-
Notifications
You must be signed in to change notification settings - Fork 1
/
releasenotes.html
1497 lines (1444 loc) · 93.7 KB
/
releasenotes.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<html>
<head>
<title>Bouncy Castle Crypto Package - Release Notes</title>
</head>
<body bgcolor="#ffffff" text="#000000#">
<center>
<h1>Bouncy Castle Crypto Package - Release Notes</h1>
<font size=1>
<pre>
</pre>
</font>
</center>
<h2>1.0 Introduction</h2>
The Bouncy Castle Crypto package is a Java implementation of
cryptographic algorithms. The package is organised so that it
contains a light-weight API suitable for use in any environment
(including the newly released J2ME) with the additional infrastructure
to conform the algorithms to the JCE framework.
<p>
<h2>2.0 Release History</h2>
<h3>2.1.1 Version</h3>
Release 1.50
<h3>2.1.2 Defects Fixed</h3>
<ul>
<li>The DualECSP800DRBG sometimes truncated the last block in the generated stream incorrectly. This has been fixed.</li>
<li>Keys produced from RSA certificates with specialised parameters would lose the parameter settings. This has been fixed.</li>
<li>OAEP parameters were being ignored on CMS key trans recipient processing. This has been fixed.</li>
</ul>
<h3>2.2.3 Additional Features and Functionality</h3>
<ul>
<li>Addtional work has been done on CMS recipient generation to simplify the generation of OAEP encrypted messages and allow for non-default parameters.</li>
<li>OCB implementation updated to account for changes in draft-irtf-cfrg-ocb-03.</li>
<li>RFC 6637 ECDSA support has been added to the OpenPGP API.</li>
</ul>
<h3>2.2.1 Version</h3>
Release 1.49
<h3>2.2.2 Defects Fixed</h3>
<ul>
<li>Occasional ArrayOutOfBounds exception in DSTU-4145 signature generation has been fixed.</li>
<li>The handling of escaped characters in X500 names is much improved.</li>
<li>The BC CertificateFactory no longer returns null for CertificateFactory.getCertPathEncodings().</li>
<li>PKCS10CertificationRequestBuilder now encodes no attributes as empty by default. Encoding as absent is still available via a boolean flag.</li>
<li>DERT61String has been reverted back to its previous implementation. A new class DERT61UTF8String has been introduced which defaults to UTF-8 encoding.</li>
<li>OAEPEncoding could throw an array output bounds exception for small keys with large mask function digests. This has been fixed.</li>
<li>PEMParser would throw a NullPointerException if it ran into explicit EC curve parameters, it would also throw an Exception if the named curve was not already defined. The parser now returns X9ECParmameters for explicit parameters and returns an ASN1ObjectIdentifier for a named curve.</li>
<li>The V2TBSCertListGenerator was adding the wrong date type for CRL invalidity date extensions. This has been fixed.</li>
</ul>
<h3>2.2.3 Additional Features and Functionality</h3>
<ul>
<li>A SecretKeyFactory has been added that enables use of PBKDF2WithHmacSHA.</li>
<li>Support has been added to PKCS12 KeyStores and PfxPdu to handle PKCS#5 encrypted private keys.</li>
<li>Support has been added for SHA-512/224, SHA-512/256, as well as a general SHA-512/t in the lightweight API.</li>
<li>The JcaPGPPrivateKey class has been added to provide better support in the PGP API for HSM private keys.</li>
<li>A new KeyStore type, BKS-V1, has been added for people needing to create key stores compatible with earlier versions of Bouncy Castle.</li>
<li>Some extra generation methods have been added to TimeStampResponseGenerator to allow more control in the generation of TimeStampResponses.</li>
<li>It is now possible to override the SignerInfo attributes during TimeStampTokenGeneration.</li>
<li>The TSP API now supports generation of certIDs based on digests other than SHA-1.</li>
<li>OCSP responses can now be included in CMS SignedData objects.</li>
<li>The SipHash MAC algorithm has been added to the lightweight API and the provider.</li>
<li>ISO9796-2 PSS signatures can now be initialised with a signature to allow the signer to deal with odd recovered message lengths on verification.</li>
<li>The 4 DRBGs described in NIST SP 800-90A have been added to the prng package together with SecureRandom builders.</li>
<li>Support has been added for OCB mode in the lightweight API.</li>
<li>DSA version 2 parameter and key generation is now supported in the provider and lightweight API.</li>
<li>A new interface Memoable has been added for objects that can copy in and out their state. The digest classes now support this. A special
class NonMemoableDigest has been added which hides the Memoable interface where it should not be available.</li>
<li>TDEA is now recognised as an alias for DESede.</li>
<li>A new package org.bouncycastle.crypto.ec has been introduced to the light wieght API with a range of EC based cryptographic operators.</li>
<li>The OpenPGP API now supports password changing on V3 keys if the appropriate PBEKeyEncryptor is used.</li>
<li>The OpenPGP API now supports password changing on secret key rings where only the private keys for the subkeys have been exported.</li>
<li>Support has been added to the lightweight API for RSA-KEM and ECIES-KEM.</li>
<li>Support has been added for NIST SP 800-38D - GMAC to AES and other 128 bit block size algorithms.</li>
<li>The org.bouncycastle.crypto.tls package has been extended to support client and server side TLS 1.1.</li>
<li>The org.bouncycastle.crypto.tls package has been extended to support client and server side DTLS 1.0.</li>
<li>A basic commitment package has been introduced into the lightweight API containing a digest based commitment scheme.</li>
</ul>
<h3>2.2.4 Notes</h3>
<ul>
<li>The NTRU implementation has been moved into the org.bouncycastle.pqc package hierarchy.</li>
<li>The change to PEMParser to support explicit EC curves is not backward compatible. If you run into a named curve you need to use org.bouncycastle.asn1.x9.ECNamedCurveTable.getByOID() to look the curve up if required.</li>
</ul>
<h3>2.3.1 Version</h3>
Release 1.48
<h3>2.3.2 Defects Fixed</h3>
<ul>
<li>Occasional key compatibility issues in IES due to variable length keys have been fixed.</li>
<li>PEMWriter now recognises the new PKCS10CertificationRequest object.</li>
<li>The provider implementation for RSA now resets when the init method is called.</li>
<li>SignerInformation has been rewritten to better support signers without any associated signed attributes.</li>
<li>An issue with an incorrect version number of SignedData associated with the use of SubjectKeyIdentifiers has now been fixed.</li>
<li>An issue with the equals() check in BCStrictStyle has been fixed.</li>
<li>The BC SSL implementation has been modified to deal with the "Lucky Thirteen" attack.</li>
<li>A regression in 1.47 which prevented key wrapping with regular symmetric PBE algorihtms has been fixed.</li>
</ul>
<h3>2.3.3 Additional Features and Functionality</h3>
<ul>
<li>IES now supports auto generation of ephemeral keys in both the JCE and the lightweight APIs.</li>
<li>A new class PEMParser has been added to return the new CertificateHolder and Request objects introduced recently.</li>
<li>An implementation of Password Authenticated Key Exchange by Juggling (J-PAKE) has now been added to the lightweight API.</li>
<li>Support has now been added for the DSTU-4145-2002 to the lightweight API and the provider.</li>
<li>The BC X509Certificate implementation now provides support for the JCA methods X509Certificate.getSubjectAlternativeNames() and X509Certificate.getIssuerAlternativeNames().</li>
<li>PEMReader can now be configured to support different providers for encyrption and public key decoding.</li>
<li>Some extra DSA OIDs have been added to the supported list for the provider.</li>
<li>The BC provider will now automatically try to interpret other provider software EC private keys. It is no longer necessary to use a KeyFactory for conversion.</li>
<li>A new provider, the BCPQ (for BC Post Quantum) provider has been added with support for the Rainbow signature algorithm and the McEliece family of encryption algorithms.</li>
<li>Support has been added for the SHA3 family of digests to both the provider and the lightweight API.</li>
<li>T61String now uses UTF-8 encoding by default rather than a simple 8 bit transform.</li>
</ul>
<h3>2.4.1 Version</h3>
Release 1.47
<h3>2.4.2 Defects Fixed</h3>
<ul>
<li>OpenPGP ID based certifications now support UTF-8. Note: this may mean that some old certifications no longer validate - if this happens a retry can be added using by converting the ID using Strings.fromByteArray(Strings.toByteArray(id)) - this will strip out the top byte in each character.</li>
<li>IPv4/IPv6 parsing in CIDR no longer assumes octet boundaries on a mask.</li>
<li>The CRL PKIX routines will now only rebuild the CRL as a last resort when looking for the certificate issuer.</li>
<li>The DEK-Info header in PEM generation was lower case. It is now upper case in accordance with RFC 1421.</li>
<li>An occasional issue causing an OutOfMemoryException for PGP compressed data generation has now been fixed.</li>
<li>An illegal argument exception that could occur with multi-valued RDNs in the X509v3CertificateBuilder has been fixed.</li>
<li>Shared secret calculation in IES could occasionally add a leading zero byte. This has been fixed.</li>
<li>PEMReader would choke on a private key with an empty password. This has been fixed.</li>
<li>The default MAC for a BKS key store was 2 bytes, this has been upgraded to 20 bytes.</li>
<li>BKS key store loading no longer freezes on negative iteration counts.</li>
<li>A regression in 1.46 which prevented parsing of PEM files with extra text at the start has been fixed.</li>
<li>CMS secret key generation now attempts to stop use of invalid lengths with OIDs that predefine a key length.</li>
<li>Check of DH parameter L could reject some valid keys. This is now fixed.</li>
</ul>
<h3>2.4.3 Additional Features and Functionality</h3>
<ul>
<li>Support is now provided via the RepeatedKey class to enable IV only re-initialisation in the JCE layer. The same effect can be acheived in the light weight API by using null as the key parameter when creating a ParametersWithIV object.</li>
<li>CRMF now supports empty poposkInput.</li>
<li>The OpenPGP API now supports operator based interfaces for most operations and lightweight implementations have been added for JCE related functionality.</li>
<li>JcaSignerId and JceRecipientId will now match on serial number, issuer, and the subject key identifier if it's available.</li>
<li>CMS Enveloped and AuthenticatedData now support OriginatorInfo.</li>
<li>NTRU encryption and signing is now provided in the lightweight source and the ext version of the provider.</li>
<li>There is now API support for Extended Access Control (EAC).</li>
<li>The performance of CertPath building and validation has been improved.</li>
<li>The TLS Java Client API has been updated to make support for GSI GSSAPI possible.</li>
<li>Support for ECDSA_fixed_ECDH authentication has been added to the TLS client.</li>
<li>Support for the Features signature sub-packet has been added to the PGP API.</li>
<li>The number of lightweight operators for PGP and CMS/SMIME has been increased.</li>
<li>Classes involved in CRL manipulation have been rewritten to reduce memory requirements for handling and parsing extremely large CRLs.</li>
<li>RFC 5751 changed the definition of the micalg parameters defined in RFC 3851. The SMIMESignedGenerator is now up to date with the latest micalg parameter set and a constructor has been added to allow the old micalg parameter set to be used.</li>
<li>An operator based framework has been added for processing PKCS#8 and PKCS#12 files.</li>
<li>The J2ME lcrypto release now includes higher level classes for handling PKCS, CMS, CRMF, CMP, EAC, OpenPGP, and certificate generation.</li>
</ul>
<h3>2.4.4 Other notes</h3>
<p>
Okay, so we have had to do another release. The issue we have run into is that we probably didn't go far enough in 1.46, but we are now confident that moving from this release to 2.0 should be largely just getting rid of deprecated methods. While this release does change a lot it is relatively straight forward to do a port and we have a <a href="http://www.bouncycastle.org/wiki/display/JA1/Porting+from+earlier+BC+releases+to+1.47+and+later">porting guide</a> which explains the important ones. The area there has been the most change in is the ASN.1 library which was in bad need of a rewrite after 10 years of patching. On the bright side the rewrite did allow us to eliminate a few problems and bugs in the ASN.1 library, so we have some hope anyone porting to it will also have similar benefits. As with 1.46 the other point of emphasis has been making sure interface support is available for operations across the major APIs, so the lightweight API or some local role your own methods can be used instead for doing encryption and signing.
</p>
<h3>2.5.1 Version</h3>
Release 1.46
<h3>2.5.2 Defects Fixed</h3>
<ul>
<li>An edge condition in ECDSA which could result in an invalid signature has been fixed.</li>
<li>Exhaustive testing has been performed on the ASN.1 parser, eliminating another potential OutOfMemoryException and several escaping run time exceptions.</li>
<li>BC generated certificates generated different hashCodes from other equivalent implementations. This has been fixed.</li>
<li>Parsing an ESSCertIDv2 would fail if the object did not include an IssuerSerialNumber. This has been fixed.</li>
<li>DERGeneralizedTime.getDate() would produce incorrect results for fractional seconds. This has been fixed.</li>
<li>PSSSigner would produce incorrect results if the MGF digest and content digest were not the same. This has been fixed.</li>
</ul>
<h3>2.5.3 Additional Features and Functionality</h3>
<ul>
<li>A null genTime can be passed to TimeStampResponseGenerator.generate() to generate timeNotAvailable error responses.</li>
<li>Support has been added for reading and writing of openssl PKCS#8 encrypted keys.</li>
<li>New streams have been added for supporting general creation of PEM data, and allowing for estimation of output size on generation. Generators have been added for some of the standard OpenSSL objects.</li>
<li>CRL searching for CertPath validation now supports the optional algorithm given in Section 6.3.3 of RFC 5280, allowing the latest CRL to be used for a set time providing the certificate is unexpired.</li>
<li>AES-CMAC and DESede-CMAC have been added to the JCE provider.</li>
<li>Support for CRMF (RFC 4211) and CMP (RFC 4210) has been added.</li>
<li>BufferedBlockCipher will now always reset after a doFinal().</li>
<li>Support for CMS TimeStampedData (RFC 5544) has been added.</li>
<li>JCE EC keypairs are now serialisable.</li>
<li>TLS now supports client-side authentication.</li>
<li>TLS now supports compression.</li>
<li>TLS now supports ECC cipher suites (RFC 4492).</li>
<li>PGP public subkeys can now be separately decoded and encoded.</li>
<li>An IV can now be passed to an ISO9797Alg3Mac.</li>
</ul>
<h3>2.5.4 Other notes</h3>
<p>
Baring security patches we expect 1.46 will be the last of the 1.* releases. The next release of
BC will be version 2.0. For this reason a lot of things in 1.46 that relate to CMS have been deprecated and
new methods have been added to the CMS and certificate handling APIs which provide greater flexibility
in how digest and signature algorithms get used. It is now possible to use the lightweight API or a simple
custom API with CMS and for certificate generation. In addition a lot of methods and some classes that were
deprecated for reasons of been confusing, or in some cases just plan wrong, have been removed.
