| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Fix: mprove and update the comments. Added API documentation notes for provider lifecycle and reentrancy expectations. Provider init callbacks should not re-enter provider manager APIs with the same library context, and provider-backed contexts require the selected provider to remain loaded until those contexts are freed or deinitialized. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1808 | 10 天前 | |
feat: harden SLH-DSA and PQC PKI support Includes e6a7edaeecc1e259105a97ddc04555ef33fc088b: Fix SLH-DSA validation and consolidate HBS interfaces Harden SLH-DSA key, mode, and input validation, including empty-message and invalid algorithm/hash handling. Clean up randomized signing state and extend SDV coverage. Consolidate the shared XMSS/SLH-DSA hash and address interfaces while keeping HSS on its LMS-specific tree context. Includes 9b0811feb31dd409d0dc9b4dbb45413092c2a2c7: feat: harden ML-DSA and SLH-DSA PKI support Add the HashSLH-DSA profiles, strict PQC key container handling, exact X.509 profile binding, signing-state isolation, and key consistency regression coverage. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1745 | 1 个月前 | |
feat: The command line pkey supports the -pubin/-inform/-check options, and supports traditional unencrypted DSA private key parsing, and rsa command line supports -passin Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1819 | 8 天前 | |
fix:bug fix of pki 、cms and cpdecskey 1:The value of unusedBits may not be zero. 2: Side-channel issues 3: Inconsistency between version field and standard 4: CMS streaming signature performs the signature operation twice 5: Annotation issues Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1727 | 1 个月前 | |
fix: TLS 1.3 server correctly handles client early_data extension A rejecting server cannot decrypt 0-RTT records but replied with a fatal bad_record_mac alert, which RFC 8446 4.2.10 does not allow. The discard guards also read hsCtx->extFlag.haveEarlyData, which was never set, so the discard path was dead code. - Sync extFlag.haveEarlyData after ClientHello validation; reject early_data in the second ClientHello after HRR (illegal_parameter). - Add error code HITLS_MSG_HANDLE_ILLEGAL_EARLY_DATA. - Silently discard empty and too-short records; count at least the record header against the 16KB cap; skip plaintext early-data records after HRR instead of caching them. - Add SDV suite test_suite_sdv_frame_tls13_0rtt (8 cases). Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1810 | 20 天前 |