to :doc:`Fernet </fernet>` with
  374. :meth:`~cryptography.fernet.MultiFernet.rotate`.
  375. * Fixed a memory leak in
  376. :func:`~cryptography.hazmat.primitives.asymmetric.ec.derive_private_key`.
  377. * Added support for AES key wrapping with padding via
  378. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_wrap_with_padding`
  379. and
  380. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap_with_padding`
  381. .
  382. * Allow loading DSA keys with 224 bit ``q``.
  383. .. _v2-1-4:
  384. 2.1.4 - 2017-11-29
  385. ~~~~~~~~~~~~~~~~~~
  386. * Added ``X509_up_ref`` for an upcoming ``pyOpenSSL`` release.
  387. .. _v2-1-3:
  388. 2.1.3 - 2017-11-02
  389. ~~~~~~~~~~~~~~~~~~
  390. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  391. OpenSSL 1.1.0g.
  392. .. _v2-1-2:
  393. 2.1.2 - 2017-10-24
  394. ~~~~~~~~~~~~~~~~~~
  395. * Corrected a bug with the ``manylinux1`` wheels where OpenSSL's stack was
  396. marked executable.
  397. .. _v2-1-1:
  398. 2.1.1 - 2017-10-12
  399. ~~~~~~~~~~~~~~~~~~
  400. * Fixed support for install with the system ``pip`` on Ubuntu 16.04.
  401. .. _v2-1:
  402. 2.1 - 2017-10-11
  403. ~~~~~~~~~~~~~~~~
  404. * **FINAL DEPRECATION** Python 2.6 support is deprecated, and will be removed
  405. in the next release of ``cryptography``.
  406. * **BACKWARDS INCOMPATIBLE:** ``Whirlpool``, ``RIPEMD160``, and
  407. ``UnsupportedExtension`` have been removed in accordance with our
  408. :doc:`/api-stability` policy.
  409. * **BACKWARDS INCOMPATIBLE:**
  410. :attr:`DNSName.value <cryptography.x509.DNSName.value>`,
  411. :attr:`RFC822Name.value <cryptography.x509.RFC822Name.value>`, and
  412. :attr:`UniformResourceIdentifier.value
  413. <cryptography.x509.UniformResourceIdentifier.value>`
  414. will now return an :term:`A-label` string when parsing a certificate
  415. containing an internationalized domain name (IDN) or if the caller passed
  416. a :term:`U-label` to the constructor. See below for additional deprecations
  417. related to this change.
  418. * Installing ``cryptography`` now requires ``pip`` 6 or newer.
  419. * Deprecated passing :term:`U-label` strings to the
  420. :class:`~cryptography.x509.DNSName`,
  421. :class:`~cryptography.x509.UniformResourceIdentifier`, and
  422. :class:`~cryptography.x509.RFC822Name` constructors. Instead, users should
  423. pass values as :term:`A-label` strings with ``idna`` encoding if necessary.
  424. This change will not affect anyone who is not processing internationalized
  425. domains.
  426. * Added support for
  427. :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20`. In
  428. most cases users should choose
  429. :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaCha20Poly1305`
  430. rather than using this unauthenticated form.
  431. * Added :meth:`~cryptography.x509.CertificateRevocationList.is_signature_valid`
  432. to :class:`~cryptography.x509.CertificateRevocationList`.
  433. * Support :class:`~cryptography.hazmat.primitives.hashes.BLAKE2b` and
  434. :class:`~cryptography.hazmat.primitives.hashes.BLAKE2s` with
  435. :class:`~cryptography.hazmat.primitives.hmac.HMAC`.
  436. * Added support for
  437. :class:`~cryptography.hazmat.primitives.ciphers.modes.XTS` mode for
  438. AES.
  439. * Added support for using labels with
  440. :class:`~cryptography.hazmat.primitives.asymmetric.padding.OAEP` when using
  441. OpenSSL 1.0.2 or greater.
  442. * Improved compatibility with NSS when issuing certificates from an issuer
  443. that has a subject with non-``UTF8String`` string types.
  444. * Add support for the :class:`~cryptography.x509.DeltaCRLIndicator` extension.
  445. * Add support for the :class:`~cryptography.x509.TLSFeature`
  446. extension. This is commonly used for enabling ``OCSP Must-Staple`` in
  447. certificates.
  448. * Add support for the :class:`~cryptography.x509.FreshestCRL` extension.
  449. .. _v2-0-3:
  450. 2.0.3 - 2017-08-03
  451. ~~~~~~~~~~~~~~~~~~
  452. * Fixed an issue with weak linking symbols when compiling on macOS
  453. versions older than 10.12.
  454. .. _v2-0-2:
  455. 2.0.2 - 2017-07-27
  456. ~~~~~~~~~~~~~~~~~~
  457. * Marked all symbols as hidden in the ``manylinux1`` wheel to avoid a
  458. bug with symbol resolution in certain scenarios.
  459. .. _v2-0-1:
  460. 2.0.1 - 2017-07-26
  461. ~~~~~~~~~~~~~~~~~~
  462. * Fixed a compilation bug affecting OpenBSD.
  463. * Altered the ``manylinux1`` wheels to statically link OpenSSL instead of
  464. dynamically linking and bundling the shared object. This should resolve
  465. crashes seen when using ``uwsgi`` or other binaries that link against
  466. OpenSSL independently.
  467. * Fixed the stack level for the ``signer`` and ``verifier`` warnings.
  468. .. _v2-0:
  469. 2.0 - 2017-07-17
  470. ~~~~~~~~~~~~~~~~
  471. * **BACKWARDS INCOMPATIBLE:** Support for Python 3.3 has been dropped.
  472. * We now ship ``manylinux1`` wheels linked against OpenSSL 1.1.0f. These wheels
  473. will be automatically used with most Linux distributions if you are running
  474. the latest pip.
  475. * Deprecated the use of ``signer`` on
  476. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`,
  477. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`,
  478. and
  479. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey`
  480. in favor of ``sign``.
  481. * Deprecated the use of ``verifier`` on
  482. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`,
  483. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey`,
  484. and
  485. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`
  486. in favor of ``verify``.
  487. * Added support for parsing
  488. :class:`~cryptography.x509.certificate_transparency.SignedCertificateTimestamp`
  489. objects from X.509 certificate extensions.
  490. * Added support for
  491. :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaCha20Poly1305`.
  492. * Added support for
  493. :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`.
  494. * Added
  495. :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`, a "one shot"
  496. API for AES GCM encryption.
  497. * Added support for :doc:`/hazmat/primitives/asymmetric/x25519`.
