CHANGELOG.rst 56 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462
  1. Changelog
  2. =========
  3. .. _v2-9:
  4. 2.9 - 2020-04-02
  5. ~~~~~~~~~~~~~~~~
  6. * **BACKWARDS INCOMPATIBLE:** Support for Python 3.4 has been removed due to
  7. low usage and maintenance burden.
  8. * **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.0.1 has been removed.
  9. Users on older version of OpenSSL will need to upgrade.
  10. * **BACKWARDS INCOMPATIBLE:** Support for LibreSSL 2.6.x has been removed.
  11. * Removed support for calling
  12. :meth:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey.public_bytes`
  13. with no arguments, as per our deprecation policy. You must now pass
  14. ``encoding`` and ``format``.
  15. * **BACKWARDS INCOMPATIBLE:** Reversed the order in which
  16. :meth:`~cryptography.x509.Name.rfc4514_string` returns the RDNs
  17. as required by :rfc:`4514`.
  18. * Updated Windows, macOS, and ``manylinux`` wheels to be compiled with
  19. OpenSSL 1.1.1f.
  20. * Added support for parsing
  21. :attr:`~cryptography.x509.ocsp.OCSPResponse.single_extensions` in an OCSP
  22. response.
  23. * :class:`~cryptography.x509.NameAttribute` values can now be empty strings.
  24. .. _v2-8:
  25. 2.8 - 2019-10-16
  26. ~~~~~~~~~~~~~~~~
  27. * Updated Windows, macOS, and ``manylinux`` wheels to be compiled with
  28. OpenSSL 1.1.1d.
  29. * Added support for Python 3.8.
  30. * Added class methods
  31. :meth:`Poly1305.generate_tag
  32. <cryptography.hazmat.primitives.poly1305.Poly1305.generate_tag>`
  33. and
  34. :meth:`Poly1305.verify_tag
  35. <cryptography.hazmat.primitives.poly1305.Poly1305.verify_tag>`
  36. for Poly1305 sign and verify operations.
  37. * Deprecated support for OpenSSL 1.0.1. Support will be removed in
  38. ``cryptography`` 2.9.
  39. * We now ship ``manylinux2010`` wheels in addition to our ``manylinux1``
  40. wheels.
  41. * Added support for ``ed25519`` and ``ed448`` keys in the
  42. :class:`~cryptography.x509.CertificateBuilder`,
  43. :class:`~cryptography.x509.CertificateSigningRequestBuilder`,
  44. :class:`~cryptography.x509.CertificateRevocationListBuilder` and
  45. :class:`~cryptography.x509.ocsp.OCSPResponseBuilder`.
  46. * ``cryptography`` no longer depends on ``asn1crypto``.
  47. * :class:`~cryptography.x509.FreshestCRL` is now allowed as a
  48. :class:`~cryptography.x509.CertificateRevocationList` extension.
  49. .. _v2-7:
  50. 2.7 - 2019-05-30
  51. ~~~~~~~~~~~~~~~~
  52. * **BACKWARDS INCOMPATIBLE:** We no longer distribute 32-bit ``manylinux1``
  53. wheels. Continuing to produce them was a maintenance burden.
  54. * **BACKWARDS INCOMPATIBLE:** Removed the
  55. ``cryptography.hazmat.primitives.mac.MACContext`` interface. The ``CMAC`` and
  56. ``HMAC`` APIs have not changed, but they are no longer registered as
  57. ``MACContext`` instances.
  58. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  59. OpenSSL 1.1.1c.
  60. * Removed support for running our tests with ``setup.py test``. Users
  61. interested in running our tests can continue to follow the directions in our
  62. :doc:`development documentation</development/getting-started>`.
  63. * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  64. when using OpenSSL 1.1.1 or newer.
  65. * Support serialization with ``Encoding.OpenSSH`` and ``PublicFormat.OpenSSH``
  66. in
  67. :meth:`Ed25519PublicKey.public_bytes
  68. <cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes>`
  69. .
  70. * Correctly allow passing a ``SubjectKeyIdentifier`` to
  71. :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  72. and deprecate passing an ``Extension`` object. The documentation always
  73. required ``SubjectKeyIdentifier`` but the implementation previously
  74. required an ``Extension``.
  75. .. _v2-6-1:
  76. 2.6.1 - 2019-02-27
  77. ~~~~~~~~~~~~~~~~~~
  78. * Resolved an error in our build infrastructure that broke our Python3 wheels
  79. for macOS and Linux.
  80. .. _v2-6:
  81. 2.6 - 2019-02-27
  82. ~~~~~~~~~~~~~~~~
  83. * **BACKWARDS INCOMPATIBLE:** Removed
  84. ``cryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature``
  85. and
  86. ``cryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature``,
  87. which had been deprecated for nearly 4 years. Use
  88. :func:`~cryptography.hazmat.primitives.asymmetric.utils.encode_dss_signature`
  89. and
  90. :func:`~cryptography.hazmat.primitives.asymmetric.utils.decode_dss_signature`
  91. instead.
  92. * **BACKWARDS INCOMPATIBLE**: Removed ``cryptography.x509.Certificate.serial``,
  93. which had been deprecated for nearly 3 years. Use
  94. :attr:`~cryptography.x509.Certificate.serial_number` instead.
  95. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  96. OpenSSL 1.1.1b.
  97. * Added support for :doc:`/hazmat/primitives/asymmetric/ed448` when using
  98. OpenSSL 1.1.1b or newer.
  99. * Added support for :doc:`/hazmat/primitives/asymmetric/ed25519` when using
  100. OpenSSL 1.1.1b or newer.
  101. * :func:`~cryptography.hazmat.primitives.serialization.load_ssh_public_key` can
  102. now load ``ed25519`` public keys.
  103. * Add support for easily mapping an object identifier to its elliptic curve
  104. class via
  105. :func:`~cryptography.hazmat.primitives.asymmetric.ec.get_curve_for_oid`.
  106. * Add support for OpenSSL when compiled with the ``no-engine``
  107. (``OPENSSL_NO_ENGINE``) flag.
  108. .. _v2-5:
  109. 2.5 - 2019-01-22
  110. ~~~~~~~~~~~~~~~~
  111. * **BACKWARDS INCOMPATIBLE:** :term:`U-label` strings were deprecated in
  112. version 2.1, but this version removes the default ``idna`` dependency as
  113. well. If you still need this deprecated path please install cryptography
  114. with the ``idna`` extra: ``pip install cryptography[idna]``.
  115. * **BACKWARDS INCOMPATIBLE:** The minimum supported PyPy version is now 5.4.
  116. * Numerous classes and functions have been updated to allow :term:`bytes-like`
  117. types for keying material and passwords, including symmetric algorithms, AEAD
  118. ciphers, KDFs, loading asymmetric keys, and one time password classes.
  119. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  120. OpenSSL 1.1.1a.
  121. * Added support for :class:`~cryptography.hazmat.primitives.hashes.SHA512_224`
  122. and :class:`~cryptography.hazmat.primitives.hashes.SHA512_256` when using
  123. OpenSSL 1.1.1.
  124. * Added support for :class:`~cryptography.hazmat.primitives.hashes.SHA3_224`,
  125. :class:`~cryptography.hazmat.primitives.hashes.SHA3_256`,
  126. :class:`~cryptography.hazmat.primitives.hashes.SHA3_384`, and
  127. :class:`~cryptography.hazmat.primitives.hashes.SHA3_512` when using OpenSSL
  128. 1.1.1.
  129. * Added support for :doc:`/hazmat/primitives/asymmetric/x448` when using
  130. OpenSSL 1.1.1.
  131. * Added support for :class:`~cryptography.hazmat.primitives.hashes.SHAKE128`
  132. and :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` when using
  133. OpenSSL 1.1.1.
  134. * Added initial support for parsing PKCS12 files with
  135. :func:`~cryptography.hazmat.primitives.serialization.pkcs12.load_key_and_certificates`.
  136. * Added support for :class:`~cryptography.x509.IssuingDistributionPoint`.
  137. * Added ``rfc4514_string()`` method to
  138. :meth:`x509.Name <cryptography.x509.Name.rfc4514_string>`,
  139. :meth:`x509.RelativeDistinguishedName
  140. <cryptography.x509.RelativeDistinguishedName.rfc4514_string>`, and
  141. :meth:`x509.NameAttribute <cryptography.x509.NameAttribute.rfc4514_string>`
  142. to format the name or component an :rfc:`4514` Distinguished Name string.
