[gnutls-dev] GnuTLS 1.4.4
Simon Josefsson
jas at extundo.com
Tue Sep 12 16:35:42 CEST 2006
I am happy to announce GnuTLS 1.4.4, a bugfix release on the stable
1.4 branch. This version is what we recommend for those who need a
stable version of GnuTLS.
GnuTLS is a modern C library that implement the standard network
security protocol Transport Layer Security (TLS), for use by network
applications.
Noteworthy changes since 1.4.3:
** Relax the test that caught signatures that exploit the variant of
** Bleichenbacher's Crypto 06 rump session attack on our
** verification logic flaw.
In particular, we now permit the digestAlgorithm.parameters field to
be present but empty, whereas in 1.4.3 we actually checked that the
field was absent.
** Revert the removal of debug information for the GNUTLS-SA-2006-3 problem.
The messages are only printed in debug mode, which is not recommended
for normal use, and thus logging this situation cannot be abused as an
oracle in typical recommended situations.
Note that this release does not contain any security fixes compared to
1.4.3, however, it does fix a crash that was introduced by 1.4.3, and
it also fixes false negatives when verifying certificates. Thus,
users are strongly encouraged to upgrade to this version.
Improving GnuTLS is costly, but you can help! We are looking for
organizations that find GnuTLS useful and wish to contribute back.
You can contribute by reporting bugs, improve the software, or donate
money or equipment.
Commercial support contracts for GnuTLS are available, and they help
finance continued maintenance. Simon Josefsson Datakonsult, a
Stockholm based privately held company, is currently funding GnuTLS
maintenance. We are always looking for interesting development
projects. See http://josefsson.org/ for more details.
All manual formats are available from:
http://www.gnutls.org/manual/
Direct link to the most popular formats:
http://www.gnutls.org/manual/gnutls.html - HTML format
http://www.gnutls.org/manual/gnutls.pdf - PDF format
http://www.gnutls.org/reference/ch01.html - API Reference, GTK-DOC HTML
If you need help to use GnuTLS, or want to help others, you are
invited to join our help-gnutls mailing list, see:
<http://lists.gnu.org/mailman/listinfo/help-gnutls>.
The project page of the library is available at:
http://www.gnutls.org/
http://www.gnu.org/software/gnutls/
http://josefsson.org/gnutls/
Here are the compressed sources (3.9MB):
http://josefsson.org/gnutls/releases/gnutls-1.4.4.tar.bz2
Here are GPG detached signatures signed using key 0xB565716F:
http://josefsson.org/gnutls/releases/gnutls-1.4.4.tar.bz2.sig
The software is cryptographically signed by the author using an
OpenPGP key identified by the following information:
pub 1280R/B565716F 2002-05-05 [expires: 2007-02-15]
uid Simon Josefsson <jas at extundo.com>
uid Simon Josefsson <simon at josefsson.org>
sub 1280R/4D5D40AE 2002-05-05 [expires: 2007-02-15]
sub 1024R/09CC4670 2006-03-18 [expires: 2007-04-22]
sub 1024R/AABB1F7B 2006-03-18 [expires: 2007-04-22]
sub 1024R/A14C401A 2006-03-18 [expires: 2007-04-22]
The key is available from:
http://josefsson.org/key.txt
dns:b565716f.josefsson.org?TYPE=CERT
Here are the SHA-1 and SHA-224 checksums:
8f6ee112c8d93dd726e8e3d0e3fbf234f085a2cd gnutls-1.4.4.tar.bz2
a72377bccf8d49421f7f5f4e0ff85b489ef4d8d1 gnutls-1.4.4.tar.bz2.sig
a357b06cecc3ed5b79d98a26c08bc0b4137aa90bb6453e10a5845681 gnutls-1.4.4.tar.bz2
9aad60797aa994fbac8fd0b8ec6127acfa0c01a75680a6520dc28fc1 gnutls-1.4.4.tar.bz2.sig
Enjoy,
Nikos and Simon
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 419 bytes
Desc: not available
URL: </pipermail/attachments/20060912/7a3528a1/attachment.pgp>
More information about the Gnutls-devel
mailing list