  498. * Added support for serializing and deserializing Diffie-Hellman parameters
  499. with
  500. :func:`~cryptography.hazmat.primitives.serialization.load_pem_parameters`,
  501. :func:`~cryptography.hazmat.primitives.serialization.load_der_parameters`,
  502. and
  503. :meth:`~cryptography.hazmat.primitives.asymmetric.dh.DHParameters.parameter_bytes`
  504. .
  505. * The ``extensions`` attribute on :class:`~cryptography.x509.Certificate`,
  506. :class:`~cryptography.x509.CertificateSigningRequest`,
  507. :class:`~cryptography.x509.CertificateRevocationList`, and
  508. :class:`~cryptography.x509.RevokedCertificate` now caches the computed
  509. ``Extensions`` object. There should be no performance change, just a
  510. performance improvement for programs accessing the ``extensions`` attribute
  511. multiple times.
  512. .. _v1-9:
  513. 1.9 - 2017-05-29
  514. ~~~~~~~~~~~~~~~~
  515. * **BACKWARDS INCOMPATIBLE:** Elliptic Curve signature verification no longer
  516. returns ``True`` on success. This brings it in line with the interface's
  517. documentation, and our intent. The correct way to use
  518. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.verify`
  519. has always been to check whether or not
  520. :class:`~cryptography.exceptions.InvalidSignature` was raised.
  521. * **BACKWARDS INCOMPATIBLE:** Dropped support for macOS 10.7 and 10.8.
  522. * **BACKWARDS INCOMPATIBLE:** The minimum supported PyPy version is now 5.3.
  523. * Python 3.3 support has been deprecated, and will be removed in the next
  524. ``cryptography`` release.
  525. * Add support for providing ``tag`` during
  526. :class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` finalization via
  527. :meth:`~cryptography.hazmat.primitives.ciphers.AEADDecryptionContext.finalize_with_tag`.
  528. * Fixed an issue preventing ``cryptography`` from compiling against
  529. LibreSSL 2.5.x.
  530. * Added
  531. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.key_size`
  532. and
  533. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey.key_size`
  534. as convenience methods for determining the bit size of a secret scalar for
  535. the curve.
  536. * Accessing an unrecognized extension marked critical on an X.509 object will
  537. no longer raise an ``UnsupportedExtension`` exception, instead an
  538. :class:`~cryptography.x509.UnrecognizedExtension` object will be returned.
  539. This behavior was based on a poor reading of the RFC, unknown critical
  540. extensions only need to be rejected on certificate verification.
  541. * The CommonCrypto backend has been removed.
  542. * MultiBackend has been removed.
  543. * ``Whirlpool`` and ``RIPEMD160`` have been deprecated.
  544. .. _v1-8-2:
  545. 1.8.2 - 2017-05-26
  546. ~~~~~~~~~~~~~~~~~~
  547. * Fixed a compilation bug affecting OpenSSL 1.1.0f.
  548. * Updated Windows and macOS wheels to be compiled against OpenSSL 1.1.0f.
  549. .. _v1-8-1:
  550. 1.8.1 - 2017-03-10
  551. ~~~~~~~~~~~~~~~~~~
  552. * Fixed macOS wheels to properly link against 1.1.0 rather than 1.0.2.
  553. .. _v1-8:
  554. 1.8 - 2017-03-09
  555. ~~~~~~~~~~~~~~~~
  556. * Added support for Python 3.6.
  557. * Windows and macOS wheels now link against OpenSSL 1.1.0.
  558. * macOS wheels are no longer universal. This change significantly shrinks the
  559. size of the wheels. Users on macOS 32-bit Python (if there are any) should
  560. migrate to 64-bit or build their own packages.
  561. * Changed ASN.1 dependency from ``pyasn1`` to ``asn1crypto`` resulting in a
  562. general performance increase when encoding/decoding ASN.1 structures. Also,
  563. the ``pyasn1_modules`` test dependency is no longer required.
  564. * Added support for
  565. :meth:`~cryptography.hazmat.primitives.ciphers.CipherContext.update_into` on
  566. :class:`~cryptography.hazmat.primitives.ciphers.CipherContext`.
  567. * Added
  568. :meth:`~cryptography.hazmat.primitives.asymmetric.dh.DHPrivateKeyWithSerialization.private_bytes`
  569. to
  570. :class:`~cryptography.hazmat.primitives.asymmetric.dh.DHPrivateKeyWithSerialization`.
  571. * Added
  572. :meth:`~cryptography.hazmat.primitives.asymmetric.dh.DHPublicKey.public_bytes`
  573. to
  574. :class:`~cryptography.hazmat.primitives.asymmetric.dh.DHPublicKey`.
  575. * :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`
  576. and
  577. :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`
  578. now require that ``password`` must be bytes if provided. Previously this
  579. was documented but not enforced.
  580. * Added support for subgroup order in :doc:`/hazmat/primitives/asymmetric/dh`.
  581. .. _v1-7-2:
  582. 1.7.2 - 2017-01-27
  583. ~~~~~~~~~~~~~~~~~~
  584. * Updated Windows and macOS wheels to be compiled against OpenSSL 1.0.2k.
  585. .. _v1-7-1:
  586. 1.7.1 - 2016-12-13
  587. ~~~~~~~~~~~~~~~~~~
  588. * Fixed a regression in ``int_from_bytes`` where it failed to accept
  589. ``bytearray``.
  590. .. _v1-7:
  591. 1.7 - 2016-12-12
  592. ~~~~~~~~~~~~~~~~
  593. * Support for OpenSSL 1.0.0 has been removed. Users on older version of OpenSSL
  594. will need to upgrade.
  595. * Added support for Diffie-Hellman key exchange using
  596. :meth:`~cryptography.hazmat.primitives.asymmetric.dh.DHPrivateKey.exchange`.
  597. * The OS random engine for OpenSSL has been rewritten to improve compatibility
  598. with embedded Python and other edge cases. More information about this change
  599. can be found in the
  600. `pull request <https://github.com/pyca/cryptography/pull/3229>`_.
  601. .. _v1-6:
  602. 1.6 - 2016-11-22
  603. ~~~~~~~~~~~~~~~~
  604. * Deprecated support for OpenSSL 1.0.0. Support will be removed in
  605. ``cryptography`` 1.7.
  606. * Replaced the Python-based OpenSSL locking callbacks with a C version to fix
  607. a potential deadlock that could occur if a garbage collection cycle occurred
  608. while inside the lock.
  609. * Added support for :class:`~cryptography.hazmat.primitives.hashes.BLAKE2b` and
  610. :class:`~cryptography.hazmat.primitives.hashes.BLAKE2s` when using OpenSSL
  611. 1.1.0.
  612. * Added
  613. :attr:`~cryptography.x509.Certificate.signature_algorithm_oid` support to
  614. :class:`~cryptography.x509.Certificate`.
