Release AWS-LC FIPS v2.0.0

• FIPS module can be statically built.
• More KDFs are now approved.

Release v1.16.0

What's Changed

• Upstream merge 2023 08 25 by @nebeid in #1169
• Add support for LoongArch. by @liuxiang88 in #1137
• Lower returned number for SSL_CTX_get_security_level by @samuel40791765 in #1157
• Add AWS-LC version number to both OpenSSL_version and OPENSSL_VERSION_TEXT by @andrewhop in #767
• Simplify HAProxy integration tests by using built in filters by @andrewhop in #1174
• Fix and add CI for postgres build on arm by @samuel40791765 in #1176
• Align with OpenSSL on TLS 1.3 cipher suite constants. by @andrewhop in #1175
• Fix Compiler Error on GCC 13 by @skmcgrail in #1184
• add integration CI dimension for nginx by @samuel40791765 in #1143
• Alias RAND_priv_bytes to RAND_bytes by @geedo0 in #1180
• Add BN_CTX_secure_new alias for BN_CTX_new by @geedo0 in #1179
• Simplify Prefix Build Support by @skmcgrail in #1178
• Check for unset certificates in servers by @samuel40791765 in #1181
• Add prefix symbols for Windows FIPS Shared Build by @skmcgrail in #1191
• MSVC 2022 - Ignore C5266 and C5267 by @justsmth in #1190
• Fix AVX512 capability check by @justsmth in #1193
• Disable XTS use of AVX512 on Windows by @justsmth in #1195
• Use passive entropy source method by default for FIPS build mode by @torben-hansen in #1188
• add patch and integration CI dimension for sslproxy by @samuel40791765 in #1183
• Pull in the latest changes from s2n-bignum (2023-09-17) by @aqjune-aws in #1197
• Upstream Merge - Remove unions in EC_SCALAR and EC_FELEM. by @justsmth in #1177
• Remove a few lingering references to Rust bindings by @justsmth in #1203
• Calibrate BN_window_bits_for_ctime_exponent_size to use 5 by @aqjune-aws in #1166
• Bump release version to v1.16.0 by @torben-hansen in #1207

New Contributors

• @liuxiang88 made their first contribution in #1137

Full Changelog: v1.15.0...v1.16.0

v1.15.0

Main changes

Reduced RSA sign/verify latency on Graviton 2 for sizes 2048-4096. For example, RSA 2048 signing reduced from ~3.3 ms to 2 ms

What's Changed

• Add EVP_MD_do_all by @WillChilds-Klein in #1154
• error: '%s' directive argument is null by @justsmth in #1158
• Fix build on gcc 4.8.3 by @samuel40791765 in #1156
• Remove duplicate handling of OPENSSL_NO_ASM from CMake. by @PiotrSikora in #1149
• Add -DBUILD_TOOL=OFF to CMake. by @PiotrSikora in #1148
• Upstream merge 2023 08 09 by @justsmth in #1152, #1160, #1161
• Add missing symbols for SSLProxy support by @samuel40791765 in #1155
• RSA performance improvement on Graviton 2 - part 1: Update montgomery multiplication to use s2n-bignum's verified scalar bignum functions by @aqjune-aws in #1135
• Add more ssl runner tests for multiple certificate support by @samuel40791765 in #1141
• CVE-2023-3446 and CVE-2023-3817 by @dkostic in #1163
• Minor fix in aead test by @dkostic in #1165
• RSA performance improvement on Graviton 2 - part 2: Conditionally enable Neon version of s2n-bignum implementations for montgomery multiplications by @aqjune-aws in #1164
• Fix build for ppc64le by @justsmth in #1167
• Add additional documentation for X509 headers by @samuel40791765 in #1142
• Preparing for release v1.15.0 by @nebeid in #1171