  143. * Added
  144. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.from_encoded_point`,
  145. which immediately checks if the point is on the curve and supports compressed
  146. points. Deprecated the previous method
  147. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers.from_encoded_point`.
  148. * Added :attr:`~cryptography.x509.ocsp.OCSPResponse.signature_hash_algorithm`
  149. to ``OCSPResponse``.
  150. * Updated :doc:`/hazmat/primitives/asymmetric/x25519` support to allow
  151. additional serialization methods. Calling
  152. :meth:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PublicKey.public_bytes`
  153. with no arguments has been deprecated.
  154. * Added support for encoding compressed and uncompressed points via
  155. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.public_bytes`. Deprecated the previous method
  156. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers.encode_point`.
  157. .. _v2-4-2:
  158. 2.4.2 - 2018-11-21
  159. ~~~~~~~~~~~~~~~~~~
  160. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  161. OpenSSL 1.1.0j.
  162. .. _v2-4-1:
  163. 2.4.1 - 2018-11-11
  164. ~~~~~~~~~~~~~~~~~~
  165. * Fixed a build breakage in our ``manylinux1`` wheels.
  166. .. _v2-4:
  167. 2.4 - 2018-11-11
  168. ~~~~~~~~~~~~~~~~
  169. * **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL 2.4.x.
  170. * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no longer supported by
  171. the OpenSSL project. At this time there is no time table for dropping
  172. support, however we strongly encourage all users to upgrade or install
  173. ``cryptography`` from a wheel.
  174. * Added initial :doc:`OCSP </x509/ocsp>` support.
  175. * Added support for :class:`~cryptography.x509.PrecertPoison`.
  176. .. _v2-3-1:
  177. 2.3.1 - 2018-08-14
  178. ~~~~~~~~~~~~~~~~~~
  179. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  180. OpenSSL 1.1.0i.
  181. .. _v2-3:
  182. 2.3 - 2018-07-18
  183. ~~~~~~~~~~~~~~~~
  184. * **SECURITY ISSUE:**
  185. :meth:`~cryptography.hazmat.primitives.ciphers.AEADDecryptionContext.finalize_with_tag`
  186. allowed tag truncation by default which can allow tag forgery in some cases.
  187. The method now enforces the ``min_tag_length`` provided to the
  188. :class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` constructor.
  189. *CVE-2018-10903*
  190. * Added support for Python 3.7.
  191. * Added :meth:`~cryptography.fernet.Fernet.extract_timestamp` to get the
  192. authenticated timestamp of a :doc:`Fernet </fernet>` token.
  193. * Support for Python 2.7.x without ``hmac.compare_digest`` has been deprecated.
  194. We will require Python 2.7.7 or higher (or 2.7.6 on Ubuntu) in the next
  195. ``cryptography`` release.
  196. * Fixed multiple issues preventing ``cryptography`` from compiling against
  197. LibreSSL 2.7.x.
  198. * Added
  199. :class:`~cryptography.x509.CertificateRevocationList.get_revoked_certificate_by_serial_number`
  200. for quick serial number searches in CRLs.
  201. * The :class:`~cryptography.x509.RelativeDistinguishedName` class now
  202. preserves the order of attributes. Duplicate attributes now raise an error
  203. instead of silently discarding duplicates.
  204. * :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap` and
  205. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap_with_padding`
  206. now raise :class:`~cryptography.hazmat.primitives.keywrap.InvalidUnwrap` if
  207. the wrapped key is an invalid length, instead of ``ValueError``.
  208. .. _v2-2-2:
  209. 2.2.2 - 2018-03-27
  210. ~~~~~~~~~~~~~~~~~~
  211. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  212. OpenSSL 1.1.0h.
  213. .. _v2-2-1:
  214. 2.2.1 - 2018-03-20
  215. ~~~~~~~~~~~~~~~~~~
  216. * Reverted a change to ``GeneralNames`` which prohibited having zero elements,
  217. due to breakages.
  218. * Fixed a bug in
  219. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap_with_padding`
  220. that caused it to raise ``InvalidUnwrap`` when key length modulo 8 was
  221. zero.
  222. .. _v2-2:
  223. 2.2 - 2018-03-19
  224. ~~~~~~~~~~~~~~~~
  225. * **BACKWARDS INCOMPATIBLE:** Support for Python 2.6 has been dropped.
  226. * Resolved a bug in ``HKDF`` that incorrectly constrained output size.
  227. * Added :class:`~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP256R1`,
  228. :class:`~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP384R1`, and
  229. :class:`~cryptography.hazmat.primitives.asymmetric.ec.BrainpoolP512R1` to
  230. support inter-operating with systems like German smart meters.
  231. * Added token rotation support to :doc:`Fernet </fernet>` with
  232. :meth:`~cryptography.fernet.MultiFernet.rotate`.
  233. * Fixed a memory leak in
  234. :func:`~cryptography.hazmat.primitives.asymmetric.ec.derive_private_key`.
  235. * Added support for AES key wrapping with padding via
  236. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_wrap_with_padding`
  237. and
  238. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap_with_padding`
  239. .
  240. * Allow loading DSA keys with 224 bit ``q``.
  241. .. _v2-1-4:
  242. 2.1.4 - 2017-11-29
  243. ~~~~~~~~~~~~~~~~~~
  244. * Added ``X509_up_ref`` for an upcoming ``pyOpenSSL`` release.
  245. .. _v2-1-3:
  246. 2.1.3 - 2017-11-02
  247. ~~~~~~~~~~~~~~~~~~
  248. * Updated Windows, macOS, and ``manylinux1`` wheels to be compiled with
  249. OpenSSL 1.1.0g.
  250. .. _v2-1-2:
  251. 2.1.2 - 2017-10-24
  252. ~~~~~~~~~~~~~~~~~~
  253. * Corrected a bug with the ``manylinux1`` wheels where OpenSSL's stack was
  254. marked executable.
  255. .. _v2-1-1:
  256. 2.1.1 - 2017-10-12
  257. ~~~~~~~~~~~~~~~~~~
  258. * Fixed support for install with the system ``pip`` on Ubuntu 16.04.
  259. .. _v2-1:
  260. 2.1 - 2017-10-11
  261. ~~~~~~~~~~~~~~~~
  262. * **FINAL DEPRECATION** Python 2.6 support is deprecated, and will be removed
  263. in the next release of ``cryptography``.
  264. * **BACKWARDS INCOMPATIBLE:** ``Whirlpool``, ``RIPEMD160``, and
  265. ``UnsupportedExtension`` have been removed in accordance with our
  266. :doc:`/api-stability` policy.
  267. * **BACKWARDS INCOMPATIBLE:**
  268. :attr:`DNSName.value <cryptography.x509.DNSName.value>`,
  269. :attr:`RFC822Name.value <cryptography.x509.RFC822Name.value>`, and
  270. :attr:`UniformResourceIdentifier.value
  271. <cryptography.x509.UniformResourceIdentifier.value>`
  272. will now return an :term:`A-label` string when parsing a certificate
  273. containing an internationalized domain name (IDN) or if the caller passed
  274. a :term:`U-label` to the constructor. See below for additional deprecations
  275. related to this change.
  276. * Installing ``cryptography`` now requires ``pip`` 6 or newer.
  277. * Deprecated passing :term:`U-label` strings to the
  278. :class:`~cryptography.x509.DNSName`,
  279. :class:`~cryptography.x509.UniformResourceIdentifier`, and
  280. :class:`~cryptography.x509.RFC822Name` constructors. Instead, users should
  281. pass values as :term:`A-label` strings with ``idna`` encoding if necessary.
  282. This change will not affect anyone who is not processing internationalized
  283. domains.
  284. * Added support for
  285. :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20`. In
  286. most cases users should choose
  287. :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaCha20Poly1305`
  288. rather than using this unauthenticated form.
  289. * Added :meth:`~cryptography.x509.CertificateRevocationList.is_signature_valid`
  290. to :class:`~cryptography.x509.CertificateRevocationList`.