  615. * Added
  616. :attr:`~cryptography.x509.CertificateSigningRequest.signature_algorithm_oid`
  617. support to :class:`~cryptography.x509.CertificateSigningRequest`.
  618. * Added
  619. :attr:`~cryptography.x509.CertificateRevocationList.signature_algorithm_oid`
  620. support to :class:`~cryptography.x509.CertificateRevocationList`.
  621. * Added support for :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`
  622. when using OpenSSL 1.1.0.
  623. * Added a workaround to improve compatibility with Python application bundling
  624. tools like ``PyInstaller`` and ``cx_freeze``.
  625. * Added support for generating a
  626. :meth:`~cryptography.x509.random_serial_number`.
  627. * Added support for encoding ``IPv4Network`` and ``IPv6Network`` in X.509
  628. certificates for use with :class:`~cryptography.x509.NameConstraints`.
  629. * Added :meth:`~cryptography.x509.Name.public_bytes` to
  630. :class:`~cryptography.x509.Name`.
  631. * Added :class:`~cryptography.x509.RelativeDistinguishedName`
  632. * :class:`~cryptography.x509.DistributionPoint` now accepts
  633. :class:`~cryptography.x509.RelativeDistinguishedName` for
  634. :attr:`~cryptography.x509.DistributionPoint.relative_name`.
  635. Deprecated use of :class:`~cryptography.x509.Name` as
  636. :attr:`~cryptography.x509.DistributionPoint.relative_name`.
  637. * :class:`~cryptography.x509.Name` now accepts an iterable of
  638. :class:`~cryptography.x509.RelativeDistinguishedName`. RDNs can
  639. be accessed via the :attr:`~cryptography.x509.Name.rdns`
  640. attribute. When constructed with an iterable of
  641. :class:`~cryptography.x509.NameAttribute`, each attribute becomes
  642. a single-valued RDN.
  643. * Added
  644. :func:`~cryptography.hazmat.primitives.asymmetric.ec.derive_private_key`.
  645. * Added support for signing and verifying RSA, DSA, and ECDSA signatures with
  646. :class:`~cryptography.hazmat.primitives.asymmetric.utils.Prehashed`
  647. digests.
  648. .. _v1-5-3:
  649. 1.5.3 - 2016-11-05
  650. ~~~~~~~~~~~~~~~~~~
  651. * **SECURITY ISSUE**: Fixed a bug where ``HKDF`` would return an empty
  652. byte-string if used with a ``length`` less than ``algorithm.digest_size``.
  653. Credit to **Markus Döring** for reporting the issue. *CVE-2016-9243*
  654. .. _v1-5-2:
  655. 1.5.2 - 2016-09-26
  656. ~~~~~~~~~~~~~~~~~~
  657. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2j.
  658. .. _v1-5-1:
  659. 1.5.1 - 2016-09-22
  660. ~~~~~~~~~~~~~~~~~~
  661. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2i.
  662. * Resolved a ``UserWarning`` when used with cffi 1.8.3.
  663. * Fixed a memory leak in name creation with X.509.
  664. * Added a workaround for old versions of setuptools.
  665. * Fixed an issue preventing ``cryptography`` from compiling against
  666. OpenSSL 1.0.2i.
  667. .. _v1-5:
  668. 1.5 - 2016-08-26
  669. ~~~~~~~~~~~~~~~~
  670. * Added
  671. :func:`~cryptography.hazmat.primitives.asymmetric.padding.calculate_max_pss_salt_length`.
  672. * Added "one shot"
  673. :meth:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey.sign`
  674. and
  675. :meth:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey.verify`
  676. methods to DSA keys.
  677. * Added "one shot"
  678. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey.sign`
  679. and
  680. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.verify`
  681. methods to ECDSA keys.
  682. * Switched back to the older callback model on Python 3.5 in order to mitigate
  683. the locking callback problem with OpenSSL <1.1.0.
  684. * :class:`~cryptography.x509.CertificateBuilder`,
  685. :class:`~cryptography.x509.CertificateRevocationListBuilder`, and
  686. :class:`~cryptography.x509.RevokedCertificateBuilder` now accept timezone
  687. aware ``datetime`` objects as method arguments
  688. * ``cryptography`` now supports OpenSSL 1.1.0 as a compilation target.
  689. .. _v1-4:
  690. 1.4 - 2016-06-04
  691. ~~~~~~~~~~~~~~~~
  692. * Support for OpenSSL 0.9.8 has been removed. Users on older versions of
  693. OpenSSL will need to upgrade.
  694. * Added :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`.
  695. * Added support for ``OpenSSH`` public key serialization.
  696. * Added support for SHA-2 in RSA
  697. :class:`~cryptography.hazmat.primitives.asymmetric.padding.OAEP` when using
  698. OpenSSL 1.0.2 or greater.
  699. * Added "one shot"
  700. :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey.sign`
  701. and
  702. :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey.verify`
  703. methods to RSA keys.
  704. * Deprecated the ``serial`` attribute on
  705. :class:`~cryptography.x509.Certificate`, in favor of
  706. :attr:`~cryptography.x509.Certificate.serial_number`.
  707. .. _v1-3-4:
  708. 1.3.4 - 2016-06-03
  709. ~~~~~~~~~~~~~~~~~~
  710. * Added another OpenSSL function to the bindings to support an upcoming
  711. ``pyOpenSSL`` release.
  712. .. _v1-3-3:
  713. 1.3.3 - 2016-06-02
  714. ~~~~~~~~~~~~~~~~~~
  715. * Added two new OpenSSL functions to the bindings to support an upcoming
  716. ``pyOpenSSL`` release.
  717. .. _v1-3-2:
  718. 1.3.2 - 2016-05-04
  719. ~~~~~~~~~~~~~~~~~~
  720. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2h.
  721. * Fixed an issue preventing ``cryptography`` from compiling against
  722. LibreSSL 2.3.x.
  723. .. _v1-3-1:
  724. 1.3.1 - 2016-03-21
  725. ~~~~~~~~~~~~~~~~~~
  726. * Fixed a bug that caused an ``AttributeError`` when using ``mock`` to patch
  727. some ``cryptography`` modules.
  728. .. _v1-3:
  729. 1.3 - 2016-03-18
  730. ~~~~~~~~~~~~~~~~
  731. * Added support for padding ANSI X.923 with
  732. :class:`~cryptography.hazmat.primitives.padding.ANSIX923`.
  733. * Deprecated support for OpenSSL 0.9.8. Support will be removed in
  734. ``cryptography`` 1.4.
