bc-java/docs/releasenotes.html at main · bcgit/bc-java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<html>
<head>
<title>Bouncy Castle Crypto Package - Release Notes</title>
</head>

<body bgcolor="#ffffff" text="#000000#">

<center>
<h1>Bouncy Castle Crypto Package - Release Notes</h1>
</center>
<h2>1.0 Introduction</h2>
<p>
The Bouncy Castle Crypto package is a Java implementation of
cryptographic algorithms.  The package is organised so that it
contains a light-weight API suitable for use in any environment
(including the J2ME) with the additional infrastructure
to conform the algorithms to the JCE framework.
</p>

<h2>2.0 Release History</h2>
<a id="r1rv85"><h3>2.1.1 Version</h3></a>
Release: 1.85<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2026, TBD
<h3>2.1.2 Defects Fixed</h3>
<ul>
<li>Other provider public key conversions was failing with an exception for ML-DSA signature verification. This has been fixed.</li>
<li>FalconKeyPairGeneratorSpi.getNameFromParams was inconsistent: FalconParameterSpec returned an upper-cased name while NamedParameterSpec was lower-cased, leaving NamedParameterSpec inputs unable to resolve any Falcon variant. FalconParameterSpec now preserves the canonical lower-case algorithm name, so both spec types now work (issue #2194).</li>
<li>ProvOcspRevocationChecker was silently ignoring OCSP response signature verification failures when an OCSP response was supplied via PKIXRevocationChecker.setOcspResponses(). The checker now raises a CertPathValidatorException when the response signature fails to validate.</li>
<li>X509CertificateFormatter was indenting the basicConstraints pathLenConstraint line incorrectly, dropping the 23-space prefix shared with other extension lines. The line now uses the same pad as the surrounding output (issue #2214).</li>
<li>A wide audit of catch-and-rethrow sites that dropped the original cause when rewrapping as IllegalArgumentException, IllegalStateException, or IOException has been carried out across core, prov, pkix, pg, mail/jmail, mls and tls. The affected sites now chain the cause via org.bouncycastle.util.Exceptions so the full stack trace is preserved, while keeping the existing message text unchanged (issue #2239 / PR #2250).</li>
<li>PGPPublicKey.getValidSeconds() returned a stale expiration time when an earlier self-signature carried a Key Expiration Time subpacket and a more recent self-signature omitted it; per RFC 4880 5.2.4.1 the latest self-signature wins, so the absence of the subpacket on the newer signature now correctly cancels the expiry and the method returns 0 (issue #1749).</li>
<li>PEMParser failed to parse a "BEGIN PRIVATE KEY" block carrying OpenSSL-legacy encryption headers (Proc-Type: 4,ENCRYPTED / DEK-Info), throwing "corrupted stream" while ASN.1-decoding the ciphertext. The PRIVATE KEY parser now honours those headers and returns a PEMEncryptedKeyPair whose decryptKeyPair() yields a PEMKeyPair holding the decrypted PKCS#8 PrivateKeyInfo (issue #1238).</li>
<li>PKIXCertPathValidatorSpi (and its JDK 8+ revocation-checker-aware variant) threw a NullPointerException when validating against a TrustAnchor constructed with (caName, caPublicKey, nameConstraints) instead of an X509Certificate, because the trust anchor's certificate encoding was always validated up front. The check is now skipped when no certificate is supplied, allowing name-and-key trust anchors to validate as expected (issue #1420).</li>
<li>PKCS12PfxPdu.isMacValid threw ClassCastException when the PFX used PBMAC1 (id-PBMAC1) for integrity, because JcePKCS12MacCalculatorBuilderProvider tried to parse the algorithm parameters as PKCS12PBEParams. The provider now dispatches to JcePBMac1CalculatorBuilder for id-PBMAC1, and isMacValid compares only the inner MAC digest bytes for PBMAC1 (RFC 9579 sec. 6 leaves the MacData salt and iterations unused, so producers may write arbitrary placeholder values) — PBMAC1 PFX files written by OpenSSL and BCJSSE now verify correctly.</li>
<li>JcaPGPKeyConverter.getPublicKey threw "InvalidParameterSpecException: Not a supported curve" on JDK 11 when the underlying JCE provider was Sun's, because the converter unconditionally fed the X9.62 OID-encoded form to AlgorithmParameters and Sun's CurveDB couldn't resolve it. The converter now resolves the curve name first via ECNamedCurveTable.getName(...) and only falls back to the OID encoding when the provider doesn't recognise the name (issue #1230).</li>
