CHANGELOG.rst 25 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545
  1. Changelog
  2. =========
  3. 1.1.1 - 2015-11-19
  4. ~~~~~~~~~~~~~~~~~~
  5. * Fixed several small bugs related to compiling the OpenSSL bindings with
  6. unusual OpenSSL configurations.
  7. * Resolved an issue where, depending on the method of installation and
  8. which Python interpreter they were using, users on El Capitan (OS X 10.11)
  9. may have seen an ``InternalError`` on import.
  10. 1.1 - 2015-10-28
  11. ~~~~~~~~~~~~~~~~
  12. * Added support for Elliptic Curve Diffie-Hellman with
  13. :class:`~cryptography.hazmat.primitives.asymmetric.ec.ECDH`.
  14. * Added :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`.
  15. * Added support for parsing certificate revocation lists (CRLs) using
  16. :func:`~cryptography.x509.load_pem_x509_crl` and
  17. :func:`~cryptography.x509.load_der_x509_crl`.
  18. * Add support for AES key wrapping with
  19. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_wrap` and
  20. :func:`~cryptography.hazmat.primitives.keywrap.aes_key_unwrap`.
  21. * Added a ``__hash__`` method to :class:`~cryptography.x509.Name`.
  22. * Add support for encoding and decoding elliptic curve points to a byte string
  23. form using
  24. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers.encode_point`
  25. and
  26. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicNumbers.from_encoded_point`.
  27. * Added :meth:`~cryptography.x509.Extensions.get_extension_for_class`.
  28. * :class:`~cryptography.x509.CertificatePolicies` are now supported in the
  29. :class:`~cryptography.x509.CertificateBuilder`.
  30. * ``countryName`` is now encoded as a ``PrintableString`` when creating subject
  31. and issuer distinguished names with the Certificate and CSR builder classes.
  32. 1.0.2 - 2015-09-27
  33. ~~~~~~~~~~~~~~~~~~
  34. * **SECURITY ISSUE**: The OpenSSL backend prior to 1.0.2 made extensive use
  35. of assertions to check response codes where our tests could not trigger a
  36. failure. However, when Python is run with ``-O`` these asserts are optimized
  37. away. If a user ran Python with this flag and got an invalid response code
  38. this could result in undefined behavior or worse. Accordingly, all response
  39. checks from the OpenSSL backend have been converted from ``assert``
  40. to a true function call. Credit **Emilia Käsper (Google Security Team)**
  41. for the report.
  42. 1.0.1 - 2015-09-05
  43. ~~~~~~~~~~~~~~~~~~
  44. * We now ship OS X wheels that statically link OpenSSL by default. When
  45. installing a wheel on OS X 10.10+ (and using a Python compiled against the
  46. 10.10 SDK) users will no longer need to compile. See :doc:`/installation` for
  47. alternate installation methods if required.
  48. * Set the default string mask to UTF-8 in the OpenSSL backend to resolve
  49. character encoding issues with older versions of OpenSSL.
  50. * Several new OpenSSL bindings have been added to support a future pyOpenSSL
  51. release.
  52. * Raise an error during install on PyPy < 2.6. 1.0+ requires PyPy 2.6+.
  53. 1.0 - 2015-08-12
  54. ~~~~~~~~~~~~~~~~
  55. * Switched to the new `cffi`_ ``set_source`` out-of-line API mode for
  56. compilation. This results in significantly faster imports and lowered
  57. memory consumption. Due to this change we no longer support PyPy releases
  58. older than 2.6 nor do we support any released version of PyPy3 (until a
  59. version supporting cffi 1.0 comes out).
  60. * Fix parsing of OpenSSH public keys that have spaces in comments.
  61. * Support serialization of certificate signing requests using the
  62. ``public_bytes`` method of
  63. :class:`~cryptography.x509.CertificateSigningRequest`.
  64. * Support serialization of certificates using the ``public_bytes`` method of
  65. :class:`~cryptography.x509.Certificate`.
