| 1 | Crypto++: a C++ Class Library of Cryptographic Schemes |
|---|
| 2 | Version 5.6.4 - SEPT/11/2016 |
|---|
| 3 | |
|---|
| 4 | Crypto++ Library is a free C++ class library of cryptographic schemes. |
|---|
| 5 | Currently the library contains the following algorithms: |
|---|
| 6 | |
|---|
| 7 | algorithm type name |
|---|
| 8 | |
|---|
| 9 | authenticated encryption schemes GCM, CCM, EAX |
|---|
| 10 | |
|---|
| 11 | high speed stream ciphers ChaCha (ChaCha8/12/20), Panama, Sosemanuk, |
|---|
| 12 | Salsa20, XSalsa20 |
|---|
| 13 | |
|---|
| 14 | AES and AES candidates AES (Rijndael), RC6, MARS, Twofish, Serpent, |
|---|
| 15 | CAST-256 |
|---|
| 16 | |
|---|
| 17 | IDEA, Triple-DES (DES-EDE2 and DES-EDE3), |
|---|
| 18 | other block ciphers Camellia, SEED, RC5, Blowfish, TEA, XTEA, |
|---|
| 19 | Skipjack, SHACAL-2 |
|---|
| 20 | |
|---|
| 21 | block cipher modes of operation ECB, CBC, CBC ciphertext stealing (CTS), |
|---|
| 22 | CFB, OFB, counter mode (CTR) |
|---|
| 23 | |
|---|
| 24 | message authentication codes VMAC, HMAC, GMAC, CMAC, CBC-MAC, DMAC, |
|---|
| 25 | Two-Track-MAC |
|---|
| 26 | |
|---|
| 27 | BLAKE2 (BLAKE2b, BLAKE2s), SHA-1, SHA-2 (SHA-224, |
|---|
| 28 | hash functions SHA-256, SHA-384, and SHA-512), SHA-3, Tiger, |
|---|
| 29 | WHIRLPOOL, RIPEMD-128, RIPEMD-256, RIPEMD-160, |
|---|
| 30 | RIPEMD-320 |
|---|
| 31 | |
|---|
| 32 | RSA, DSA, ElGamal, Nyberg-Rueppel (NR), |
|---|
| 33 | public-key cryptography Rabin-Williams (RW), LUC, LUCELG, |
|---|
| 34 | DLIES (variants of DHAES), ESIGN |
|---|
| 35 | |
|---|
| 36 | padding schemes for public-key PKCS#1 v2.0, OAEP, PSS, PSSR, IEEE P1363 |
|---|
| 37 | systems EMSA2 and EMSA5 |
|---|
| 38 | |
|---|
| 39 | Diffie-Hellman (DH), Unified Diffie-Hellman |
|---|
| 40 | key agreement schemes (DH2), Menezes-Qu-Vanstone (MQV), Hashed MQV (HMQV), |
|---|
| 41 | Fully Hashed MQV (FHMQV), LUCDIF, XTR-DH |
|---|
| 42 | |
|---|
| 43 | elliptic curve cryptography ECDSA, ECNR, ECIES, ECDH, ECMQV |
|---|
| 44 | |
|---|
| 45 | insecure or obsolescent MD2, MD4, MD5, Panama Hash, DES, ARC4, SEAL |
|---|
| 46 | algorithms retained for backwards 3.0, WAKE-OFB, DESX (DES-XEX3), RC2, |
|---|
| 47 | compatibility and historical SAFER, 3-WAY, GOST, SHARK, CAST-128, Square |
|---|
| 48 | value |
|---|
| 49 | |
|---|
| 50 | Other features include: |
|---|
| 51 | |
|---|
| 52 | * pseudo random number generators (PRNG): ANSI X9.17 appendix C, RandomPool |
|---|
| 53 | * password based key derivation functions: PBKDF1 and PBKDF2 from PKCS #5, |
|---|
| 54 | PBKDF from PKCS #12 appendix B, HKDF from RFC 5869 |
|---|
| 55 | * Shamir's secret sharing scheme and Rabin's information dispersal algorithm |
|---|
| 56 | (IDA) |
|---|
| 57 | * fast multi-precision integer (bignum) and polynomial operations |
|---|
| 58 | * finite field arithmetics, including GF(p) and GF(2^n) |
|---|
| 59 | * prime number generation and verification |
|---|
| 60 | * useful non-cryptographic algorithms |
|---|
| 61 | + DEFLATE (RFC 1951) compression/decompression with gzip (RFC 1952) and |
|---|
| 62 | zlib (RFC 1950) format support |
|---|
| 63 | + hex, base-32, and base-64 coding/decoding |
|---|
| 64 | + 32-bit CRC, CRC-C and Adler32 checksum |
|---|
| 65 | * class wrappers for these platform and operating system features (optional): |
|---|
| 66 | + high resolution timers on Windows, Unix, and Mac OS |
|---|
| 67 | + Berkeley and Windows style sockets |
|---|
| 68 | + Windows named pipes |
|---|
| 69 | + /dev/random, /dev/urandom, /dev/srandom |
|---|
| 70 | + Microsoft's CryptGenRandom on Windows |
|---|
| 71 | + VIA Padlock, Amd64 RDRAND and RDSEED |
|---|
| 72 | * A high level interface for most of the above, using a filter/pipeline |
|---|
| 73 | metaphor |
|---|
| 74 | * benchmarks and validation testing |
|---|
| 75 | * x86, x86_64, MMX, SSE2, SSE4 assembly code for the most commonly used |
|---|
| 76 | algorithms, with run-time CPU feature detection and code selection. |
|---|
| 77 | Limited ARM NEON and ARMv8 ASIMD, CRC and Crypto extension support |
|---|
| 78 | * some versions are available in FIPS 140-2 validated form |
|---|
| 79 | |
|---|
| 80 | You are welcome to use it for any purpose without paying me, but see |
|---|
| 81 | License.txt for the fine print. |
|---|
| 82 | |
|---|
| 83 | The following compilers are supported for this release. Please visit |
|---|
| 84 | http://www.cryptopp.com the most up to date build instructions and porting notes. |