<li>CertPathBuilder could recurse without bound (StackOverflowError on small stacks) when CRL revocation was enabled and a CRL had multiple candidate signers, e.g. several trust-anchor roots sharing the issuer DN. A re-entry guard in RFC3280CertPathUtilities.processCRLF now breaks the cycle, and candidates whose path can't be built are skipped instead of aborting the whole check (issue #2291).</li>
<li>OpenSSHPrivateKeyUtil.encodePrivateKey now wraps ECDSA keys in the openssh-key-v1 envelope (matching the Ed25519 path) instead of emitting a raw RFC 5915 ECPrivateKey SEQUENCE, so the output is loadable by OpenSSH and JSCH (issue #2240).</li>
</ul>
<h3>2.2.3 Additional Features and Functionality</h3>
<ul>
<li>The system/security property "org.bouncycastle.argon2.max_memory_exp" can now be used to set the maximum exponent for the memory setting in Argon2. Default value is (and max possible) is 30.</li>
<li>Argon2BytesGenerator now accepts a caller-supplied BlockPool via Argon2Parameters.Builder.withBlockPool(...), allowing reuse of working memory across successive generateBytes calls (issue #1646 / PR #1647). A bounded FixedBlockPool implementation is included.</li>
<li>BCFKS keystore now supports storing and retrieving javax.crypto.interfaces.PBEKey entries, so passwords and other PBE-based secrets no longer need to be stored as HMAC keys (issue #2164).</li>
<li>X509v3CertificateBuilder now exposes setters for the constructor arguments (setIssuer, setSerialNumber, setNotBefore, setNotAfter, setSubject, setSubjectPublicKeyInfo) to support equivalence-comparison use cases (issue #1545).</li>
<li>CMS EnvelopedData now supports RFC 8418 ECDH key agreement using X25519 or X448 with HKDF (SHA-256/384/512). Three CMSAlgorithm constants (ECDH_HKDF_SHA256, ECDH_HKDF_SHA384, ECDH_HKDF_SHA512) and the corresponding KeyAgreement registrations (XDHwithSHA256HKDF / XDHwithSHA384HKDF / XDHwithSHA512HKDF) have been added (issue #1845).</li>
<li>The SM2 JCE Cipher now accepts a ciphertext-format mode in the transformation string. Cipher.getInstance("SM2/C1C3C2/NoPadding", "BC") and Cipher.getInstance("SM2/C1C2C3/NoPadding", "BC") select between the two SM2Engine modes; the previous "SM2"/"SM2/NONE/NoPadding" forms continue to default to C1C2C3 (issue #1302).</li>
<li>SimplePKIResponse now also accepts the unsigned Full PKI Response variant used for EST server-generated errors (RFC 7030 4.2.3 / 4.4.2): a CMS SignedData with no SignerInfos whose encapsulated content is an id-cct-PKIResponse PKIResponse SEQUENCE. New accessors getPKIResponse(), getControlAttributes(), getCmsContents() and getStatusInfoV2() expose the embedded PKIResponse content as structured TaggedAttribute / TaggedContentInfo / CMCStatusInfoV2 objects so callers no longer need to walk the raw ASN.1. A new PKIResponseBuilder produces SimplePKIResponse instances directly, with addControlAttribute / addStatusInfoV2 / addCmsContent / addOtherMsg helpers so EST error responses can be assembled without manually composing the SignedData and PKIResponse SEQUENCE. CMSSignedData has a new getSignedContentType() returning the encapsulated content type as an ASN1ObjectIdentifier alongside the existing getSignedContentTypeOID() (issue #1452).</li>
<li>org.bouncycastle.gpg.KeyGripCalculator computes the GnuPG-style 20-byte SHA-1 keygrip for a BCPGKey. The calculator is constructed with a caller-supplied SHA-1 PGPDigestCalculator. RSA public keys are supported initially (matching libgcrypt's _gcry_rsa_compute_keygrip: SHA-1 of the canonical unsigned big-endian modulus); other key types throw on calculateKeygrip() until support is added (issue #676).</li>
<li>CMS key transport now supports the SM2 cipher: JceKeyTransRecipientInfoGenerator wraps the CEK and JceKeyTransRecipient unwraps it when the keyEncryptionAlgorithm is GMObjectIdentifiers.sm2encrypt_with_sm3. The ciphertext format defaults to C1C3C2 (GB/T 35276 envelope encoding) and the SM4-CBC content encryption is exposed as the new CMSAlgorithm.SM4_CBC constant.</li>