  735. * Added support for the :class:`~cryptography.x509.PolicyConstraints`
  736. X.509 extension including both parsing and generation using
  737. :class:`~cryptography.x509.CertificateBuilder` and
  738. :class:`~cryptography.x509.CertificateSigningRequestBuilder`.
  739. * Added :attr:`~cryptography.x509.CertificateSigningRequest.is_signature_valid`
  740. to :class:`~cryptography.x509.CertificateSigningRequest`.
  741. * Fixed an intermittent ``AssertionError`` when performing an RSA decryption on
  742. an invalid ciphertext, ``ValueError`` is now correctly raised in all cases.
  743. * Added
  744. :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`.
  745. .. _v1-2-3:
  746. 1.2.3 - 2016-03-01
  747. ~~~~~~~~~~~~~~~~~~
  748. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2g.
  749. .. _v1-2-2:
  750. 1.2.2 - 2016-01-29
  751. ~~~~~~~~~~~~~~~~~~
  752. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2f.
  753. .. _v1-2-1:
  754. 1.2.1 - 2016-01-08
  755. ~~~~~~~~~~~~~~~~~~
  756. * Reverts a change to an OpenSSL ``EVP_PKEY`` object that caused errors with
  757. ``pyOpenSSL``.
  758. .. _v1-2:
  759. 1.2 - 2016-01-08
  760. ~~~~~~~~~~~~~~~~
  761. * **BACKWARDS INCOMPATIBLE:**
  762. :class:`~cryptography.x509.RevokedCertificate`
  763. :attr:`~cryptography.x509.RevokedCertificate.extensions` now uses extension
  764. classes rather than returning raw values inside the
  765. :class:`~cryptography.x509.Extension`
  766. :attr:`~cryptography.x509.Extension.value`. The new classes
  767. are:
  768. * :class:`~cryptography.x509.CertificateIssuer`
  769. * :class:`~cryptography.x509.CRLReason`
  770. * :class:`~cryptography.x509.InvalidityDate`
  771. * Deprecated support for OpenSSL 0.9.8 and 1.0.0. At this time there is no time
  772. table for actually dropping support, however we strongly encourage all users
  773. to upgrade, as those versions no longer receive support from the OpenSSL
  774. project.
  775. * The :class:`~cryptography.x509.Certificate` class now has
  776. :attr:`~cryptography.x509.Certificate.signature` and
  777. :attr:`~cryptography.x509.Certificate.tbs_certificate_bytes` attributes.
  778. * The :class:`~cryptography.x509.CertificateSigningRequest` class now has
  779. :attr:`~cryptography.x509.CertificateSigningRequest.signature` and
  780. :attr:`~cryptography.x509.CertificateSigningRequest.tbs_certrequest_bytes`
  781. attributes.
  782. * The :class:`~cryptography.x509.CertificateRevocationList` class now has
  783. :attr:`~cryptography.x509.CertificateRevocationList.signature` and
  784. :attr:`~cryptography.x509.CertificateRevocationList.tbs_certlist_bytes`
  785. attributes.
  786. * :class:`~cryptography.x509.NameConstraints` are now supported in the
  787. :class:`~cryptography.x509.CertificateBuilder` and
  788. :class:`~cryptography.x509.CertificateSigningRequestBuilder`.
  789. * Support serialization of certificate revocation lists using the
  790. :meth:`~cryptography.x509.CertificateRevocationList.public_bytes` method of
  791. :class:`~cryptography.x509.CertificateRevocationList`.
  792. * Add support for parsing :class:`~cryptography.x509.CertificateRevocationList`
  793. :meth:`~cryptography.x509.CertificateRevocationList.extensions` in the
  794. OpenSSL backend. The following extensions are currently supported:
  795. * :class:`~cryptography.x509.AuthorityInformationAccess`
  796. * :class:`~cryptography.x509.AuthorityKeyIdentifier`
  797. * :class:`~cryptography.x509.CRLNumber`
  798. * :class:`~cryptography.x509.IssuerAlternativeName`
  799. * Added :class:`~cryptography.x509.CertificateRevocationListBuilder` and
  800. :class:`~cryptography.x509.RevokedCertificateBuilder` to allow creation of
  801. CRLs.
  802. * Unrecognized non-critical X.509 extensions are now parsed into an
  803. :class:`~cryptography.x509.UnrecognizedExtension` object.
  804. .. _v1-1-2:
  805. 1.1.2 - 2015-12-10
  806. ~~~~~~~~~~~~~~~~~~
  807. * Fixed a SIGBUS crash with the OS X wheels caused by redefinition of a
  808. method.
  809. * Fixed a runtime error ``undefined symbol EC_GFp_nistp224_method`` that
  810. occurred with some OpenSSL installations.
  811. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2e.
  812. .. _v1-1-1:
  813. 1.1.1 - 2015-11-19
  814. ~~~~~~~~~~~~~~~~~~
  815. * Fixed several small bugs related to compiling the OpenSSL bindings with
  816. unusual OpenSSL configurations.
  817. * Resolved an issue where, depending on the method of installation and
  818. which Python interpreter they were using, users on El Capitan (OS X 10.11)
  819. may have seen an ``InternalError`` on import.
  820. .. _v1-1:
  821. 1.1 - 2015-10-28
  822. ~~~~~~~~~~~~~~~~
  823. * Added support for Elliptic Curve Diffie-Hellman with
  824. :class:`~cryptography.hazmat.primitives.asymmetric.ec.ECDH`.
  825. * Added :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`.
  826. * Added support for parsing certificate revocation lists (CRLs) using
  827. :func:`~cryptography.x509.load_pem_x509_crl` and
  828. :func:`~cryptography.x509.load_der_x509_crl`.
  829. * Add support for AES key wrapping with
  830. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_wrap` and
  831. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap`.
  832. * Added a ``__hash__`` method to :class:`~cryptography.x509.Name`.
  833. * Add support for encoding and decoding elliptic curve points to a byte string
  834. form using
  835. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers.encode_point`
  836. and
  837. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers.from_encoded_point`.
  838. * Added :meth:`~cryptography.x509.Extensions.get_extension_for_class`.
  839. * :class:`~cryptography.x509.CertificatePolicies` are now supported in the
  840. :class:`~cryptography.x509.CertificateBuilder`.
  841. * ``countryName`` is now encoded as a ``PrintableString`` when creating subject
  842. and issuer distinguished names with the Certificate and CSR builder classes.
  843. .. _v1-0-2:
  844. 1.0.2 - 2015-09-27
  845. ~~~~~~~~~~~~~~~~~~
  846. * **SECURITY ISSUE**: The OpenSSL backend prior to 1.0.2 made extensive use
  847. of assertions to check response codes where our tests could not trigger a
  848. failure. However, when Python is run with ``-O`` these asserts are optimized
  849. away. If a user ran Python with this flag and got an invalid response code
  850. this could result in undefined behavior or worse. Accordingly, all response
  851. checks from the OpenSSL backend have been converted from ``assert``
  852. to a true function call. Credit **Emilia Käsper (Google Security Team)**
  853. for the report.