|---|
| 85 | |
|---|
| 86 | * MSVC 6.0 - 2015 |
|---|
| 87 | * GCC 3.3 - 7.0 |
|---|
| 88 | * Clang 2.9 - 4.0 |
|---|
| 89 | * C++Builder 2010 |
|---|
| 90 | * Intel C++ Compiler 9 - 16.0 |
|---|
| 91 | * Sun Studio 12u1 - 12.5 |
|---|
| 92 | |
|---|
| 93 | *** Important Usage Notes *** |
|---|
| 94 | |
|---|
| 95 | 1. If a constructor for A takes a pointer to an object B (except primitive |
|---|
| 96 | types such as int and char), then A owns B and will delete B at A's |
|---|
| 97 | destruction. If a constructor for A takes a reference to an object B, |
|---|
| 98 | then the caller retains ownership of B and should not destroy it until |
|---|
| 99 | A no longer needs it. |
|---|
| 100 | |
|---|
| 101 | 2. Crypto++ is thread safe at the class level. This means you can use |
|---|
| 102 | Crypto++ safely in a multithreaded application, but you must provide |
|---|
| 103 | synchronization when multiple threads access a common Crypto++ object. |
|---|
| 104 | |
|---|
| 105 | *** MSVC-Specific Information *** |
|---|
| 106 | |
|---|
| 107 | On Windows, Crypto++ can be compiled into 3 forms: a static library |
|---|
| 108 | including all algorithms, a DLL with only FIPS Approved algorithms, and |
|---|
| 109 | a static library with only algorithms not in the DLL. |
|---|
| 110 | (FIPS Approved means Approved according to the FIPS 140-2 standard.) |
|---|
| 111 | The DLL may be used by itself, or it may be used together with the second |
|---|
| 112 | form of the static library. MSVC project files are included to build |
|---|
| 113 | all three forms, and sample applications using each of the three forms |
|---|
| 114 | are also included. |
|---|
| 115 | |
|---|
| 116 | To compile Crypto++ with MSVC, open "cryptest.sln" (for MSVC 2005 - 2015) |
|---|
| 117 | or "cryptest.dsw" (for MSVC 6 - MSVC .NET 2003) workspace file and build |
|---|
| 118 | one or more of the following projects: |
|---|
| 119 | |
|---|
| 120 | cryptdll - This builds the DLL. Please note that if you wish to use Crypto++ |
|---|
| 121 | as a FIPS validated module, you must use a pre-built DLL that has undergone |
|---|
| 122 | the FIPS validation process instead of building your own. |
|---|
| 123 | dlltest - This builds a sample application that only uses the DLL. |
|---|
| 124 | cryptest Non-DLL-Import Configuration - This builds the full static library |
|---|
| 125 | along with a full test driver. |
|---|
| 126 | cryptest DLL-Import Configuration - This builds a static library containing |
|---|
| 127 | only algorithms not in the DLL, along with a full test driver that uses |
|---|
| 128 | both the DLL and the static library. |
|---|
| 129 | |
|---|
| 130 | To use the Crypto++ DLL in your application, #include "dll.h" before including |
|---|
| 131 | any other Crypto++ header files, and place the DLL in the same directory as |
|---|
| 132 | your .exe file. dll.h includes the line #pragma comment(lib, "cryptopp") |
|---|
| 133 | so you don't have to explicitly list the import library in your project |
|---|
| 134 | settings. To use a static library form of Crypto++, make the "cryptlib" |
|---|
| 135 | project a dependency of your application project, or specify it as |
|---|
| 136 | an additional library to link with in your project settings. |
|---|
| 137 | In either case you should check the compiler options to |
|---|
| 138 | make sure that the library and your application are using the same C++ |
|---|
| 139 | run-time libraries and calling conventions. |
|---|
| 140 | |
|---|
| 141 | *** DLL Memory Management *** |
|---|
| 142 | |
|---|
| 143 | Because it's possible for the Crypto++ DLL to delete objects allocated |
|---|
| 144 | by the calling application, they must use the same C++ memory heap. Three |
|---|
| 145 | methods are provided to achieve this. |
|---|
| 146 | 1. The calling application can tell Crypto++ what heap to use. This method |
|---|
| 147 | is required when the calling application uses a non-standard heap. |
|---|
| 148 | 2. Crypto++ can tell the calling application what heap to use. This method |
|---|
| 149 | is required when the calling application uses a statically linked C++ Run |
|---|
| 150 | Time Library. (Method 1 does not work in this case because the Crypto++ DLL |
|---|
| 151 | is initialized before the calling application's heap is initialized.) |
|---|
| 152 | 3. Crypto++ can automatically use the heap provided by the calling application's |
|---|
