v0.12.5

CHANGES:

• Rename length to v_length to be compatible with cstruct 6.0.0 (#419 @dinosaure)

v0.12.4

CHANGES:

• handshake_server13: demote group and cipher log level (#417 by @xguerin)
• tls_lwt: register printers for Tls_alert and Tls_failure (#418 by @hannesm)

v0.12.3

CHANGES:

• Adapt to new GCM and CCM API of mirage-crypto (#416 by @hannesm)
• Add support for ChaCha20/Poly1305 ciphersuite (#416 by @hannesm)

v0.12.2

CHANGES:

• tls_lwt again calls Mirage_crypto_rng_lwt.initialize () -- which is since
  mirage-crypto-rng 0.8 no longer inside the lwt monad, and safe to be called
  multiple times and on top level (#415 by @hannesm)

v0.12.1

CHANGES:

in #414 by @hannesm

• Drop support for RC4 ciphersuite
• Raise lower TLS version in default configuration to 1.2
• tls_lwt no longer calls Mirage_crypto_rng_unix.initialize -- this needs to be
  done in the application, inside Lwt_main.run:
  Mirage_crypto_rng_lwt.initialize () >>= fun () ->
• Support ECDHE ciphersuites in TLS 1.2 and below as specified in RFC 8422
  (requested in #413 by @ryanakca, also in #362 by @orbitz @annubiz)
• drop "TLS_" prefix from ciphersuite constructors
• BUGFIX: TLS client (<= 1.2) assembling an empty Certificate message
  (noticed in #413, present since 0.12.0 release)
• Cleanup Packet.any_ciphersuite list (remove ARIA, CAMELLIA, KRB5, EXPORT)
• Adapt interoperability test scripts with TLS 1.3 support

v0.12.0

CHANGES:

in #405 by @hannesm

• TLS 1.3 support
• Tracing now uses the logs library (log source tls.tracing on debug level)
• bugfix for padding in ClientHello, which computed wrong length
• bugfix hs_fragments to be set before executing the protocol handling logic
• bugfix guard RSA signature with an Insufficient_key handler, which may occur
  when using an RSA key which size is too small for the used digest algorithm

v0.11.1

CHANGES:

• Adapt to X509.0.11.0 API changes (#412)

v0.11.0

CHANGES:

• use dune as build system (#407)
• BREAKING split into tls and tls-mirage opam packages (#407)
• BREAKING use mirage-crypto instead of nocrypto (#407)

v0.10.6

v0.10.6 (2020-01-23)

• adapt to x509 0.9.0 interface: certificate revocation lists can now be passed
  to the authenticator in Tls_mirage and X509_lwt; also a list of hash
  algorithms to be used for certificate signature verification can be passed to
  the authenticator
• adapt to lwt 5.0.0

v0.10.5

v0.10.5 (2019-11-01)

• adapt to mirage-flow 2.0.0, mirage-clock 3.0.0, mirage-kv 3.0.0 interfaces (#401 @hannesm)