  854. .. _v1-0-1:
  855. 1.0.1 - 2015-09-05
  856. ~~~~~~~~~~~~~~~~~~
  857. * We now ship OS X wheels that statically link OpenSSL by default. When
  858. installing a wheel on OS X 10.10+ (and using a Python compiled against the
  859. 10.10 SDK) users will no longer need to compile. See :doc:`/installation` for
  860. alternate installation methods if required.
  861. * Set the default string mask to UTF-8 in the OpenSSL backend to resolve
  862. character encoding issues with older versions of OpenSSL.
  863. * Several new OpenSSL bindings have been added to support a future pyOpenSSL
  864. release.
  865. * Raise an error during install on PyPy < 2.6. 1.0+ requires PyPy 2.6+.
  866. .. _v1-0:
  867. 1.0 - 2015-08-12
  868. ~~~~~~~~~~~~~~~~
  869. * Switched to the new `cffi`_ ``set_source`` out-of-line API mode for
  870. compilation. This results in significantly faster imports and lowered
  871. memory consumption. Due to this change we no longer support PyPy releases
  872. older than 2.6 nor do we support any released version of PyPy3 (until a
  873. version supporting cffi 1.0 comes out).
  874. * Fix parsing of OpenSSH public keys that have spaces in comments.
  875. * Support serialization of certificate signing requests using the
  876. ``public_bytes`` method of
  877. :class:`~cryptography.x509.CertificateSigningRequest`.
  878. * Support serialization of certificates using the ``public_bytes`` method of
  879. :class:`~cryptography.x509.Certificate`.
  880. * Add ``get_provisioning_uri`` method to
  881. :class:`~cryptography.hazmat.primitives.twofactor.hotp.HOTP` and
  882. :class:`~cryptography.hazmat.primitives.twofactor.totp.TOTP` for generating
  883. provisioning URIs.
  884. * Add :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatKDFHash`
  885. and :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatKDFHMAC`.
  886. * Raise a ``TypeError`` when passing objects that are not text as the value to
  887. :class:`~cryptography.x509.NameAttribute`.
  888. * Add support for :class:`~cryptography.x509.OtherName` as a general name
  889. type.
  890. * Added new X.509 extension support in :class:`~cryptography.x509.Certificate`
  891. The following new extensions are now supported:
  892. * :class:`~cryptography.x509.OCSPNoCheck`
  893. * :class:`~cryptography.x509.InhibitAnyPolicy`
  894. * :class:`~cryptography.x509.IssuerAlternativeName`
  895. * :class:`~cryptography.x509.NameConstraints`
  896. * Extension support was added to
  897. :class:`~cryptography.x509.CertificateSigningRequest`.
  898. * Add support for creating signed certificates with
  899. :class:`~cryptography.x509.CertificateBuilder`. This includes support for
  900. the following extensions:
  901. * :class:`~cryptography.x509.BasicConstraints`
  902. * :class:`~cryptography.x509.SubjectAlternativeName`
  903. * :class:`~cryptography.x509.KeyUsage`
  904. * :class:`~cryptography.x509.ExtendedKeyUsage`
  905. * :class:`~cryptography.x509.SubjectKeyIdentifier`
  906. * :class:`~cryptography.x509.AuthorityKeyIdentifier`
  907. * :class:`~cryptography.x509.AuthorityInformationAccess`
  908. * :class:`~cryptography.x509.CRLDistributionPoints`
  909. * :class:`~cryptography.x509.InhibitAnyPolicy`
  910. * :class:`~cryptography.x509.IssuerAlternativeName`
  911. * :class:`~cryptography.x509.OCSPNoCheck`
  912. * Add support for creating certificate signing requests with
  913. :class:`~cryptography.x509.CertificateSigningRequestBuilder`. This includes
  914. support for the same extensions supported in the ``CertificateBuilder``.
  915. * Deprecate ``encode_rfc6979_signature`` and ``decode_rfc6979_signature`` in
  916. favor of
  917. :func:`~cryptography.hazmat.primitives.asymmetric.utils.encode_dss_signature`
  918. and
  919. :func:`~cryptography.hazmat.primitives.asymmetric.utils.decode_dss_signature`.
  920. .. _v0-9-3:
  921. 0.9.3 - 2015-07-09
  922. ~~~~~~~~~~~~~~~~~~
  923. * Updated Windows wheels to be compiled against OpenSSL 1.0.2d.
  924. .. _v0-9-2:
  925. 0.9.2 - 2015-07-04
  926. ~~~~~~~~~~~~~~~~~~
  927. * Updated Windows wheels to be compiled against OpenSSL 1.0.2c.
  928. .. _v0-9-1:
  929. 0.9.1 - 2015-06-06
  930. ~~~~~~~~~~~~~~~~~~
  931. * **SECURITY ISSUE**: Fixed a double free in the OpenSSL backend when using DSA
  932. to verify signatures. Note that this only affects PyPy 2.6.0 and (presently
  933. unreleased) CFFI versions greater than 1.1.0.
  934. .. _v0-9:
  935. 0.9 - 2015-05-13
  936. ~~~~~~~~~~~~~~~~
  937. * Removed support for Python 3.2. This version of Python is rarely used
  938. and caused support headaches. Users affected by this should upgrade to 3.3+.
  939. * Deprecated support for Python 2.6. At the time there is no time table for
  940. actually dropping support, however we strongly encourage all users to upgrade
  941. their Python, as Python 2.6 no longer receives support from the Python core
  942. team.
  943. * Add support for the
  944. :class:`~cryptography.hazmat.primitives.asymmetric.ec.SECP256K1` elliptic
  945. curve.
  946. * Fixed compilation when using an OpenSSL which was compiled with the
  947. ``no-comp`` (``OPENSSL_NO_COMP``) option.
  948. * Support :attr:`~cryptography.hazmat.primitives.serialization.Encoding.DER`
  949. serialization of public keys using the ``public_bytes`` method of
  950. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKeyWithSerialization`,
  951. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKeyWithSerialization`,
  952. and
  953. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKeyWithSerialization`.
  954. * Support :attr:`~cryptography.hazmat.primitives.serialization.Encoding.DER`
  955. serialization of private keys using the ``private_bytes`` method of
  956. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization`,
  957. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization`,
  958. and
  959. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization`.
  960. * Add support for parsing X.509 certificate signing requests (CSRs) with
  961. :func:`~cryptography.x509.load_pem_x509_csr` and
  962. :func:`~cryptography.x509.load_der_x509_csr`.
