Release: Botan 3.5.0 #225

reneme · 2024-07-11T06:41:58Z

Those will contain the finishing touches for the Botan 3.5.0 documents, after the library was released on Monday.

THIS PULL REQUEST WON'T BE MERGED, BUT THE release/3.5.0 BRANCH WILL LIVE ON. We'll close the pull request as soon as the documents are finalized. Nevertheless, there are changes to the cryptodoc and testspec in this pull request that have to be applied to main. We'll cherry-pick those as soon as we're ready to submit the documents.

TODO

Reminder: Cryptodoc Update for Botan 3.5.0 #214
Write up the summary chapters in the Audit Report
Write up summaries for the Audit Report topics
Update the "reviewed modules" list
(perhaps also regard the new "experimental" and "deprecated" modules)
Review of audit entries regarding required modifications in the cryptodoc, testspec and so on
Final document review

This reverts the audit of a few patches that got picked up by the auto-update bot but that don't belong into 3.5.0 anymore.

KMAC was initially introduced in Botan 3.2.0 but we missed to mention it in the crypto documentation thus far.

reneme · 2024-07-18T13:15:51Z

docs/audit_report/changes/topics/documentation.yml

-# Add an explicit warning about Botan2 reaching end of life to readme [ci skip] (Jack Lloyd)
- commit: 0417790d0794d2c4382f4cfe6f87a88e33f3d21d # https://github.com/randombit/botan/commit/0417790d0794d2c4382f4cfe6f87a88e33f3d21d
- classification: info
- auditer: FAlbertDev
-
-# Fix some spelling and formatting errors in the release notes [ci skip] (Jack Lloyd)
- commit: 722dde9d63b1c4b0b3f5b2fcd5851f3a24937c1a # https://github.com/randombit/botan/commit/722dde9d63b1c4b0b3f5b2fcd5851f3a24937c1a
- classification: info
- auditer: FAlbertDev
-
-# Describe affected versions of name constraint bugs [ci skip] (Jack Lloyd)
- commit: 82ad62fea5629c1952aa112e3016b61e2c2a56b4 # https://github.com/randombit/botan/commit/82ad62fea5629c1952aa112e3016b61e2c2a56b4
- classification: info
- auditer: FAlbertDev
-
-# Add 2.19.5 release notes [ci skip] (Jack Lloyd)
- commit: 939f200875f708f6b281b6aa3d38bc62a5b80355 # https://github.com/randombit/botan/commit/939f200875f708f6b281b6aa3d38bc62a5b80355
- classification: info
- auditer: FAlbertDev
-


Those are removed because they were pulled in by the Auto-Update Bot but are not part of the 3.5.0 release.

reneme · 2024-07-18T13:18:28Z

docs/cryptodoc/src/03_mac.rst

+KMAC
+----


Originally, KMAC was introduced in Botan 3.2.0 but we failed to mention it in the cryptodoc. That may have been by design, I'm not sure anymore.

Nevertheless, now that we mention KMAC in the context of SP800-56Cr2, I guess it's just fair to also mention it explicitly in the MAC section of the cryptodoc.

reneme · 2024-07-18T13:19:46Z

docs/cryptodoc/src/05_09_kyber.rst

-.. todo::
-
- This documentation is outdated (and potentially too detailed).
- It should be updated as soon as those pull requests are merged:
-
- * https://github.com/randombit/botan/pull/4024
-
- Until then, I've removed some of the source links to pass CI.


This was postponed to 3.6.0 but randombit/botan#4024 was merged in the meantime. I.e. we'll have to tackle the overhaul of the Kyber/Dilthium chapters rather soon.

reneme · 2024-07-18T13:30:15Z

docs/cryptodoc/src/09_x509.rst

-**Vulnerability:** Botan 3.0.0-alpha1 and previous versions contained a bug in
-the OCSP response validation where the authenticity of a spoofed response was not
-properly checked. That allowed an attacker to forge OCSP responses for arbitrary
-CAs that were considered authentic. That alone had the potential for DOS
-attacks. Provided the attacker was in possession of a compromised subject
-certificate, they would have been able to circumvent revocation checks and (keep)
-impersonating the legitimate certificate owner (if no additional CRL-based
-checks are performed).
-
-This vulnerability was assigned CVE-2022-43705. For further details, please refer
-to the `associated security advisory in Botan's GitHub repository
-<https://github.com/randombit/botan/security/advisories/GHSA-4v9w-qvcq-6q7w>`_ or
-the vulnerability description document provided along with this report.
-
-**Conclusion:** With `the given patch <https://github.com/randombit/botan/pull/3067>`_
-applied, Botan is no longer vulnerable to the described issue.
-


This should have been removed from the document as early as the 3.1.0 release.

FAlbertDev

Very nice! Some nits I found while proofreading. I'll fix them myself :)

FAlbertDev · 2024-07-19T07:40:58Z

docs/audit_report/changes/topics/build_system.yml

+ This section covers changes to the build system. Most notably, Botan now
+ requires at least XCode 15 to build on macOS and distinguishes between clang
+ fork of xcode and vanilla clang.


Suggested change

This section covers changes to the build system. Most notably, Botan now

requires at least XCode 15 to build on macOS and distinguishes between clang

fork of xcode and vanilla clang.

This section covers changes to the build system. Most notably, Botan now

requires at least XCode 15 to build on macOS and distinguishes between the clang

fork of XCode and vanilla clang.

docs/audit_report/src/01_generic_changes.rst

docs/cryptodoc/src/05_09_kyber.rst

docs/audit_report/src/02_security_issues.rst

FAlbertDev

For me, the release is ready to go :)

docs/audit_report/src/02_security_issues.rst

atreiber94 · 2024-07-23T08:43:54Z

docs/audit_report/changes/topics/hss_lms.yml

@@ -1,5 +1,8 @@
 title: HSS/LMS

+description: |


Somehow Philippe is missing as Code Author here in the PDF

Currently the scripts don't take the Co-Authored-By: ... in the commits into account. Only the pull-request author. I'm guessing that's the reason it didn't pick up @lieser.

We could certainly look into this, though. Sucks that we're currently missing due credit. Perhaps GitHub even provides an API to resolve the email addresses in Co-Authored-By into a GitHub account? That'd certainly help.

Co-authored-by: Amos Treiber <40764707+atreiber94@users.noreply.github.com>

reneme added the release label Jul 11, 2024

reneme added this to the Botan 3.5.0 milestone Jul 11, 2024

reneme self-assigned this Jul 11, 2024

reneme mentioned this pull request Jul 11, 2024

Prepare for 3.6.0 audit #226

Merged

reneme and others added 3 commits July 18, 2024 10:27

Fix BOTAN_REF to 3.5.0 release

90e3c69

This reverts the audit of a few patches that got picked up by the auto-update bot but that don't belong into 3.5.0 anymore.

X.509 Vulnerability Descriptions

dcb2cc0

Backport: Document housekeeping

7563b3c

reneme force-pushed the release/3.5.0 branch from 24026e3 to 7563b3c Compare July 18, 2024 08:29

reneme added 13 commits July 18, 2024 10:47

update list of audited modules

7621106

changelog

ab803c9

changelog

5d230dc

add changes topic descriptions

a837aec

add a most-notable changes overview

d031fb4

add related links to vulnerabilities

2a610d6

KMAC in the cryptodoc

c6300ac

KMAC was initially introduced in Botan 3.2.0 but we missed to mention it in the crypto documentation thus far.

DLIES is deprecated

e760fca

Remove OCSP vulnerability notice

b304c2b

reflect X.509 adaptions in crypto documentation

0da351d

Mention the Limbo X.509 tests in the testspec

9c366bb

curve25519 is out of scope

8d52aa2

minor kyber/dilithium adaptions

8bf1a37

reneme commented Jul 18, 2024

View reviewed changes

reneme requested review from FAlbertDev and atreiber94 July 18, 2024 13:30

run more tests

3bb7f25

FAlbertDev reviewed Jul 19, 2024

View reviewed changes

Fix some minor nits and rendering issues

2a6bbcd

FAlbertDev approved these changes Jul 19, 2024

View reviewed changes

reneme mentioned this pull request Jul 22, 2024

Persistent Changes from Release 3.5.0 #232

Merged

atreiber94 approved these changes Jul 23, 2024

View reviewed changes

Update docs/audit_report/src/02_security_issues.rst

572e000

Co-authored-by: Amos Treiber <40764707+atreiber94@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release: Botan 3.5.0 #225

Release: Botan 3.5.0 #225

reneme commented Jul 11, 2024 •

edited

Loading

reneme Jul 18, 2024

reneme Jul 18, 2024

reneme Jul 18, 2024

reneme Jul 18, 2024

FAlbertDev left a comment

FAlbertDev Jul 19, 2024

FAlbertDev left a comment

atreiber94 Jul 23, 2024

reneme Jul 23, 2024

		KMAC
		----

Release: Botan 3.5.0 #225

Are you sure you want to change the base?

Release: Botan 3.5.0 #225

Conversation

reneme commented Jul 11, 2024 • edited Loading

TODO

reneme Jul 18, 2024

Choose a reason for hiding this comment

reneme Jul 18, 2024

Choose a reason for hiding this comment

reneme Jul 18, 2024

Choose a reason for hiding this comment

reneme Jul 18, 2024

Choose a reason for hiding this comment

FAlbertDev left a comment

Choose a reason for hiding this comment

FAlbertDev Jul 19, 2024

Choose a reason for hiding this comment

FAlbertDev left a comment

Choose a reason for hiding this comment

atreiber94 Jul 23, 2024

Choose a reason for hiding this comment

reneme Jul 23, 2024

Choose a reason for hiding this comment

reneme commented Jul 11, 2024 •

edited

Loading