Noteworthy changes in version 1.6.7 (2024-06-21) [C22/A14/R7]
------------------------------------------------

 * Allow for an empty Subject in certs.  [T7171]

 Release-info: https://dev.gnupg.org/T7173


Noteworthy changes in version 1.6.6 (2024-02-23) [C22/A14/R6]
------------------------------------------------

 * Fix a possible wrong error return from the DER builder.  [T6992]

 Release-info: https://dev.gnupg.org/T7009


Noteworthy changes in version 1.6.5 (2023-11-16) [C22/A14/R5]
------------------------------------------------

 * Add Brainpool curve detection using parameters with compressed base
   point.  [rKeb23f853f178]

 * New configure option --with-libtool-modification.  [T6619]

 Release-info: https://dev.gnupg.org/T6822


Noteworthy changes in version 1.6.4 (2023-06-19) [C22/A14/R4]
------------------------------------------------

 * Correctly detect CMS write errors.  [rK9ced7706f2]

 Release-info: https://dev.gnupg.org/T6543


Noteworthy changes in version 1.6.3 (2022-12-06) [C22/A14/R3]
------------------------------------------------

 * Fix another integer overflow in the CRL parser.  [T6284]

 Release-info: https://dev.gnupg.org/T6304


Noteworthy changes in version 1.6.2 (2022-10-07) [C22/A14/R2]
------------------------------------------------

 * Fix integer overflow in the CRL parser.  [rK4b7d9cd4a0]

 Release-info: https://dev.gnupg.org/T6230


Noteworthy changes in version 1.6.1 (2022-09-16) [C22/A14/R1]
------------------------------------------------

 * Allow an OCSP server not to return the sent nonce.  [rK24992a4a7a]

 Release-info: https://dev.gnupg.org/T6210


Noteworthy changes in version 1.6.0 (2021-06-10) [C22/A14/R0]
------------------------------------------------

 * Limited support for the Authenticated-Enveloped-Data content type.
   [81fdcd680c12]

 * Support password based decryption.  [cb7f2484a09c]

 * Fix build problem on macOS.  (#5440)

 * Silence warnings from static analyzers.  (#5395)

 * Interface changes relative to the 1.5.0 release:
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   KSBA_CT_AUTHENVELOPED_DATA       NEW.

 Release-info: https://dev.gnupg.org/T5479


Noteworthy changes in version 1.5.1 (2021-04-06) [C21/A13/R1]
------------------------------------------------

 * Support Brainpool curves specified by ECDomainParameters.

 Release-info: https://dev.gnupg.org/T5379


Noteworthy changes in version 1.5.0 (2020-11-18) [C21/A13/R0]
------------------------------------------------

 * ksba_cms_identify now identifies OpenPGP keyblock content.

 * Supports TR-03111 plain format ECDSA signature verification.

 * Fixes a CMS signed data parser bug exhibited by a somewhat strange
   CMS message.  [b6438e768c]

 * Interface changes relative to the 1.4.0 release:
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   KSBA_CT_OPENPGP_KEYBLOCK         NEW.

 Release-info: https://dev.gnupg.org/T5146


Noteworthy changes in version 1.4.0 (2020-05-19) [C20/A12/R0]
------------------------------------------------

 * Supports ECDSA and EdDSA certificate creation and parsing.  [#4896]

 * Supports ECDH enveloped data.  [#4920]

 * Supports ECDSA and EdDSA signed data.  [#4920]

 * Supports rsaPSS signature verification.  [#4538]

 * Supports standard file descriptors in ksba_reader_read. [#3072]

 * New configure flag --disable-doc.

 * Improves supports for reproducible builds.  [#4801]

 * Allows for optional elements in keyinfo objects.  [#4892]

 * Updates the config and M4 scripts to the latest version.

 * Fixes error detection in the CMS parser.  [#4207]

 * Fixes memory leak in ksba_cms_identify.