  963. * Moved ``cryptography.exceptions.InvalidToken`` to
  964. :class:`cryptography.hazmat.primitives.twofactor.InvalidToken` and deprecated
  965. the old location. This was moved to minimize confusion between this exception
  966. and :class:`cryptography.fernet.InvalidToken`.
  967. * Added support for X.509 extensions in :class:`~cryptography.x509.Certificate`
  968. objects. The following extensions are supported as of this release:
  969. * :class:`~cryptography.x509.BasicConstraints`
  970. * :class:`~cryptography.x509.AuthorityKeyIdentifier`
  971. * :class:`~cryptography.x509.SubjectKeyIdentifier`
  972. * :class:`~cryptography.x509.KeyUsage`
  973. * :class:`~cryptography.x509.SubjectAlternativeName`
  974. * :class:`~cryptography.x509.ExtendedKeyUsage`
  975. * :class:`~cryptography.x509.CRLDistributionPoints`
  976. * :class:`~cryptography.x509.AuthorityInformationAccess`
  977. * :class:`~cryptography.x509.CertificatePolicies`
  978. Note that unsupported extensions with the critical flag raise
  979. ``UnsupportedExtension`` while unsupported extensions set to non-critical are
  980. silently ignored. Read the :doc:`X.509 documentation</x509/index>` for more
  981. information.
  982. .. _v0-8-2:
  983. 0.8.2 - 2015-04-10
  984. ~~~~~~~~~~~~~~~~~~
  985. * Fixed a race condition when initializing the OpenSSL or CommonCrypto backends
  986. in a multi-threaded scenario.
  987. .. _v0-8-1:
  988. 0.8.1 - 2015-03-20
  989. ~~~~~~~~~~~~~~~~~~
  990. * Updated Windows wheels to be compiled against OpenSSL 1.0.2a.
  991. .. _v0-8:
  992. 0.8 - 2015-03-08
  993. ~~~~~~~~~~~~~~~~
  994. * :func:`~cryptography.hazmat.primitives.serialization.load_ssh_public_key` can
  995. now load elliptic curve public keys.
  996. * Added
  997. :attr:`~cryptography.x509.Certificate.signature_hash_algorithm` support to
  998. :class:`~cryptography.x509.Certificate`.
  999. * Added
  1000. :func:`~cryptography.hazmat.primitives.asymmetric.rsa.rsa_recover_prime_factors`
  1001. * :class:`~cryptography.hazmat.primitives.kdf.KeyDerivationFunction` was moved
  1002. from ``cryptography.hazmat.primitives.interfaces`` to
  1003. :mod:`~cryptography.hazmat.primitives.kdf`.
  1004. * Added support for parsing X.509 names. See the
  1005. :doc:`X.509 documentation</x509/index>` for more information.
  1006. * Added
  1007. :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key` to
  1008. support loading of DER encoded private keys and
  1009. :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key` to
  1010. support loading DER encoded public keys.
  1011. * Fixed building against LibreSSL, a compile-time substitute for OpenSSL.
  1012. * FreeBSD 9.2 was removed from the continuous integration system.
  1013. * Updated Windows wheels to be compiled against OpenSSL 1.0.2.
  1014. * :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`
  1015. and :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`
  1016. now support PKCS1 RSA public keys (in addition to the previous support for
  1017. SubjectPublicKeyInfo format for RSA, EC, and DSA).
  1018. * Added
  1019. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization`
  1020. and deprecated ``EllipticCurvePrivateKeyWithNumbers``.
  1021. * Added
  1022. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization.private_bytes`
  1023. to
  1024. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization`.
  1025. * Added
  1026. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization`
  1027. and deprecated ``RSAPrivateKeyWithNumbers``.
  1028. * Added
  1029. :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization.private_bytes`
  1030. to
  1031. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization`.
  1032. * Added
  1033. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization`
  1034. and deprecated ``DSAPrivateKeyWithNumbers``.
  1035. * Added
  1036. :meth:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization.private_bytes`
  1037. to
  1038. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization`.
  1039. * Added
  1040. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKeyWithSerialization`
  1041. and deprecated ``RSAPublicKeyWithNumbers``.
  1042. * Added ``public_bytes`` to
  1043. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKeyWithSerialization`.
  1044. * Added
  1045. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKeyWithSerialization`
  1046. and deprecated ``EllipticCurvePublicKeyWithNumbers``.
  1047. * Added ``public_bytes`` to
  1048. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKeyWithSerialization`.
  1049. * Added
  1050. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKeyWithSerialization`
  1051. and deprecated ``DSAPublicKeyWithNumbers``.
  1052. * Added ``public_bytes`` to
  1053. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKeyWithSerialization`.
  1054. * :class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm` and
  1055. :class:`~cryptography.hazmat.primitives.hashes.HashContext` were moved from
  1056. ``cryptography.hazmat.primitives.interfaces`` to
  1057. :mod:`~cryptography.hazmat.primitives.hashes`.
  1058. * :class:`~cryptography.hazmat.primitives.ciphers.CipherContext`,
  1059. :class:`~cryptography.hazmat.primitives.ciphers.AEADCipherContext`,
  1060. :class:`~cryptography.hazmat.primitives.ciphers.AEADEncryptionContext`,
  1061. :class:`~cryptography.hazmat.primitives.ciphers.CipherAlgorithm`, and
  1062. :class:`~cryptography.hazmat.primitives.ciphers.BlockCipherAlgorithm`
  1063. were moved from ``cryptography.hazmat.primitives.interfaces`` to
  1064. :mod:`~cryptography.hazmat.primitives.ciphers`.
  1065. * :class:`~cryptography.hazmat.primitives.ciphers.modes.Mode`,
  1066. :class:`~cryptography.hazmat.primitives.ciphers.modes.ModeWithInitializationVector`,
  1067. :class:`~cryptography.hazmat.primitives.ciphers.modes.ModeWithNonce`, and
  1068. :class:`~cryptography.hazmat.primitives.ciphers.modes.ModeWithAuthenticationTag`
  1069. were moved from ``cryptography.hazmat.primitives.interfaces`` to
  1070. :mod:`~cryptography.hazmat.primitives.ciphers.modes`.
  1071. * :class:`~cryptography.hazmat.primitives.padding.PaddingContext` was moved
  1072. from ``cryptography.hazmat.primitives.interfaces`` to
  1073. :mod:`~cryptography.hazmat.primitives.padding`.
  1074. *
  1075. :class:`~cryptography.hazmat.primitives.asymmetric.padding.AsymmetricPadding`
  1076. was moved from ``cryptography.hazmat.primitives.interfaces`` to
  1077. :mod:`~cryptography.hazmat.primitives.asymmetric.padding`.