  291. * Support :class:`~cryptography.hazmat.primitives.hashes.BLAKE2b` and
  292. :class:`~cryptography.hazmat.primitives.hashes.BLAKE2s` with
  293. :class:`~cryptography.hazmat.primitives.hmac.HMAC`.
  294. * Added support for
  295. :class:`~cryptography.hazmat.primitives.ciphers.modes.XTS` mode for
  296. AES.
  297. * Added support for using labels with
  298. :class:`~cryptography.hazmat.primitives.asymmetric.padding.OAEP` when using
  299. OpenSSL 1.0.2 or greater.
  300. * Improved compatibility with NSS when issuing certificates from an issuer
  301. that has a subject with non-``UTF8String`` string types.
  302. * Add support for the :class:`~cryptography.x509.DeltaCRLIndicator` extension.
  303. * Add support for the :class:`~cryptography.x509.TLSFeature`
  304. extension. This is commonly used for enabling ``OCSP Must-Staple`` in
  305. certificates.
  306. * Add support for the :class:`~cryptography.x509.FreshestCRL` extension.
  307. .. _v2-0-3:
  308. 2.0.3 - 2017-08-03
  309. ~~~~~~~~~~~~~~~~~~
  310. * Fixed an issue with weak linking symbols when compiling on macOS
  311. versions older than 10.12.
  312. .. _v2-0-2:
  313. 2.0.2 - 2017-07-27
  314. ~~~~~~~~~~~~~~~~~~
  315. * Marked all symbols as hidden in the ``manylinux1`` wheel to avoid a
  316. bug with symbol resolution in certain scenarios.
  317. .. _v2-0-1:
  318. 2.0.1 - 2017-07-26
  319. ~~~~~~~~~~~~~~~~~~
  320. * Fixed a compilation bug affecting OpenBSD.
  321. * Altered the ``manylinux1`` wheels to statically link OpenSSL instead of
  322. dynamically linking and bundling the shared object. This should resolve
  323. crashes seen when using ``uwsgi`` or other binaries that link against
  324. OpenSSL independently.
  325. * Fixed the stack level for the ``signer`` and ``verifier`` warnings.
  326. .. _v2-0:
  327. 2.0 - 2017-07-17
  328. ~~~~~~~~~~~~~~~~
  329. * **BACKWARDS INCOMPATIBLE:** Support for Python 3.3 has been dropped.
  330. * We now ship ``manylinux1`` wheels linked against OpenSSL 1.1.0f. These wheels
  331. will be automatically used with most Linux distributions if you are running
  332. the latest pip.
  333. * Deprecated the use of ``signer`` on
  334. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`,
  335. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`,
  336. and
  337. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey`
  338. in favor of ``sign``.
  339. * Deprecated the use of ``verifier`` on
  340. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`,
  341. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey`,
  342. and
  343. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`
  344. in favor of ``verify``.
  345. * Added support for parsing
  346. :class:`~cryptography.x509.certificate_transparency.SignedCertificateTimestamp`
  347. objects from X.509 certificate extensions.
  348. * Added support for
  349. :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaCha20Poly1305`.
  350. * Added support for
  351. :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`.
  352. * Added
  353. :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`, a "one shot"
  354. API for AES GCM encryption.
  355. * Added support for :doc:`/hazmat/primitives/asymmetric/x25519`.
  356. * Added support for serializing and deserializing Diffie-Hellman parameters
  357. with
  358. :func:`~cryptography.hazmat.primitives.serialization.load_pem_parameters`,
  359. :func:`~cryptography.hazmat.primitives.serialization.load_der_parameters`,
  360. and
  361. :meth:`~cryptography.hazmat.primitives.asymmetric.dh.DHParameters.parameter_bytes`
  362. .
  363. * The ``extensions`` attribute on :class:`~cryptography.x509.Certificate`,
  364. :class:`~cryptography.x509.CertificateSigningRequest`,
  365. :class:`~cryptography.x509.CertificateRevocationList`, and
  366. :class:`~cryptography.x509.RevokedCertificate` now caches the computed
  367. ``Extensions`` object. There should be no performance change, just a
  368. performance improvement for programs accessing the ``extensions`` attribute
  369. multiple times.
  370. .. _v1-9:
  371. 1.9 - 2017-05-29
  372. ~~~~~~~~~~~~~~~~
  373. * **BACKWARDS INCOMPATIBLE:** Elliptic Curve signature verification no longer
  374. returns ``True`` on success. This brings it in line with the interface's
  375. documentation, and our intent. The correct way to use
  376. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.verify`
  377. has always been to check whether or not
  378. :class:`~cryptography.exceptions.InvalidSignature` was raised.
  379. * **BACKWARDS INCOMPATIBLE:** Dropped support for macOS 10.7 and 10.8.
  380. * **BACKWARDS INCOMPATIBLE:** The minimum supported PyPy version is now 5.3.
  381. * Python 3.3 support has been deprecated, and will be removed in the next
  382. ``cryptography`` release.
  383. * Add support for providing ``tag`` during
  384. :class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` finalization via
  385. :meth:`~cryptography.hazmat.primitives.ciphers.AEADDecryptionContext.finalize_with_tag`.
  386. * Fixed an issue preventing ``cryptography`` from compiling against
  387. LibreSSL 2.5.x.
  388. * Added
  389. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.key_size`
  390. and
  391. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey.key_size`
  392. as convenience methods for determining the bit size of a secret scalar for
  393. the curve.
  394. * Accessing an unrecognized extension marked critical on an X.509 object will
  395. no longer raise an ``UnsupportedExtension`` exception, instead an
  396. :class:`~cryptography.x509.UnrecognizedExtension` object will be returned.
  397. This behavior was based on a poor reading of the RFC, unknown critical
  398. extensions only need to be rejected on certificate verification.
  399. * The CommonCrypto backend has been removed.
  400. * MultiBackend has been removed.
  401. * ``Whirlpool`` and ``RIPEMD160`` have been deprecated.
  402. .. _v1-8-2:
  403. 1.8.2 - 2017-05-26
  404. ~~~~~~~~~~~~~~~~~~
  405. * Fixed a compilation bug affecting OpenSSL 1.1.0f.
  406. * Updated Windows and macOS wheels to be compiled against OpenSSL 1.1.0f.
  407. .. _v1-8-1:
  408. 1.8.1 - 2017-03-10
  409. ~~~~~~~~~~~~~~~~~~
  410. * Fixed macOS wheels to properly link against 1.1.0 rather than 1.0.2.
  411. .. _v1-8:
  412. 1.8 - 2017-03-09
  413. ~~~~~~~~~~~~~~~~
  414. * Added support for Python 3.6.
  415. * Windows and macOS wheels now link against OpenSSL 1.1.0.
  416. * macOS wheels are no longer universal. This change significantly shrinks the
  417. size of the wheels. Users on macOS 32-bit Python (if there are any) should
  418. migrate to 64-bit or build their own packages.
  419. * Changed ASN.1 dependency from ``pyasn1`` to ``asn1crypto`` resulting in a
  420. general performance increase when encoding/decoding ASN.1 structures. Also,
  421. the ``pyasn1_modules`` test dependency is no longer required.
  422. * Added support for
  423. :meth:`~cryptography.hazmat.primitives.ciphers.CipherContext.update_into` on
  424. :class:`~cryptography.hazmat.primitives.ciphers.CipherContext`.
  425. * Added
  426. :meth:`~cryptography.hazmat.primitives.asymmetric.dh.DHPrivateKeyWithSerialization.private_bytes`
  427. to
  428. :class:`~cryptography.hazmat.primitives.asymmetric.dh.DHPrivateKeyWithSerialization`.
  429. * Added
  430. :meth:`~cryptography.hazmat.primitives.asymmetric.dh.DHPublicKey.public_bytes`
  431. to
  432. :class:`~cryptography.hazmat.primitives.asymmetric.dh.DHPublicKey`.
  433. * :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`
  434. and
  435. :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`
  436. now require that ``password`` must be bytes if provided. Previously this
  437. was documented but not enforced.
  438. * Added support for subgroup order in :doc:`/hazmat/primitives/asymmetric/dh`.
  439. .. _v1-7-2:
  440. 1.7.2 - 2017-01-27
  441. ~~~~~~~~~~~~~~~~~~
  442. * Updated Windows and macOS wheels to be compiled against OpenSSL 1.0.2k.