<li>org.bouncycastle.asn1.pkcs.SecretBag — RFC 7292 ASN.1 holder for the PKCS#12 secretBag bag type, complementing the existing CertBag / CRLBag classes. PKCS12SecretBag and PKCS12SecretBagBuilder in org.bouncycastle.pkcs sit alongside the SafeBag / SafeBagBuilder pair: PKCS12SafeBagBuilder takes a PKCS12SecretBag in a new constructor, and PKCS12SafeBag.getBagValue() returns a PKCS12SecretBag for safe bags of type secretBag.</li>
<li>JCE provider plumbing for the LEA (Lightweight Encryption Algorithm) block cipher built on the existing core LEAEngine. Cipher.LEA (ECB) plus the standard transformation forms (LEA/CBC/PKCS5Padding etc.), Cipher.LEA-GCM, Cipher.LEA-CCM, Mac.LEA-CMAC / LEA-GMAC / LEA-Poly1305, KeyGenerator.LEA and SecretKeyFactory.LEA are registered, with 128/192/256-bit keys supported.</li>
<li>HashMLDSASigner now exposes generateSignature(hash) and verifySignature(hash, signature) overloads alongside the streaming Signer API, letting callers feed an externally computed digest into HashML-DSA without having to stream the message through update(...). The DER-encoded digest OID is taken from the parameter set the signer was initialised with. The same external-hash mode is exposed through the BC JCE provider via Signature.getInstance("ML-DSA-{44,65,87}-WITH-SHA512-EXTERNAL-HASH", "BC") (plus the parameter-set-agnostic "HASH-ML-DSA-EXTERNAL-HASH"); Signature.update(...) accepts the pre-computed SHA-512 digest in place of the message, and a wrong-length input is reported as a SignatureException (issue #2198).</li>
</ul>

<a id="r1rv84"><h3>2.2.1 Version</h3></a>
Release: 1.84<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2026, April 14th
<h3>2.2.2 Defects Fixed</h3>
<ul>
<li>Random numbers being generated for DSTU4145 signature calculations were 1 bit shorter than they could be. The code has been corrected to allow the generated numbers to occupy the full numeric range available.</li>
<li>HKDF implementation has been corrected to use multiple IKMs if available.<li>
<li>CompositePublic/PrivateKey builders had an issue identifying brainpool and EdDSA curves from the algorithm names due to an error in the OID mapping table. This has been fixed.</li>
<li>S/MIME: Fix AuthEnveloped support for AES192/GCM and AES256/GCM.</li>
<li>CMS: Use implicit tag for AuthEnvelopedData.authEncryptedContentInfo.encryptedContent.</li>
<li>Fixed Strings.split to handle delimiters at position 0.</li>
<li>Fixed FrodoKEM error sampling to be constant-time.</li>
<li>Fixed PKIXNameConstraintValidator to treat a DNS name as intersecting itself.</li>
<li>Fixed PKCS12 key stores not calling getInstance with the original provider (which was forcing provider registration).</li>
<li>A resource leak due to the SMIMESigned constructor leaving background threads hanging on MessagingException has been fixed.</li>
<li>OpenPGP: Fixed an issue where a custom signature creation time was ignored when generating message signatures.</li>
<li>OpenPGP: Fixed SKESK encoding for direct-S2K-encrypted messages.</li>
</ul>
<h3>2.2.3 Additional Features and Functionality</h3>
<ul>
<li>In line with JVM changes, KEM support has been backported to Java 17.</li>
<li>BCJSSE: Configurable (client) early key_share groups via BCSSLParameters.earlyKeyShares or "org.bouncycastle.jsse.client.earlyKeyShares" system property.</li>
<li>BCJSSE: Support for curveSM2MLKEM768 hybrid NamedGroup in TLS 1.3 per draft-yang-tls-hybrid-sm2-mlkem-03.</li>
<li>BCJSSE: Log when default cipher suites are disabled.</li>
<li>BCJSSE: Experimental support for ShangMi crypto in TLS 1.3 per RFC 8998 (not enabled by default).</li>
<li>CMS: Added CMSAuthEnvelopedDataStreamGenerator.open taking an explicit content type.</li>
<li>HKDF: Provider support for HKDFParameterSpec.Expand.</li>
<li>Added initial support for RFC 9380 (Hashing to Elliptic Curves); see org.bouncycastle.crypto.hash2curve .</li>
<li>PKCS12: Added default max iteration count of 5,000,000 (configurable via "org.bouncycastle.pkcs12.max_it_count" property).</li>
<li>TLS: Use javax.crypto.KEM API (when available) to access ML-KEM implementation (incl. hybrids).</li>
<li>A new KeyStore, PKCS12-PBMAC1, has been added which defaults to using PBMAC1 and supports RFC 9879.</li>