</p>
<p>
So there are four things useful to know about this release:
<ul>
<li>It's not a simple drop in like previous releases, if you wish migrate to it you will need to recompile your application.</li>
<li>If you avoid deprecated methods it should be relatively painless to move to version 2.0</li>
<li>The X509Name class will utlimately be replacde with the X500Name class, the getInstance() methods on both these classes allow conversion from one type to another.</li>
<li>The org.bouncycastle.cms.RecipientId class now has a collection of subclasses to allow for more specific recipient matching. If you are creating your own recipient ids you should use the constructors for the subclasses rather than relying on the set methods inherited from X509CertSelector. The dependencies on X509CertSelector and CertStore will be removed from the version 2 CMS API.</li>
</ul>
</p>
<h3>2.6.1 Version</h3>
Release 1.45
<h3>2.6.2 Defects Fixed</h3>
<ul>
<li>OpenPGP now supports UTF-8 in file names for literal data.</li>
<li>The ASN.1 library was losing track of the stream limit in a couple of places, leading to the potential of an OutOfMemoryError on a badly corrupted stream. This has been fixed.</li>
<li>The provider now uses a privileged block for initialisation.</li>
<li>JCE/JCA EC keys are now serialisable.</li>
</ul>
<h3>2.6.3 Additional Features and Functionality</h3>
<ul>
<li>Support for EC MQV has been added to the light weight API, provider, and the CMS/SMIME library.</li>
</ul>
<h3>2.6.4 Security Advisory</h3>
<ul>
<li>This version of the provider has been specifically reviewed to eliminate possible timing attacks on algorithms such as GCM and CCM mode.</li>
</ul>
<h3>2.7.1 Version</h3>
Release 1.44
<h3>2.7.2 Defects Fixed</h3>
<ul>
<li>The reset() method in BufferedAsymmetricBlockCipher is now fully clearing the buffer.</li>
<li>Use of ImplicitlyCA with KeyFactory and Sun keyspec no longer causes NullPointerException.</li>
<li>X509DefaultEntryConverter was not recognising telephone number as a PrintableString field. This has been fixed.</li>
<li>The SecureRandom in the J2ME was not using a common seed source, which made cross seeeding of SecureRandom's impossible. This has been fixed.</li>
<li>Occasional uses of "private final" on methods were causing issues with some J2ME platforms. The use of "private final" on methods has been removed.</li>
<li>NONEwithDSA was not resetting correctly on verify() or sign(). This has been fixed.</li>
<li>Fractional seconds in a GeneralisedTime were resulting in incorrect date conversions if more than 3 decimal places were included due to the Java date parser. Fractional seconds are now truncated to 3 decimal places on conversion.</li>
<li>The micAlg in S/MIME signed messages was not always including the hash algorithm for previous signers. This has been fixed.</li>
<li>SignedMailValidator was only including the From header and ignoring the Sender header in validating the email address. This has been fixed.</li>
<li>The PKCS#12 keystore would throw a NullPointerException if a null password was passed in. This has been fixed.</li>
<li>CertRepMessage.getResponse() was attempting to return the wrong underlying field in the structure. This has been fixed.</li>
<li>PKIXCertPathReviewer.getTrustAnchor() could occasionally cause a null pointer exception or an exception due to conflicting trust anchors. This has been fixed.</li>
<li>Handling of explicit CommandMap objects with the generation of S/MIME messages has been improved.</li>
</ul>
<h3>2.7.3 Additional Features and Functionality</h3>
<ul>
<li>PEMReader/PEMWriter now support encrypted EC keys.</li>
<li>BC generated EC private keys now include optional fields required by OpenSSL.</li>
<li>Support for PSS signatures has been added to CMS and S/MIME.</li>
<li>CMS processing will attempt to recover if there is no AlgorithmParameters object for a provider and use an IvParameterSpec where possible.</li>
<li>CertificateID always required a provider to be explicitly set. A null provider is now interpreted as a request to use the default provider.</li>
<li>SubjectKeyIdentifier now supports both methods specified in RFC 3280, section 4.2.1.2 for generating the identifier.</li>
<li>Performance of GCM mode has been greatly improved (on average 10x).</li>
<li>The BC provider has been updated to support the JSSE in providing ECDH.</li>
<li>Support for mac lengths of 96, 104, 112, and 120 bits has been added to existing support for 128 bits in GCMBlockCipher.</li>
<li>General work has been done on trying to propagate exception causes more effectively.</li>
<li>Support for loading GOST 34.10-2001 keys has been improved in the provider.</li>
<li>Support for raw signatures has been extended to RSA and RSA-PSS in the provider. RSA support can be used in CMSSignedDataStreamGenerator to support signatures without signed attributes.</li>
</ul>
<h3>2.8.1 Version</h3>
Release 1.43
<h3>2.8.2 Defects Fixed</h3>
<ul>
<li>Multiple countersignature attributes are now correctly collected.</li>
<li>Two bugs in HC-128 and HC-256 related to sign extension and byte swapping have been fixed. The implementations now pass the latest ecrypt vector tests.</li>
<li>X509Name.hashCode() is now consistent with equals.</li>
</ul>
<h3>2.8.3 Security Advisory</h3>
<ul>
<li>The effect of the sign extension bug was to decrease the key space the HC-128 and HC-256 ciphers were operating in and the byte swapping inverted every 32 bits of the generated stream. If you are using either HC-128 or HC-256 you must upgrade to this release.</li>
</ul>
<h3>2.9.1 Version</h3>
Release 1.42
<h3>2.9.2 Defects Fixed</h3>
<ul>
<li>A NullPointer exception which could be result from generating a diffie-hellman key has been fixed.</li>
<li>CertPath validation could occasionally mistakenly identify a delta CRL. This has been fixed.</li>
<li>'=' inside a X509Name/X509Principal was not being properly escaped. This has been fixed.</li>
<li>ApplicationSpecific ASN.1 tags are now recognised in BER data. The getObject() method now handles processing of arbitrary tags.</li>
<li>X509CertStoreSelector.getInstance() was not propagating the subjectAlternativeNames attribute. This has been fixed.</li>
<li>Use of the BC PKCS#12 implementation required the BC provider to be registered explicitly with the JCE. This has been fixed.</li>
<li>OpenPGP now fully supports use of the Provider object.</li>
<li>CMS now fully supports use of the Provider object.</li>
<li>Multiplication by negative powers of two is fixed in BigInteger.</li>
<li>OptionalValidity now encodes correctly.</li>
</ul>
<h3>2.9.3 Additional Features and Functionality</h3>
<ul>
<li>Support for NONEwithECDSA has been added.</li>
<li>Support for Grainv1 and Grain128 has been added.</li>
<li>Support for EAC algorithms has been added to CMS/SMIME.</li>
<li>Support for basic CMS AuthenticatedData to the CMS package.</li>
<li>Jars are now packaged using pack200 for JDK1.5 and JDK 1.6.</li>
<li>ASN1Dump now supports a verbose mode for displaying the contents of octet and bit strings.</li>
<li>Support for the SRP-6a protocol has been added to the lightweight API.</li>
</ul>
<h3>2.10.1 Version</h3>
Release 1.41
<h3>2.10.2 Defects Fixed</h3>
<ul>
<li>The GeneralName String constructor now supports IPv4 and IPv6 address parsing.</li>
<li>An issue with nested-multiparts with postamble for S/MIME that was causing signatures to fail verification has been fixed.</li>
<li>ESSCertIDv2 encoding now complies with RFC 5035.</li>
<li>ECDSA now computes correct signatures for oversized hashes when the order of the base point is not a multiple of 8 in compliance with X9.62-2005.</li>
<li>J2ME SecureRandom now provides additional protection against predictive and backtracking attacks when high volumes of random data are generated.</li>
<li>Fix to regression from 1.38: PKIXCertPathCheckers were not being called on intermediate certificates.</li>
<li>Standard name "DiffieHellman" is now supported in the provider.</li>
<li>Better support for equality tests for '#' encoded entries has been added to X509Name.</li>
</ul>
<h3>2.10.3 Additional Features and Functionality</h3>
<ul>
<li>Camellia is now 12.5% faster than previously.</li>
<li>A smaller version (around 8k compiled) of Camellia, CamelliaLightEngine has also been added.</li>
<li>CMSSignedData generation now supports SubjectKeyIdentifier as well as use of issuer/serial.</li>
<li>A CMSPBE key holder for UTF8 keys has been added to the CMS API.</li>
<li>Salt and iteration count can now be recovered from PasswordRecipientInformation.</li>
<li>Methods in the OpenPGP, CMS, and S/MIME APIs which previously could only take provider names can now take providers objects as well (JDK1.4 and greater).</li>
<li>Support for reading and extracting personalised certificates in PGP Secret Key rings has been added.</li>
</ul>
<h3>2.11.1 Version</h3>
Release 1.40
<h3>2.11.2 Defects Fixed</h3>
<ul>
<li>EAX mode ciphers were not resetting correctly after a doFinal/reset. This has been fixed.</li>
<li>The SMIME API was failing to verify doubly nested multipart objects in signatures correctly. This has been fixed.</li>
<li>Some boolean parameters to IssuingDistributionPoint were being reversed. This has been fixed.</li>
<li>A zero length RDN would cause an exception in an X509Name. This has been fixed.</li>
<li>Passing a null to ExtendedPKIXParameters.setTrustedACIssuers() would cause a NullPointerException. This has been fixed.</li>
<li>CertTemplate was incorrectly encoding issuer and subject fields when set.</li>
<li>hashCode() for X509CertificateObject was very poor. This has been fixed.<li>
<li>Specifying a greater than 32bit length for a stream and relying on the default BCPGOutputStream resulted in corrupted data. This has been fixed.</li>
<li>PKCS7Padding validation would not fail if pad length was 0. This has been fixed.</li>
<li>javax.crypto classes no longer appear in the JDK 1.3 provider jar.</li>
<li>Signature creation time was not being properly initialised in new V4 PGP signature objects although the encoding was correct. This has been fixed.</li>
<li>The '+' character can now be escaped or quoted in the constructor for X509Name, X509Prinicipal.</li>
<li>Fix to regression from 1.38: PKIXCertPathValidatorResult.getPublicKey was returning the wrong public key when the BC certificate path validator was used.</li>
</ul>
<h3>2.11.3 Additional Features and Functionality</h3>
<ul>
<li>Galois/Counter Mode (GCM) has been added to the lightweight API and the JCE provider.</li>
<li>SignedPublicKeyAndChallenge and PKCS10CertificationRequest can now take null providers if you need to fall back to the default provider mechanism.</li>
<li>The TSP package now supports validation of responses with V2 signing certificate entries.</li>
<li>Unnecessary local ID attributes on certificates in PKCS12 files are now automatically removed.</li>
<li>The PKCS12 store types PKCS12-3DES-3DES and PKCS12-DEF-3DES-3DES have been added to support generation of PKCS12 files with both certificates and keys protected by 3DES.</li>
</ul>
<h3>2.11.4 Additional Notes</h3>
<ul>