  443. .. _v1-7-1:
  444. 1.7.1 - 2016-12-13
  445. ~~~~~~~~~~~~~~~~~~
  446. * Fixed a regression in ``int_from_bytes`` where it failed to accept
  447. ``bytearray``.
  448. .. _v1-7:
  449. 1.7 - 2016-12-12
  450. ~~~~~~~~~~~~~~~~
  451. * Support for OpenSSL 1.0.0 has been removed. Users on older version of OpenSSL
  452. will need to upgrade.
  453. * Added support for Diffie-Hellman key exchange using
  454. :meth:`~cryptography.hazmat.primitives.asymmetric.dh.DHPrivateKey.exchange`.
  455. * The OS random engine for OpenSSL has been rewritten to improve compatibility
  456. with embedded Python and other edge cases. More information about this change
  457. can be found in the
  458. `pull request <https://github.com/pyca/cryptography/pull/3229>`_.
  459. .. _v1-6:
  460. 1.6 - 2016-11-22
  461. ~~~~~~~~~~~~~~~~
  462. * Deprecated support for OpenSSL 1.0.0. Support will be removed in
  463. ``cryptography`` 1.7.
  464. * Replaced the Python-based OpenSSL locking callbacks with a C version to fix
  465. a potential deadlock that could occur if a garbage collection cycle occurred
  466. while inside the lock.
  467. * Added support for :class:`~cryptography.hazmat.primitives.hashes.BLAKE2b` and
  468. :class:`~cryptography.hazmat.primitives.hashes.BLAKE2s` when using OpenSSL
  469. 1.1.0.
  470. * Added
  471. :attr:`~cryptography.x509.Certificate.signature_algorithm_oid` support to
  472. :class:`~cryptography.x509.Certificate`.
  473. * Added
  474. :attr:`~cryptography.x509.CertificateSigningRequest.signature_algorithm_oid`
  475. support to :class:`~cryptography.x509.CertificateSigningRequest`.
  476. * Added
  477. :attr:`~cryptography.x509.CertificateRevocationList.signature_algorithm_oid`
  478. support to :class:`~cryptography.x509.CertificateRevocationList`.
  479. * Added support for :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`
  480. when using OpenSSL 1.1.0.
  481. * Added a workaround to improve compatibility with Python application bundling
  482. tools like ``PyInstaller`` and ``cx_freeze``.
  483. * Added support for generating a
  484. :meth:`~cryptography.x509.random_serial_number`.
  485. * Added support for encoding ``IPv4Network`` and ``IPv6Network`` in X.509
  486. certificates for use with :class:`~cryptography.x509.NameConstraints`.
  487. * Added :meth:`~cryptography.x509.Name.public_bytes` to
  488. :class:`~cryptography.x509.Name`.
  489. * Added :class:`~cryptography.x509.RelativeDistinguishedName`
  490. * :class:`~cryptography.x509.DistributionPoint` now accepts
  491. :class:`~cryptography.x509.RelativeDistinguishedName` for
  492. :attr:`~cryptography.x509.DistributionPoint.relative_name`.
  493. Deprecated use of :class:`~cryptography.x509.Name` as
  494. :attr:`~cryptography.x509.DistributionPoint.relative_name`.
  495. * :class:`~cryptography.x509.Name` now accepts an iterable of
  496. :class:`~cryptography.x509.RelativeDistinguishedName`. RDNs can
  497. be accessed via the :attr:`~cryptography.x509.Name.rdns`
  498. attribute. When constructed with an iterable of
  499. :class:`~cryptography.x509.NameAttribute`, each attribute becomes
  500. a single-valued RDN.
  501. * Added
  502. :func:`~cryptography.hazmat.primitives.asymmetric.ec.derive_private_key`.
  503. * Added support for signing and verifying RSA, DSA, and ECDSA signatures with
  504. :class:`~cryptography.hazmat.primitives.asymmetric.utils.Prehashed`
  505. digests.
  506. .. _v1-5-3:
  507. 1.5.3 - 2016-11-05
  508. ~~~~~~~~~~~~~~~~~~
  509. * **SECURITY ISSUE**: Fixed a bug where ``HKDF`` would return an empty
  510. byte-string if used with a ``length`` less than ``algorithm.digest_size``.
  511. Credit to **Markus Döring** for reporting the issue. *CVE-2016-9243*
  512. .. _v1-5-2:
  513. 1.5.2 - 2016-09-26
  514. ~~~~~~~~~~~~~~~~~~
  515. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2j.
  516. .. _v1-5-1:
  517. 1.5.1 - 2016-09-22
  518. ~~~~~~~~~~~~~~~~~~
  519. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2i.
  520. * Resolved a ``UserWarning`` when used with cffi 1.8.3.
  521. * Fixed a memory leak in name creation with X.509.
  522. * Added a workaround for old versions of setuptools.
  523. * Fixed an issue preventing ``cryptography`` from compiling against
  524. OpenSSL 1.0.2i.
  525. .. _v1-5:
  526. 1.5 - 2016-08-26
  527. ~~~~~~~~~~~~~~~~
  528. * Added
  529. :func:`~cryptography.hazmat.primitives.asymmetric.padding.calculate_max_pss_salt_length`.
  530. * Added "one shot"
  531. :meth:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey.sign`
  532. and
  533. :meth:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey.verify`
  534. methods to DSA keys.
  535. * Added "one shot"
  536. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey.sign`
  537. and
  538. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey.verify`
  539. methods to ECDSA keys.
  540. * Switched back to the older callback model on Python 3.5 in order to mitigate
  541. the locking callback problem with OpenSSL <1.1.0.
  542. * :class:`~cryptography.x509.CertificateBuilder`,
  543. :class:`~cryptography.x509.CertificateRevocationListBuilder`, and
  544. :class:`~cryptography.x509.RevokedCertificateBuilder` now accept timezone
  545. aware ``datetime`` objects as method arguments
  546. * ``cryptography`` now supports OpenSSL 1.1.0 as a compilation target.
  547. .. _v1-4:
  548. 1.4 - 2016-06-04
  549. ~~~~~~~~~~~~~~~~
  550. * Support for OpenSSL 0.9.8 has been removed. Users on older versions of
  551. OpenSSL will need to upgrade.
  552. * Added :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`.
  553. * Added support for ``OpenSSH`` public key serialization.
  554. * Added support for SHA-2 in RSA
  555. :class:`~cryptography.hazmat.primitives.asymmetric.padding.OAEP` when using
  556. OpenSSL 1.0.2 or greater.
  557. * Added "one shot"
  558. :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey.sign`
  559. and
  560. :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey.verify`
  561. methods to RSA keys.
  562. * Deprecated the ``serial`` attribute on
  563. :class:`~cryptography.x509.Certificate`, in favor of
  564. :attr:`~cryptography.x509.Certificate.serial_number`.
  565. .. _v1-3-4:
  566. 1.3.4 - 2016-06-03
  567. ~~~~~~~~~~~~~~~~~~
  568. * Added another OpenSSL function to the bindings to support an upcoming
  569. ``pyOpenSSL`` release.
  570. .. _v1-3-3:
  571. 1.3.3 - 2016-06-02
  572. ~~~~~~~~~~~~~~~~~~
  573. * Added two new OpenSSL functions to the bindings to support an upcoming
  574. ``pyOpenSSL`` release.
  575. .. _v1-3-2:
  576. 1.3.2 - 2016-05-04
  577. ~~~~~~~~~~~~~~~~~~
  578. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2h.
  579. * Fixed an issue preventing ``cryptography`` from compiling against
  580. LibreSSL 2.3.x.
  581. .. _v1-3-1:
  582. 1.3.1 - 2016-03-21
  583. ~~~~~~~~~~~~~~~~~~
  584. * Fixed a bug that caused an ``AttributeError`` when using ``mock`` to patch
  585. some ``cryptography`` modules.
  586. .. _v1-3:
  587. 1.3 - 2016-03-18
  588. ~~~~~~~~~~~~~~~~
  589. * Added support for padding ANSI X.923 with
  590. :class:`~cryptography.hazmat.primitives.padding.ANSIX923`.
  591. * Deprecated support for OpenSSL 0.9.8. Support will be removed in
  592. ``cryptography`` 1.4.