 * Fixes build warnings on macOS.  [#2910]

 * Uses --disable-new-dtags if LD_LIBRARY_PATH is defined.  [#4298]

 * New constants KSBA_VERSION and KSBA_VERSION_NUMBER.

 * New API to make creation of DER objects easy.

 * Interface changes relative to the 1.3.5 release:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 KSBA_VERSION                     NEW.
 KSBA_VERSION_NUMBER              NEW.
 KSBA_CT_SPC_IND_DATA_CTX         NEW.
 KSBA_CLASS_*                     NEW.
 KSBA_TYPE_*                      NEW.
 ksba_der_t                       NEW.
 ksba_der_release                 NEW.
 ksba_der_builder_new             NEW.
 ksba_der_builder_reset           NEW.
 ksba_der_add_ptr                 NEW.
 ksba_der_add_val                 NEW.
 ksba_der_add_int                 NEW.
 ksba_der_add_oid                 NEW.
 ksba_der_add_bts                 NEW.
 ksba_der_add_der                 NEW.
 ksba_der_add_tag                 NEW.
 ksba_der_add_end                 NEW.
 ksba_der_builder_get             NEW.

 Release-info: https://dev.gnupg.org/T4943


Noteworthy changes in version 1.3.5 (2016-08-22) [C19/A11/R6]
------------------------------------------------

 * Limit the allowed size of complex ASN.1 objects (e.g. certificates)
   to 16MiB.

 * Avoid read access to unitialized memory.

 * Improve detection of invalid RDNs.

 * Encode the OCSP nonce value as an octet string as described by
   RFC-6960.


Noteworthy changes in version 1.3.4 (2016-05-03) [C19/A11/R5]
------------------------------------------------

 * Fixed two OOB read access bugs which could be used to force a DoS.

 * Fixed a crash due to faulty curve OID lookup code.

 * Synced the list of supported curves with those of Libgcrypt.

 * New configure option --enable-build-timestamp; a build timestamp is
   not anymore used by default.


Noteworthy changes in version 1.3.3 (2015-04-10) [C19/A11/R4]
------------------------------------------------

 * Fixed an integer overflow in the DN decoder.

 * Now returns an error instead of terminating the process for certain
   bad BER encodings.

 * Improved the parsing of utf-8 strings in DNs.

 * Allow building with newer versions of Bison.

 * Improvement building on Windows with newer versions of Mingw.


Noteworthy changes in version 1.3.2 (2014-11-25) [C19/A11/R3]
------------------------------------------------

 * Fixed a buffer overflow in ksba_oid_to_str. [CVE-2014-9087]


Noteworthy changes in version 1.3.1 (2014-09-18)
------------------------------------------------

 * Fixed memory leak in CRL parsing.

 * Build fixes for Windows, Android, and ppc64el.


Noteworthy changes in version 1.3.0 (2012-09-27)
------------------------------------------------

 * Changed the license of the library from GPLv3 to LGPLv3/GPLv2; see
   the file AUTHORS for details.

 * Minor bug fixes.


Noteworthy changes in version 1.2.0 (2011-03-01)
------------------------------------------------

 * New functions to allow the creation of X.509 certificates.

 * Interface changes relative to the 1.1.0 release:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ksba_certreq_set_serial          NEW.
 ksba_certreq_set_issuer          NEW.
 ksba_certreq_set_validity        NEW.
 ksba_certreq_set_siginfo         NEW.


Noteworthy changes in version 1.1.0 (2010-10-26)
------------------------------------------------

 * New functions to fix a leak in dirmngr.

 * Interface changes relative to the 1.0.0 release:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ksba_reader_set_release_notify   NEW
 ksba_writer_set_release_notify   NEW


Noteworthy changes in version 1.0.8 (2010-07-15)
------------------------------------------------

 * Support for WindowsCE.

 * Builds cleanly from SVN even when cross-compiling.

 * Fixed a CMS parsing bug exhibited by Lotus Notes.