| 153 | dynamically linked C++ Run Time Library. The calling application must |
|---|
| 154 | make sure that the dynamically linked C++ Run Time Library is initialized |
|---|
| 155 | before Crypto++ is loaded. (At this time it is not clear if it is possible |
|---|
| 156 | to control the order in which DLLs are initialized on Windows 9x machines, |
|---|
| 157 | so it might be best to avoid using this method.) |
|---|
| 158 | |
|---|
| 159 | When Crypto++ attaches to a new process, it searches all modules loaded |
|---|
| 160 | into the process space for exported functions "GetNewAndDeleteForCryptoPP" |
|---|
| 161 | and "SetNewAndDeleteFromCryptoPP". If one of these functions is found, |
|---|
| 162 | Crypto++ uses methods 1 or 2, respectively, by calling the function. |
|---|
| 163 | Otherwise, method 3 is used. |
|---|
| 164 | |
|---|
| 165 | *** Linux and Unix-like Specific Information *** |
|---|
| 166 | |
|---|
| 167 | A makefile is included for you to compile Crypto++ with GCC and compatibles. |
|---|
| 168 | Make sure you are using GNU Make and GNU ld. The make process will produce |
|---|
| 169 | two files, libcryptopp.a and cryptest.exe. Run "cryptest.exe v" for the |
|---|
| 170 | validation suite and "cryptest.exe tv all" for additional test vectors. |
|---|
| 171 | |
|---|
| 172 | The makefile uses '-DNDEBUG -g2 -O2' CXXFLAGS by default. If you use an |
|---|
| 173 | alternate build system, like Autotools or CMake, then ensure the build system |
|---|
| 174 | includes '-DNDEBUG' for production or release builds. The Crypto++ library uses |
|---|
| 175 | asserts for debugging and diagnostics during development; it does not |
|---|
| 176 | rely on them to crash a program at runtime. |
|---|
| 177 | |
|---|
| 178 | If an assert triggers in production software, then unprotected sensitive |
|---|
| 179 | information could be egressed from the program to the filesystem or the |
|---|
| 180 | platform's error reporting program, like Apport on Ubuntu or CrashReporter |
|---|
| 181 | on Apple. |
|---|
| 182 | |
|---|
| 183 | The makefile orders object files to help remediate problems associated with |
|---|
| 184 | C++ static initialization order. The library does not use custom linker scripts. |
|---|
| 185 | If you use an alternate build system, like Autotools or CMake, and collect source |
|---|
| 186 | files into a list, then ensure these three are at the head of the list: 'cryptlib.cpp |
|---|
| 187 | cpu.cpp integer.cpp <other sources>'. They should be linked in the same order: |
|---|
| 188 | 'cryptlib.o cpu.o integer.o <other objects>'. |
|---|
| 189 | |
|---|
| 190 | If your linker supports initialization attributes, like init_priority, then you can |
|---|
| 191 | define CRYPTOPP_INIT_PRIORITY to control object initialization order. Set it to a |
|---|
| 192 | value like 250. User programs can use CRYPTOPP_USER_PRIORITY to avoid conflicts with |
|---|
| 193 | library values. Initialization attributes are more reliable than object file ordering, |
|---|
| 194 | but its not ubiquitously supported by linkers. |
|---|
| 195 | |
|---|
| 196 | The makefile links to the static version of the Crypto++ library to avoid binary |
|---|
| 197 | planting and other LD_PRELOAD tricks. You should use the static version of the |
|---|
| 198 | library in your programs to help avoid unwanted redirections. |
|---|
| 199 | |
|---|
| 200 | *** Documentation and Support *** |
|---|
| 201 | |
|---|
| 202 | Crypto++ is documented through inline comments in header files, which are |
|---|
| 203 | processed through Doxygen to produce an HTML reference manual. You can find |
|---|
| 204 | a link to the manual from http://www.cryptopp.com. Also at that site is |
|---|
| 205 | the Crypto++ FAQ, which you should browse through before attempting to |
|---|
| 206 | use this library, because it will likely answer many of questions that |
|---|
| 207 | may come up. Finally, the site provide the wiki which has many topics |
|---|
| 208 | and code examples. |
|---|
| 209 | |
|---|
| 210 | If you run into any problems, please try the Crypto++ mailing list. |
|---|
| 211 | The subscription information and the list archive are available on |
|---|
| 212 | http://www.cryptopp.com. You can also email me directly by visiting |
|---|
| 213 | http://www.weidai.com, but you will probably get a faster response through |
|---|
| 214 | the mailing list. |
|---|
| 215 | |
|---|
| 216 | *** History *** |
|---|
| 217 | |
|---|