  593. * Added support for the :class:`~cryptography.x509.PolicyConstraints`
  594. X.509 extension including both parsing and generation using
  595. :class:`~cryptography.x509.CertificateBuilder` and
  596. :class:`~cryptography.x509.CertificateSigningRequestBuilder`.
  597. * Added :attr:`~cryptography.x509.CertificateSigningRequest.is_signature_valid`
  598. to :class:`~cryptography.x509.CertificateSigningRequest`.
  599. * Fixed an intermittent ``AssertionError`` when performing an RSA decryption on
  600. an invalid ciphertext, ``ValueError`` is now correctly raised in all cases.
  601. * Added
  602. :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`.
  603. .. _v1-2-3:
  604. 1.2.3 - 2016-03-01
  605. ~~~~~~~~~~~~~~~~~~
  606. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2g.
  607. .. _v1-2-2:
  608. 1.2.2 - 2016-01-29
  609. ~~~~~~~~~~~~~~~~~~
  610. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2f.
  611. .. _v1-2-1:
  612. 1.2.1 - 2016-01-08
  613. ~~~~~~~~~~~~~~~~~~
  614. * Reverts a change to an OpenSSL ``EVP_PKEY`` object that caused errors with
  615. ``pyOpenSSL``.
  616. .. _v1-2:
  617. 1.2 - 2016-01-08
  618. ~~~~~~~~~~~~~~~~
  619. * **BACKWARDS INCOMPATIBLE:**
  620. :class:`~cryptography.x509.RevokedCertificate`
  621. :attr:`~cryptography.x509.RevokedCertificate.extensions` now uses extension
  622. classes rather than returning raw values inside the
  623. :class:`~cryptography.x509.Extension`
  624. :attr:`~cryptography.x509.Extension.value`. The new classes
  625. are:
  626. * :class:`~cryptography.x509.CertificateIssuer`
  627. * :class:`~cryptography.x509.CRLReason`
  628. * :class:`~cryptography.x509.InvalidityDate`
  629. * Deprecated support for OpenSSL 0.9.8 and 1.0.0. At this time there is no time
  630. table for actually dropping support, however we strongly encourage all users
  631. to upgrade, as those versions no longer receive support from the OpenSSL
  632. project.
  633. * The :class:`~cryptography.x509.Certificate` class now has
  634. :attr:`~cryptography.x509.Certificate.signature` and
  635. :attr:`~cryptography.x509.Certificate.tbs_certificate_bytes` attributes.
  636. * The :class:`~cryptography.x509.CertificateSigningRequest` class now has
  637. :attr:`~cryptography.x509.CertificateSigningRequest.signature` and
  638. :attr:`~cryptography.x509.CertificateSigningRequest.tbs_certrequest_bytes`
  639. attributes.
  640. * The :class:`~cryptography.x509.CertificateRevocationList` class now has
  641. :attr:`~cryptography.x509.CertificateRevocationList.signature` and
  642. :attr:`~cryptography.x509.CertificateRevocationList.tbs_certlist_bytes`
  643. attributes.
  644. * :class:`~cryptography.x509.NameConstraints` are now supported in the
  645. :class:`~cryptography.x509.CertificateBuilder` and
  646. :class:`~cryptography.x509.CertificateSigningRequestBuilder`.
  647. * Support serialization of certificate revocation lists using the
  648. :meth:`~cryptography.x509.CertificateRevocationList.public_bytes` method of
  649. :class:`~cryptography.x509.CertificateRevocationList`.
  650. * Add support for parsing :class:`~cryptography.x509.CertificateRevocationList`
  651. :meth:`~cryptography.x509.CertificateRevocationList.extensions` in the
  652. OpenSSL backend. The following extensions are currently supported:
  653. * :class:`~cryptography.x509.AuthorityInformationAccess`
  654. * :class:`~cryptography.x509.AuthorityKeyIdentifier`
  655. * :class:`~cryptography.x509.CRLNumber`
  656. * :class:`~cryptography.x509.IssuerAlternativeName`
  657. * Added :class:`~cryptography.x509.CertificateRevocationListBuilder` and
  658. :class:`~cryptography.x509.RevokedCertificateBuilder` to allow creation of
  659. CRLs.
  660. * Unrecognized non-critical X.509 extensions are now parsed into an
  661. :class:`~cryptography.x509.UnrecognizedExtension` object.
  662. .. _v1-1-2:
  663. 1.1.2 - 2015-12-10
  664. ~~~~~~~~~~~~~~~~~~
  665. * Fixed a SIGBUS crash with the OS X wheels caused by redefinition of a
  666. method.
  667. * Fixed a runtime error ``undefined symbol EC_GFp_nistp224_method`` that
  668. occurred with some OpenSSL installations.
  669. * Updated Windows and OS X wheels to be compiled against OpenSSL 1.0.2e.
  670. .. _v1-1-1:
  671. 1.1.1 - 2015-11-19
  672. ~~~~~~~~~~~~~~~~~~
  673. * Fixed several small bugs related to compiling the OpenSSL bindings with
  674. unusual OpenSSL configurations.
  675. * Resolved an issue where, depending on the method of installation and
  676. which Python interpreter they were using, users on El Capitan (OS X 10.11)
  677. may have seen an ``InternalError`` on import.
  678. .. _v1-1:
  679. 1.1 - 2015-10-28
  680. ~~~~~~~~~~~~~~~~
  681. * Added support for Elliptic Curve Diffie-Hellman with
  682. :class:`~cryptography.hazmat.primitives.asymmetric.ec.ECDH`.
  683. * Added :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`.
  684. * Added support for parsing certificate revocation lists (CRLs) using
  685. :func:`~cryptography.x509.load_pem_x509_crl` and
  686. :func:`~cryptography.x509.load_der_x509_crl`.
  687. * Add support for AES key wrapping with
  688. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_wrap` and
  689. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap`.
  690. * Added a ``__hash__`` method to :class:`~cryptography.x509.Name`.
  691. * Add support for encoding and decoding elliptic curve points to a byte string
  692. form using
  693. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers.encode_point`
  694. and
  695. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers.from_encoded_point`.
  696. * Added :meth:`~cryptography.x509.Extensions.get_extension_for_class`.
  697. * :class:`~cryptography.x509.CertificatePolicies` are now supported in the
  698. :class:`~cryptography.x509.CertificateBuilder`.
  699. * ``countryName`` is now encoded as a ``PrintableString`` when creating subject
  700. and issuer distinguished names with the Certificate and CSR builder classes.
  701. .. _v1-0-2:
  702. 1.0.2 - 2015-09-27
  703. ~~~~~~~~~~~~~~~~~~
  704. * **SECURITY ISSUE**: The OpenSSL backend prior to 1.0.2 made extensive use
  705. of assertions to check response codes where our tests could not trigger a
  706. failure. However, when Python is run with ``-O`` these asserts are optimized
  707. away. If a user ran Python with this flag and got an invalid response code
  708. this could result in undefined behavior or worse. Accordingly, all response
  709. checks from the OpenSSL backend have been converted from ``assert``
  710. to a true function call. Credit **Emilia Käsper (Google Security Team)**
  711. for the report.
  712. .. _v1-0-1:
  713. 1.0.1 - 2015-09-05
  714. ~~~~~~~~~~~~~~~~~~
  715. * We now ship OS X wheels that statically link OpenSSL by default. When
  716. installing a wheel on OS X 10.10+ (and using a Python compiled against the
  717. 10.10 SDK) users will no longer need to compile. See :doc:`/installation` for
  718. alternate installation methods if required.
  719. * Set the default string mask to UTF-8 in the OpenSSL backend to resolve
  720. character encoding issues with older versions of OpenSSL.
  721. * Several new OpenSSL bindings have been added to support a future pyOpenSSL
  722. release.
  723. * Raise an error during install on PyPy < 2.6. 1.0+ requires PyPy 2.6+.
  724. .. _v1-0:
  725. 1.0 - 2015-08-12
  726. ~~~~~~~~~~~~~~~~
  727. * Switched to the new `cffi`_ ``set_source`` out-of-line API mode for
  728. compilation. This results in significantly faster imports and lowered
  729. memory consumption. Due to this change we no longer support PyPy releases
  730. older than 2.6 nor do we support any released version of PyPy3 (until a
  731. version supporting cffi 1.0 comes out).