Noteworthy changes in version 1.0.7 (2009-07-03)
------------------------------------------------

 * Detect overflow while parsing OIDs.  Map BER encoded OIDs to well
   known names.

 * Allow mixed case names in DNs.


Noteworthy changes in version 1.0.6 (2009-06-05)
------------------------------------------------

 * Support SHA-{384,512} based signature generation.

 * The RSA algorithmIdentifier ASN.1 sequence is now emitted with an
   explicit NULL parameter.  Despite the interop testing we did in the
   past, some software still requires this and thus we better follow
   the best current practise.


Noteworthy changes in version 1.0.5 (2009-01-09)
------------------------------------------------

 * Minor bug fixes.


Noteworthy changes in version 1.0.4 (2008-09-22)
------------------------------------------------

 * Write smimeCapabilities according to RFC3851 to help Mozilla.

 * Support DSA.

 * The visibility attribute is now used if supported by the toolchain.


Noteworthy changes in version 1.0.3 (2008-02-12)
------------------------------------------------

 * Minor bug fixes.

 * Include the used hash algorithm in sig-val structures.

 * Fix for unknown tags in issuerAltName and subjectAltName.


Noteworthy changes in version 1.0.2 (2007-07-04)
------------------------------------------------

 * Support for SHA-2.

 * Fixed a couple of memory leaks.

 * Experimental support for ECDSA.

 * Minor portability fixes.

 * Switched to GPLv3.


Noteworthy changes in version 1.0.1 (2006-11-29)
------------------------------------------------

 * Fixes for certificates lacking certain objects.

 * Fixes to allow building on systems with a broken ar.


Noteworthy changes in version 1.0.0 (2006-08-31)
------------------------------------------------

 * OCSP nonces are now checked to detect replay attacks.

 * OCSP extensions may no be retrieved.

 * Implemented ksba_ocsp_get_responder_id which used to always return
   an error code not_implemented.  Thus we can assume that the
   function has never been used and we don't need to see this as an
   API break.

 * Interface changes relative to the 0.9.16 release:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ksba_ocsp_get_extension        NEW
 ksba_ocsp_get_responder_id     CHANGED: No ABI break.


Noteworthy changes in version 0.9.16 (2006-08-01)
-------------------------------------------------

 * Fixed a character set conversion bug in BMPStrings.

 * New function for better error reporting of DNs.

 * Interface changes relative to the 0.9.13 release:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ksba_dn_teststr                NEW
 ksba_dn_str2der                NEW
 ksba_dn_der2str                NEW


Noteworthy changes in version 0.9.15 (2006-06-20)
-------------------------------------------------

 * Fixed BER parser which was broken in the last release.


Noteworthy changes in version 0.9.14 (2006-05-16)
-------------------------------------------------

 * Fixed broken OCSP requests.

 * Ignore invalid bytes appended to a certificate.


Noteworthy changes in version 0.9.13 (2005-11-24)
-------------------------------------------------

 * New functions to associate user data with a certificate object.

 * Interface changes relative to the 0.9.12 release:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ksba_cert_set_user_data        NEW
 ksba_cert_get_user_data        NEW


Noteworthy changes in version 0.9.12 (2005-08-01)
-------------------------------------------------

 * GeneralNames types dNSName and Uri are now supported.

 * Minor changes to some function declarations.  This should not
   affect any compilation.

 * Interface changes relative to the 0.9.7 release:
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 ksba_certreq_add_extension     CHANGED: Argument DER is now a void*.
 ksba_cms_set_content_enc_algo  CHANGED: Argument IV is now void*.
 ksba_cms_get_content_enc_iv    CHANGED: Argument IV is now void*.
 ksba_cms_set_message_digest    CHANGED: Argument DIGEST is now
                                         unsigned char*.


Noteworthy changes in version 0.9.11 (2005-04-20)
-------------------------------------------------

 * New convenience API function for the subjectKeyIdentifier.

 * Implemented the keyIdentifier part for authorityKeyIdentifier of
   CRLs and certificates.