New Contributors

• @PiotrSikora made their first contribution in #1149

Full Changelog: v1.14.0...v1.15.0

Release v1.14.0

What's Changed

• Fix formal verification CI by @samuel40791765 in #1130
• Pull in the latest changes from s2n-bignum (2023-07-25) by @aqjune-aws in #1114
• Upstream merge 2023 07 28 by @samuel40791765 in #1122
• Implementation passive entropy by @torben-hansen in #1125
• add curl integration test CI dimension by @samuel40791765 in #1134
• Retrieve multiple certificate slot for TLS1.2/1.3 based on negotiated sigalgs by @samuel40791765 in #1120
• ABI Diff GitHub Action by @skmcgrail in #1116
• Add vzeroupper instruction for AVX512 optimization in AES-XTS by @shirsing0712 in #1115
• Avoid UB in test shim by @torben-hansen in #1140
• Simplify the Kyber prefix build by @andrewhop in #1131
• Pull in the latest changes from s2n-bignum (2023-08-04) by @aqjune-aws in #1139
• Detect GCM-SIV alignment change by @justsmth in #1144
• Retrieve multiple certificate slot for TLS1.0/1.1 based on negotiated sigalgs by @samuel40791765 in #1138
• Update for Release v1.14.0 by @justsmth in #1150

New Contributors

• @aqjune-aws made their first contribution in #1114

Full Changelog: v1.13.0...v1.14.0

AWS-LC-FIPS-1.1.2

What's Changed

• [FIPS-2021-10-20] Detect GCM-SIV alignment change by @justsmth in #1147
• [FIPS-2021-10-20] Release v1.1.2 by @justsmth in #1151

Full Changelog: AWS-LC-FIPS-1.1.1...AWS-LC-FIPS-1.1.2

Release AWS-LC-FIPS-1.1.1

What's Changed

• Fix handling of EXFLAG_INVALID_POLICY on the leaf. by @andrewhop in #913
• [fips-2021-10-20] Backport CVE-2023-3446, CVE-2023-3817 fixes for DH_check by @skmcgrail in #1127

Full Changelog: AWS-LC-FIPS-1.1.0...AWS-LC-FIPS-1.1.1

Release v1.13.0

What's Changed

• EVP API ECDHE speed tool support by @torben-hansen in #1080
• fix rust sanity check CI by @samuel40791765 in #1106
• Silence static analyser by validating pointer prior to function call by @torben-hansen in #1107
• Improve LICENSE readability by @skmcgrail in #1110
• add back CERT_PKEY structure and refactor pointers by @samuel40791765 in #1086
• Turn on tests in CI dimension for mySQL by @samuel40791765 in #1063
• Fix DH_check() excessive time with oversized modulus by @skmcgrail in #1109
• Add GitHub CODEOWNERS by @skmcgrail in #1103
• Add BoringSSL Dispatch Test for aarch64 by @billbo-yang in #1093
• Run additional HAProxy tests by @andrewhop in #1097
• Add webhook event support for push to main and fips branches by @skmcgrail in #1082
• Remove CRNGT by @torben-hansen in #1112
• Make dispatch tests use corruptible registers on aarch64. by @nebeid in #1118
• Allow SSL_CTX to use the new multiple certificate slots internally by @samuel40791765 in #1100
• Upstream merge 2023 07 18 by @nebeid in #1101
• tweak back error string functions with exclamation marks by @samuel40791765 in #1117
• Support changing OPENSSL_armcap with environment variable on Apple 64-bit ARM systems by @billbo-yang in #1045
• Abstract fips entropy functions by @torben-hansen in #1113
• Silence static analyser with additional checks by @samuel40791765 in #1123
• Fix Excessive time spent checking DH q parameter value by @skmcgrail in #1121

Full Changelog: v1.12.1...v1.12.2

v1.12.1

What's Changed

• Disable two "Visual Studio 17 2022" warnings by @justsmth in #1087
• Add HAProxy to our CI by @andrewhop in #1083
• Align OCSP behavior with OpenSSL for nginx by @samuel40791765 in #1077
• Merge and remove duplicate yml files in CI by @samuel40791765 in #1088
• Missing export symbols for OCSP by @samuel40791765 in #1091
• Turn on shared library build with HAProxy by @andrewhop in #1092
• Allow SHA3 digests with EC key types by @skmcgrail in #1094
• Release v1.12.1 by @andrewhop in #1095