  732. * Fix parsing of OpenSSH public keys that have spaces in comments.
  733. * Support serialization of certificate signing requests using the
  734. ``public_bytes`` method of
  735. :class:`~cryptography.x509.CertificateSigningRequest`.
  736. * Support serialization of certificates using the ``public_bytes`` method of
  737. :class:`~cryptography.x509.Certificate`.
  738. * Add ``get_provisioning_uri`` method to
  739. :class:`~cryptography.hazmat.primitives.twofactor.hotp.HOTP` and
  740. :class:`~cryptography.hazmat.primitives.twofactor.totp.TOTP` for generating
  741. provisioning URIs.
  742. * Add :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatKDFHash`
  743. and :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatKDFHMAC`.
  744. * Raise a ``TypeError`` when passing objects that are not text as the value to
  745. :class:`~cryptography.x509.NameAttribute`.
  746. * Add support for :class:`~cryptography.x509.OtherName` as a general name
  747. type.
  748. * Added new X.509 extension support in :class:`~cryptography.x509.Certificate`
  749. The following new extensions are now supported:
  750. * :class:`~cryptography.x509.OCSPNoCheck`
  751. * :class:`~cryptography.x509.InhibitAnyPolicy`
  752. * :class:`~cryptography.x509.IssuerAlternativeName`
  753. * :class:`~cryptography.x509.NameConstraints`
  754. * Extension support was added to
  755. :class:`~cryptography.x509.CertificateSigningRequest`.
  756. * Add support for creating signed certificates with
  757. :class:`~cryptography.x509.CertificateBuilder`. This includes support for
  758. the following extensions:
  759. * :class:`~cryptography.x509.BasicConstraints`
  760. * :class:`~cryptography.x509.SubjectAlternativeName`
  761. * :class:`~cryptography.x509.KeyUsage`
  762. * :class:`~cryptography.x509.ExtendedKeyUsage`
  763. * :class:`~cryptography.x509.SubjectKeyIdentifier`
  764. * :class:`~cryptography.x509.AuthorityKeyIdentifier`
  765. * :class:`~cryptography.x509.AuthorityInformationAccess`
  766. * :class:`~cryptography.x509.CRLDistributionPoints`
  767. * :class:`~cryptography.x509.InhibitAnyPolicy`
  768. * :class:`~cryptography.x509.IssuerAlternativeName`
  769. * :class:`~cryptography.x509.OCSPNoCheck`
  770. * Add support for creating certificate signing requests with
  771. :class:`~cryptography.x509.CertificateSigningRequestBuilder`. This includes
  772. support for the same extensions supported in the ``CertificateBuilder``.
  773. * Deprecate ``encode_rfc6979_signature`` and ``decode_rfc6979_signature`` in
  774. favor of
  775. :func:`~cryptography.hazmat.primitives.asymmetric.utils.encode_dss_signature`
  776. and
  777. :func:`~cryptography.hazmat.primitives.asymmetric.utils.decode_dss_signature`.
  778. .. _v0-9-3:
  779. 0.9.3 - 2015-07-09
  780. ~~~~~~~~~~~~~~~~~~
  781. * Updated Windows wheels to be compiled against OpenSSL 1.0.2d.
  782. .. _v0-9-2:
  783. 0.9.2 - 2015-07-04
  784. ~~~~~~~~~~~~~~~~~~
  785. * Updated Windows wheels to be compiled against OpenSSL 1.0.2c.
  786. .. _v0-9-1:
  787. 0.9.1 - 2015-06-06
  788. ~~~~~~~~~~~~~~~~~~
  789. * **SECURITY ISSUE**: Fixed a double free in the OpenSSL backend when using DSA
  790. to verify signatures. Note that this only affects PyPy 2.6.0 and (presently
  791. unreleased) CFFI versions greater than 1.1.0.
  792. .. _v0-9:
  793. 0.9 - 2015-05-13
  794. ~~~~~~~~~~~~~~~~
  795. * Removed support for Python 3.2. This version of Python is rarely used
  796. and caused support headaches. Users affected by this should upgrade to 3.3+.
  797. * Deprecated support for Python 2.6. At the time there is no time table for
  798. actually dropping support, however we strongly encourage all users to upgrade
  799. their Python, as Python 2.6 no longer receives support from the Python core
  800. team.
  801. * Add support for the
  802. :class:`~cryptography.hazmat.primitives.asymmetric.ec.SECP256K1` elliptic
  803. curve.
  804. * Fixed compilation when using an OpenSSL which was compiled with the
  805. ``no-comp`` (``OPENSSL_NO_COMP``) option.
  806. * Support :attr:`~cryptography.hazmat.primitives.serialization.Encoding.DER`
  807. serialization of public keys using the ``public_bytes`` method of
  808. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKeyWithSerialization`,
  809. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKeyWithSerialization`,
  810. and
  811. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKeyWithSerialization`.
  812. * Support :attr:`~cryptography.hazmat.primitives.serialization.Encoding.DER`
  813. serialization of private keys using the ``private_bytes`` method of
  814. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization`,
  815. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization`,
  816. and
  817. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization`.
  818. * Add support for parsing X.509 certificate signing requests (CSRs) with
  819. :func:`~cryptography.x509.load_pem_x509_csr` and
  820. :func:`~cryptography.x509.load_der_x509_csr`.
  821. * Moved ``cryptography.exceptions.InvalidToken`` to
  822. :class:`cryptography.hazmat.primitives.twofactor.InvalidToken` and deprecated
  823. the old location. This was moved to minimize confusion between this exception
  824. and :class:`cryptography.fernet.InvalidToken`.
  825. * Added support for X.509 extensions in :class:`~cryptography.x509.Certificate`
  826. objects. The following extensions are supported as of this release:
  827. * :class:`~cryptography.x509.BasicConstraints`
  828. * :class:`~cryptography.x509.AuthorityKeyIdentifier`
  829. * :class:`~cryptography.x509.SubjectKeyIdentifier`
  830. * :class:`~cryptography.x509.KeyUsage`
  831. * :class:`~cryptography.x509.SubjectAlternativeName`
  832. * :class:`~cryptography.x509.ExtendedKeyUsage`
  833. * :class:`~cryptography.x509.CRLDistributionPoints`
  834. * :class:`~cryptography.x509.AuthorityInformationAccess`
  835. * :class:`~cryptography.x509.CertificatePolicies`
  836. Note that unsupported extensions with the critical flag raise
  837. ``UnsupportedExtension`` while unsupported extensions set to non-critical are
  838. silently ignored. Read the :doc:`X.509 documentation</x509/index>` for more
  839. information.
  840. .. _v0-8-2:
  841. 0.8.2 - 2015-04-10
  842. ~~~~~~~~~~~~~~~~~~
  843. * Fixed a race condition when initializing the OpenSSL or CommonCrypto backends
  844. in a multi-threaded scenario.
  845. .. _v0-8-1:
  846. 0.8.1 - 2015-03-20
  847. ~~~~~~~~~~~~~~~~~~
  848. * Updated Windows wheels to be compiled against OpenSSL 1.0.2a.
  849. .. _v0-8:
  850. 0.8 - 2015-03-08
  851. ~~~~~~~~~~~~~~~~
  852. * :func:`~cryptography.hazmat.primitives.serialization.load_ssh_public_key` can
  853. now load elliptic curve public keys.
  854. * Added
  855. :attr:`~cryptography.x509.Certificate.signature_hash_algorithm` support to
  856. :class:`~cryptography.x509.Certificate`.
  857. * Added
  858. :func:`~cryptography.hazmat.primitives.asymmetric.rsa.rsa_recover_prime_factors`
  859. * :class:`~cryptography.hazmat.primitives.kdf.KeyDerivationFunction` was moved
  860. from ``cryptography.hazmat.primitives.interfaces`` to
  861. :mod:`~cryptography.hazmat.primitives.kdf`.
  862. * Added support for parsing X.509 names. See the
  863. :doc:`X.509 documentation</x509/index>` for more information.
  864. * Added
  865. :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key` to
  866. support loading of DER encoded private keys and
  867. :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key` to
  868. support loading DER encoded public keys.
  869. * Fixed building against LibreSSL, a compile-time substitute for OpenSSL.
  870. * FreeBSD 9.2 was removed from the continuous integration system.
