diff --git a/CHANGELOG.md b/CHANGELOG.md index 5d091bdb..b0d91765 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,176 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## 0.10.0 (2026-11-08) +### Security +- Replace `num-bigint-dig` with `crypto-bigint` for constant-time modular exponentiation ([#394]) +- Redact private-key components from `Debug` output ([#480]) +- Harden private-key operations following `draft-irtf-cfrg-rsa-guidance` ([#710], [#715], [#739], + [#751], [#752], [#755], [#756], [#758], [#770], [#771], [#773]) +- Zeroize stored secret-prime Montgomery parameters in `PrecomputedValues` ([#716]) +- Implement PKCS#1 v1.5 implicit rejection: return deterministic synthetic plaintext on invalid + padding instead of exposing a padding error and with it a sidechannel ([#726], [#729], [#749]) + +### Added +- PKCS#8/SPKI decoding for PSS keys, including `id-RSASSA-PSS` algorithm identifiers ([#424]) +- `pss::VerifyingKey::salt_len` and opt-in automatic salt-length detection via + `new_with_auto_salt_len` ([#448], [#546]) +- Wycheproof test coverage for PKCS#1 v1.5, PSS, and OAEP ([#477], [#740]) +- `PublicKeyParts::n_bytes` and `e_bytes` serialization helpers ([#519]) +- Multipart signing trait implementations for PKCS#1 v1.5 and PSS ([#525]) +- `Clone` and `core::error::Error` implementations for `Error` ([#530], [#694]) +- `PrivateKey::as_public_key` accessor ([#592]) +- Algorithm-specific inherent methods on `PrivateKey` and `PublicKey` for OAEP encryption/decryption + and PKCS#1 v1.5/PSS signing/verification, including prehash and explicit-RNG variants ([#638]) +- `PrivateKey::from_components_with_large_exponent`, gated on `hazmat` ([#648]) +- Constant-time validation harness using `cargo checkct`/BINSEC ([#732], [#733], [#749], [#756], + [#771], [#773]) +- `PrivateKey::from_components_with_wide_primes` for unbalanced two-prime keys, which ordinary + constructors now reject ([#755]) +- `TryFrom>` for PKCS#1 v1.5 and PSS signatures ([#764]) +- `crypto_common::Generate` implementation and `Generate` re-export for generating 3072-bit keys + with public exponent 65537 ([#780]) + +### Changed +- Replace `BigUint` in the public API with `BoxedUint`; return `NonZero` for the modulus + and `Odd` for prime factors ([#394], [#735]) +- Use `crypto-primes` for prime generation ([#394]) +- Use DER-based key encodings and hex-or-binary serde representations via `serdect`; extend serde + support to OAEP, PKCS#1 v1.5, and PSS wrapper types ([#420]) +- Accept arbitrary byte strings as OAEP labels ([#467]) +- Gate PKCS#1/PKCS#8/SPKI support on the default-enabled `encoding` feature; `std` no longer + implicitly enables encoding dependencies ([#537], [#543]) +- Enforce a 1024-bit minimum for key generation and default public-key construction/decoding; add + `PublicKey::new_with_size_limits` and `hazmat`-gated unchecked key generation ([#576], [#760]) +- Bump `pkcs1` to v0.8; `pkcs8` to v0.11; `spki` to v0.8; `serdect` to v0.4 ([#584], [#684], [#688], + [#766]) +- Make `Oaep` and `Pss` generic over their digest types instead of using `DynDigest` ([#593]) +- Bump `rand_core` to v0.10, `crypto-common` to v0.2, `digest` to v0.11, and `signature` to v3 + ([#650], [#671], [#693]) +- Remove a redundant allocation during OAEP decryption ([#659]) +- Improve encryption and verification performance by bounding exponentiation to the public + exponent's bit length ([#662]) +- Bump `crypto-bigint` to v0.7.10 and `crypto-primes` to v0.7 ([#673], [#766]) +- Raise the default maximum public-key