<li>A new property "org.bouncycastle.asn1.max_cons_depth" has been added to allow setting of the maximum nesting for SETs/SEQUENCESs in ASN.1. Default is 32.</li>
<li>A new property "org.bouncycastle.asn1.max_limit" has been added to allow setting of the stream size of ASN.1 encodings. The value can be either in bytes, or appended with k (1 kilobyte blocks), m (1 megabyte blocks), or g (1 gigabyte blocks).</li>
<li>Added NTRU+ support to the lightweight PQC API and the BCPQC provider.</li>
<li>Added SM4 key wrap/unwrap mode, SM2 key exchange, and logging to SM2Signer.</li>
<li>OpenPGP: Added encryption‑key filtering by purpose, a new OpenPGPKey constructor, KeyPassphraseProvider‑based passphrase change, wildcard (anonymous) recipient handling, and Web‑of‑Trust methods for third‑party signature chains and delegations.</li>
<li>CMSSignedDataStreamGenerator can now support the generation of DER/DL encoded SignedData objects (note memory restrictions still apply).</li>
<li>It is now possible to add extra digest alorithm IDs to CMSSignedDataStreamGenerator when required.</li>
</ul>
<h3>2.2.4 Security Fixes</h3>
<ul>
<li>CVE-2025-14813 - GOSTCTR implementation unable to process more than 255 blocks correctly.</li>
<li>CVE-2026-0636 - LDAP Injection Vulnerability in LDAPStoreHelper.java.</li>
<li>CVE-2026-3505 - Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.</li>
<li>CVE-2026-5588 - PKIX draft CompositeVerifier accepts empty signature sequence as valid.</li>
<li>CVE-2026-5598 - Non-constant time comparisons risk private key leakage in FrodoKEM.</li>
</ul>
<h3>2.2.5 Additional Notes</h3>
<ul>
<li>DSA was recently deprecated by NIST and several users have requested that we move to an RSA signing certificate for provider signing instead of our current DSA one. We are grateful to report that Oracle have been very supportive of this and issued us a second RSA certificate based on a new RSA key for signing providers. Providers signed with the previous DSA key will continue to work as before.</li>
<li>This will be the last release which will recognise Dilithium and SphincsPlus in the BC provider, the Kyber wrapper (which is just ML-KEM) will also be removed. The algorithms won't be deleted in 1.85, but will only be accessible via the low-level APIs and deleted in a later release.</li>
</ul>

<a id="r1rv83"><h3>2.3.1 Version</h3></a>
Release: 1.83<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2025, November 27th.
<h3>2.3.2 Defects Fixed</h3>
<ul>
<li>Attempting to check a password on a stripped PGP key would throw an exception. Checking the password on such a key will now always return false.</li>
<li>Fixed an issue in KangarooTwelve where premature absorption caused erroneous 168-byte padding; absorption is now delayed so correct final-byte padding is applied.</li>
<li>BCJSSE: Fix supported_versions creation for renegotiation handshake.</li>
<li>(D)TLS: Reneg info now only offered with pre-1.3.</li>
</ul>
<h3>2.3.3 Additional Features and Functionality</h3>
<ul>
<li>A generic "COMPOSITE" algorithm name has been added as a JCA Signature algorithm. The algorithm will identify the composite signature to use from the composite key passed in.</li>
<li>The composite signatures implementation has been updated to the final draft and now follows the submitted standard.</li>
<li>Support for the generation and use as trust anchors has been added for certificate signatures with id-alg-unsigned as the signature type.</li>
<li>Support for CMP direct POP for encryption keys using challenge/response has been added to the CMP/CRMF APIs.</li>
<li>Support for SupportedCurves attribute added to the BC provider</li>
<li>BCJSSE: Added support for SLH-DSA signature schemes in TLS 1.3 per draft-reddy-tls-slhdsa-01.</li>
<li>Support has been added for the Java 25 KDF API (current algorithms, PBKDF2, SCRYPT, and HKDF).</li>
<li>Support for composite signatures is now included in CMS and timestamping.</li>
<li>It is now possible to disable the Lenstra check in RSA where the public key is not available via the system/security property "org.bouncycastle.rsa.no_lenstra_check".</li>
</ul>

<a id="r1rv82"><h3>2.4.1 Version</h3></a>
Release: 1.82<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2025, 17th September.