  871. * Updated Windows wheels to be compiled against OpenSSL 1.0.2.
  872. * :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`
  873. and :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`
  874. now support PKCS1 RSA public keys (in addition to the previous support for
  875. SubjectPublicKeyInfo format for RSA, EC, and DSA).
  876. * Added
  877. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization`
  878. and deprecated ``EllipticCurvePrivateKeyWithNumbers``.
  879. * Added
  880. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization.private_bytes`
  881. to
  882. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization`.
  883. * Added
  884. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization`
  885. and deprecated ``RSAPrivateKeyWithNumbers``.
  886. * Added
  887. :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization.private_bytes`
  888. to
  889. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization`.
  890. * Added
  891. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization`
  892. and deprecated ``DSAPrivateKeyWithNumbers``.
  893. * Added
  894. :meth:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization.private_bytes`
  895. to
  896. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization`.
  897. * Added
  898. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKeyWithSerialization`
  899. and deprecated ``RSAPublicKeyWithNumbers``.
  900. * Added ``public_bytes`` to
  901. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKeyWithSerialization`.
  902. * Added
  903. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKeyWithSerialization`
  904. and deprecated ``EllipticCurvePublicKeyWithNumbers``.
  905. * Added ``public_bytes`` to
  906. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKeyWithSerialization`.
  907. * Added
  908. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKeyWithSerialization`
  909. and deprecated ``DSAPublicKeyWithNumbers``.
  910. * Added ``public_bytes`` to
  911. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKeyWithSerialization`.
  912. * :class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm` and
  913. :class:`~cryptography.hazmat.primitives.hashes.HashContext` were moved from
  914. ``cryptography.hazmat.primitives.interfaces`` to
  915. :mod:`~cryptography.hazmat.primitives.hashes`.
  916. * :class:`~cryptography.hazmat.primitives.ciphers.CipherContext`,
  917. :class:`~cryptography.hazmat.primitives.ciphers.AEADCipherContext`,
  918. :class:`~cryptography.hazmat.primitives.ciphers.AEADEncryptionContext`,
  919. :class:`~cryptography.hazmat.primitives.ciphers.CipherAlgorithm`, and
  920. :class:`~cryptography.hazmat.primitives.ciphers.BlockCipherAlgorithm`
  921. were moved from ``cryptography.hazmat.primitives.interfaces`` to
  922. :mod:`~cryptography.hazmat.primitives.ciphers`.
  923. * :class:`~cryptography.hazmat.primitives.ciphers.modes.Mode`,
  924. :class:`~cryptography.hazmat.primitives.ciphers.modes.ModeWithInitializationVector`,
  925. :class:`~cryptography.hazmat.primitives.ciphers.modes.ModeWithNonce`, and
  926. :class:`~cryptography.hazmat.primitives.ciphers.modes.ModeWithAuthenticationTag`
  927. were moved from ``cryptography.hazmat.primitives.interfaces`` to
  928. :mod:`~cryptography.hazmat.primitives.ciphers.modes`.
  929. * :class:`~cryptography.hazmat.primitives.padding.PaddingContext` was moved
  930. from ``cryptography.hazmat.primitives.interfaces`` to
  931. :mod:`~cryptography.hazmat.primitives.padding`.
  932. *
  933. :class:`~cryptography.hazmat.primitives.asymmetric.padding.AsymmetricPadding`
  934. was moved from ``cryptography.hazmat.primitives.interfaces`` to
  935. :mod:`~cryptography.hazmat.primitives.asymmetric.padding`.
  936. * ``AsymmetricSignatureContext`` and ``AsymmetricVerificationContext``
  937. were moved from ``cryptography.hazmat.primitives.interfaces`` to
  938. ``cryptography.hazmat.primitives.asymmetric``.
  939. * :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAParameters`,
  940. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAParametersWithNumbers`,
  941. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`,
  942. ``DSAPrivateKeyWithNumbers``,
  943. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey` and
  944. ``DSAPublicKeyWithNumbers`` were moved from
  945. ``cryptography.hazmat.primitives.interfaces`` to
  946. :mod:`~cryptography.hazmat.primitives.asymmetric.dsa`
  947. * :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurve`,
  948. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveSignatureAlgorithm`,
  949. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey`,
  950. ``EllipticCurvePrivateKeyWithNumbers``,
  951. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`,
  952. and ``EllipticCurvePublicKeyWithNumbers``
  953. were moved from ``cryptography.hazmat.primitives.interfaces`` to
  954. :mod:`~cryptography.hazmat.primitives.asymmetric.ec`.
  955. * :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`,
  956. ``RSAPrivateKeyWithNumbers``,
  957. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey` and
  958. ``RSAPublicKeyWithNumbers`` were moved from
  959. ``cryptography.hazmat.primitives.interfaces`` to
  960. :mod:`~cryptography.hazmat.primitives.asymmetric.rsa`.
  961. .. _v0-7-2:
  962. 0.7.2 - 2015-01-16
  963. ~~~~~~~~~~~~~~~~~~
  964. * Updated Windows wheels to be compiled against OpenSSL 1.0.1l.
  965. * ``enum34`` is no longer installed on Python 3.4, where it is included in
  966. the standard library.
  967. * Added a new function to the OpenSSL bindings to support additional
  968. functionality in pyOpenSSL.
  969. .. _v0-7-1:
  970. 0.7.1 - 2014-12-28
  971. ~~~~~~~~~~~~~~~~~~
  972. * Fixed an issue preventing compilation on platforms where ``OPENSSL_NO_SSL3``
  973. was defined.
  974. .. _v0-7:
  975. 0.7 - 2014-12-17
  976. ~~~~~~~~~~~~~~~~
  977. * Cryptography has been relicensed from the Apache Software License, Version
  978. 2.0, to being available under *either* the Apache Software License, Version
  979. 2.0, or the BSD license.
  980. * Added key-rotation support to :doc:`Fernet </fernet>` with
  981. :class:`~cryptography.fernet.MultiFernet`.
  982. * More bit-lengths are now supported for ``p`` and ``q`` when loading DSA keys
  983. from numbers.
  984. * Added ``MACContext`` as a common interface for CMAC and HMAC and
  985. deprecated ``CMACContext``.
  986. * Added support for encoding and decoding :rfc:`6979` signatures in
  987. :doc:`/hazmat/primitives/asymmetric/utils`.
  988. * Added
  989. :func:`~cryptography.hazmat.primitives.serialization.load_ssh_public_key` to
  990. support the loading of OpenSSH public keys (:rfc:`4253`). Only RSA and DSA
  991. keys are currently supported.
  992. * Added initial support for X.509 certificate parsing. See the
  993. :doc:`X.509 documentation</x509/index>` for more information.
  994. .. _v0-6-1:
  995. 0.6.1 - 2014-10-15
  996. ~~~~~~~~~~~~~~~~~~
  997. * Updated Windows wheels to be compiled against OpenSSL 1.0.1j.
  998. * Fixed an issue where OpenSSL 1.0.1j changed the errors returned by some
  999. functions.
  1000. * Added our license file to the ``cryptography-vectors`` package.
  1001. * Implemented DSA hash truncation support (per FIPS 186-3) in the OpenSSL
  1002. backend. This works around an issue in 1.0.0, 1.0.0a, and 1.0.0b where
  1003. truncation was not implemented.
  1004. .. _v0-6:
  1005. 0.6 - 2014-09-29
  1006. ~~~~~~~~~~~~~~~~
  1007. * Added
  1008. :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key` to
  1009. ease loading private keys, and
  1010. :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key` to
  1011. support loading public keys.
  1012. * Removed the, deprecated in 0.4, support for the ``salt_length`` argument to
  1013. the :class:`~cryptography.hazmat.primitives.asymmetric.padding.MGF1`
  1014. constructor. The ``salt_length`` should be passed to
  1015. :class:`~cryptography.hazmat.primitives.asymmetric.padding.PSS` instead.
  1016. * Fix compilation on OS X Yosemite.
  1017. * Deprecated ``elliptic_curve_private_key_from_numbers`` and
  1018. ``elliptic_curve_public_key_from_numbers`` in favor of
  1019. ``load_elliptic_curve_private_numbers`` and
  1020. ``load_elliptic_curve_public_numbers`` on
  1021. :class:`~cryptography.hazmat.backends.interfaces.EllipticCurveBackend`.