| 218 | 1.0 - First public release. Withdrawn at the request of RSA DSI. |
|---|
| 219 | - included Blowfish, BBS, DES, DH, Diamond, DSA, ElGamal, IDEA, |
|---|
| 220 | MD5, RC4, RC5, RSA, SHA, WAKE, secret sharing, DEFLATE compression |
|---|
| 221 | - had a serious bug in the RSA key generation code. |
|---|
| 222 | |
|---|
| 223 | 1.1 - Removed RSA, RC4, RC5 |
|---|
| 224 | - Disabled calls to RSAREF's non-public functions |
|---|
| 225 | - Minor bugs fixed |
|---|
| 226 | |
|---|
| 227 | 2.0 - a completely new, faster multiprecision integer class |
|---|
| 228 | - added MD5-MAC, HAVAL, 3-WAY, TEA, SAFER, LUC, Rabin, BlumGoldwasser, |
|---|
| 229 | elliptic curve algorithms |
|---|
| 230 | - added the Lucas strong probable primality test |
|---|
| 231 | - ElGamal encryption and signature schemes modified to avoid weaknesses |
|---|
| 232 | - Diamond changed to Diamond2 because of key schedule weakness |
|---|
| 233 | - fixed bug in WAKE key setup |
|---|
| 234 | - SHS class renamed to SHA |
|---|
| 235 | - lots of miscellaneous optimizations |
|---|
| 236 | |
|---|
| 237 | 2.1 - added Tiger, HMAC, GOST, RIPE-MD160, LUCELG, LUCDIF, XOR-MAC, |
|---|
| 238 | OAEP, PSSR, SHARK |
|---|
| 239 | - added precomputation to DH, ElGamal, DSA, and elliptic curve algorithms |
|---|
| 240 | - added back RC5 and a new RSA |
|---|
| 241 | - optimizations in elliptic curves over GF(p) |
|---|
| 242 | - changed Rabin to use OAEP and PSSR |
|---|
| 243 | - changed many classes to allow copy constructors to work correctly |
|---|
| 244 | - improved exception generation and handling |
|---|
| 245 | |
|---|
| 246 | 2.2 - added SEAL, CAST-128, Square |
|---|
| 247 | - fixed bug in HAVAL (padding problem) |
|---|
| 248 | - fixed bug in triple-DES (decryption order was reversed) |
|---|
| 249 | - fixed bug in RC5 (couldn't handle key length not a multiple of 4) |
|---|
| 250 | - changed HMAC to conform to RFC-2104 (which is not compatible |
|---|
| 251 | with the original HMAC) |
|---|
| 252 | - changed secret sharing and information dispersal to use GF(2^32) |
|---|
| 253 | instead of GF(65521) |
|---|
| 254 | - removed zero knowledge prover/verifier for graph isomorphism |
|---|
| 255 | - removed several utility classes in favor of the C++ standard library |
|---|
| 256 | |
|---|
| 257 | 2.3 - ported to EGCS |
|---|
| 258 | - fixed incomplete workaround of min/max conflict in MSVC |
|---|
| 259 | |
|---|
| 260 | 3.0 - placed all names into the "CryptoPP" namespace |
|---|
| 261 | - added MD2, RC2, RC6, MARS, RW, DH2, MQV, ECDHC, CBC-CTS |
|---|
| 262 | - added abstract base classes PK_SimpleKeyAgreementDomain and |
|---|
| 263 | PK_AuthenticatedKeyAgreementDomain |
|---|
| 264 | - changed DH and LUCDIF to implement the PK_SimpleKeyAgreementDomain |
|---|
| 265 | interface and to perform domain parameter and key validation |
|---|
| 266 | - changed interfaces of PK_Signer and PK_Verifier to sign and verify |
|---|
| 267 | messages instead of message digests |
|---|
| 268 | - changed OAEP to conform to PKCS#1 v2.0 |
|---|
| 269 | - changed benchmark code to produce HTML tables as output |
|---|
| 270 | - changed PSSR to track IEEE P1363a |
|---|
| 271 | - renamed ElGamalSignature to NR and changed it to track IEEE P1363 |
|---|
| 272 | - renamed ECKEP to ECMQVC and changed it to track IEEE P1363 |
|---|
| 273 | - renamed several other classes for clarity |
|---|
| 274 | - removed support for calling RSAREF |
|---|
| 275 | - removed option to compile old SHA (SHA-0) |
|---|
| 276 | - removed option not to throw exceptions |
|---|
| 277 | |
|---|
| 278 | 3.1 - added ARC4, Rijndael, Twofish, Serpent, CBC-MAC, DMAC |
|---|
| 279 | - added interface for querying supported key lengths of symmetric ciphers |
|---|
| 280 | and MACs |
|---|
| 281 | - added sample code for RSA signature and verification |
|---|
| 282 | - changed CBC-CTS to be compatible with RFC 2040 |
|---|
| 283 | - updated SEAL to version 3.0 of the cipher specification |
|---|
| 284 | - optimized multiprecision squaring and elliptic curves over GF(p) |
|---|
| 285 | - fixed bug in MARS key setup |
|---|
| 286 | - fixed bug with attaching objects to Deflator |
|---|
| 287 | |
|---|
| 288 | 3.2 - added DES-XEX3, ECDSA, DefaultEncryptorWithMAC |
|---|
| 289 | - renamed DES-EDE to DES-EDE2 and TripleDES to DES-EDE3 |
|---|
| 290 | - optimized ARC4 |
|---|
| 291 | - generalized DSA to allow keys longer than 1024 bits |
|---|
| 292 | - fixed bugs in GF2N and ModularArithmetic that can cause calculation errors |