  66. * Add ``get_provisioning_uri`` method to
  67. :class:`~cryptography.hazmat.primitives.twofactor.hotp.HOTP` and
  68. :class:`~cryptography.hazmat.primitives.twofactor.totp.TOTP` for generating
  69. provisioning URIs.
  70. * Add :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatKDFHash`
  71. and :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatKDFHMAC`.
  72. * Raise a ``TypeError`` when passing objects that are not text as the value to
  73. :class:`~cryptography.x509.NameAttribute`.
  74. * Add support for :class:`~cryptography.x509.OtherName` as a general name
  75. type.
  76. * Added new X.509 extension support in :class:`~cryptography.x509.Certificate`
  77. The following new extensions are now supported:
  78. * :class:`~cryptography.x509.OCSPNoCheck`
  79. * :class:`~cryptography.x509.InhibitAnyPolicy`
  80. * :class:`~cryptography.x509.IssuerAlternativeName`
  81. * :class:`~cryptography.x509.NameConstraints`
  82. * Extension support was added to
  83. :class:`~cryptography.x509.CertificateSigningRequest`.
  84. * Add support for creating signed certificates with
  85. :class:`~cryptography.x509.CertificateBuilder`. This includes support for
  86. the following extensions:
  87. * :class:`~cryptography.x509.BasicConstraints`
  88. * :class:`~cryptography.x509.SubjectAlternativeName`
  89. * :class:`~cryptography.x509.KeyUsage`
  90. * :class:`~cryptography.x509.ExtendedKeyUsage`
  91. * :class:`~cryptography.x509.SubjectKeyIdentifier`
  92. * :class:`~cryptography.x509.AuthorityKeyIdentifier`
  93. * :class:`~cryptography.x509.AuthorityInformationAccess`
  94. * :class:`~cryptography.x509.CRLDistributionPoints`
  95. * :class:`~cryptography.x509.InhibitAnyPolicy`
  96. * :class:`~cryptography.x509.IssuerAlternativeName`
  97. * :class:`~cryptography.x509.OCSPNoCheck`
  98. * Add support for creating certificate signing requests with
  99. :class:`~cryptography.x509.CertificateSigningRequestBuilder`. This includes
  100. support for the same extensions supported in the ``CertificateBuilder``.
  101. * Deprecate ``encode_rfc6979_signature`` and ``decode_rfc6979_signature`` in
  102. favor of
  103. :func:`~cryptography.hazmat.primitives.asymmetric.utils.encode_dss_signature`
  104. and
  105. :func:`~cryptography.hazmat.primitives.asymmetric.utils.decode_dss_signature`.
  106. 0.9.3 - 2015-07-09
  107. ~~~~~~~~~~~~~~~~~~
  108. * Updated Windows wheels to be compiled against OpenSSL 1.0.2d.
  109. 0.9.2 - 2015-07-04
  110. ~~~~~~~~~~~~~~~~~~
  111. * Updated Windows wheels to be compiled against OpenSSL 1.0.2c.
  112. 0.9.1 - 2015-06-06
  113. ~~~~~~~~~~~~~~~~~~
  114. * **SECURITY ISSUE**: Fixed a double free in the OpenSSL backend when using DSA
  115. to verify signatures. Note that this only affects PyPy 2.6.0 and (presently
  116. unreleased) CFFI versions greater than 1.1.0.
  117. 0.9 - 2015-05-13
  118. ~~~~~~~~~~~~~~~~
  119. * Removed support for Python 3.2. This version of Python is rarely used
  120. and caused support headaches. Users affected by this should upgrade to 3.3+.
  121. * Deprecated support for Python 2.6. At the time there is no time table for
  122. actually dropping support, however we strongly encourage all users to upgrade
  123. their Python, as Python 2.6 no longer receives support from the Python core
  124. team.
  125. * Add support for the
  126. :class:`~cryptography.hazmat.primitives.asymmetric.ec.SECP256K1` elliptic
  127. curve.
  128. * Fixed compilation when using an OpenSSL which was compiled with the
  129. ``no-comp`` (``OPENSSL_NO_COMP``) option.