<li>Due to problems for some users caused by the presence of the IDEA algorithm, an implementation is no longer included in the default signed jars. Only the providers of the form bcprov-ext-*-*.jar now include IDEA.</li>
</ul>
<h3>2.12.1 Version</h3>
Release 1.39
<h3>2.12.2 Defects Fixed</h3>
<ul>
<li>A bug causing the odd NullPointerException has been removed from the LocalizedMessage class.</li>
<li>IV handling in CMS for the SEED and Camellia was incorrect. This has been fixed.</li>
<li>ASN.1 stream parser now throws exceptions for unterminated sequences.</li>
<li>EAX mode was not handling non-zero offsetted data correctly and failing. This has been fixed.</li>
<li>The BC X509CertificateFactory now handles multiple certificates and CRLs in streams that don't support marking.</li>
<li>The BC CRL implementation could lead to a NullPointer exception being thrown if critical extensions were missing. This has been fixed.</li>
<li>Some ASN.1 structures would cause a class cast exception in AuthorityKeyIdentifier. This has been fixed.</li>
<li>The CertID class used by the TSP library was incomplete. This has been fixed.</li>
<li>A system property check in PKCS1Encoding to cause a AccessControlException under some circumstances. This has been fixed.</li>
<li>A decoding issue with a mis-identified tagged object in CertRepMessage has been fixed.</li>
<li>\# is now properly recognised in the X509Name class.</li>
</ul>
<h3>2.10.3 Additional Features and Functionality</h3>
<ul>
<li>Certifications associated with user attributes can now be created, verified and removed in OpenPGP.</li>
<li>API support now exists for CMS countersignature reading and production.</li>
<li>The TSP package now supports parsing of responses with V2 signing certificate entries.</li>
<li>Lazy evaluation of DER sequences has been introduced to ASN1InputStream to allow support for larger sequences.</li>
<li>KeyPurposeId class has been updated for RFC 4945.</li>
<li>CertPath processing has been further extended to encompass the NIST CertPath evaluation suite.</li>
<li>Initial support has been added for HP_CERTIFICATE_REQUEST in the TLS API.</li>
<li>Providers for JDK 1.4 and up now use SignatureSpi directly rather than extending Signature. This is more in track with the way dynamic provider selection now works.</li>
<li>PGP example programs now handle blank names in literal data objects.</li>
<li>The ProofOfPossession class now better supports the underlying ASN.1 structure.</li>
<li>Support has been added to the provider for the VMPC MAC.</li>
</ul>
<h3>2.13.1 Version</h3>
Release 1.38
<h3>2.13.2 Defects Fixed</h3>
<ul>
<li>SMIME signatures containing non-standard quote-printable data could be altered by SMIME encryption. This has been fixed.</li>
<li>CMS signatures that do not use signed attributes were vulnerable to one of Bleichenbacher's RSA signature forgery attacks. This has been fixed.</li>
<li>The SMIMESignedParser(Part) constructor was not producing a content body part that cleared itself after writeTo() as indicated in the JavaDoc. This has been fixed.</li>
<li>BCPGInputStream now handles data blocks in the 2**31->2**32-1 range.</li>
<li>A bug causing second and later encrypted objects to be ignored in KeyBasedFileProcessor example has been fixed.</li>
<li>Value of the TstInfo.Tsa field is now directly accessible from TimeStampTokenInfo.</li>
<li>Generating an ECGOST-3410 key using an ECGenParameterSpec could cause a ClassCastException in the key generator. This has been fixed.</li>
<li>Use of the parameters J and L in connection with Diffie-Hellman parameters in the light weight API was ambiguous and confusing. This has been dealt with.</li>
<li>Some entities were not fully removed from a PKCS#12 file when deleted due to case issues. This has been fixed.</li>
<li>Overwriting entities in a PKCS#12 file was not fully compliant with the JavaDoc for KeyStore. This has been fixed.</li>
<li>TlsInputStream.read() could appear to return end of file when end of file had not been reached. This has been fixed.</li>
</ul>
<h3>2.13.3 Additional Features and Functionality</h3>
<ul>
<li>Buffering in the streaming CMS has been reworked. Throughput is now usually higher and the behaviour is more predictable.</li>
<li>It's now possible to pass a table of hashes to a CMS detached signature rather than having to always pass the data.</li>
<li>Classes supporting signature policy and signer attributes have been added to the ASN.1 ESS/ESF packages.</li>
<li>Further work has been done on optimising memory usage in ASN1InputStream. In some cases memory usage has been reduced to 25% of previous.</li>
<li>Pre-existing signers can now be added to the SMIMESignedGenerator.</li>
<li>Support has been added to the provider for the VMPC stream cipher.</li>
<li>CertPathReviewer has better handling for problem trust anchors.</li>
<li>Base64 encoder now does initial size calculations to try to improve resource usage.</li>
</ul>
<h3>2.14.1 Version</h3>
Release 1.37
<h3>2.14.2 Defects Fixed</h3>
<ul>
<li>The ClearSignedFileProcessor example for OpenPGP did not take into account trailing white space in
the file to be signed. This has been fixed.</li>
<li>A possible infinite loop in the CertPathBuilder and SignedMailValidator have been removed.</li>
<li>Requesting DES, DESede, or Blowfish keys using regular Diffie-Hellman now returns the same length keys as the regular JCE provider.</li>
<li>Some uncompressed EC certificates were being interpreted as compressed and causing an exception. This has been fixed.</li>
<li>Adding a CRL with no revocations on it to the CRL generator could cause an exception to be thrown. This has been fixed.</li>
<li>Using the default JDK provider with the CMS library would cause exceptions in some circumstances. This has been fixed.</li>
<li>BC provider DSAKeys are now serializable.</li>
<li>Using only a non-sha digest in S/MIME signed data would produce a corrupt MIME header. This has been fixed.</li>
<li>The default private key length in the lightweght API for generated DiffieHellman parameters was absurdly small, this has been fixed.</li>
<li>Cipher.getParameters() for PBEwithSHAAndTwofish-CBC was returning null after intialisation. This has been fixed.</li>
</ul>
<h3>2.14.3 Additional Features and Functionality</h3>
<ul>
<li>The block cipher mode CCM has been added to the provider and light weight API.</li>
<li>The block cipher mode EAX has been added to the provider and light weight API.</li>
<li>The stream cipher HC-128 and HC-256 has been added to the provider and lightwieght API.</li>
<li>The stream cipher ISAAC has been added to the lightweight API.</li>
<li>Support for producing and parsing notation data signature subpackets has been added to OpenPGP.</li>
<li>Support for implicit tagging has been added to DERApplicationSpecific.</li>
<li>CMS better supports basic Sun provider.</li>
<li>A full set of SEC-2 EC curves is now provided in the SEC lookup table.</li>
<li>Specifying a null provider in CMS now always uses the default provider, rather than causing an exception.</li>
<li>Support has been added to the OpenPGP API for parsing experimental signatures</li>
<li>CertPath validator now handles inherited DSA parameters and a wider range of name constraints.</li>
<li>Further work has been done on improving the performance of ECDSA - it is now about two to six times faster depending on the curve.</li>
<li>The Noekeon block cipher has been added to the provider and the lightweight API.</li>
<li>Certificate generation now supports generation of certificates with an empty Subject if the subjectAlternativeName extension is present.</li>
<li>The JCE provider now supports RIPEMD160withECDSA.</li>
</ul>
<h3>2.15.1 Version</h3>
Release 1.36
<h3>2.15.2 Defects Fixed</h3>
<ul>
<li>DSA key generator now checks range and keysize.</li>
<li>Class loader issues with i18n classes should now be fixed.</li>
<li>X.500 name serial number value now output as unambiguous long form SERIALNUMBER</li>
<li>The fix for multipart messages with mixed content-transfer-encoding in 1.35 caused a
regression for processing some messages with embedded multiparts that contained blank lines of preamble text - this should now be fixed.</li>
<li>Another regression which sometimes affected the SMIMESignedParser has also been fixed.</li>
<li>SharedFileInputStream compatibility issues with JavaMail 1.4 have been addressed.</li>
<li>JDK 1.5 and later KeyFactory now accepts ECPublicKey/ECPrivateKey to translateKey.</li>
<li>JDK 1.5 and later KeyFactory now produces ECPublicKeySpec/ECPrivateKeySpec on getKeySpec.</li>
<li>Some surrogate pairs were not assembled correctly by the UTF8 decoder. This has been fixed.</li>
<li>Alias resolution in PKCS#12 is now case insensitive.</li>
</ul>
<h3>2.15.3 Additional Features and Functionality</h3>
<ul>
<li>CMS/SMIME now supports basic EC KeyAgreement with X9.63.</li>
<li>CMS/SMIME now supports RFC 3211 password based encryption.</li>
<li>Support has been added for certificate, CRL, and certification request generation for the regular SHA algorithms with RSA-PSS.</li>
<li>Further work has been done in speeding up prime number generation in the lightweight BigInteger class.</li>
<li>Support for the SEED algorithm has been added to the provider and the lightweight API.</li>
<li>Support for the Salsa20 algorithm has been added to the provider and the lightweight API.</li>
<li>CMS/SMIME now support SEED and Camellia</li>
<li>A table of TeleTrusT curves has been added.</li>
<li>CMSSignedData creation and Collection CertStore now preserves the order of certificates/CRls if the backing collection is ordered.</li>
<li>CMS Signed objects now use BER encoding for sets containing certificates and CRLs, allowing specific ordering to be specified for the objects contained.</li>
<li>CMS enveloped now works around providers which throw UnsupportedOperationException if key wrap is attempted.</li>
<li>DSASigner now handles long messages. SHA2 family digest support for DSA has been added to the provider.</li>
</ul>
<h3>2.16.1 Version</h3>
Release 1.35
<h3>2.16.2 Defects Fixed</h3>
<ul>
<li>Test data files are no longer in the provider jars.</li>
<li>SMIMESignedParser now handles indefinite length data in SignerInfos.</li>
<li>Under some circumstances the SMIME library was failing to canonicalize mixed-multipart data correctly. This has been fixed.</li>
<li>The l parameter was being ignored for the DH and ElGamal key generation. This has been fixed.</li>
<li>The ASN1Sequence constructor for OtherRecipientInfo was broken. It has been fixed</li>
<li>Regression - DN fields SerialNumber and Country were changed to encode as UTF8String in 1.34 in the X509DefaultEntryConverter, these now encode as PrintableString.</li>
<li>CMSSignedData.replaceSigners() was not replacing the digest set as well as the signers. This has been fixed.</li>
<li>DERGeneralizedTime produced a time string without a GMT offset if they represented local time. This has been fixed.</li>
<li>Some temp files were still being left on Windows by the SMIME library. All of the known problems have been fixed.</li>
<li>Comparing ASN.1 object for equality would fail in some circumstances. This has been fixed.