|---|
| 293 | - fixed crashing bug in Inflator when given invalid inputs |
|---|
| 294 | - fixed endian bug in Serpent |
|---|
| 295 | - fixed padding bug in Tiger |
|---|
| 296 | |
|---|
| 297 | 4.0 - added Skipjack, CAST-256, Panama, SHA-2 (SHA-256, SHA-384, and SHA-512), |
|---|
| 298 | and XTR-DH |
|---|
| 299 | - added a faster variant of Rabin's Information Dispersal Algorithm (IDA) |
|---|
| 300 | - added class wrappers for these operating system features: |
|---|
| 301 | - high resolution timers on Windows, Unix, and MacOS |
|---|
| 302 | - Berkeley and Windows style sockets |
|---|
| 303 | - Windows named pipes |
|---|
| 304 | - /dev/random and /dev/urandom on Linux and FreeBSD |
|---|
| 305 | - Microsoft's CryptGenRandom on Windows |
|---|
| 306 | - added support for SEC 1 elliptic curve key format and compressed points |
|---|
| 307 | - added support for X.509 public key format (subjectPublicKeyInfo) for |
|---|
| 308 | RSA, DSA, and elliptic curve schemes |
|---|
| 309 | - added support for DER and OpenPGP signature format for DSA |
|---|
| 310 | - added support for ZLIB compressed data format (RFC 1950) |
|---|
| 311 | - changed elliptic curve encryption to use ECIES (as defined in SEC 1) |
|---|
| 312 | - changed MARS key schedule to reflect the latest specification |
|---|
| 313 | - changed BufferedTransformation interface to support multiple channels |
|---|
| 314 | and messages |
|---|
| 315 | - changed CAST and SHA-1 implementations to use public domain source code |
|---|
| 316 | - fixed bug in StringSource |
|---|
| 317 | - optmized multi-precision integer code for better performance |
|---|
| 318 | |
|---|
| 319 | 4.1 - added more support for the recommended elliptic curve parameters in SEC 2 |
|---|
| 320 | - added Panama MAC, MARC4 |
|---|
| 321 | - added IV stealing feature to CTS mode |
|---|
| 322 | - added support for PKCS #8 private key format for RSA, DSA, and elliptic |
|---|
| 323 | curve schemes |
|---|
| 324 | - changed Deflate, MD5, Rijndael, and Twofish to use public domain code |
|---|
| 325 | - fixed a bug with flushing compressed streams |
|---|
| 326 | - fixed a bug with decompressing stored blocks |
|---|
| 327 | - fixed a bug with EC point decompression using non-trinomial basis |
|---|
| 328 | - fixed a bug in NetworkSource::GeneralPump() |
|---|
| 329 | - fixed a performance issue with EC over GF(p) decryption |
|---|
| 330 | - fixed syntax to allow GCC to compile without -fpermissive |
|---|
| 331 | - relaxed some restrictions in the license |
|---|
| 332 | |
|---|
| 333 | 4.2 - added support for longer HMAC keys |
|---|
| 334 | - added MD4 (which is not secure so use for compatibility purposes only) |
|---|
| 335 | - added compatibility fixes/workarounds for STLport 4.5, GCC 3.0.2, |
|---|
| 336 | and MSVC 7.0 |
|---|
| 337 | - changed MD2 to use public domain code |
|---|
| 338 | - fixed a bug with decompressing multiple messages with the same object |
|---|
| 339 | - fixed a bug in CBC-MAC with MACing multiple messages with the same object |
|---|
| 340 | - fixed a bug in RC5 and RC6 with zero-length keys |
|---|
| 341 | - fixed a bug in Adler32 where incorrect checksum may be generated |
|---|
| 342 | |
|---|
| 343 | 5.0 - added ESIGN, DLIES, WAKE-OFB, PBKDF1 and PBKDF2 from PKCS #5 |
|---|
| 344 | - added key validation for encryption and signature public/private keys |
|---|
| 345 | - renamed StreamCipher interface to SymmetricCipher, which is now implemented |
|---|
| 346 | by both stream ciphers and block cipher modes including ECB and CBC |
|---|
| 347 | - added keying interfaces to support resetting of keys and IVs without |
|---|
| 348 | having to destroy and recreate objects |
|---|
| 349 | - changed filter interface to support non-blocking input/output |
|---|
| 350 | - changed SocketSource and SocketSink to use overlapped I/O on Microsoft Windows |
|---|
| 351 | - grouped related classes inside structs to help templates, for example |
|---|
| 352 | AESEncryption and AESDecryption are now AES::Encryption and AES::Decryption |
|---|
| 353 | - where possible, typedefs have been added to improve backwards |
|---|
| 354 | compatibility when the CRYPTOPP_MAINTAIN_BACKWARDS_COMPATIBILITY macro is defined |
|---|
| 355 | - changed Serpent, HAVAL and IDEA to use public domain code |
|---|
| 356 | - implemented SSE2 optimizations for Integer operations |
|---|
| 357 | - fixed a bug in HMAC::TruncatedFinal() |