<h3>2.4.2 Defects Fixed</h3>
<ul>
<li>SNOVA and MAYO are now correctly added to the JCA provider module-info file.</li>
<li>TLS: Avoid nonce reuse error in JCE AEAD workaround for pre-Java7.</li>
<li>BCJSSE: Session binding map is now shared across all stages of the session lifecycle (SunJSSE compatibility).</li>
<li>The CMCEPrivateKeyParameters#reconstructPublicKey method was returning an empty byte array. It now returns an encoding of the public key.</li>
<li>CBZip2InputStream no longer auto-closes at end-of-contents.</li>
<li>The BC CertPath implementation was eliminating certificates on the bases of the Key-ID. This is not in accordance with RFC 4158 and has been fixed.</li>
<li>Support for the previous set of libOQS Falcon OIDs has been restored.</li>
<li>The BC CipherInputStream could throw an exception if asked to handle an AEAD stream consisting of the MAC only. This has been fixed.</li>
<li>Some KeyAgreement classes were missing in the Java 11 class hierarchy. This has been fixed.</li>
<li>A typo in a constant name in the HPKE class has been fixed and the old constant deprecated.</li>
<li>Fuzzing analysis has been done on the OpenPGP API and additional code has been added to prevent escaping exceptions.</li>
</ul>
<h3>2.4.3 Additional Features and Functionality</h3>
<ul>
<li>SHA3Digest, CSHAKE, TupleHash, KMAC now provide support for Memoable and EncodableService.</li>
<li>BCJSSE: Added support for integrity-only cipher suites in TLS 1.3 per RFC 9150.</li>
<li>BCJSSE: Added support for system properties "jdk.tls.client.maxInboundCertificateChainLength" and "jdk.tls.server.maxInboundCertificateChainLength".</li>
<li>BCJSSE: Added support for ML-DSA signature schemes in TLS 1.3 per draft-ietf-tls-mldsa-00.</li>
<li>The Composite post-quantum signatures implementation has been updated to the latest draft (07) <a href="https://datatracker.ietf.org/doc/html/draft-ietf-lamps-pq-composite-sigs">draft-ietf-lamps-pq-composite-sigs</a>.</li>
<li>"<name>_PREHASH" implementations are now provided for all composite signatures to allow the hash of the data to be used instead of the actual data in signature calculation.</li>
<li>The gradle build can now be used to generate an Bill of Materials (BOM) file.</li>
<li>It is now possible to configure the SignerInfoVerifierBuilder used by the SignedMailValidator class.</li>
<li>The Ascon family of algorithms has been updated with the latest published changes.</li>
<li>Composite signature keys can now be constructed from the individual keys of the algorithms composing the composite.</li>
<li>PGPSecretKey, PGPSignatureGenerator now support version 6.</li>
<li>Further optimisation work has been done on ML-KEM public key validation.</li>
<li>Zeroization of passwords in the JCA PKCS12 key store has been improved.</li>
<li>The "org.bouncycastle.drbg.effective_256bits_entropy" property has been added for platforms where the entropy source is not producing 1 full bit of entropy per bit and additional bits are required (default value 282).</li>
<li>Support has been added to the CMS content encryptors to allow a generated key to be passed in, rather than always having them generate their own.</li>
<li>OpenPGPKeyGenerator now allows for the use of empty UserIDs (version 4 compatibility).</li>
<li>The HQC KEM has been updated with the latest draft updates.</li>
</ul>
<h3>2.4.4 Additional Notes</h3>
<ul>
<li>The legacy post-quantum package has now been removed.</li>
</ul>

<a id="r1rv81"><h3>2.5.1 Version</h3></a>
Release: 1.81<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2025, 4th June.