  130. * Support :attr:`~cryptography.hazmat.primitives.serialization.Encoding.DER`
  131. serialization of public keys using the ``public_bytes`` method of
  132. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKeyWithSerialization`,
  133. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKeyWithSerialization`,
  134. and
  135. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKeyWithSerialization`.
  136. * Support :attr:`~cryptography.hazmat.primitives.serialization.Encoding.DER`
  137. serialization of private keys using the ``private_bytes`` method of
  138. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization`,
  139. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization`,
  140. and
  141. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization`.
  142. * Add support for parsing X.509 certificate signing requests (CSRs) with
  143. :func:`~cryptography.x509.load_pem_x509_csr` and
  144. :func:`~cryptography.x509.load_der_x509_csr`.
  145. * Moved ``cryptography.exceptions.InvalidToken`` to
  146. :class:`cryptography.hazmat.primitives.twofactor.InvalidToken` and deprecated
  147. the old location. This was moved to minimize confusion between this exception
  148. and :class:`cryptography.fernet.InvalidToken`.
  149. * Added support for X.509 extensions in :class:`~cryptography.x509.Certificate`
  150. objects. The following extensions are supported as of this release:
  151. * :class:`~cryptography.x509.BasicConstraints`
  152. * :class:`~cryptography.x509.AuthorityKeyIdentifier`
  153. * :class:`~cryptography.x509.SubjectKeyIdentifier`
  154. * :class:`~cryptography.x509.KeyUsage`
  155. * :class:`~cryptography.x509.SubjectAlternativeName`
  156. * :class:`~cryptography.x509.ExtendedKeyUsage`
  157. * :class:`~cryptography.x509.CRLDistributionPoints`
  158. * :class:`~cryptography.x509.AuthorityInformationAccess`
  159. * :class:`~cryptography.x509.CertificatePolicies`
  160. Note that unsupported extensions with the critical flag raise
  161. :class:`~cryptography.x509.UnsupportedExtension` while unsupported extensions
  162. set to non-critical are silently ignored. Read the
  163. :doc:`X.509 documentation</x509/index>` for more information.
  164. 0.8.2 - 2015-04-10
  165. ~~~~~~~~~~~~~~~~~~
  166. * Fixed a race condition when initializing the OpenSSL or CommonCrypto backends
  167. in a multi-threaded scenario.
  168. 0.8.1 - 2015-03-20
  169. ~~~~~~~~~~~~~~~~~~
  170. * Updated Windows wheels to be compiled against OpenSSL 1.0.2a.
  171. 0.8 - 2015-03-08
  172. ~~~~~~~~~~~~~~~~
  173. * :func:`~cryptography.hazmat.primitives.serialization.load_ssh_public_key` can
  174. now load elliptic curve public keys.
  175. * Added
  176. :attr:`~cryptography.x509.Certificate.signature_hash_algorithm` support to
  177. :class:`~cryptography.x509.Certificate`.
  178. * Added
  179. :func:`~cryptography.hazmat.primitives.asymmetric.rsa.rsa_recover_prime_factors`
  180. * :class:`~cryptography.hazmat.primitives.kdf.KeyDerivationFunction` was moved
  181. from :mod:`~cryptography.hazmat.primitives.interfaces` to
  182. :mod:`~cryptography.hazmat.primitives.kdf`.
  183. * Added support for parsing X.509 names. See the
  184. :doc:`X.509 documentation</x509/index>` for more information.
  185. * Added
  186. :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key` to
  187. support loading of DER encoded private keys and
  188. :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key` to
  189. support loading DER encoded public keys.
  190. * Fixed building against LibreSSL, a compile-time substitute for OpenSSL.
  191. * FreeBSD 9.2 was removed from the continuous integration system.
  192. * Updated Windows wheels to be compiled against OpenSSL 1.0.2.
  193. * :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`
  194. and :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`
  195. now support PKCS1 RSA public keys (in addition to the previous support for
  196. SubjectPublicKeyInfo format for RSA, EC, and DSA).
  197. * Added
  198. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization`
  199. and deprecated ``EllipticCurvePrivateKeyWithNumbers``.
  200. * Added
  201. :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization.private_bytes`
  202. to
  203. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKeyWithSerialization`.
