From a7251c26e001f5fd52e736fde71db72159e60c44 Mon Sep 17 00:00:00 2001 From: Douglas Stebila Date: Fri, 6 Dec 2024 10:49:05 -0500 Subject: [PATCH 1/4] Release notes for 0.12.0 release Signed-off-by: Douglas Stebila --- CMakeLists.txt | 2 +- RELEASE.md | 13 +++++++++---- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index d80771942..1801c5927 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -43,7 +43,7 @@ set(CMAKE_C_VISIBILITY_PRESET hidden) set(OQS_VERSION_MAJOR 0) set(OQS_VERSION_MINOR 12) set(OQS_VERSION_PATCH 0) -set(OQS_VERSION_PRE_RELEASE "-rc1") +set(OQS_VERSION_PRE_RELEASE "") set(OQS_VERSION_TEXT "${OQS_VERSION_MAJOR}.${OQS_VERSION_MINOR}.${OQS_VERSION_PATCH}${OQS_VERSION_PRE_RELEASE}") set(OQS_COMPILE_BUILD_TARGET "${CMAKE_SYSTEM_PROCESSOR}-${CMAKE_HOST_SYSTEM}") set(OQS_MINIMAL_GCC_VERSION "7.1.0") diff --git a/RELEASE.md b/RELEASE.md index c03d07a1f..8eb8573ba 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -1,5 +1,5 @@ -liboqs version 0.12.0-rc1 -========================= +liboqs version 0.12.0 +===================== About ----- @@ -27,7 +27,7 @@ liboqs can also be used in the following programming languages via language-spec Release notes ============= -This is release candidate 1 for version 0.12.0 of liboqs. It was released on November 29, 2024. +This is version 0.12.0 of liboqs. It was released on December 6, 2024. This release updates the ML-DSA implementation to the [final FIPS 204](https://csrc.nist.gov/pubs/fips/204/final) version. This release still includes the NIST Round 3 version of Dilithium for interoperability purposes, but we plan to remove Dilithium Round 3 in a future release. @@ -38,6 +38,11 @@ This will be the last release of liboqs to include Kyber (that is, the NIST Roun The addition of ML-DSA FIPS 204 final version to liboqs has introduced a new signature API which includes a context string parameter. We are planning to remove the old version of the API without a context string in the next release to streamline the API and bring it in line with NIST specifications. Users who have an opinion on this removal are invited to provide input at https://github.com/open-quantum-safe/liboqs/issues/2001. +Security issues +=============== + +- CVE-2024-54137: Fixed bug in decapsulation that leads to incorrect shared secret value during decapsulation when called with an invalid ciphertext. Thank you to Célian Glénaz and Dahmun Goudarzi from Quarkslab for identifying the issue. + What's New ---------- @@ -45,7 +50,7 @@ This release continues from the 0.11.0 release of liboqs. ### Key encapsulation mechanisms -- HQC: Fixed correctness bug in decapsulation. Thank you to Célian Glénaz and Dahmun Goudarzi from Quarkslab for identifying the issue. +- HQC: Fixed bug in decapsulation that leads to incorrect shared secret value during decapsulation when called with an invalid ciphertext. Thank you to Célian Glénaz and Dahmun Goudarzi from Quarkslab for identifying the issue. - Kyber: This is the last release of liboqs to include Kyber. - ML-KEM: Improved testing of ML-KEM. From f6b1effb744fda04817e0fd79dc5035e0f0ebfcb Mon Sep 17 00:00:00 2001 From: Douglas Stebila Date: Fri, 6 Dec 2024 11:37:47 -0500 Subject: [PATCH 2/4] Update changelog [skip ci] Signed-off-by: Douglas Stebila --- RELEASE.