|---|
| 358 | - fixed SKIPJACK byte ordering following NIST clarification dated 5/9/02 |
|---|
| 359 | |
|---|
| 360 | 5.01 - added known answer test for X9.17 RNG in FIPS 140 power-up self test |
|---|
| 361 | - submitted to NIST/CSE, but not publicly released |
|---|
| 362 | |
|---|
| 363 | 5.02 - changed EDC test to MAC integrity check using HMAC/SHA1 |
|---|
| 364 | - improved performance of integrity check |
|---|
| 365 | - added blinding to defend against RSA timing attack |
|---|
| 366 | |
|---|
| 367 | 5.03 - created DLL version of Crypto++ for FIPS 140-2 validation |
|---|
| 368 | - fixed vulnerabilities in GetNextIV for CTR and OFB modes |
|---|
| 369 | |
|---|
| 370 | 5.0.4 - Removed DES, SHA-256, SHA-384, SHA-512 from DLL |
|---|
| 371 | |
|---|
| 372 | 5.1 - added PSS padding and changed PSSR to track IEEE P1363a draft standard |
|---|
| 373 | - added blinding for RSA and Rabin to defend against timing attacks |
|---|
| 374 | on decryption operations |
|---|
| 375 | - changed signing and decryption APIs to support the above |
|---|
| 376 | - changed WaitObjectContainer to allow waiting for more than 64 |
|---|
| 377 | objects at a time on Win32 platforms |
|---|
| 378 | - fixed a bug in CBC and ECB modes with processing non-aligned data |
|---|
| 379 | - fixed standard conformance bugs in DLIES (DHAES mode) and RW/EMSA2 |
|---|
| 380 | signature scheme (these fixes are not backwards compatible) |
|---|
| 381 | - fixed a number of compiler warnings, minor bugs, and portability problems |
|---|
| 382 | - removed Sapphire |
|---|
| 383 | |
|---|
| 384 | 5.2 - merged in changes for 5.01 - 5.0.4 |
|---|
| 385 | - added support for using encoding parameters and key derivation parameters |
|---|
| 386 | with public key encryption (implemented by OAEP and DL/ECIES) |
|---|
| 387 | - added Camellia, SHACAL-2, Two-Track-MAC, Whirlpool, RIPEMD-320, |
|---|
| 388 | RIPEMD-128, RIPEMD-256, Base-32 coding, FIPS variant of CFB mode |
|---|
| 389 | - added ThreadUserTimer for timing thread CPU usage |
|---|
| 390 | - added option for password-based key derivation functions |
|---|
| 391 | to iterate until a mimimum elapsed thread CPU time is reached |
|---|
| 392 | - added option (on by default) for DEFLATE compression to detect |
|---|
| 393 | uncompressible files and process them more quickly |
|---|
| 394 | - improved compatibility and performance on 64-bit platforms, |
|---|
| 395 | including Alpha, IA-64, x86-64, PPC64, Sparc64, and MIPS64 |
|---|
| 396 | - fixed ONE_AND_ZEROS_PADDING to use 0x80 instead 0x01 as padding. |
|---|
| 397 | - fixed encoding/decoding of PKCS #8 privateKeyInfo to properly |
|---|
| 398 | handle optional attributes |
|---|
| 399 | |
|---|
| 400 | 5.2.1 - fixed bug in the "dlltest" DLL testing program |
|---|
| 401 | - fixed compiling with STLport using VC .NET |
|---|
| 402 | - fixed compiling with -fPIC using GCC |
|---|
| 403 | - fixed compiling with -msse2 on systems without memalign() |
|---|
| 404 | - fixed inability to instantiate PanamaMAC |
|---|
| 405 | - fixed problems with inline documentation |
|---|
| 406 | |
|---|
| 407 | 5.2.2 - added SHA-224 |
|---|
| 408 | - put SHA-256, SHA-384, SHA-512, RSASSA-PSS into DLL |
|---|
| 409 | |
|---|
| 410 | 5.2.3 - fixed issues with FIPS algorithm test vectors |
|---|
| 411 | - put RSASSA-ISO into DLL |
|---|
| 412 | |
|---|
| 413 | 5.3 - ported to MSVC 2005 with support for x86-64 |
|---|
| 414 | - added defense against AES timing attacks, and more AES test vectors |
|---|
| 415 | - changed StaticAlgorithmName() of Rijndael to "AES", CTR to "CTR" |
|---|
| 416 | |
|---|
| 417 | 5.4 - added Salsa20 |
|---|
| 418 | - updated Whirlpool to version 3.0 |
|---|
| 419 | - ported to GCC 4.1, Sun C++ 5.8, and Borland C++Builder 2006 |
|---|
| 420 | |
|---|
| 421 | 5.5 - added VMAC and Sosemanuk (with x86-64 and SSE2 assembly) |
|---|
| 422 | - improved speed of integer arithmetic, AES, SHA-512, Tiger, Salsa20, |
|---|
| 423 | Whirlpool, and PANAMA cipher using assembly (x86-64, MMX, SSE2) |
|---|
| 424 | - optimized Camellia and added defense against timing attacks |
|---|
| 425 | - updated benchmarks code to show cycles per byte and to time key/IV setup |
|---|
| 426 | - started using OpenMP for increased multi-core speed |
|---|
| 427 | - enabled GCC optimization flags by default in GNUmakefile |
|---|
| 428 | - added blinding and computational error checking for RW signing |
|---|