  204. * Added
  205. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization`
  206. and deprecated ``RSAPrivateKeyWithNumbers``.
  207. * Added
  208. :meth:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization.private_bytes`
  209. to
  210. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKeyWithSerialization`.
  211. * Added
  212. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization`
  213. and deprecated ``DSAPrivateKeyWithNumbers``.
  214. * Added
  215. :meth:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization.private_bytes`
  216. to
  217. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKeyWithSerialization`.
  218. * Added
  219. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKeyWithSerialization`
  220. and deprecated ``RSAPublicKeyWithNumbers``.
  221. * Added ``public_bytes`` to
  222. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKeyWithSerialization`.
  223. * Added
  224. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKeyWithSerialization`
  225. and deprecated ``EllipticCurvePublicKeyWithNumbers``.
  226. * Added ``public_bytes`` to
  227. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKeyWithSerialization`.
  228. * Added
  229. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKeyWithSerialization`
  230. and deprecated ``DSAPublicKeyWithNumbers``.
  231. * Added ``public_bytes`` to
  232. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKeyWithSerialization`.
  233. * :class:`~cryptography.hazmat.primitives.hashes.HashAlgorithm` and
  234. :class:`~cryptography.hazmat.primitives.hashes.HashContext` were moved from
  235. :mod:`~cryptography.hazmat.primitives.interfaces` to
  236. :mod:`~cryptography.hazmat.primitives.hashes`.
  237. * :class:`~cryptography.hazmat.primitives.ciphers.CipherContext`,
  238. :class:`~cryptography.hazmat.primitives.ciphers.AEADCipherContext`,
  239. :class:`~cryptography.hazmat.primitives.ciphers.AEADEncryptionContext`,
  240. :class:`~cryptography.hazmat.primitives.ciphers.CipherAlgorithm`, and
  241. :class:`~cryptography.hazmat.primitives.ciphers.BlockCipherAlgorithm`
  242. were moved from :mod:`~cryptography.hazmat.primitives.interfaces` to
  243. :mod:`~cryptography.hazmat.primitives.ciphers`.
  244. * :class:`~cryptography.hazmat.primitives.ciphers.modes.Mode`,
  245. :class:`~cryptography.hazmat.primitives.ciphers.modes.ModeWithInitializationVector`,
  246. :class:`~cryptography.hazmat.primitives.ciphers.modes.ModeWithNonce`, and
  247. :class:`~cryptography.hazmat.primitives.ciphers.modes.ModeWithAuthenticationTag`
  248. were moved from :mod:`~cryptography.hazmat.primitives.interfaces` to
  249. :mod:`~cryptography.hazmat.primitives.ciphers.modes`.
  250. * :class:`~cryptography.hazmat.primitives.padding.PaddingContext` was moved
  251. from :mod:`~cryptography.hazmat.primitives.interfaces` to
  252. :mod:`~cryptography.hazmat.primitives.padding`.
  253. *
  254. :class:`~cryptography.hazmat.primitives.asymmetric.padding.AsymmetricPadding`
  255. was moved from :mod:`~cryptography.hazmat.primitives.interfaces` to
  256. :mod:`~cryptography.hazmat.primitives.asymmetric.padding`.
  257. *
  258. :class:`~cryptography.hazmat.primitives.asymmetric.AsymmetricSignatureContext`
  259. and
  260. :class:`~cryptography.hazmat.primitives.asymmetric.AsymmetricVerificationContext`
  261. were moved from :mod:`~cryptography.hazmat.primitives.interfaces` to
  262. :mod:`~cryptography.hazmat.primitives.asymmetric`.
  263. * :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAParameters`,
  264. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAParametersWithNumbers`,
  265. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`,
  266. ``DSAPrivateKeyWithNumbers``,
  267. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey` and
  268. ``DSAPublicKeyWithNumbers`` were moved from
  269. :mod:`~cryptography.hazmat.primitives.interfaces` to
  270. :mod:`~cryptography.hazmat.primitives.asymmetric.dsa`
  271. * :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurve`,
  272. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurveSignatureAlgorithm`,
  273. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey`,
  274. ``EllipticCurvePrivateKeyWithNumbers``,
  275. :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`,
  276. and ``EllipticCurvePublicKeyWithNumbers``
  277. were moved from :mod:`~cryptography.hazmat.primitives.interfaces` to
  278. :mod:`~cryptography.hazmat.primitives.asymmetric.ec`.