<li>The IESEngine could incorrectly encrypt data when used in block cipher mode. This has been fixed.
<li>An error in the encoding of the KEKRecipientInfo has been fixed. Compatability warning: this may mean that versions of BC mail prior to 1.35 will have trouble processing KEK messages produced by 1.35 or later.
</ul>
<h3>2.16.3 Additional Features and Functionality</h3>
<ul>
<li>Further optimisations to elliptic curve math libraries.</li>
<li>API now incorporates a CertStore which should be suitable for use with LDAP.</li>
<li>The streaming ASN.1 API is now integrated into the base one, the sasn1 package has been deprecated.</li>
<li>The OpenPGP implementation now supports SHA-224 and BZIP2.</li>
<li>The OpenPGP implementation now supports SHA-1 checksumming on secret keys.</li>
<li>The JCE provider now does RSA blinding by default.</li>
<li>CMSSignedDataParser now provides methods for replacing signers and replacing certificates and CRLs.</li>
<li>A generic store API has been added to support CRLs, Certificates and Attribute certificates.</li>
<li>The CMS/SMIME API now supports inclusion and retrieval of version 2 attribute certificates.</li>
<li>Support for generating CertificationRequests and Certificates has been added for GOST-3410-2001 (ECGOST)</li>
<li>CMS/SMIME now support ECGOST</li>
<li>Basic BER Octet Strings now encode in a canonical fashion by default.</li>
<li>DERUTCTime can now return Date objects</li>
<li>Validating constructors have been added to DERPrintableString, DERIA5String, and DERNumericString.</li>
<li>A lightweight API for supporting TLS has been added.</li>
<li>Implementations of the TEA and XTEA ciphers have been added to the light weight API and the provider.</li>
<li>PEMReader now supports OpenSSL ECDSA key pairs.</li>
<li>PGP packet streams can now be closed off using close() on the returned stream as well as closing the generator.</li>
</ul>
<h3>2.17.1 Version</h3>
Release 1.34
<h3>2.17.2 Defects Fixed</h3>
<ul>
<li>Endianess of integer conversion in KDF2BytesGenerator was incorrect. This has been fixed.
<li>Generating critical signature subpackets in OpenPGP would result in a zero packet tag. This has been fixed.
<li>Some flags in PKIFailure info were incorrect, and the range of values was incomplete. The range of values has been increased and the flags corrected.
<li>The helper class for AuthorityKeyExtension generation was including the subject rather than the issuer DN of the CA certificate. This has been fixed.
<li>SMIMESignedParser now avoids JavaMail quoted-printable recoding issue.
<li>Verification of RSA signatures done with keys with public exponents of 3 was vunerable to
Bleichenbacher's RSA signature forgery attack. This has been fixed.
<li>PGP Identity strings were only being interpreted as ASCII rather than UTF8. This has been fixed.
<li>CertificateFactory.generateCRLs now returns a Collection rather than null.
</ul>
<h3>2.17.3 Additional Features and Functionality</h3>
<ul>
<li>An ISO18033KDFParameters class had been added to support ISO18033 KDF generators.
<li>An implemention of the KDF1 bytes generator algorithm has been added.
<li>An implementation of NaccacheStern encryption has been added to the lightweight API.
<li>X509V2CRLGenerator can now be loaded from an existing CRL.
<li>The CMS enveloped data generators will now attempt to use the default provider for encryption if the passed in provider can only handle key exchange.
<li>OpenPGP file processing has been substantially speeded up.
<li>The PKCS1Encoder would accept PKCS1 packets which were one byte oversize. By default this will now cause an error. However, as there are still implementations which still produce such packets the older behaviour can be turned on by setting the VM system property org.bouncycastle.pkcs1.strict to false before creating an RSA cipher using PKCS1 encoding.
<li>A target has been added to the bc-build.xml to zip up the source code rather than leaving it in a directory tree.
The build scripts now run this target by default.
<li>Use of toUpperCase and toLowerCase has been replaced with a locale independent converter where appropriate.
<li>Support for retrieving the issuers of indirect CRLs has been added.
<li>Classes for doing incremental path validation of PKIX cert paths have been added to the X.509 package and S/MIME.
<li>Locale issues with String.toUpperCase() have now been worked around.
<li>Optional limiting has been added to ASN1InputStream to avoid possible OutOfMemoryErrors on corrupted streams.
<li>Support has been added for SHA224withECDSA, SHA256withECDSA, SHA384withECDSA, and SHA512withECDSA for the generation of signatures, certificates, CRLs, and certification requests.
<li>Performance of the prime number generation in the BigInteger library has been further improved.
<li>In line with RFC 3280 section 4.1.2.4 DN's are now encoded using UTF8String by default rather than PrintableString.
</ul>
<h3>2.17.5 Security Advisory</h3>
<ul>
<li>If you are using public exponents with the value three you *must* upgrade to this release, otherwise it
will be possible for attackers to exploit some of Bleichenbacher's RSA signature forgery attacks on your applications.</li>
</ul>
<h3>2.18.1 Version</h3>
Release 1.33
<h3>2.18.2 Defects Fixed</h3>
<ul>
<li>OCSPResponseData was including the default version in its encoding. This has been fixed.
<li>BasicOCSPResp.getVersion() would throw a NullPointer exception if called on a default version response. This has been fixed.
<li>Addition of an EC point under Fp could result in an ArithmeticException. This has been fixed.
<li>The n value for prime192v2 was incorrect. This has been fixed.
<li>ArmoredInputStream was not closing the underlying stream on close. This has been fixed.
<li>Small base64 encoded strings with embedded white space could decode incorrectly using the Base64 class. This has been fixed.
</ul>
<h3>2.18.3 Additional Features and Functionality</h3>
<ul>
<li>The X509V2CRLGenerator now supports adding general extensions to CRL entries.
<li>A RoleSyntax implementation has been added to the x509 ASN.1 package, and the AttributeCertificateHolder class now support the IssuerSerial option.
<li>The CMS API now correctly recognises the OIW OID for DSA with SHA-1.
<li>DERUTF8String now supports surrogate pairs.
</ul>
<h3>2.19.1 Version</h3>
Release 1.32
<h3>2.19.2 Defects Fixed</h3>
<ul>
<li>Further work has been done on RFC 3280 compliance.
<li>The ASN1Sequence constructor for SemanticsInformation would sometimes throw a ClassCastException on reconstruction an object from a byte stream. This has been fixed.
<li>The SharedInputStream.read(buf, 0, len) method would return 0 at EOF, rather than -1. This has been fixed.
<li>X9FieldElement could fail to encode a Fp field element correctly. This has been fixed.