  1078. * ``AsymmetricSignatureContext`` and ``AsymmetricVerificationContext``
  1079. were moved from ``cryptography.hazmat.primitives.interfaces`` to
  1080. ``cryptography.hazmat.primitives.asymmetric``.
  1081. * :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAParameters`,
  1082. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAParametersWithNumbers`,
  1083. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`,
  1084. ``DSAPrivateKeyWithNumbers``,
  1085. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey` and
  1086. ``DSAPublicKeyWithNumbers`` were moved from
  1087. ``cryptography.hazmat.primitives.interfaces`` to
  1088. :mod:`~cryptography.hazmat.primitives.asymmetric.dsa`
  1089. * :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurve`,
  1090. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveSignatureAlgorithm`,
  1091. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey`,
  1092. ``EllipticCurvePrivateKeyWithNumbers``,
  1093. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`,
  1094. and ``EllipticCurvePublicKeyWithNumbers``
  1095. were moved from ``cryptography.hazmat.primitives.interfaces`` to
  1096. :mod:`~cryptography.hazmat.primitives.asymmetric.ec`.
  1097. * :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`,
  1098. ``RSAPrivateKeyWithNumbers``,
  1099. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey` and
  1100. ``RSAPublicKeyWithNumbers`` were moved from
  1101. ``cryptography.hazmat.primitives.interfaces`` to
  1102. :mod:`~cryptography.hazmat.primitives.asymmetric.rsa`.
  1103. .. _v0-7-2:
  1104. 0.7.2 - 2015-01-16
  1105. ~~~~~~~~~~~~~~~~~~
  1106. * Updated Windows wheels to be compiled against OpenSSL 1.0.1l.
  1107. * ``enum34`` is no longer installed on Python 3.4, where it is included in
  1108. the standard library.
  1109. * Added a new function to the OpenSSL bindings to support additional
  1110. functionality in pyOpenSSL.
  1111. .. _v0-7-1:
  1112. 0.7.1 - 2014-12-28
  1113. ~~~~~~~~~~~~~~~~~~
  1114. * Fixed an issue preventing compilation on platforms where ``OPENSSL_NO_SSL3``
  1115. was defined.
  1116. .. _v0-7:
  1117. 0.7 - 2014-12-17
  1118. ~~~~~~~~~~~~~~~~
  1119. * Cryptography has been relicensed from the Apache Software License, Version
  1120. 2.0, to being available under *either* the Apache Software License, Version
  1121. 2.0, or the BSD license.
  1122. * Added key-rotation support to :doc:`Fernet </fernet>` with
  1123. :class:`~cryptography.fernet.MultiFernet`.
  1124. * More bit-lengths are now supported for ``p`` and ``q`` when loading DSA keys
  1125. from numbers.
  1126. * Added ``MACContext`` as a common interface for CMAC and HMAC and
  1127. deprecated ``CMACContext``.
  1128. * Added support for encoding and decoding :rfc:`6979` signatures in
  1129. :doc:`/hazmat/primitives/asymmetric/utils`.
  1130. * Added
  1131. :func:`~cryptography.hazmat.primitives.serialization.load_ssh_public_key` to
  1132. support the loading of OpenSSH public keys (:rfc:`4253`). Only RSA and DSA
  1133. keys are currently supported.
  1134. * Added initial support for X.509 certificate parsing. See the
  1135. :doc:`X.509 documentation</x509/index>` for more information.
  1136. .. _v0-6-1:
  1137. 0.6.1 - 2014-10-15
  1138. ~~~~~~~~~~~~~~~~~~
  1139. * Updated Windows wheels to be compiled against OpenSSL 1.0.1j.
  1140. * Fixed an issue where OpenSSL 1.0.1j changed the errors returned by some
  1141. functions.
  1142. * Added our license file to the ``cryptography-vectors`` package.
  1143. * Implemented DSA hash truncation support (per FIPS 186-3) in the OpenSSL
  1144. backend. This works around an issue in 1.0.0, 1.0.0a, and 1.0.0b where
  1145. truncation was not implemented.
  1146. .. _v0-6:
  1147. 0.6 - 2014-09-29
  1148. ~~~~~~~~~~~~~~~~
  1149. * Added
  1150. :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key` to
  1151. ease loading private keys, and
  1152. :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key` to
  1153. support loading public keys.
  1154. * Removed the, deprecated in 0.4, support for the ``salt_length`` argument to
  1155. the :class:`~cryptography.hazmat.primitives.asymmetric.padding.MGF1`
  1156. constructor. The ``salt_length`` should be passed to
  1157. :class:`~cryptography.hazmat.primitives.asymmetric.padding.PSS` instead.
  1158. * Fix compilation on OS X Yosemite.
  1159. * Deprecated ``elliptic_curve_private_key_from_numbers`` and
  1160. ``elliptic_curve_public_key_from_numbers`` in favor of
  1161. ``load_elliptic_curve_private_numbers`` and
  1162. ``load_elliptic_curve_public_numbers`` on
  1163. :class:`~cryptography.hazmat.backends.interfaces.EllipticCurveBackend`.
  1164. * Added ``EllipticCurvePrivateKeyWithNumbers`` and
  1165. ``EllipticCurvePublicKeyWithNumbers`` support.
  1166. * Work around three GCM related bugs in CommonCrypto and OpenSSL.
  1167. * On the CommonCrypto backend adding AAD but not subsequently calling update
  1168. would return null tag bytes.
  1169. * One the CommonCrypto backend a call to update without an empty add AAD call
  1170. would return null ciphertext bytes.
  1171. * On the OpenSSL backend with certain versions adding AAD only would give
  1172. invalid tag bytes.
  1173. * Support loading EC private keys from PEM.
  1174. .. _v0-5-4:
  1175. 0.5.4 - 2014-08-20
  1176. ~~~~~~~~~~~~~~~~~~
  1177. * Added several functions to the OpenSSL bindings to support new
  1178. functionality in pyOpenSSL.
  1179. * Fixed a redefined constant causing compilation failure with Solaris 11.2.
  1180. .. _v0-5-3:
  1181. 0.5.3 - 2014-08-06
  1182. ~~~~~~~~~~~~~~~~~~
  1183. * Updated Windows wheels to be compiled against OpenSSL 1.0.1i.
  1184. .. _v0-5-2:
  1185. 0.5.2 - 2014-07-09
  1186. ~~~~~~~~~~~~~~~~~~
  1187. * Add ``TraditionalOpenSSLSerializationBackend`` support to ``multibackend``.
  1188. * Fix compilation error on OS X 10.8 (Mountain Lion).