  279. * :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`,
  280. ``RSAPrivateKeyWithNumbers``,
  281. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey` and
  282. ``RSAPublicKeyWithNumbers`` were moved from
  283. :mod:`~cryptography.hazmat.primitives.interfaces` to
  284. :mod:`~cryptography.hazmat.primitives.asymmetric.rsa`.
  285. 0.7.2 - 2015-01-16
  286. ~~~~~~~~~~~~~~~~~~
  287. * Updated Windows wheels to be compiled against OpenSSL 1.0.1l.
  288. * ``enum34`` is no longer installed on Python 3.4, where it is included in
  289. the standard library.
  290. * Added a new function to the OpenSSL bindings to support additional
  291. functionality in pyOpenSSL.
  292. 0.7.1 - 2014-12-28
  293. ~~~~~~~~~~~~~~~~~~
  294. * Fixed an issue preventing compilation on platforms where ``OPENSSL_NO_SSL3``
  295. was defined.
  296. 0.7 - 2014-12-17
  297. ~~~~~~~~~~~~~~~~
  298. * Cryptography has been relicensed from the Apache Software License, Version
  299. 2.0, to being available under *either* the Apache Software License, Version
  300. 2.0, or the BSD license.
  301. * Added key-rotation support to :doc:`Fernet </fernet>` with
  302. :class:`~cryptography.fernet.MultiFernet`.
  303. * More bit-lengths are now supported for ``p`` and ``q`` when loading DSA keys
  304. from numbers.
  305. * Added :class:`~cryptography.hazmat.primitives.interfaces.MACContext` as a
  306. common interface for CMAC and HMAC and deprecated ``CMACContext``.
  307. * Added support for encoding and decoding :rfc:`6979` signatures in
  308. :doc:`/hazmat/primitives/asymmetric/utils`.
  309. * Added
  310. :func:`~cryptography.hazmat.primitives.serialization.load_ssh_public_key` to
  311. support the loading of OpenSSH public keys (:rfc:`4253`). Only RSA and DSA
  312. keys are currently supported.
  313. * Added initial support for X.509 certificate parsing. See the
  314. :doc:`X.509 documentation</x509/index>` for more information.
  315. 0.6.1 - 2014-10-15
  316. ~~~~~~~~~~~~~~~~~~
  317. * Updated Windows wheels to be compiled against OpenSSL 1.0.1j.
  318. * Fixed an issue where OpenSSL 1.0.1j changed the errors returned by some
  319. functions.
  320. * Added our license file to the ``cryptography-vectors`` package.
  321. * Implemented DSA hash truncation support (per FIPS 186-3) in the OpenSSL
  322. backend. This works around an issue in 1.0.0, 1.0.0a, and 1.0.0b where
  323. truncation was not implemented.
  324. 0.6 - 2014-09-29
  325. ~~~~~~~~~~~~~~~~
  326. * Added
  327. :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key` to
  328. ease loading private keys, and
  329. :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key` to
  330. support loading public keys.
  331. * Removed the, deprecated in 0.4, support for the ``salt_length`` argument to
  332. the :class:`~cryptography.hazmat.primitives.asymmetric.padding.MGF1`
  333. constructor. The ``salt_length`` should be passed to
  334. :class:`~cryptography.hazmat.primitives.asymmetric.padding.PSS` instead.
  335. * Fix compilation on OS X Yosemite.
  336. * Deprecated ``elliptic_curve_private_key_from_numbers`` and
  337. ``elliptic_curve_public_key_from_numbers`` in favor of
  338. ``load_elliptic_curve_private_numbers`` and
  339. ``load_elliptic_curve_public_numbers`` on
  340. :class:`~cryptography.hazmat.backends.interfaces.EllipticCurveBackend`.