<li>The streaming S/MIME API was occasionally leaving temporary files around. The SIMEUtil class responsible for creating the files now returns a FileBackedMimeBodyPart object
which has a dispose method on it which should allow removal of the file backing the body part.
<li>An encoding defect in EnvelopedData generation in the CMS streaming, S/MIME API has been fixed.
<li>DER constructed octet strings could cause exceptions in the streaming ASN.1 library. This has been fixed.
<li>Several compatibility issues connected with EnvelopedData decoding between the streaming CMS library and other libraries have been fixed.
<li>JDK 1.4 and earlier would sometimes encode named curve parameters explicitly. This has been fixed.
<li>An incorrect header for SHA-256 OpenPGP clear text signatures has been fixed.
<li>An occasional bug that could result in invalid clear text signatures has been fixed.
<li>OpenPGP clear text signatures containing '\r' as line separators were not being correctly canonicalized. This has been fixed.
</ul>
<h3>2.19.3 Additional Features and Functionality</h3>
<ul>
<li>The ASN.1 library now includes classes for the ICAO Electronic Passport.
<li>Support has been added to CMS and S/MIME for ECDSA.
<li>Support has been added for the SEC/NIST elliptic curves.
<li>Support has been added for elliptic curves over F2m.
<li>Support has been added for repeated attributes in CMS and S/MIME messages.
<li>A wider range of RSA-PSS signature types is now supported for CRL and Certificate verification.
</ul>
<h3>2.19.4 Possible compatibility issue</h3>
<ul>
<li>Previously elliptic curve keys and points were generated with point compression enabled by default.
Owing to patent issues in some jurisdictions, they are now generated with point compression disabled by default.
</ul>
<h3>2.20.1 Version</h3>
Release 1.31
<h3>2.20.2 Defects Fixed</h3>
<ul>
<li>getCriticalExtensionOIDs on an X.509 attribute certificate was returning the non-critical set. This has been fixed.
<li>Encoding uncompressed ECDSA keys could occasionally introduce an extra leading zero byte. This has been fixed.
<li>Expiry times for OpenPGP master keys are now recognised across the range of possible certifications.
<li>PGP 2 keys can now be decrypted by the the OpenPGP library.
<li>PGP 2 signature packets threw an exception on trailer processing. This has been been fixed.
<li>Attempting to retrieve signature subpackets from an OpenPGP version 3 signature would throw a null pointer exception. This has been fixed.
<li>Another occasional defect in EC point encoding has been fixed.
<li>In some cases AttributeCertificateHolder.getIssuer() would return an empty array for attribute certificates using the BaseCertificateID.
This has been fixed.
<li>OIDs with extremely large components would sometimes reencode with unnecessary bytes in their encoding. The optimal DER encoding will now be produced instead.
</ul>
<h3>2.20.3 Additional Features and Functionality</h3>
<ul>
<li>The SMIME package now supports the large file streaming model as well.
<li>Additional ASN.1 message support has been added for RFC 3739 in the org.bouncycastle.x509.qualified package.
<li>Support has been added for Mac algorithm 3 from ISO 9797 to both the lightweight APIs and the provider.
<li>The provider now supports the DESEDE64 MAC algorithm.
<li>CertPathValidator has been updated to better support path validation as defined in RFC 3280.
</ul>
<h3>2.21.1 Version</h3>
Release 1.30
<h3>2.21.2 Defects Fixed</h3>
<ul>
<li>Whirlpool was calculating the wrong digest for 31 byte data and could throw an exception for some other data lengths. This has been fixed.
<li>AlgorithmParameters for IVs were returning a default of RAW encoding of the parameters when they should have been returning an
ASN.1 encoding. This has been fixed.
<li>Base64 encoded streams without armoring could cause an exception in PGPUtil.getDecoderStream(). This has been fixed.
<li>PGPSecretKey.copyWithNewPassword() would incorrectly tag sub keys. This has been fixed.
<li>PGPSecretKey.copyWithNewPassword() would not handle the NULL algorithm. This has been fixed.
<li>Directly accessing the dates on an X.509 Attribute Certificate constructed from an InputStream would return null, not the date objects. This has been fixed.
<li>KEKIdentifier would not handle OtherKeyAttribute objects correctly. This has been fixed.
<li>GetCertificateChain on a PKCS12 keystore would return a single certificate chain rather than null if the alias passed in represented a certificate not a key. This has been fixed.
</ul>
<h3>2.21.3 Additional Features and Functionality</h3>
<ul>
<li>RSAEngine no longer assumes keys are byte aligned when checking for out of range input.
<li>PGPSecretKeyRing.removeSecretKey and PGPSecretKeyRing.insertSecretKey have been added.
<li>There is now a getter for the serial number on TimeStampTokenInfo.
<li>Classes for dealing with CMS objects in a streaming fashion have been added to the CMS package.
<li>PGPCompressedDataGenerator now supports partial packets on output.
<li>OpenPGP Signature generation and verification now supports SHA-256, SHA-384, and SHA-512.
<li>Both the lightweight API and the provider now support the Camellia encryption algorithm.
</ul>
<h3>2.22.1 Version</h3>
Release 1.29
<h3>2.22.2 Defects Fixed</h3>
<ul>
<li>HMac-SHA384 and HMac-SHA512 were not IETF compliant. This has been fixed.
<li>The equals() method on ElGamalKeyParameters and DHKeyParameters in the lightweight API would sometimes
return false when it should return true. This has been fixed.
<li>Parse error for OpenSSL style PEM encoded certificate requests in the PEMReader has been fixed.
<li>PGPPublicKey.getValidDays() now checks for the relevant signature for version 4 and later keys as well as using the
version 3 key valid days field.
<li>ISO9796 signatures for full recovered messsages could incorrectly verify for similar messages in some circumstances. This has been fixed.
<li>The occasional problem with decrypting PGP messages containing compressed streams now appears to be fixed.
</ul>
<h3>2.22.3 Additional Features and Functionality</h3>
<ul>
<li>Support has been added for the OIDs and key generation required for HMac-SHA224, HMac-SHA256, HMac-SHA384, and
HMac-SHA512.
<li>SignerInformation will used default implementation of message digest if signature provider doesn't support it.
<li>The provider and the lightweight API now support the GOST-28147-94 MAC algorithm.
<li>Headers are now settable for PGP armored output streams.
</ul>
<h3>2.22.4 Notes</h3>
<ul>
<li>The old versions of HMac-SHA384 and HMac-SHA512 can be invoked as OldHMacSHA384 and OldHMacSHA512, or by using the OldHMac class in the
lightweight API.
</ul>
<h3>2.23.1 Version</h3>
Release 1.28
<h3>2.23.2 Defects Fixed</h3>
<ul>
<li>Signatures on binary encoded S/MIME messages could fail to validate when correct. This has been fixed.
<li>getExtensionValue() on CRL Entries were returning the encoding of the inner object, rather than the octet string. This has been fixed.
<li>CertPath implementation now returns an immutable list for a certificate path.
<li>Generic sorting now takes place in the CertificateFactory.generateCertPath() rather than CertPathValidator.
<li>DERGeneralizedTime can now handle time strings with milli-seconds.
<li>Stateful CertPathCheckers were not being initialised in all cases, by the CertPathValidator. This has been fixed.
<li>PGPUtil file processing methods were failing to close files after processing. This has been fixed.
<li>A disordered set in a CMS signature could cause a CMS signature to fail to validate when it should. This has been fixed.
<li>PKCS12 files where both the local key id and friendly name were set on a certificate would not parse correctly. This has been fixed.
<li>Filetype for S/MIME compressed messages was incorrect. This has been fixed.
<li>BigInteger class can now create negative numbers from byte arrays.
</ul>
<h3>2.23.3 Additional Features and Functionality</h3>
<ul>
<li>S/MIME now does canonicalization on non-binary input for signatures.
<li>Micalgs for the new SHA schemes are now supported.
<li>Provided and lightweight API now support ISO 7816-4 padding.
<li>The S/MIME API now directly supports the creation of certificate management messages.
<li>The provider and the light weight API now support the cipher GOST-28147, the signature algorithms GOST-3410 (GOST-3410 94) and EC GOST-3410 (GOST-3410 2001), the message digest GOST-3411 and the GOST OFB mode (use GOFB).
<li>CMSSignedDataGenerator will used default implementation of message digest if signature provider doesn't support it.
<li>Support has been added for the creation of ECDSA certificate requests.
<li>The provider and the light weight API now support the WHIRLPOOL message digest.
</ul>
<h3>2.23.4 Notes</h3>
<ul>
<li>Patches for S/MIME binary signatures and canonicalization were actually applied in 1.27, but a couple of days after the release - if the class
CMSProcessableBodyPartOutbound is present in the package org.bouncycastle.mail.smime you have the patched 1.27. We would recommend upgrading to 1.28 in any case
as some S/MIME 3.1 recommendations have also been introduced for header creation.