<h3>2.5.2 Defects Fixed</h3>
<ul>
<li>A potention NullPointerException in the KEM KDF KemUtil class has been removed.</li>
<li>Overlapping input/output buffers in doFinal could result in data corruption. This has been fixed.</li>
<li>Fixed Grain-128AEAD decryption incorrectly handle MAC verification.</li>
<li>Add configurable header validation to prevent malicious header injection in PGP cleartext signed messages; Fix signature packet encoding issues in PGPSignature.join() and embedded signatures while phasing out legacy format.</li>
<li>Fixed ParallelHash initialization stall when using block size B=0.</li>
<li>The PRF from the PBKDF2 function was been lost when PBMAC1 was initialized from protectionAlgorithm. This has been fixed.</li>
<li>The lowlevel DigestFactory was cloning MD5 when being asked to clone SHA1. This has been fixed.</li>
</ul>
<h3>2.5.3 Additional Features and Functionality</h3>
<ul>
<li>XWing implementation updated to draft-connolly-cfrg-xwing-kem/07/</li>
<li>Further support has been added for generation and use of PGP V6 keys</li>
<li>Additional validation has been added for armored headers in Cleartext Signed Messages.<li>
<li>The PQC signature algorithm proposal Mayo has been added to the low-level API and the BCPQC provider.</li>
<li>The PQC signature algorithm proposal Snova has been added to the low-level API and the BCPQC provider.</li>
<li>Support for ChaCha20-Poly1305 has been added to the CMS/SMIME APIs.</li>
<li>The Falcon implementation has been updated to the latest draft.</li>
<li>Support has been added for generating keys which encode as seed-only and expanded-key-only for ML-KEM and ML-DSA private keys.</li>
<li>Private key encoding of ML-DSA and ML-KEM private keys now follows the latest IETF draft.</li>
<li>The Ascon family of algorithms has been updated to the initial draft of SP 800-232. Some additional optimisation work has been done.</li>
<li>Support for ML-DSA's external-mu calculation and signing has been added to the BC provider.</li>
<li>CMS now supports ML-DSA for SignedData generation.</li>
<li>Introduce high-level OpenPGP API for message creation/consumption and certificate evaluation.</li>
<li>Added JDK21 KEM API implementation for HQC algorithm.</li>
<li>BCJSSE: Strip trailing dot from hostname for SNI, endpointID checks.</li>
<li>BCJSSE: Draft support for ML-KEM updated (draft-connolly-tls-mlkem-key-agreement-05).</li>
<li>BCJSSE: Draft support for hybrid ECDHE-MLKEM (draft-ietf-tls-ecdhe-mlkem-00).</li>
<li>BCJSSE: Optionally prefer TLS 1.3 server's supported_groups order (BCSSLParameters.useNamedGroupsOrder).</li>
</ul>

<a id="r1rv80"><h3>2.6.1 Version</h3></a>
Release: 1.80<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2025, 14th January.
<h3>2.6.2 Defects Fixed</h3>
<ul>
<li>A splitting issue for ML-KEM lead to an incorrect size for kemct in KEMRecipientInfos. This has been fixed.</li>
<li>The PKCS12 KeyStore has been adjusted to prevent accidental doubling of the Oracle trusted certificate attribute (results in an IOException when used with the JVM PKCS12 implementation).</li>
<li>The SignerInfoGenerator copy constructor was ignoring the certHolder field. This has been fixed.</li>
<li>The getAlgorithm() method return value for a CompositePrivateKey was not consistent with the corresponding getAlgorithm() return value for the CompositePrivateKey. This has been fixed.</li>
<li>The international property files were missing from the bcjmail distribution. This has been fixed.</li>
<li>Issues with ElephantEngine failing on processing large/multi-block messages have been addressed.</li>
<li>GCFB mode now fully resets on a reset.</li>
<li>The lightweight algorithm contestants: Elephant, ISAP, PhotonBeetle, Xoodyak now support the use of the AEADParameters class and provide accurate update/doFinal output lengths.</li>
<li>An unnecessary downcast in CertPathValidatorUtilities was resulting in the ignoring of URLs for FTP based CRLs. This has been fixed.</li>
<li>A regression in the OpenPGP API could cause NoSuchAlgorithmException to be thrown when attempting to use SHA-256 in some contexts. This has been fixed.</li>
<li>EtsiTs1029411TypesAuthorization was missing an extension field. This has been added.</li>
<li>Interoperability issues with single depth LMS keys have been addressed.</li>
</ul>
<h3>2.6.3 Additional Features and Functionality</h3>
<ul>
<li>CompositeSignatures now updated to draft-ietf-lamps-pq-composite-sigs-03.</li>
<li>ML-KEM, ML-DSA, SLH-DSA, and Composite private keys now use raw encodings as per the latest drafts from IETF 121: draft-ietf-lamps-kyber-certificates-06, draft-ietf-lamps-dilithium-certificates-05, and draft-ietf-lamps-x509-slhdsa.</li>
<li>Initial support has been added for RFC 9579 PBMAC1 in the PKCS API.</li>
<li>Support has been added for EC-JPAKE to the lightweight API.</li>
<li>Support has been added for the direct construction of S/MIME AuthEnvelopedData objects, via the SMIMEAuthEnvelopedData class.</li>
<li>An override "org.bouncycastle.asn1.allow_wrong_oid_enc" property has been added to disable new OID encoding checks (use with caution).</li>
<li>Support has been added for the PBEParemeterSpec.getParameterSpec() method where supported by the JVM.</li>