  341. * Added ``EllipticCurvePrivateKeyWithNumbers`` and
  342. ``EllipticCurvePublicKeyWithNumbers`` support.
  343. * Work around three GCM related bugs in CommonCrypto and OpenSSL.
  344. * On the CommonCrypto backend adding AAD but not subsequently calling update
  345. would return null tag bytes.
  346. * One the CommonCrypto backend a call to update without an empty add AAD call
  347. would return null ciphertext bytes.
  348. * On the OpenSSL backend with certain versions adding AAD only would give
  349. invalid tag bytes.
  350. * Support loading EC private keys from PEM.
  351. 0.5.4 - 2014-08-20
  352. ~~~~~~~~~~~~~~~~~~
  353. * Added several functions to the OpenSSL bindings to support new
  354. functionality in pyOpenSSL.
  355. * Fixed a redefined constant causing compilation failure with Solaris 11.2.
  356. 0.5.3 - 2014-08-06
  357. ~~~~~~~~~~~~~~~~~~
  358. * Updated Windows wheels to be compiled against OpenSSL 1.0.1i.
  359. 0.5.2 - 2014-07-09
  360. ~~~~~~~~~~~~~~~~~~
  361. * Add ``TraditionalOpenSSLSerializationBackend`` support to
  362. :doc:`/hazmat/backends/multibackend`.
  363. * Fix compilation error on OS X 10.8 (Mountain Lion).
  364. 0.5.1 - 2014-07-07
  365. ~~~~~~~~~~~~~~~~~~
  366. * Add ``PKCS8SerializationBackend`` support to
  367. :doc:`/hazmat/backends/multibackend`.
  368. 0.5 - 2014-07-07
  369. ~~~~~~~~~~~~~~~~
  370. * **BACKWARDS INCOMPATIBLE:**
  371. :class:`~cryptography.hazmat.primitives.ciphers.modes.GCM` no longer allows
  372. truncation of tags by default. Previous versions of ``cryptography`` allowed
  373. tags to be truncated by default, applications wishing to preserve this
  374. behavior (not recommended) can pass the ``min_tag_length`` argument.
  375. * Windows builds now statically link OpenSSL by default. When installing a
  376. wheel on Windows you no longer need to install OpenSSL separately. Windows
  377. users can switch between static and dynamic linking with an environment
  378. variable. See :doc:`/installation` for more details.
  379. * Added :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`.
  380. * Added :class:`~cryptography.hazmat.primitives.ciphers.modes.CFB8` support
  381. for :class:`~cryptography.hazmat.primitives.ciphers.algorithms.AES` and
  382. :class:`~cryptography.hazmat.primitives.ciphers.algorithms.TripleDES` on
  383. :doc:`/hazmat/backends/commoncrypto` and :doc:`/hazmat/backends/openssl`.
  384. * Added ``AES`` :class:`~cryptography.hazmat.primitives.ciphers.modes.CTR`
  385. support to the OpenSSL backend when linked against 0.9.8.
  386. * Added ``PKCS8SerializationBackend`` and
  387. ``TraditionalOpenSSLSerializationBackend`` support to the
  388. :doc:`/hazmat/backends/openssl`.
  389. * Added :doc:`/hazmat/primitives/asymmetric/ec` and
  390. :class:`~cryptography.hazmat.backends.interfaces.EllipticCurveBackend`.
  391. * Added :class:`~cryptography.hazmat.primitives.ciphers.modes.ECB` support
  392. for :class:`~cryptography.hazmat.primitives.ciphers.algorithms.TripleDES` on
  393. :doc:`/hazmat/backends/commoncrypto` and :doc:`/hazmat/backends/openssl`.
  394. * Deprecated the concrete ``RSAPrivateKey`` class in favor of backend
  395. specific providers of the
  396. :class:`cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
  397. interface.
  398. * Deprecated the concrete ``RSAPublicKey`` in favor of backend specific
  399. providers of the
  400. :class:`cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`
  401. interface.