 * Reason codes for CRL items are now returned.

 * Interface changes relative to the 0.9.7 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ksba_cert_get_subj_key_id            NEW.


Noteworthy changes in version 0.9.10 (2004-12-03)
-------------------------------------------------

 * Fixed a CMS parsing bug.


Noteworthy changes in version 0.9.9 (2004-09-27)
------------------------------------------------

 * Fixed a couple of bugs which caused parsing errors with some
   certificates.


Noteworthy changes in version 0.9.8 (2004-07-22)
------------------------------------------------

 * Fixed a bug in the OCSP request generation.


Noteworthy changes in version 0.9.7 (2004-06-08)
------------------------------------------------

 * New API function to add arbitrary extensions to pkcs#10 requests.

 * Interface changes relative to the 0.9.6 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ksba_certreq_add_extension           NEW.


Noteworthy changes in version 0.9.6 (2004-04-29)
------------------------------------------------

 * New API functions to support v2 CRLs.

 * Interface changes relative to the 0.9.5 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ksba_crl_get_extension               NEW.
ksba_crl_get_auth_key_id             NEW.
ksba_crl_get_crl_number              NEW.

Noteworthy changes in version 0.9.5 (2004-04-06)
------------------------------------------------

 * New APIs to get hands on some more information.

 * Interface changes relative to the 0.9.4 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ksba_ocsp_get_responder_id           NEW.
ksba_ocsp_get_cert                   NEW.
ksba_cert_get_authority_info_access  NEW.
ksba_cert_get_subject_info_access    NEW.
ksba_cms_add_smime_capability        NEW.


Noteworthy changes in version 0.9.4 (2004-02-20)
------------------------------------------------

 * Support for Extended Key Usage.

 * ksba_cms_identify may no return a pseudo content type for pkcs#12
   files.

 * Interface changes relative to the 0.9.3 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ksba_reader_clear             NEW.
ksba_cert_get_ext_key_usages  NEW.
KSBA_CT_PKCS12                NEW.


Noteworthy changes in version 0.9.3 (2004-01-30)
------------------------------------------------

 * Fixed a serious bug shortly after the last release :-(.


Noteworthy changes in version 0.9.2 (2004-01-29)
------------------------------------------------

 * Cleaned up the DN label table.

 * Fixed a bug in creating CMS signed data.


Noteworthy changes in version 0.9.1 (2003-12-19)
------------------------------------------------

 * Support for OCSP (rfc2560).

 * The new function ksba_set_hash_buffer_function may be used during
   intialization to register a simple hash fucntion for internal use
   by libksba.

 * Changed the license of the manual to GPL.

 * Interface changes relative to the 0.9.0 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ksba_status_t                 NEW.
ksba_ocsp_t                   NEW.
ksba_ocsp_response_status_t   NEW.
ksba_ocsp_new                 NEW.
void ksba_ocsp_release        NEW.
ksba_ocsp_set_digest_algo     NEW.
ksba_ocsp_set_requestor       NEW.
ksba_ocsp_add_target          NEW.
ksba_ocsp_set_nonce           NEW.
ksba_ocsp_prepare_request     NEW.
ksba_ocsp_hash_request        NEW.
ksba_ocsp_set_sig_val         NEW.
ksba_ocsp_add_cert            NEW.
ksba_ocsp_build_request       NEW.
ksba_ocsp_parse_response      NEW.
ksba_ocsp_get_digest_algo     NEW.
ksba_ocsp_hash_respons        NEW.
ksba_ocsp_get_sig_val         NEW.
ksba_ocsp_get_status          NEW.
ksba_set_hash_buffer_function NEW.


Noteworthy changes in version 0.9.0 (2003-11-17)
------------------------------------------------

 * The time is not any longer described by time_t but through the new
   type ksba_isotime_t which is string of excactly 15 characters in
   ISO 8601 format (e.g. "19611107T152010") and always stored as
   UTC. This is to allow representation of dates beyond the year 2038.
   Comparing is a mere strcmp.