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/RELEASE.md b/RELEASE.md index 8eb8573ba..5c6ed1122 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -98,10 +98,13 @@ Detailed changelog * Update PLATFORMS.md / re-enable CROSS on s390x by @SWilson4 in https://github.com/open-quantum-safe/liboqs/pull/1988 * Avoid OpenSSL functions are unconditionally called at OQS_destroy by @ueno in https://github.com/open-quantum-safe/liboqs/pull/1982 * Test Improvements for ML-KEM by @abhinav-thales in https://github.com/open-quantum-safe/liboqs/pull/1947 +* Add patch to fix HQC decapsulation in https://github.com/open-quantum-safe/liboqs/commit/95f904bcaafe4cb12cfdf029347ac3b7c795308a +* Run copy_from_upstream.py in https://github.com/open-quantum-safe/liboqs/commit/cce1bfde4e52c524b087b9687020d283fbde0f24 * Fix LMS crash by @ashman-p in https://github.com/open-quantum-safe/liboqs/pull/1998 * Set ML-KEM alg_version to "FIPS203" by @SWilson4 in https://github.com/open-quantum-safe/liboqs/pull/1997 * Add ML-DSA / FIPS 204 final by @bhess in https://github.com/open-quantum-safe/liboqs/pull/1919 * Add defines for OQS version components by @dstebila in https://github.com/open-quantum-safe/liboqs/pull/2000 +* Create liboqs 0.12.0 release candidate 1 by @dstebila in https://github.com/open-quantum-safe/liboqs/pull/2006 ## New Contributors @@ -113,4 +116,4 @@ Detailed changelog * @ChinoUkaegbu made their first contribution in https://github.com/open-quantum-safe/liboqs/pull/1987 * @abhinav-thales made their first contribution in https://github.com/open-quantum-safe/liboqs/pull/1947 -**Full Changelog**: https://github.com/open-quantum-safe/liboqs/compare/0.11.0...0.12.0-rc1 +**Full Changelog**: https://github.com/open-quantum-safe/liboqs/compare/0.11.0...0.12.0 From 58fa250646280990d9ef9ae8088751f5cb1b901f Mon Sep 17 00:00:00 2001 From: Douglas Stebila Date: Fri, 6 Dec 2024 11:38:59 -0500 Subject: [PATCH 3/4] Wording in release notes [skip ci] Co-authored-by: Spencer Wilson Signed-off-by: Douglas Stebila --- RELEASE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RELEASE.md b/RELEASE.md index 5c6ed1122..97b67e4fa 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -41,7 +41,7 @@ The addition of ML-DSA FIPS 204 final version to liboqs has introduced a new sig Security issues =============== -- CVE-2024-54137: Fixed bug in decapsulation that leads to incorrect shared secret value during decapsulation when called with an invalid ciphertext. Thank you to Célian Glénaz and Dahmun Goudarzi from Quarkslab for identifying the issue. +- CVE-2024-54137: Fixed bug in HQC decapsulation that leads to incorrect shared secret value during decapsulation when called with an invalid ciphertext. Thank you to Célian Glénaz and Dahmun Goudarzi from Quarkslab for identifying the issue. What's New ---------- From 5b1fe6a180c9d442e1572e57913281df471facae Mon Sep 17 00:00:00 2001 From: Douglas Stebila Date: Mon, 9 Dec 2024 20:27:13 -0500 Subject: [PATCH 4/4] Update release date [skip ci] Signed-off-by: Douglas Stebila --- RELEASE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RELEASE.md b/RELEASE.md index 97b67e4fa..0c10a8fae 100644 --- a/RELEASE.md +++ b/RELEASE.md @@ -27,7 +27,7 @@ liboqs can also be used in the following programming languages via language-spec Release notes ============= -This is version 0.12.0 of liboqs. It was released on December 6, 2024. +This is version 0.12.0 of liboqs. It was released on December 9, 2024. This release updates the ML-DSA implementation to the [final FIPS 204](https://csrc.nist.gov/pubs/fips/204/final) version. This release still includes the NIST Round 3 version of Dilithium for interoperability purposes, but we plan to remove Dilithium Round 3 in a future release.