  402. * Deprecated the concrete ``DSAPrivateKey`` class in favor of backend
  403. specific providers of the
  404. :class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`
  405. interface.
  406. * Deprecated the concrete ``DSAPublicKey`` class in favor of backend specific
  407. providers of the
  408. :class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey`
  409. interface.
  410. * Deprecated the concrete ``DSAParameters`` class in favor of backend specific
  411. providers of the
  412. :class:`cryptography.hazmat.primitives.asymmetric.dsa.DSAParameters`
  413. interface.
  414. * Deprecated ``encrypt_rsa``, ``decrypt_rsa``, ``create_rsa_signature_ctx`` and
  415. ``create_rsa_verification_ctx`` on
  416. :class:`~cryptography.hazmat.backends.interfaces.RSABackend`.
  417. * Deprecated ``create_dsa_signature_ctx`` and ``create_dsa_verification_ctx``
  418. on :class:`~cryptography.hazmat.backends.interfaces.DSABackend`.
  419. 0.4 - 2014-05-03
  420. ~~~~~~~~~~~~~~~~
  421. * Deprecated ``salt_length`` on
  422. :class:`~cryptography.hazmat.primitives.asymmetric.padding.MGF1` and added it
  423. to :class:`~cryptography.hazmat.primitives.asymmetric.padding.PSS`. It will
  424. be removed from ``MGF1`` in two releases per our :doc:`/api-stability`
  425. policy.
  426. * Added :class:`~cryptography.hazmat.primitives.ciphers.algorithms.SEED`
  427. support.
  428. * Added :class:`~cryptography.hazmat.primitives.cmac.CMAC`.
  429. * Added decryption support to
  430. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
  431. and encryption support to
  432. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`.
  433. * Added signature support to
  434. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPrivateKey`
  435. and verification support to
  436. :class:`~cryptography.hazmat.primitives.asymmetric.dsa.DSAPublicKey`.
  437. 0.3 - 2014-03-27
  438. ~~~~~~~~~~~~~~~~
  439. * Added :class:`~cryptography.hazmat.primitives.twofactor.hotp.HOTP`.
  440. * Added :class:`~cryptography.hazmat.primitives.twofactor.totp.TOTP`.
  441. * Added :class:`~cryptography.hazmat.primitives.ciphers.algorithms.IDEA`
  442. support.
  443. * Added signature support to
  444. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
  445. and verification support to
  446. :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`.
  447. * Moved test vectors to the new ``cryptography_vectors`` package.
  448. 0.2.2 - 2014-03-03
  449. ~~~~~~~~~~~~~~~~~~
  450. * Removed a constant definition that was causing compilation problems with
  451. specific versions of OpenSSL.
  452. 0.2.1 - 2014-02-22
  453. ~~~~~~~~~~~~~~~~~~
  454. * Fix a bug where importing cryptography from multiple paths could cause
  455. initialization to fail.
  456. 0.2 - 2014-02-20
  457. ~~~~~~~~~~~~~~~~
  458. * Added :doc:`/hazmat/backends/commoncrypto`.
  459. * Added initial :doc:`/hazmat/bindings/commoncrypto`.
  460. * Removed ``register_cipher_adapter`` method from
  461. :class:`~cryptography.hazmat.backends.interfaces.CipherBackend`.
  462. * Added support for the OpenSSL backend under Windows.
  463. * Improved thread-safety for the OpenSSL backend.
  464. * Fixed compilation on systems where OpenSSL's ``ec.h`` header is not
  465. available, such as CentOS.
  466. * Added :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC`.
  467. * Added :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
  468. * Added :doc:`/hazmat/backends/multibackend`.
  469. * Set default random for the :doc:`/hazmat/backends/openssl` to the OS
  470. random engine.
  471. * Added :class:`~cryptography.hazmat.primitives.ciphers.algorithms.CAST5`
  472. (CAST-128) support.
  473. 0.1 - 2014-01-08
  474. ~~~~~~~~~~~~~~~~
  475. * Initial release.
  476. .. _`master`: https://github.com/pyca/cryptography/
  477. .. _`cffi`: https://cffi.readthedocs.org/en/latest/