modulus size to 8192 bits ([#681]) +- Bump `sha1` and `sha2` to v0.11 ([#683]) +- Store PKCS#1 v1.5 and PSS signatures as byte strings, preserving their encoded width ([#722], + [#723]) +- MSRV 1.87; Rust 2024 edition ([#731], [#757]) +- Enable `getrandom` by default and use the system RNG for blinding in default decryption and + signing paths ([#739], [#758]) +- Limit signature decoding to 1024 bytes by default; add `Signature::from_bytes_with_max_len` for + explicit limits ([#767]) +- Require the opt-in `pkcs1v15` feature for PKCS#1 v1.5 encryption and signatures ([#778]) +- Accept fallible RNGs through `TryCryptoRng` and propagate RNG failures as errors ([#779]) +- Rename `RsaPrivateKey` and `RsaPublicKey` to `PrivateKey` and `PublicKey`, retaining the old names + as deprecated aliases ([#781]) + +### Deprecated +- `pss::BlindedSigningKey` in favor of `pss::SigningKey`, which now applies blinding by + default ([#758]) +- `PublicKey::new_with_max_size` in favor of `PublicKey::new_with_size_limits` ([#760]) + +### Removed +- `nightly` and `u64_digit` features associated with `num-bigint-dig` ([#394]) +- Deprecated `Pkcs1v15Sign::new_raw` and `pkcs1v15` `*_with_prefix` constructors ([#524]) +- Separate `pem` feature; PEM support is included with `encoding` ([#537]) +- Optional `sha2` feature; SHA-2 support is now always enabled ([#749]) + +### Fixed +- Honor explicit larger-key construction limits during cryptographic operations, including OAEP + decryption ([#441], [#595]) +- PKCS#1 v1.5 `SigningKey::from` and `VerifyingKey::from` now use the digest prefix consistently + with `new` ([#472], [#498]) +- Check the modulus's actual bit length instead of its storage precision when enforcing size limits + ([#529]) +- Retry zero blinding factors instead of replacing them with one ([#653]) +- Reject private-key factors less than or equal to one, even or repeated factors, and private + exponents greater than or equal to the modulus ([#655], [#738], [#772], [#774]) +- Reject PSS salt lengths that cannot be represented by the `AlgorithmIdentifier` encoder instead of + truncating them ([#704]) +- Apply RFC 8017 encoded-message width rules for PSS, including moduli whose bit length is congruent + to 1 modulo 8 ([#725]) +- Return verification errors instead of panicking for undersized PSS encoded messages and + overflowing salt lengths ([#769]) +- Propagate CRT precomputation errors from private-key constructors ([#782]) + +[#394]: https://github.com/RustCrypto/RSA/pull/394 +[#420]: https://github.com/RustCrypto/RSA/pull/420 +[#424]: https://github.com/RustCrypto/RSA/pull/424 +[#441]: https://github.com/RustCrypto/RSA/pull/441 +[#448]: https://github.com/RustCrypto/RSA/pull/448 +[#467]: https://github.com/RustCrypto/RSA/pull/467 +[#472]: https://github.com/RustCrypto/RSA/pull/472 +[#477]: https://github.com/RustCrypto/RSA/pull/477 +[#480]: https://github.com/RustCrypto/RSA/pull/480 +[#498]: https://github.com/RustCrypto/RSA/pull/498 +[#519]: https://github.com/RustCrypto/RSA/pull/519 +[#524]: https://github.com/RustCrypto/RSA/pull/524 +[#525]: https://github.com/RustCrypto/RSA/pull/525 +[#529]: https://github.com/RustCrypto/RSA/pull/529 +[#530]: https://github.com/RustCrypto/RSA/pull/530 +[#537]: https://github.com/RustCrypto/RSA/pull/537 +[#543]: https://github.com/RustCrypto/RSA/pull/543 +[#546]: https://github.com/RustCrypto/RSA/pull/546 +[#576]: https://github.com/RustCrypto/RSA/pull/576 +[#584]: https://github.com/RustCrypto/RSA/pull/584 +[#592]: https://github.com/RustCrypto/RSA/pull/592 +[#593]: https://github.com/RustCrypto/RSA/pull/593 +[#595]: https://github.com/RustCrypto/RSA/pull/595 +[#638]: https://github.com/RustCrypto/RSA/pull/638 +[#648]: https://github.com/RustCrypto/RSA/pull/648 +[#650]: https://github.com/RustCrypto/RSA/pull/650 +[#653]: https://github.com/RustCrypto/RSA/pull/653 +[#655]: https://github.com/RustCrypto/RSA/pull/655 +[#659]: https://github.com/RustCrypto/RSA/pull/659 +[#662]: https://github.com/RustCrypto/RSA/pull/662 +[#671]: https://github.com/RustCrypto/RSA/pull/671 +[#673]: https://github.com/RustCrypto/RSA/pull/673 +[#681]: https://github.com/RustCrypto/RSA/pull/681 +[#683]: https://github.com/RustCrypto/RSA/pull/683 +[#684]: https://github.com/RustCrypto/RSA/pull/684 +[#688]: https://github.com/RustCrypto/RSA/pull/688 +[#693]: https://github.com/RustCrypto/RSA/pull/693 +[#694]: https://github.com/RustCrypto/RSA/pull/694 +[#704]: https://github.com/RustCrypto/RSA/pull/704 +[#710]: https://github.com/RustCrypto/RSA/pull/710 +[#715]: https://github.com/RustCrypto/RSA/pull/715 +[#716]: https://github.com/RustCrypto/RSA/pull/716 +[#722]: https://github.com/RustCrypto/RSA/pull/722 +[#723]: https://github.com/RustCrypto/RSA/pull/723 +[#725]: https://github.com/RustCrypto/RSA/pull/725 +[#726]: https://github.com/RustCrypto/RSA/pull/726 +[#729]: https://github.com/RustCrypto/RSA/pull/729 +[#731]: https://github.com/RustCrypto/RSA/pull/731 +[#732]: https://github.com/RustCrypto/RSA/pull/732 +[#733]: https://github.com/RustCrypto/RSA/pull/733 +[#735]: https://github.com/RustCrypto/RSA/pull/735 +[#738]: https://github.com/RustCrypto/RSA/pull/738 +[#739]: https://github.com/RustCrypto/RSA/pull/739 +[#740]: https://github.com/RustCrypto/RSA/pull/740 +[#749]: https://github.com/RustCrypto/RSA/pull/749 +[#751]: https://github.com/RustCrypto/RSA/pull/751 +[#752]: https://github.com/RustCrypto/RSA/pull/752 +[#755]: https://github.com/RustCrypto/RSA/pull/755 +[#756]: https://github.com/RustCrypto/RSA/pull/756 +[#757]: https://github.com/RustCrypto/RSA/pull/757 +[#758]: https://github.com/RustCrypto/RSA/pull/758 +[#760]: https://github.com/RustCrypto/RSA/pull/760 +[#764]: https://github.com/RustCrypto/RSA/pull/764 +[#766]: https://github.com/RustCrypto/RSA/pull/766 +[#767]: https://github.com/RustCrypto/RSA/pull/767 +[#769]: https://github.com/RustCrypto/RSA/pull/769 +[#770]: https://github.com/RustCrypto/RSA/pull/770 +[#771]: https://github.com/RustCrypto/RSA/pull/771 +[#772]: https://github.com/RustCrypto/RSA/pull/772 +[#773]: https://github.com/RustCrypto/RSA/pull/773 +[#774]: https://github.com/RustCrypto/RSA/pull/774 +[#778]: https://github.com/RustCrypto/RSA/pull/778 +[#779]: https://github.com/RustCrypto/RSA/pull/779 +[#780]: https://github.com/RustCrypto/RSA/pull/780 +[#781]: https://github.com/RustCrypto/RSA/pull/781 +[#782]: https://github.com/RustCrypto/RSA/pull/782 + ## 0.9.8 (2025-03-12) ### Added - Doc comments to specify the `rand` version ([#473]) diff --git a/Cargo.lock b/Cargo.lock index 1fad3096..311f7e36 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -838,7 +838,7 @@ checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2" [[package]] name = "rsa" -version = "0.10.0-rc.22" +version = "0.10.0" dependencies = [ "base64ct", "const-oid", diff --git a/Cargo.toml b/Cargo.toml index 0dae1aee..b7849720 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "rsa" -version = "0.10.0-rc.22" +version = "0.10.0" authors = ["RustCrypto Developers", "dignifiedquire "] edition = "2024" description = "Pure Rust RSA implementation"