  1022. * Added ``EllipticCurvePrivateKeyWithNumbers`` and
  1023. ``EllipticCurvePublicKeyWithNumbers`` support.
  1024. * Work around three GCM related bugs in CommonCrypto and OpenSSL.
  1025. * On the CommonCrypto backend adding AAD but not subsequently calling update
  1026. would return null tag bytes.
  1027. * One the CommonCrypto backend a call to update without an empty add AAD call
  1028. would return null ciphertext bytes.
  1029. * On the OpenSSL backend with certain versions adding AAD only would give
  1030. invalid tag bytes.
  1031. * Support loading EC private keys from PEM.
  1032. .. _v0-5-4:
  1033. 0.5.4 - 2014-08-20
  1034. ~~~~~~~~~~~~~~~~~~
  1035. * Added several functions to the OpenSSL bindings to support new
  1036. functionality in pyOpenSSL.
  1037. * Fixed a redefined constant causing compilation failure with Solaris 11.2.
  1038. .. _v0-5-3:
  1039. 0.5.3 - 2014-08-06
  1040. ~~~~~~~~~~~~~~~~~~
  1041. * Updated Windows wheels to be compiled against OpenSSL 1.0.1i.
  1042. .. _v0-5-2:
  1043. 0.5.2 - 2014-07-09
  1044. ~~~~~~~~~~~~~~~~~~
  1045. * Add ``TraditionalOpenSSLSerializationBackend`` support to ``multibackend``.
  1046. * Fix compilation error on OS X 10.8 (Mountain Lion).
  1047. .. _v0-5-1:
  1048. 0.5.1 - 2014-07-07
  1049. ~~~~~~~~~~~~~~~~~~
  1050. * Add ``PKCS8SerializationBackend`` support to ``multibackend``.
  1051. .. _v0-5:
  1052. 0.5 - 2014-07-07
  1053. ~~~~~~~~~~~~~~~~
  1054. * **BACKWARDS INCOMPATIBLE:**
  1055. :class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` no longer allows
  1056. truncation of tags by default. Previous versions of ``cryptography`` allowed
  1057. tags to be truncated by default, applications wishing to preserve this
  1058. behavior (not recommended) can pass the ``min_tag_length`` argument.
  1059. * Windows builds now statically link OpenSSL by default. When installing a
  1060. wheel on Windows you no longer need to install OpenSSL separately. Windows
  1061. users can switch between static and dynamic linking with an environment
  1062. variable. See :doc:`/installation` for more details.
  1063. * Added :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`.
  1064. * Added :class:`~cryptography.hazmat.primitives.ciphers.modes.CFB8` support
  1065. for :class:`~cryptography.hazmat.primitives.ciphers.algorithms.AES` and
  1066. :class:`~cryptography.hazmat.primitives.ciphers.algorithms.TripleDES` on
  1067. ``commoncrypto`` and :doc:`/hazmat/backends/openssl`.
  1068. * Added ``AES`` :class:`~cryptography.hazmat.primitives.ciphers.modes.CTR`
  1069. support to the OpenSSL backend when linked against 0.9.8.
  1070. * Added ``PKCS8SerializationBackend`` and
  1071. ``TraditionalOpenSSLSerializationBackend`` support to the
  1072. :doc:`/hazmat/backends/openssl`.
  1073. * Added :doc:`/hazmat/primitives/asymmetric/ec` and
  1074. :class:`~cryptography.hazmat.backends.interfaces.EllipticCurveBackend`.
  1075. * Added :class:`~cryptography.hazmat.primitives.ciphers.modes.ECB` support
  1076. for :class:`~cryptography.hazmat.primitives.ciphers.algorithms.TripleDES` on
  1077. ``commoncrypto`` and :doc:`/hazmat/backends/openssl`.
  1078. * Deprecated the concrete ``RSAPrivateKey`` class in favor of backend
  1079. specific providers of the
  1080. :class:`cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
  1081. interface.
  1082. * Deprecated the concrete ``RSAPublicKey`` in favor of backend specific
  1083. providers of the
  1084. :class:`cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`
  1085. interface.
  1086. * Deprecated the concrete ``DSAPrivateKey`` class in favor of backend
  1087. specific providers of the
  1088. :class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`
  1089. interface.
  1090. * Deprecated the concrete ``DSAPublicKey`` class in favor of backend specific
  1091. providers of the
  1092. :class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey`
  1093. interface.
  1094. * Deprecated the concrete ``DSAParameters`` class in favor of backend specific
  1095. providers of the
  1096. :class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAParameters`
  1097. interface.
  1098. * Deprecated ``encrypt_rsa``, ``decrypt_rsa``, ``create_rsa_signature_ctx`` and
  1099. ``create_rsa_verification_ctx`` on
  1100. :class:`~cryptography.hazmat.backends.interfaces.RSABackend`.
  1101. * Deprecated ``create_dsa_signature_ctx`` and ``create_dsa_verification_ctx``
  1102. on :class:`~cryptography.hazmat.backends.interfaces.DSABackend`.
  1103. .. _v0-4:
  1104. 0.4 - 2014-05-03
  1105. ~~~~~~~~~~~~~~~~
  1106. * Deprecated ``salt_length`` on
  1107. :class:`~cryptography.hazmat.primitives.asymmetric.padding.MGF1` and added it
  1108. to :class:`~cryptography.hazmat.primitives.asymmetric.padding.PSS`. It will
  1109. be removed from ``MGF1`` in two releases per our :doc:`/api-stability`
  1110. policy.
  1111. * Added :class:`~cryptography.hazmat.primitives.ciphers.algorithms.SEED`
  1112. support.
  1113. * Added :class:`~cryptography.hazmat.primitives.cmac.CMAC`.
  1114. * Added decryption support to
  1115. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
  1116. and encryption support to
  1117. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`.
  1118. * Added signature support to
  1119. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`
  1120. and verification support to
  1121. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey`.
  1122. .. _v0-3:
  1123. 0.3 - 2014-03-27
  1124. ~~~~~~~~~~~~~~~~
  1125. * Added :class:`~cryptography.hazmat.primitives.twofactor.hotp.HOTP`.
  1126. * Added :class:`~cryptography.hazmat.primitives.twofactor.totp.TOTP`.
  1127. * Added :class:`~cryptography.hazmat.primitives.ciphers.algorithms.IDEA`
  1128. support.
  1129. * Added signature support to
  1130. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
  1131. and verification support to
  1132. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`.
  1133. * Moved test vectors to the new ``cryptography_vectors`` package.
  1134. .. _v0-2-2:
  1135. 0.2.2 - 2014-03-03
  1136. ~~~~~~~~~~~~~~~~~~
  1137. * Removed a constant definition that was causing compilation problems with
  1138. specific versions of OpenSSL.
  1139. .. _v0-2-1:
  1140. 0.2.1 - 2014-02-22
  1141. ~~~~~~~~~~~~~~~~~~
  1142. * Fix a bug where importing cryptography from multiple paths could cause
  1143. initialization to fail.
  1144. .. _v0-2:
  1145. 0.2 - 2014-02-20
  1146. ~~~~~~~~~~~~~~~~
  1147. * Added ``commoncrypto``.
  1148. * Added initial ``commoncrypto``.
  1149. * Removed ``register_cipher_adapter`` method from
  1150. :class:`~cryptography.hazmat.backends.interfaces.CipherBackend`.
  1151. * Added support for the OpenSSL backend under Windows.
  1152. * Improved thread-safety for the OpenSSL backend.
  1153. * Fixed compilation on systems where OpenSSL's ``ec.h`` header is not
  1154. available, such as CentOS.
  1155. * Added :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC`.
  1156. * Added :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
  1157. * Added ``multibackend``.
  1158. * Set default random for the :doc:`/hazmat/backends/openssl` to the OS
  1159. random engine.
  1160. * Added :class:`~cryptography.hazmat.primitives.ciphers.algorithms.CAST5`
  1161. (CAST-128) support.
  1162. .. _v0-1:
  1163. 0.1 - 2014-01-08
  1164. ~~~~~~~~~~~~~~~~
  1165. * Initial release.
  1166. .. _`master`: https://github.com/pyca/cryptography/
  1167. .. _`cffi`: https://cffi.readthedocs.io/