From 583d0128bb5ebfac263496bc8fe32d4aef440178 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 27 Apr 2026 10:15:23 +0200 Subject: [PATCH] Bumping up to version-3.27 Signed-off-by: Ingo Franzki --- ChangeLog | 35 ++++++++++++++++++++++++++++ README.md | 4 ++-- configure.ac | 2 +- rpm/opencryptoki.spec | 2 +- testcases/ciconfig.sh | 2 +- usr/sbin/pkcsslotd/opencryptoki.conf | 2 +- 6 files changed, 41 insertions(+), 6 deletions(-) diff --git a/ChangeLog b/ChangeLog index 3f8d57e9..ef4d46d5 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,38 @@ ++ openCryptoki 3.27 +- Add base support for PKCS#11 v3.2. +- Add support for PKCS#11 v3.2 C_VerifySignature[Init|Update|Final]. +- Add support for PKCS#11 v3.2 C_EncapsulateKey/C_DecapsulateKey. +- Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with RSA-PKCS + and RSA-OAEP mechanisms. +- Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the ECDH + mechanism. +- Soft/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the DH-PKCS + mechanism. +- Soft: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms + (requires OpenSSL 3.5 or later, or the OQS-provider must be configured). +- CCA: Add support for PKCS#11 v3.2 ML-DSA key type and mechanisms (requires + CCA v8.4 or later) +- EP11: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms + (requires an EP11 host library v4.2 or later, and a CEX8P crypto card with + firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16). +- p11sak: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types. +- Soft/ICA: Add support for PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and + CKM_ECDH_COF_AES_KEY_WRAP. +- p11sak: Add support for key wrapping with PKCS#11 v3.2 mechanisms + CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP. +- Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 mechanism + CKM_PUB_KEY_FROM_PRIV_KEY. +- Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.0 Edwards and Montgomery key + types and mechanisms. +- Soft/ICA: Support CKM_ECDH_AES_KEY_WRAP also for Montgomery keys. +- p11sak: Add support for PKCS#11 v3.0 Edwards and Montgomery key types. +- Soft: Add support for CKM_ECDH1_COFACTOR_DERIVE. +- CCA: Add support for additional RSA public exponent values 5, 17, or 257. +- p11sak: Add option to list-key command to show EP11 session IDs. +- Make the maximum number of token objects supported configurable. +- Fixes for CVE-2026-40253, CVE-2026-23893, and CVE-2026-22791. +- Bug fixes. + + openCryptoki 3.26 - Soft: Add support for RSA keys up to 16K bits. - CCA: Add support for RSA keys up to 8K bits (requires CCA v8.4 or v7.6 or diff --git a/README.md b/README.md index 1ba40861..0ddf8941 100644 --- a/README.md +++ b/README.md @@ -3,13 +3,13 @@ # openCryptoki -Package version 3.26 +Package version 3.27 Please see [ChangeLog](ChangeLog) for release specific information. ## OVERVIEW -openCryptoki version 3.26 implements the PKCS#11 specification version 3.0 +openCryptoki version 3.27 implements the PKCS#11 specification version 3.0 and partially versions 3.1 and 3.2. This package includes several cryptographic tokens: diff --git a/configure.ac b/configure.ac index 44c78db0..d0215a30 100644 --- a/configure.ac +++ b/configure.ac @@ -1,6 +1,6 @@ dnl Process this file with autoconf to produce a configure script. AC_PREREQ([2.69]) -AC_INIT([openCryptoki],[3.26.0],[https://github.com/opencryptoki/opencryptoki/issues],[],[https://github.com/opencryptoki/opencryptoki]) +AC_INIT([openCryptoki],[3.27.0],[https://github.com/opencryptoki/opencryptoki/issues],[],[https://github.com/opencryptoki/opencryptoki]) AC_CONFIG_SRCDIR([testcases/common/common.c]) dnl Needed for $target! diff --git a/rpm/opencryptoki.spec b/rpm/opencryptoki.spec index 250698ac..bf204ea2 100644 --- a/rpm/opencryptoki.spec +++ b/rpm/opencryptoki.spec @@ -2,7 +2,7 @@ Name: opencryptoki Summary: Implementation of the PKCS#11 (Cryptoki) specification v3.0 and partially v3.1, v3.2 -Version: 3.26.0 +Version: 3.27.0 Release: 1%{?dist} License: CPL Group: System Environment/Base diff --git a/testcases/ciconfig.sh b/testcases/ciconfig.sh index bc047216..ddadb7e7 100755 --- a/testcases/ciconfig.sh +++ b/testcases/ciconfig.sh @@ -96,7 +96,7 @@ if test ! -z ${PKCS11_TEST_USER}; then fi # initialize opencryptoki.conf -echo "version opencryptoki-3.26" > "${OCKCONFDIR}/opencryptoki.conf" +echo "version opencryptoki-3.27" > "${OCKCONFDIR}/opencryptoki.conf" # enable full statistics echo "statistics (on,implicit,internal)" >> "${OCKCONFDIR}/opencryptoki.conf" diff --git a/usr/sbin/pkcsslotd/opencryptoki.conf b/usr/sbin/pkcsslotd/opencryptoki.conf index 4de97b84..a0eeb36e 100644 --- a/usr/sbin/pkcsslotd/opencryptoki.conf +++ b/usr/sbin/pkcsslotd/opencryptoki.conf @@ -1,4 +1,4 @@ -version opencryptoki-3.26 +version opencryptoki-3.27 # The following defaults are defined: # hwversion = "0.0"