Full Changelog: v1.12.0...v1.12.1

Release v1.12.0

What's Changed

• Update CI README to include Valgrind on AArch64 by @nebeid in #1066
• Additional tests for failure modes for KEM API by @dkostic in #1048
• Fix potential NULL pointer dereference by @dkostic in #1067
• add integration build CI dimension for mySQL by @samuel40791765 in #1051
• add integration test CI dimension for MariaDB by @samuel40791765 in #1046
• Add SSL_get0_verified_chain by @andrewhop in #1055
• Add OSSL_HANDSHAKE_STATE enum for OpenSSL compatability by @andrewhop in #1070
• Upstream merge 2023-06-26 by @dkostic in #1072
• Fix DISABLE_PERL=on builds for non-assembly optimized platforms by @skmcgrail in #1068
• Fix BORINGSSL_PREFIX build for ppc64le by @skmcgrail in #1069
• align X509_VERIFY_PARAM host and email behavior with OpenSSL by @samuel40791765 in #1062
• Use build-in string-copy function by @torben-hansen in #1078
• Light tidy up of required dependency versions by @torben-hansen in #1076
• Remove unused variable declaration in ssl_test.cc by @dkostic in #1073
• Upstream merge 2023-06-27 by @torben-hansen in #1075
• Reapply "Remove support for "old-style" X509V3_EXT_METHODs" by @samuel40791765 in #1065
• Make PRNG model slightly more readable by @torben-hansen in #1079
• Add back custom extension support for libssl by @andrewhop in #1071
• Save leaf certificate in SSL early to avoid losing external data by @samuel40791765 in #1074
• Mark include as PUBLIC not SYSTEM PUBLIC by @skmcgrail in #1081
• Release v1.12.0 by @skmcgrail in #1085

Full Changelog: v1.11.0...v1.12.0

Release v1.11.0

What's Changed

• Merge pull request #1064 from samuel40791765/upstream-merge-2023-06-15
• Allow cleanup of thread-local data before dlclose (#1057)
• add -Wmissing-braces to build (#1061)
• Change the Jitter entropy recovery mechanism (#1058)
• Merge OCSP request feature branch to main (#1054)
• Fix aesni-xts-avx512 to support Perl v5.8.8 (#1053)
• Merge pull request #1041 from skmcgrail/upstream-merge-2023-05-30
• Simplify speed.cc if/defs for different libcryptos (#1047)
• AES-XTS optimization using vAES and vPCLMULQDQ (#1004)
• Split up integration test ci dimension (#1036)
• Ensure CodeBuild always has GOPROXY set via buildspec. (#1043)
• Add Support for RSA SigGen w/ SHA2-512/256 & PKCS1v1.5 to the ACVP Tool (#1022)
• set rsa pkcs1v1.5 and ecdsa sig/ver with SHA512/256 to not approved (#1038)
• Document X509_NAME_oneline function behavior. (#1040)
• Add additional DH groups from RFC 7919 (#1039)
• Add function for KEM key check (#1030)
• Zeroize unused Dilithium key buffers (#1031)
• Add ASN1_TIME_to_tm (#1035)
• Expose TLS prf (#1033)
• Add few compatability functions needed for HAProxy (#1032)
• quiet unused arguments on Android to silence --noexecstack related warnings (#1028)
• Add support for multiple filters for bssl speed application (#1023)
• Add LDTs to ACVP Tool (#1029)
• Fix RSA and ECDSA SigGen w/ SHA2-512/256 (#1020)
• Add support for EVP_aes_256_wrap (#1007)
• add support for SSL_get_key_update_type and SSL_KEY_UPDATE_NONE (#1011)
• Add AES CTR benchmark (#1024)
• Delete leftover comments about KEMs/Kyber (#1013)
• Add support for SSL_(read/peek/write)_ex (#1010)
• Reduce the ARM fuzz time to get the CI to pass in under an hour (#1021)
• Update speed.cc to support older versions of AWS-LC that have missing APIs. (#1018)
• Add additional no-op symbols for support mySQL (#1002)
• Revert "Temporarily remove dilithium KATs and fuzz corpus" (#1016)