| 429 | - changed RandomPool, X917RNG, GetNextIV, DSA/NR/ECDSA/ECNR to reduce |
|---|
| 430 | the risk of reusing random numbers and IVs after virtual machine state |
|---|
| 431 | rollback |
|---|
| 432 | - changed default FIPS mode RNG from AutoSeededX917RNG<DES_EDE3> to |
|---|
| 433 | AutoSeededX917RNG<AES> |
|---|
| 434 | - fixed PANAMA cipher interface to accept 256-bit key and 256-bit IV |
|---|
| 435 | - moved MD2, MD4, MD5, PanamaHash, ARC4, WAKE_CFB into the namespace "Weak" |
|---|
| 436 | - removed HAVAL, MD5-MAC, XMAC |
|---|
| 437 | |
|---|
| 438 | 5.5.1 - fixed VMAC validation failure on 32-bit big-endian machines |
|---|
| 439 | |
|---|
| 440 | 5.5.2 - ported x64 assembly language code for AES, Salsa20, Sosemanuk, and Panama |
|---|
| 441 | to MSVC 2005 (using MASM since MSVC doesn't support inline assembly on x64) |
|---|
| 442 | - fixed Salsa20 initialization crash on non-SSE2 machines |
|---|
| 443 | - fixed Whirlpool crash on Pentium 2 machines |
|---|
| 444 | - fixed possible branch prediction analysis (BPA) vulnerability in |
|---|
| 445 | MontgomeryReduce(), which may affect security of RSA, RW, LUC |
|---|
| 446 | - fixed link error with MSVC 2003 when using "debug DLL" form of runtime library |
|---|
| 447 | - fixed crash in SSE2_Add on P4 machines when compiled with |
|---|
| 448 | MSVC 6.0 SP5 with Processor Pack |
|---|
| 449 | - ported to MSVC 2008, GCC 4.2, Sun CC 5.9, Intel C++ Compiler 10.0, |
|---|
| 450 | and Borland C++Builder 2007 |
|---|
| 451 | |
|---|
| 452 | 5.6.0 - added AuthenticatedSymmetricCipher interface class and Filter wrappers |
|---|
| 453 | - added CCM, GCM (with SSE2 assembly), EAX, CMAC, XSalsa20, and SEED |
|---|
| 454 | - added support for variable length IVs |
|---|
| 455 | - added OIDs for Brainpool elliptic curve parameters |
|---|
| 456 | - improved AES and SHA-256 speed on x86 and x64 |
|---|
| 457 | - changed BlockTransformation interface to no longer assume data alignment |
|---|
| 458 | - fixed incorrect VMAC computation on message lengths |
|---|
| 459 | that are >64 mod 128 (x86 assembly version is not affected) |
|---|
| 460 | - fixed compiler error in vmac.cpp on x86 with GCC -fPIC |
|---|
| 461 | - fixed run-time validation error on x86-64 with GCC 4.3.2 -O2 |
|---|
| 462 | - fixed HashFilter bug when putMessage=true |
|---|
| 463 | - fixed AES-CTR data alignment bug that causes incorrect encryption on ARM |
|---|
| 464 | - removed WORD64_AVAILABLE; compiler support for 64-bit int is now required |
|---|
| 465 | - ported to GCC 4.3, C++Builder 2009, Sun CC 5.10, Intel C++ Compiler 11 |
|---|
| 466 | |
|---|
| 467 | 5.6.1 - added support for AES-NI and CLMUL instruction sets in AES and GMAC/GCM |
|---|
| 468 | - removed WAKE-CFB |
|---|
| 469 | - fixed several bugs in the SHA-256 x86/x64 assembly code: |
|---|
| 470 | * incorrect hash on non-SSE2 x86 machines on non-aligned input |
|---|
| 471 | * incorrect hash on x86 machines when input crosses 0x80000000 |
|---|
| 472 | * incorrect hash on x64 when compiled with GCC with optimizations enabled |
|---|
| 473 | - fixed bugs in AES x86 and x64 assembly causing crashes in some MSVC build configurations |
|---|
| 474 | - switched to a public domain implementation of MARS |
|---|
| 475 | - ported to MSVC 2010, GCC 4.5.1, Sun Studio 12u1, C++Builder 2010, Intel C++ Compiler 11.1 |
|---|
| 476 | - renamed the MSVC DLL project to "cryptopp" for compatibility with MSVC 2010 |
|---|
| 477 | |
|---|
| 478 | 5.6.2 - changed license to Boost Software License 1.0 |
|---|
| 479 | - added SHA-3 (Keccak) |
|---|
| 480 | - updated DSA to FIPS 186-3 (see DSA2 class) |
|---|
| 481 | - fixed Blowfish minimum keylength to be 4 bytes (32 bits) |
|---|
| 482 | - fixed Salsa validation failure when compiling with GCC 4.6 |
|---|
| 483 | - fixed infinite recursion when on x64, assembly disabled, and no AESNI |
|---|
| 484 | - ported to MSVC 2012, GCC 4.7, Clang 3.2, Solaris Studio 12.3, Intel C++ Compiler 13.0 |
|---|
| 485 | |
|---|
| 486 | 5.6.3 - maintenance release, honored API/ABI/Versioning requirements |
|---|
| 487 | - expanded processes to include community and its input |
|---|
| 488 | * 12 unique contributors for this release |
|---|
| 489 | - fixed CVE-2015-2141 |
|---|
| 490 | - cleared most Undefined Behavior Sanitizer (UBsan) findings |
|---|
| 491 | - cleared all Address Sanitizer (Asan) findings |
|---|
| 492 | - cleared all Valgrind findings |
|---|
| 493 | - cleared all Coverity findings |
|---|
