This is a draft of release notes for 0.24.0, summarising new changes from the last release. Please, feel free to fix or propose other changes which should be included.

General improvements

Fix compatibility of EAC with OpenSSL 3.0 (EAC: Fix compatiility with OpenSSL 3.0 and remove "APDU firewall" #2674)
Enable use_file_cache by default (enable use_file_cache by default #2501)
Use custom libctx with OpenSSL >= 3.0 (Introduce use of custom ossl libctx with OpenSSL >= 3.0 #2712, pkcs11-tool to use OpenSSL libctx #2715)
Fix record-based files (Fix record based files #2604)
Fix several race conditions (Fix several race conditions #2735)
Run tests under Valgrind (Run tests also under valgrind #2756)
Test signing of data bigger than 512 bytes (tests: Test signing more than 512 bytes of data #2789)
Update to OpenPACE 1.1.3 (update to OpenPACE 1.1.3 #2796)
Implement logout for some of the card drivers (Implemented logout for some card drivers #2807)
Fixed various issues reported by OSS-Fuzz and Coverity regarding card drivers, PKCS#11 and PKCS#15 init

PKCS#11

Check card presence state in C_GetSessionInfo (Do not remove sessions in C_GetSessionInfo if card is logged out #2740)
Remove onepin-opensc-pkcs11 module (Remove onepin-opensc-pkcs11 #2681)

PKCS#15

Fix PIN authentication bypass when card in authenticated state (Fixed PIN authentication bypass #2806)
Honor cache offsets when writing file cache (Honor cache offsets when writing file cache #2858)

Minidriver

Fix for private keys that do not need a PIN (Minidriver EC Changes for private keys that do not need a PIN and/or ECDSA failure to sign #2722)

pkcs11-tool

Fix RSA key import with OpenSSL 3.0 (Fix pkcs11-tool key import with OpenSSL 3.0 #2656)
Add support for attribute filtering when listing objects (Add support for basic attribute filtering to list objects #2687)
Add support for --private flag when writing certificates (Add support for --private flag when writing certificates #2768)
Add support for non-AEAD ciphers to the test mode (pkcs11-tool: add cipher test mode #2780)
Show CKA_SIGN attribute for secret keys (show 'sign' usage for secret keys #2862)

westcos-tool

Generate 2k RSA keys by default (b53fc5c)

pkcs11-register

Disable autostart on Linux by default (pkcs11-register: disable autostart by default on Linux #2680)

IDPrime

Add support for IDPrime MD 830, 930 and 940 (Support for IDPrime MD 830, 930 and 940 cards #2666)
Add support for SafeNet eToken 5110 token (include ATR of SafeNet eToken 5110 in the IDPrime driver #2812)

EPass2003

Change of PIN requires verification of the PIN (Update card-epass2003.c #2759)
Fix incorrect CMAC computation for subkeys (Update card-epass2003.c #2759, issue Epass2003 incorrect CMAC subkey #2734)
Use true random number for mutual authentication for SM (epass2003: use true random number for mutual authentication for SM. #2766)
Add verification of data coming from the token in the secure messaging mode (epass2003: SM checking (MAC and SW) #2772)

OpenPGP

Fix select data command (Fix OpenPGP select data #2753, issue Some Gnuk OpenPGP cards broke in 0.23. #2752)

eOI

Add support for Slovenian eID card (eOI) (Add support for Slovenian eID card (eOI) #2646)

Italian CNS

Add support for IDEMIA (Oberthur) tokens (Updated Italian CNS to support IDEMIA (Oberthur) tokens #2483)

PIV

Add support for Swissbit iShield FIDO2 Authenticator (added Swissbit iShield FIDO2 Authenticator #2671)
Implement PIV secure messaging (PIV Secure Messaging as defined in NIST 800-73-4 #2053)

SkeID

Add support for Slovak eID cards (support for Slovak eID cards #2672)

isoApplet

Support ECDSA with off-card hashing (isoapplet offcard hash #2642)

MyEID

Fix WRAP operation when using T0 (WRAP operation fix for MyEID driver (T0 protocol) #2695)
Identify changes on the card and enable use_file_cache (enable use_file_cache for MyEID card #2798)

SC-HSM

Add support for opensc-tool --serial (sc-hsm: add support for opensc-tool --serial #2675)
Fix unwrapping of 4096 keys with handling reader limits (Handle reader limits for SC Card unwrap operations - Fixes #2514 #2682)
Indicate supported hashes and MGF1s (Indicate supported hashes and MGF1s (Fixes #2826) #2827)

New release 0.24.0 #2792

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions