diff --git a/docs/audit_report/changes/topics/chore.yml b/docs/audit_report/changes/topics/chore.yml index f7d1c711..56d10913 100644 --- a/docs/audit_report/changes/topics/chore.yml +++ b/docs/audit_report/changes/topics/chore.yml @@ -222,3 +222,10 @@ patches: - pr: 4380 # https://github.com/randombit/botan/pull/4380 merge_commit: c2c8f16d32b3c3bd7e77f1fb9b16be046001fab0 classification: info + +# Cleanup test path generation +# Author: @randombit +- pr: 4283 # https://github.com/randombit/botan/pull/4283 + merge_commit: 06139a41e0d2d517458d8221d2e8857358f3c01c + classification: info + auditer: reneme diff --git a/docs/audit_report/changes/topics/tls.yml b/docs/audit_report/changes/topics/tls.yml index 2a822a06..5a5f10c8 100644 --- a/docs/audit_report/changes/topics/tls.yml +++ b/docs/audit_report/changes/topics/tls.yml @@ -6,18 +6,29 @@ patches: # Approvals: @FAlbertDev, (@randombit) - pr: 4347 # https://github.com/randombit/botan/pull/4347 merge_commit: 7f256a0afe514aa15fee594e0d5e30d2f3f74536 - classification: unspecified + classification: info # Refactor: Centralize X25519/X448 all-zero result rejection # Author: @reneme # Approvals: (@randombit) - pr: 4384 # https://github.com/randombit/botan/pull/4384 merge_commit: b33eaefd5de865295f802702b4795f09618ecf37 - classification: unspecified + classification: relevant + comment: | + `RFC 8422 Section 5.11 + `_ mandates that TLS + key exchanges with X25519/X448 have to reject all-zero results. This moves + this rejection logic into the actual key exchange algorithms, to avoid + special case handling in TLS's key exchange logic. This became particularly + relevant with the addition of hybrid groups, which also need to reject + all-zero results when they contain a X25519 or X448 component. # PQC: Add hybrid groups x25519/ML-KEM-768 and secp256r1/ML-KEM-768 # Author: @reneme # Approvals: @FAlbertDev, (@randombit) - pr: 4375 # https://github.com/randombit/botan/pull/4375 merge_commit: 6babd8226963dad7b25c4ae82c4f785162727d05 - classification: unspecified + classification: relevant + comment: | + Those groups are emerging to be the default choice for hybrid key exchange + on the web and are registered in the IANA TLS parameters registry. diff --git a/docs/audit_report/changes/topics/x509.yml b/docs/audit_report/changes/topics/x509.yml deleted file mode 100644 index f8f57923..00000000 --- a/docs/audit_report/changes/topics/x509.yml +++ /dev/null @@ -1,8 +0,0 @@ -title: X.509 improvements - -patches: -# Cleanup test path generation -# Author: @randombit -- pr: 4283 # https://github.com/randombit/botan/pull/4283 - merge_commit: 06139a41e0d2d517458d8221d2e8857358f3c01c - classification: unspecified