| 494 | - cleared all Enterprise Analysis (/analyze) findings |
|---|
| 495 | - cleared most GCC warnings with -Wall |
|---|
| 496 | - cleared most Clang warnings with -Wall |
|---|
| 497 | - cleared most MSVC warnings with /W4 |
|---|
| 498 | - added -fPIC 64-bit builds. Off by default for i386 |
|---|
| 499 | - added HKDF class from RFC 5868 |
|---|
| 500 | - switched to member_ptr due to C++ 11 warnings for auto_ptr |
|---|
| 501 | - initialization of C++ static objects, off by default |
|---|
| 502 | * GCC and init_priotirty/constructor attributes |
|---|
| 503 | * MSVC and init_seg(lib) |
|---|
| 504 | * CRYPTOPP_INIT_PRIORITY disabled by default, but available |
|---|
| 505 | - improved OS X support |
|---|
| 506 | - improved GNUmakefile support for Testing and QA |
|---|
| 507 | - added self tests for additional Testing and QA |
|---|
| 508 | - added cryptest.sh for systematic Testing and QA |
|---|
| 509 | - added GNU Gold linker support |
|---|
| 510 | - added Visual Studio 2010 solution and project files in vs2010.zip |
|---|
| 511 | - added Clang integrated assembler support |
|---|
| 512 | - unconditionally define CRYPTOPP_NO_UNALIGNED_DATA_ACCESS for Makefile |
|---|
| 513 | target 'ubsan' and at -O3 due to GCC vectorization on x86 and x86_64 |
|---|
| 514 | - workaround ARMEL/GCC 5.2 bug and failed self test |
|---|
| 515 | - fixed crash in MQV due to GCC 4.9+ and inlining |
|---|
| 516 | - fixed hang in SHA due to GCC 4.9+ and inlining |
|---|
| 517 | - fixed missing rdtables::Te under VS with ALIGNED_DATA_ACCESS |
|---|
| 518 | - fixed S/390 and big endian feature detection |
|---|
| 519 | - fixed S/390 and int128_t/uint128_t detection |
|---|
| 520 | - fixed X32 (ILP32) feature detection |
|---|
| 521 | - removed _CRT_SECURE_NO_DEPRECATE for Microsoft platforms |
|---|
| 522 | - utilized bound checking interfaces from ISO/IEC TR 24772 when available |
|---|
| 523 | - improved ARM, ARM64, MIPS, MIPS64, S/390 and X32 (ILP32) support |
|---|
| 524 | - introduced CRYPTOPP_MAINTAIN_BACKWARDS_COMPATIBILITY_562 |
|---|
| 525 | - added additional Doxygen-based documentation |
|---|
| 526 | - ported to MSVC 2015, Xcode 7.2, GCC 5.2, Clang 3.7, Intel C++ 16.00 |
|---|
| 527 | |
|---|
| 528 | 5.6.4 - maintenance release, honored API/ABI/Versioning requirements |
|---|
| 529 | - expanded community input and support |
|---|
| 530 | * 22 unique contributors for this release |
|---|
| 531 | - fixed CVE-2016-3995 |
|---|
| 532 | - changed SHA3 to FIPS 202 (F1600, XOF d=0x06) |
|---|
| 533 | - added Keccak (F1600, XOF d=0x01) |
|---|
| 534 | - added ChaCha (ChaCha8/12/20) |
|---|
| 535 | - added HMQV and FHMQV |
|---|
| 536 | * Hashed and Fully Hashed MQV |
|---|
| 537 | - added BLAKE2 (BLAKE2s and BLAKE2b) |
|---|
| 538 | * C++, SSE2, SSE4, ARM NEON and ARMv8 ASIMD |
|---|
| 539 | - added CRC32-C |
|---|
| 540 | * C/C++, Amd64 CRC, and ARMv8 CRC |
|---|
| 541 | - improved Rabin-William signatures |
|---|
| 542 | * Tweaked roots <em>e</em> and <em>f</em> |
|---|
| 543 | - improved C++11 support |
|---|
| 544 | * atomics, threads and fences |
|---|
| 545 | * alginof, alignas |
|---|
| 546 | * constexpr |
|---|
| 547 | * noexcept |
|---|
| 548 | - improved GCM mode |
|---|
| 549 | * ARM NEON and ARMv8 ASIMD |
|---|
| 550 | * ARMv8 carry-less multiply |
|---|
| 551 | - improved Windows 8 and 10 support |
|---|
| 552 | * Windows Phone, Universal Windows Platform, Windows Store |
|---|
| 553 | - improved MIPS, ARMv7 and ARMv8 support |
|---|
| 554 | * added scripts setenv-{android|embedded|ios}.sh for GNUmakefile-cross |
|---|
| 555 | * aggressive use of -march=<arch> and -mfpu=<fpu> in cryptest.sh |
|---|
| 556 | - improved build systems |
|---|
| 557 | * Visual Studio 2010 default |
|---|
| 558 | * added CMake support (lacks FindCryptopp.cmake) |
|---|
| 559 | * archived VC++ 5/0/6.0 project files (vc60.zip) |
|---|
| 560 | * archived VS2005 project files (vs2005.zip) |
|---|
| 561 | * archived Borland project files (bds10.zip) |
|---|
| 562 | - improved Testing and QA |
|---|
| 563 | * expanded platforms and compilers |
|---|
| 564 | * added code generation tests based on CPU features |
|---|
| 565 | * added C++03, C++11, C++14, C++17 testing |
|---|
| 566 | * added -O3, -O5, -Ofast and -Os testing |
|---|
| 567 | - ported to MSVC 2015 SP3, Xcode 9.0, Sun Studio 12.5, GCC 7.0, MacPorts GCC 7.0, Clang 3.8, Intel C++ 17.00 |
|---|
| 568 | |
|---|
| 569 | Written by Wei Dai and the Crypto++ Project |
|---|