  1189. .. _v0-5-1:
  1190. 0.5.1 - 2014-07-07
  1191. ~~~~~~~~~~~~~~~~~~
  1192. * Add ``PKCS8SerializationBackend`` support to ``multibackend``.
  1193. .. _v0-5:
  1194. 0.5 - 2014-07-07
  1195. ~~~~~~~~~~~~~~~~
  1196. * **BACKWARDS INCOMPATIBLE:**
  1197. :class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` no longer allows
  1198. truncation of tags by default. Previous versions of ``cryptography`` allowed
  1199. tags to be truncated by default, applications wishing to preserve this
  1200. behavior (not recommended) can pass the ``min_tag_length`` argument.
  1201. * Windows builds now statically link OpenSSL by default. When installing a
  1202. wheel on Windows you no longer need to install OpenSSL separately. Windows
  1203. users can switch between static and dynamic linking with an environment
  1204. variable. See :doc:`/installation` for more details.
  1205. * Added :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`.
  1206. * Added :class:`~cryptography.hazmat.primitives.ciphers.modes.CFB8` support
  1207. for :class:`~cryptography.hazmat.primitives.ciphers.algorithms.AES` and
  1208. :class:`~cryptography.hazmat.primitives.ciphers.algorithms.TripleDES` on
  1209. ``commoncrypto`` and :doc:`/hazmat/backends/openssl`.
  1210. * Added ``AES`` :class:`~cryptography.hazmat.primitives.ciphers.modes.CTR`
  1211. support to the OpenSSL backend when linked against 0.9.8.
  1212. * Added ``PKCS8SerializationBackend`` and
  1213. ``TraditionalOpenSSLSerializationBackend`` support to the
  1214. :doc:`/hazmat/backends/openssl`.
  1215. * Added :doc:`/hazmat/primitives/asymmetric/ec` and
  1216. :class:`~cryptography.hazmat.backends.interfaces.EllipticCurveBackend`.
  1217. * Added :class:`~cryptography.hazmat.primitives.ciphers.modes.ECB` support
  1218. for :class:`~cryptography.hazmat.primitives.ciphers.algorithms.TripleDES` on
  1219. ``commoncrypto`` and :doc:`/hazmat/backends/openssl`.
  1220. * Deprecated the concrete ``RSAPrivateKey`` class in favor of backend
  1221. specific providers of the
  1222. :class:`cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
  1223. interface.
  1224. * Deprecated the concrete ``RSAPublicKey`` in favor of backend specific
  1225. providers of the
  1226. :class:`cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`
  1227. interface.
  1228. * Deprecated the concrete ``DSAPrivateKey`` class in favor of backend
  1229. specific providers of the
  1230. :class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`
  1231. interface.
  1232. * Deprecated the concrete ``DSAPublicKey`` class in favor of backend specific
  1233. providers of the
  1234. :class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey`
  1235. interface.
  1236. * Deprecated the concrete ``DSAParameters`` class in favor of backend specific
  1237. providers of the
  1238. :class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAParameters`
  1239. interface.
  1240. * Deprecated ``encrypt_rsa``, ``decrypt_rsa``, ``create_rsa_signature_ctx`` and
  1241. ``create_rsa_verification_ctx`` on
  1242. :class:`~cryptography.hazmat.backends.interfaces.RSABackend`.
  1243. * Deprecated ``create_dsa_signature_ctx`` and ``create_dsa_verification_ctx``
  1244. on :class:`~cryptography.hazmat.backends.interfaces.DSABackend`.
  1245. .. _v0-4:
  1246. 0.4 - 2014-05-03
  1247. ~~~~~~~~~~~~~~~~
  1248. * Deprecated ``salt_length`` on
  1249. :class:`~cryptography.hazmat.primitives.asymmetric.padding.MGF1` and added it
  1250. to :class:`~cryptography.hazmat.primitives.asymmetric.padding.PSS`. It will
  1251. be removed from ``MGF1`` in two releases per our :doc:`/api-stability`
  1252. policy.
  1253. * Added :class:`~cryptography.hazmat.primitives.ciphers.algorithms.SEED`
  1254. support.
  1255. * Added :class:`~cryptography.hazmat.primitives.cmac.CMAC`.
  1256. * Added decryption support to
  1257. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
  1258. and encryption support to
  1259. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`.
  1260. * Added signature support to
  1261. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`
  1262. and verification support to
  1263. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey`.
  1264. .. _v0-3:
  1265. 0.3 - 2014-03-27
  1266. ~~~~~~~~~~~~~~~~
  1267. * Added :class:`~cryptography.hazmat.primitives.twofactor.hotp.HOTP`.
  1268. * Added :class:`~cryptography.hazmat.primitives.twofactor.totp.TOTP`.
  1269. * Added :class:`~cryptography.hazmat.primitives.ciphers.algorithms.IDEA`
  1270. support.
  1271. * Added signature support to
  1272. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
  1273. and verification support to
  1274. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`.
  1275. * Moved test vectors to the new ``cryptography_vectors`` package.
  1276. .. _v0-2-2:
  1277. 0.2.2 - 2014-03-03
  1278. ~~~~~~~~~~~~~~~~~~
  1279. * Removed a constant definition that was causing compilation problems with
  1280. specific versions of OpenSSL.
  1281. .. _v0-2-1:
  1282. 0.2.1 - 2014-02-22
  1283. ~~~~~~~~~~~~~~~~~~
  1284. * Fix a bug where importing cryptography from multiple paths could cause
  1285. initialization to fail.
  1286. .. _v0-2:
  1287. 0.2 - 2014-02-20
  1288. ~~~~~~~~~~~~~~~~
  1289. * Added ``commoncrypto``.
  1290. * Added initial ``commoncrypto``.
  1291. * Removed ``register_cipher_adapter`` method from
  1292. :class:`~cryptography.hazmat.backends.interfaces.CipherBackend`.
  1293. * Added support for the OpenSSL backend under Windows.
  1294. * Improved thread-safety for the OpenSSL backend.
  1295. * Fixed compilation on systems where OpenSSL's ``ec.h`` header is not
  1296. available, such as CentOS.
  1297. * Added :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC`.
  1298. * Added :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
  1299. * Added ``multibackend``.
  1300. * Set default random for the :doc:`/hazmat/backends/openssl` to the OS
  1301. random engine.
  1302. * Added :class:`~cryptography.hazmat.primitives.ciphers.algorithms.CAST5`
  1303. (CAST-128) support.
  1304. .. _v0-1:
  1305. 0.1 - 2014-01-08
  1306. ~~~~~~~~~~~~~~~~
  1307. * Initial release.
  1308. .. _`master`: https://github.com/pyca/cryptography/
  1309. .. _`cffi`: https://cffi.readthedocs.io/