<li>GOST private keys are probably not encoding correctly and can be expected to change.
</ul>
<h3>2.24.1 Version</h3>
Release 1.27
<h3>2.24.2 Defects Fixed</h3>
<ul>
<li>Typos in the provider which pointed Signature algorithms SHA256WithRSA, SHA256WithRSAEncryption, SHA384WithRSA, SHA384WithRSAEncryption, SHA512WithRSA, and SHA512WithRSAEncryption at the PSS versions of the algorithms have been fixed. The correct names for the PSS algorithms are SHA256withRSAandMGF1, SHA384withRSAandMGF1, and SHA512withRSAandMGF1.
<li>X509CertificateFactory failed under some circumstances to reset properly if the input stream being passed
to generateCertificate(s)() changed, This has been fixed.
<li>OpenPGP BitStrength for DSA keys was being calculated from the key's generator rather than prime. This has been fixed.
<li>Possible infinite loop in ASN.1 SET sorting has been removed.
<li>SHA512withRSAandMGF1 with a zero length salt would cause an exception if used with a 1024 bit RSA key. This has been fixed.
<li>Adding an Exporter to a PGPSubpacketVector added a Revocable instead. This has been fixed.
<li>AttributeCertificateIssuer.getPrincipal() could throw an ArrayStoreException. This has been fixed.
<li>CertPathValidator now guarantees to call any CertPathCheckers passed in for each certificate.
<li>TSP TimeStampToken was failing to validate time stamp tokens with the issuerSerial field set in the ESSCertID structure. This has been fixed.
<li>Path validation in environments with frequently updated CRLs could occasionally reject a valid path. This has been fixed.
</ul>
<h3>2.24.3 Additional Features and Functionality</h3>
<ul>
<li>Full support has been added for the OAEPParameterSpec class to the JDK 1.5 povider.
<li>Full support has been added for the PSSParameterSpec class to the JDK 1.4 and JDK 1.5 providers.
<li>Support for PKCS1 signatures for SHA-256, SHA-384, and SHA-512 has been added to CMS.
<li>PGPKeyRingCollection classes now support partial matching of user ID strings.
<li>This release disables the quick check on the IV for a PGP public key encrypted message in order to help
prevent applications being vunerable to oracle attacks.
<li>The CertPath support classes now support PKCS #7 encoding.
<li>Point compression can now be turned off when encoding elliptic curve keys.
</ul>
<h3>2.24.4 Changes that may affect compatibility</h3>
<ul>
<li>org.bouncycastle.jce.interfaces.ElGamalKey.getParams() has been changed to getParameters() to avoid clashes with
a JCE interface with the same method signature.
<li>org.bouncycastle.jce.interfaces.ECKey.getParams() has been changed in JDK 1.5 to getParameters() to avoid clashes
with a JCE interface with the same method signature. The getParams() method in pre-1.5 has been deprecated.
<li>SHA256WithRSAEncryption, SHA384WithRSAEncryption, SHA512WithRSAEncryption now refer to their PKCS #1 V1.5 implementations. If you
were using these previously you should use SHA256WithRSAAndMGF1, SHA384WithRSAAndMGF1, or SHA512WithRSAAndMGF1.
</ul>
<h3>2.25.1 Version</h3>
Release 1.26
<h3>2.25.2 Defects Fixed</h3>
<ul>
<li>The X.509 class UserNotice assumed some of the optional fields were not optional. This has been fixed.
<li>BCPGInputStream would break on input packets of 8274 bytes in length. This has been fixed.
<li>Public key fingerprints for PGP version 3 keys are now correctly calculated.
<li>ISO9796-2 PSS would sometimes throw an exception on a correct signature. This has been fixed.
<li>ASN1Sets now properly sort their contents when created from scratch.
<li>A bug introduced in the CertPath validation in the last release which meant some certificate paths would validate if they were invalid has been fixed.
</ul>
<h3>2.25.3 Additional Features and Functionality</h3>
<ul>
<li>Support for JDK 1.5 naming conventions for OAEP encryption and PSS signing has been added.
<li>Support for Time Stamp Protocol (RFC 3161) has been added.
<li>Support for Mozilla's PublicKeyAndChallenge key certification message has been added.
<li>OpenPGP now supports key rings containing GNU_DUMMY_S2K.
<li>Support for the new versions (JDK 1.4 and later) of PBEKeySpec has been added to the providers.
<li>PBEWithMD5AndRC2, PBEWithSHA1AndRC2 now generate keys rather than exceptions.
<li>The BigInteger implementation has been further optimised to take more advantage of the Montgomery number capabilities.
</ul>
<h3>2.25.4 JDK 1.5 Changes</h3>
<ul>
<li>The JDK 1.5 version of the provider now supports the new Elliptic Curve classes found in the java.security packages. Note: while we have tried to preserve some backwards compatibility people using Elliptic curve are likely to find some minor code changes are required when moving code from JDK 1.4 to JDK 1.5 as the java.security APIs have changed.
</ul>
<h3>2.26.1 Version</h3>
Release 1.25
<h3>2.26.2 Defects Fixed</h3>
<ul>
<li>In some situations OpenPGP would overread when a stream had been
broken up into partial blocks. This has been fixed.
<li>Explicitly setting a key size for RC4 in the CMS library would cause
an exception. This has been fixed.
<li>getSignatures() on PGPPublicKey would throw a ClassCastException in some cases. This has been fixed.
<li>Encapsulated signed data was been generated with the wrong mime headers, this has been fixed.
<li>The isSignature method on PGPSecretKey now correctly identifies signing keys.
<li>An interoperability issue with DH key exchange between the Sun JCE provider and the BC provider, concerning sign bit expansion, has been fixed.
<li>The X509CertificateFactory would fail to reset correctly after reading an ASN.1 certificate chain. This has been fixed.
<li>CertPathValidator now handles unsorted lists of certs.
<li>The PGPSignatureGenerator would sometimes throw an exception when adding hashed subpackets. This has been fixed.
<li>Ordered equality in X509Name was not terminating as early as possible. This has been fixed.
<li>getBitStrength for PGPPublicKeys was returning the wrong value for ElGamal keys. This has been fixed.
<li>getKeyExpirationTime/getSignatureExpirationTime was returning a Date rather than a delta. This isn't meaningful as a Date and has been changed to a long.
<li>the crlIssuer field in DistributionPoint name was encoding/decoding incorrectly. This has been fixed.
<li>X509Name now recognises international characters in the input string and
stores them as BMP strings.
<li>Parsing a message with a zero length body with SMIMESigned would cause an exception. This has been fixed.
<li>Some versions of PGP use zeros in the data stream rather than a replication of the last two bytes of the iv as specified in the RFC to determine if the correct decryption key has been found. The decryption classes will now cope with both.
</ul>
<h3>2.26.3 Additional Features and Functionality</h3>
<ul>
<li>Support for extracting signatures based on PGP user attributes has been
added to PGPPublicKey.
<li>BCPGArmoredInputStream should cope with plain text files better.
<li>The OpenPGP library can now create indefinite length streams and handle packets greater than (2^32 - 1) in length.
<li>Direct support for adding SignerUserID and PrimaryUserID has been added to the PGPSignatureSubpacketGenerator.
<li>Support for ISO-9796-2/PSS has been added to the lightweight API.
<li>API support for extracting recovered messages from signatures that support
message recovery has been added to the lightweight API.
<li>String value conversion in a DN being processed by X509Name is now fully
configurable.
<li>It is now possible to create new versions of CMSSignedData objects without
having to convert the original object down to its base ASN.1 equivalents.
<li>Support for adding PGP revocations and other key signatures has been added.
<li>Support for SHA-224 and SHA224withRSA has been added.
<li>Trailing bit complement (TBC) padding has been added.
<li>OID components of up to 2^63 bits are now supported.
</ul>
<h3>2.27.1 Version</h3>
Release 1.24
<h3>2.27.2 Defects Fixed</h3>
<ul>
<li>OpenPGP Secret key rings now parse key rings with user attribute packets in them correctly.
<li>OpenPGP Secret key rings now parse key rings with GPG comment packets in them.
<li>X509Name and X509Principal now correctly handle BitStrings.
<li>OpenPGP now correctly recognises RSA signature only keys.
<li>When re-encoding PGP public keys taken off secret keys getEncoded would
sometimes throw a NullPointerException. This has been fixed.
<li>A basic PKCS12 file with a single key and certificate, but no attributes, would cause a null pointer exception. This has been fixed.
<li>Signature verification now handles signatures where the parameters block is missing rather than NULL.
<li>Lightweight CBCBlockCipherMac was failing to add padding if padding was
being explicitly provided and data length was a multiple of the block size. This has been fixed.