 * All type names are nom conforming to the GNU coding standards, the
   old names are still available as aliases but flagged as deprecated.

 * All error codes have been replaced by libgpg-error ones.  Libksba
   now depends on this package.  Remember to use the gpg_err_code
   function when testing for error values other than success.

 * Interface changes relative to the 0.4.7 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ksba_cert_get_validity     CHANGED: Uses ksba_isotime_t instead of time_t.
ksba_crl_get_update_times  CHANGED: Uses ksba_isotime_t instead of time_t.
ksba_crl_get_item          CHANGED: Uses ksba_isotime_t instead of time_t.
ksba_cms_get_signing_time  CHANGED: Uses ksba_isotime_t instead of time_t.
ksba_cms_set_signing_time  CHANGED: Uses ksba_isotime_t instead of time_t.
ksba_cert_new              CHANGED: Returns an error code now.
ksba_cms_new               CHANGED: Returns an error code now.
ksba_name_new              CHANGED: Returns an error code now.
ksba_writer_new            CHANGED: Returns an error code now.
ksba_reader_new            CHANGED: Returns an error code now.
ksba_certreq_new           CHANGED: Returns an error code now.
ksba_crl_new               CHANGED: Returns an error code now.
ksba_isotime_t             NEW.
ksba_error_t               NEW: Should be used instead of KsbaError.
ksba_cert_t                NEW: Should be used instead of KsbaCert.
ksba_certreq_t             NEW: Should be used instead of KsbaCertreq.
ksba_cms_t                 NEW: Should be used instead of KsbaCMS.
ksba_crl_t                 NEW: Should be used instead of KsbaCRL.
ksba_name_t                NEW: Should be used instead of KsbaName.
ksba_sexp_t                NEW: Should be used instead of KsbaSexp.
ksba_reader_t              NEW: Should be used instead of KsbaReader.
ksba_writer_t              NEW: Should be used instead of KsbaWriter.
ksba_strerror              REMOVED: use gpg_strerror instead.

Noteworthy changes in version 0.4.7 (2003-03-17)
------------------------------------------------

 * Fixed type detection in creating DNs.


Noteworthy changes in version 0.4.6 (2002-12-04)
------------------------------------------------

 * DNs in pkcs#10 request are now created in reversed order as
   specified by rfc2253.

 * The content-type signed attribute is created.

 * Fixed a parser bug with a id-aa-encrypKeyPref attribute.

 * Interface changes relative to the 0.4.3 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ksba_cms_get_sigattr_oids        NEW
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Noteworthy changes in version 0.4.5 (2002-08-23)
------------------------------------------------

 * Removed some debugging output.

 * Added an autoconf macro.


Noteworthy changes in version 0.4.4 (2002-08-09)
------------------------------------------------

 * Multiple signatures can now be created and parsed.


Noteworthy changes in version 0.4.3 (2002-06-25)
------------------------------------------------

 * More bug fixes.

 * Interface changes relative to the 0.4.2 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ksba_writer_write_octet_string   NEW
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Noteworthy changes in version 0.4.2 (2002-06-04)
------------------------------------------------

 * Some bug fixes and a new function.

 * Interface changes relative to the 0.4.1 release:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ksba_cms_identify       NEW
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Noteworthy changes in version 0.4.1 (2002-05-03)
------------------------------------------------

 * Minor fixes.

Noteworthy changes in version 0.4.0 (2002-04-15)
------------------------------------------------

 * Nearly all stuff needed for the Aegypten project is now in place.


 Copyright 2002, 2003, 2004, 2005, 2006, 2007, 2008,
           2009 g10 Code GmbH

 This file is free software; as a special exception the author gives
 unlimited permission to copy and/or distribute it, with or without
 modifications, as long as this notice is preserved.

 This file is distributed in the hope that it will be useful, but
 WITHOUT ANY WARRANTY, to the extent permitted by law; without even the
 implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.