<li>ZIP compression in PGP was failing to compress data in many cases. This has been fixed.
<li>Signatures were occasionally produced with incorrect padding in their associated bit strings, this has been fixed.
<li>An encoding error introduced in 1.23 which affected generation of the
KeyUsage extension has been fixed.
</ul>
<h3>2.27.3 Additional Features and Functionality</h3>
<ul>
<li>PKCS12 keystore now handles single key/certificate files without any attributes present.
<li>Support for creation of PGPKeyRings incorporating sub keys has been added.
<li>ZeroPadding for encrypting ASCII data has been added.
</ul>
<h3>2.28.1 Version</h3>
Release 1.23
<h3>2.28.2 Defects Fixed</h3>
<ul>
<li>Reading a PGP Secret key file would sometimes cause a class cast exception. This has been fixed.
<li>PGP will now read SecretKeys which are encrypted with the null algorithm.
<li>PGP ObjectFactory will recognise Marker packets.
<li>BasicConstraints class now handles default empty sequences correctly.
<li>S2K Secret Key generation now supported in OpenPGP for keys greater than 160 bits, a bug causing
it to occasionally generate the wrong key has been fixed.
<li>OpenPGP implementation can now read PGP 8 keys.
<li>Decoding issues with Secret Sub Keys should now be fixed.
<li>PGP would occasionally unpack ElGamal encrypted data incorrectly, this has been fixed.
<li>OCSP TBSRequest now uses abbreviated encoding if the default version is used.
<li>X509Name class will now print names with nested pairs in component sets correctly.
<li>RC4 now resets correctly on doFinal.
</ul>
<h3>2.28.3 Additional Features and Functionality</h3>
<ul>
<li>PGP V3 keys and V3 signature generation is now supported.
<li>Collection classes have been added for representing files of PGP public and secret keys.
<li>PEMReader now supports "RSA PUBLIC KEY".
<li>RipeMD256 and RipeMD320 have been added.
<li>Heuristic decoder stream has been added to OpenPGP which "guesses" how the input is
constructed.
<li>ArmoredInputStream now recognises clear text signed files.
<li>ArmoredOutputStream now provides support for generating clear text signed files.
<li>Support has been added to CMS for RipeMD128, RipeMD160, and RipeMD256.
<li>Support for generating certification directly and editing PGP public key
certifications has been added.
<li>Support has been added for modification detection codes to the PGP library.
<li>Examples have been rewritten to take advantage of the above.
<li>SMIMESigned can now covert data straight into a mime message.
<li>DERGeneralizedTime getTime() method now handles a broader range of input strings.
</ul>
<h3>2.29.1 Version</h3>
Release 1.22
<h3>2.29.2 Defects Fixed</h3>
<ul>
<li>Generating DSA signatures with PGP would cause a class cast exception, this has been fixed.
<li>PGP Data in the 192 to 8383 byte length would sometimes be written with the wrong length header. This has been fixed.
<li>The certificate factory would only parse the first certificate in a PKCS7 object. This has been fixed.
<li>getRevocationReason() in RevokedStatus in OCSP would throw an exception for
a non-null reason, rather than a null one. This has been fixed.
<li>PSS signature verification would fail approximately 0.5 % of the time on correct signatures. This has been fixed.
<li>Encoding of CRL Distribution Points now always works.
</ul>
<h3>2.29.3 Additional Features and Functionality</h3>
<ul>
<li>Additional methods for getting public key information have been added to the PGP package.
<li>Some support for user attributes and the image attribute tag has been added.
<li>Support for the AuthorityInformationAccess extension has been added.
<li>Support for ElGamal encryption/decryption has been added to the PGP package.
</ul>
<h3>2.30.1 Version</h3>
Release 1.21
<h3>2.30.2 Defects Fixed</h3>
<ul>
<li>The CertPath validator would fail for some valid CRLs. This has been fixed.
<li>AES OIDS for S/MIME were still incorrect, this has been fixed.
<li>The CertPathBuilder would sometimes throw a NullPointerException looking for an issuer. This has been fixed.
<li>The J2ME BigInteger class would sometimes go into an infinite loop generating prime numbers. This has been fixed.
<li>DERBMPString.equals() would throw a class cast exception. This has been fixed.
</ul>
<h3>2.30.3 Additional Features and Functionality</h3>
<ul>
<li>PEMReader now handles public keys.
<li>OpenPGP/BCPG should now handle partial input streams. Additional methods for reading subpackets off signatures.
<li>The ASN.1 library now supports policy qualifiers and policy info objects.
</ul>
<h3>2.31.1 Version</h3>
Release 1.20
<h3>2.31.2 Defects Fixed</h3>
<ul>
<li>BigInteger toString() in J2ME/JDK1.0 now produces same output as the Sun one.
<li>RSA would throw a NullPointer exception with doFinal without arguments. This has been fixed.
<li>OCSP CertificateID would calculate wrong issuer hash if issuer cert was not self signed. This has been fixed.
<li>Most of response generation in OCSP was broken. This has been fixed.
<li>The CertPath builder would sometimes go into an infinite loop on some chains if the trust anchor was missing. This has been fixed.
<li>AES OIDS were incorrect, this has been fixed.
<li>In some cases BC generated private keys would not work with the JSSE. This has been fixed.
</ul>
<h3>2.31.3 Additional Features and Functionality</h3>
<ul>
<li>Support for reading/writing OpenPGP public/private keys and OpenPGP signatures has been added.
<li>Support for generating OpenPGP PBE messages and public key encrypted messages has been added.
<li>Support for decrypting OpenPGP messages has been added.
<li>Addition of a Null block cipher to the light weight API.
</ul>
<h3>2.32.1 Version</h3>
Release 1.19
<h3>2.32.2 Defects Fixed</h3>
<ul>
<li>The PKCS12 store would throw an exception reading PFX files that had attributes with no values. This has been fixed.
<li>RSA Private Keys would not serialise if they had PKCS12 bag attributes attached to them, this has been fixed.
<li>GeneralName was encoding OtherName as explicitly tagged, rather than implicitly tagged. This has been fixed.
<li>ASN1 parser would sometimes mistake an implicit null for an implicit empty
sequence. This has been fixed.
</ul>
<h3>2.32.3 Additional Features and Functionality</h3>
<ul>
<li>S/MIME and CMS now support the draft standard for AES encryption.
<li>S/MIME and CMS now support setable key sizes for the standard algorithms.
<li>S/MIME and CMS now handle ARC4/RC4 encrypted messages.
<li>The CertPath validator now passes the NIST test suite.
<li>A basic OCSP implementation has been added which includes request generation
and the processing of responses. Response generation is also provided, but should be treated as alpha quality code.
<li>CMS now attempts to use JCA naming conventions in addition to the OID name
in order to find algorithms.
</ul>
<h3>2.33.1 Version</h3>
Release 1.18
<h3>2.33.2 Defects Fixed</h3>
<ul>
<li>DESKeySpec.isParityAdjusted in the clean room JCE could go into an
infinite loop. This has been fixed.
<li>The SMIME API would end up throwing a class cast exception if a
MimeBodyPart was passed in containing a MimeMultipart. This is now fixed.
<li>ASN1InputStream could go into an infinite loop reading a truncated
input stream. This has been fixed.
<li>Seeding with longs in the SecureRandom for the J2ME and JDK 1.0,
only used 4 bytes of the seed value. This has been fixed.
</ul>
<h3>2.33.3 Additional Features and Functionality</h3>
<ul>
<li>The X.509 OID for RSA is now recognised by the provider as is the OID for RSA/OAEP.
<li>Default iv's for DES are now handled correctly in CMS.
<li>The ASN.1 classes have been updated to use the generic ASN1* classes where
possible.
<li>A constructor has been added to SMIMESigned to simplify the processing
of "application/pkcs7-mime; smime-type=signed-data;" signatures.
<li>Diffie-Hellman key generation is now faster in environments using the
Sun BigInteger library.
</ul>
<h3>2.34.1 Version</h3>
Release 1.17
<h3>2.34.2 Defects Fixed</h3>
<ul>
<li>Reuse of an CMSSignedObject could occasionally result in a class
cast exception. This has been fixed.
<li>The X.509 DistributionPointName occasionally encoded incorrectly. This has
been fixed.
<li>BasicConstraints construction would break if an ASN.1 sequence was used
with only the required parameter. This has been fixed.
<li>The DERObject constructor in OriginatorIdentifierOrKey was leaving
the id field as null. This has been fixed.
</ul>
<h3>2.34.2 Additional Functionality and Features</h3>
<ul>
<li>RC2 now supports the full range of parameter versions and effective
key sizes.
<li>CompressedData handling has been added to CMS/SMIME.