<li>ML-DSA/SLH-DSA now return null for Signature.getParameters() if no context is provided. This allows the algorithms to be used with the existing Java key tool.</li>
<li>HQC has been updated to reflect the reference implementation released on 2024-10-30.</li>
<li>Support has been added to the low-level APIs for the OASIS Shamir Secret Splitting algorithms.</li>
<li>BCJSSE: System property "org.bouncycastle.jsse.fips.allowGCMCiphersIn12" no longer used. FIPS TLS 1.2 GCM suites can now be enabled according to JcaTlsCrypto#getFipsGCMNonceGeneratorFactory (see JavaDoc for details) if done in alignment with FIPS requirements.</li>
<li>Support has been added for OpenPGP V6 PKESK and message encryption.</li>
<li>PGPSecretKey.copyWithNewPassword() now includes AEAD support.</li>
<li>The ASCON family of algorithms have been updated in accordance with the published FIPS SP 800-232 draft.</li>
</ul>

<a id="r1rv79"><h3>2.7.1 Version</h3></a>
Release: 1.79<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2024, 30th October.
<h3>2.7.2 Defects Fixed</h3>
<ul>
<li>Leading zeroes were sometimes dropped from Ed25519 signatures leading to verification errors in the PGP API. This has been fixed.</li>
<li>Default version string for Armored Output is now set correctly in 18on build.</li>
<li>The Elephant cipher would fail on large messages. This has been fixed.</li>
<li>CMSSignedData.replaceSigners() would re-encode the digest algorithms block, occassionally dropping ones where NULL had been previously added as an algorithm parameter. The method now attempts to only use the original digest algorithm identifiers.</li>
<li>ERSInputStreamData would fail to generate the correct hash if called a second time with a different hash algorithm. This has been fixed.</li>
<li>A downcast in the CrlCache which would cause FTP based CRLs to fail to load has been removed.</li>
<li>ECUtil.getNamedCurveOid() now trims curve names of excess space before look up.</li>
<li>The PhotonBeetle and Xoodyak digests did not reset properly after a doFinal() call. This has been fixed.</li>
<li>Malformed AlgorithmIdentifiers in CertIDs could cause caching issues in the OCSP cache. This has been fixed.</li>
<li>With Java 21 a provider service class will now be returned with a null class name where previously a null would have been returned for a service. This can cause a NullPointerException to be thrown by the BC provider if a non-existant service is requested. This issue has now been worked around.</li>
<li>CMS: OtherKeyAttribute.keyAttr now treated as optional.</li>
<li>CMS: EnvelopedData and AuthEnvelopedData could calculate the wrong versions. This has been fixed.</li>
<li>The default version header for PGP armored output did not carry the correct version string. This has been fixed.</li>
<li>In some situations the algorithm lookup for creating PGPDigestCalculators would fail due to truncation of the algorithm name. This has been fixed.</li>
</ul>
<h3>2.7.3 Additional Features and Functionality</h3>
<ul>
<li>Object Identifiers have been added for ML-KEM, ML-DSA, and SLH-DSA.</li>
<li>The PQC algorithms, ML-KEM, ML-DSA (including pre-hash), and SLH-DSA (including pre-hash) have been added to the BC provider and the lightweight API.</li>
<li>A new spec, ContextParameterSpec, has been added to support signature contexts for ML-DSA and SLH-DSA.</li>
<li>BCJSSE: Added support for security property "jdk.tls.server.defaultDHEParameters" (disabled in FIPS mode).</li>
<li>BCJSSE: Added support for signature_algorithms_cert configuration via "org.bouncycastle.jsse.client.SignatureSchemesCert" and "org.bouncycastle.jsse.server.SignatureSchemesCert" system properties or BCSSLParameters property "SignatureSchemesCert".</li>
<li>BCJSSE: Added support for boolean system property "org.bouncycastle.jsse.fips.allowGCMCiphersIn12" (false by default).</li>
<li>(D)TLS: Remove redundant verification of self-generated RSA signatures.</li>
<li>CompositePrivateKeys now support the latest revision of the composite signature draft.</li>
<li>Delta Certificates now support the latest revision of the delta certificate extension draft.</li>
<li>A general KeyIdentifier class, encapsulating both PGP KeyID and the PGP key fingerprint has been added to the PGP API.</li>
<li>Support for the LibrePGP PreferredEncryptionModes signature subpacket has been added to the PGP API.</li>
<li>Support for Version 6 signatures, including salts, has been added to the PGP API.</li>
<li>Support for the PreferredKeyServer signature supacket has been added to the PGP API.</li>
<li>Support for RFC 9269, "Using KEMs in Cryptographic Message Syntax (CMS)", has been added to the CMS API.</li>
<li>Support for the Argon2 S2K has been added to the PGP API.</li>
<li>The system property "org.bouncycastle.pemreader.lax" has been introduced for situations where the BC PEM parsing is now too strict.</li>
<li>The system property "org.bouncycastle.ec.disable_f2m" has been introduced to allow F2m EC support to be disabled.</li>
</ul>

<a id="r1rv78d1"><h3>2.8.1 Version</h3></a>
Release: 1.78.1<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2024, 18th April.
<h3>2.8.2 Defects Fixed</h3>
<ul>
<li>The new dependency of the the PGP API on the bcutil jar was missing from the module jar, the OSGi manifest, and the Maven POM. This has been fixed.</li>
<li>Missing exports and duplicate imports have been added/removed from the OSGi manifests.</li>
<li>The OSGi manifests now have the same bundle IDs as 1.77 and lock down dependencies to the equivalent variations.</li>
<li>A check in the X.509 Extensions class preventing the parsing of empty extensions has been removed.</li>
</ul>

<a id="r1rv78"><h3>2.9.1 Version</h3></a>
Release: 1.78<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2024, 7th April.
<h3>2.9.2 Defects Fixed</h3>
<ul>
<li>Issues with a dangling weak reference causing intermittent NullPointerExceptions in the OcspCache have been fixed.</li>
<li>Issues with non-constant time RSA operations in TLS handshakes have been fixed.</li>
<li>Issue with Ed25519, Ed448 signature verification causing intermittent infinite loop have been fixed.</li>
<li>Issues with non-constant time ML-KEM implementation ("Kyber Slash") have been fixed.</li>
<li>Align ML-KEM input validation with FIPS 203 IPD requirements.</li>
<li>Make PEM parsing more forgiving of whitespace to align with RFC 7468 - Textual Encodings of PKIX, PKCS, and CMS Structures.</li>
<li>Fix CCM length checks with large nonce sizes (n=12, n=13).</li>
<li>EAC: Fixed the CertificateBody ASN.1 type to support an optional Certification Authority Reference in a Certificate Request.</li>
<li>ASN.1: ObjectIdentifier (also Relative OID) parsing has been optimized and the contents octets for both types are now limited to 4096 bytes.</li>
<li>BCJSSE: Fixed a missing null check on the result of PrivateKey.getEncoded(), which could cause issues for HSM RSA keys.</li>
<li>BCJSSE: When endpoint identification is enabled and an SSL socket is not created with an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address. This has been fixed.</li>
<li>The missing module import of java.logging to the provider module has been added.</li>
<li>GOST ASN.1 public key alg parameters are now compliant with <a href="https://datatracker.ietf.org/doc/rfc9215/">RFC 9215</a>.</li>
<li>An off-by-one error in the encoding for EccP256CurvePoint for ITS has been fixed.</li>
<li>PEM Parser now enforces PEM headers to start at the beginning of the line to be meaningful.</li>
</ul>
<h3>2.9.3 Additional Features and Functionality</h3>
<ul>
<li>An implementation of MLS (<a href="https://datatracker.ietf.org/doc/rfc9420/">RFC 9420 - The Messaging Layer Security Protocol</a>) has been added as a new module.</li>
<li>NTRU now supports NTRU-HPS4096-1229 and NTRU-HRSS-1373.</li>
<li>Improvements to PGP support, including Camellia key wrapping and Curve25519, Curve448 key types (including XDH with HKDF).</li>
<li>Added initial support for ML-KEM in TLS.</li>
<li>Added XWing hybrid KEM construction (X25519 + ML-KEM-768).</li>
<li>Introduced initial KEMSpi support (NTRU, SNTRU Prime) for JDK 21+.</li>
<li>Introduced initial composite signature support for X509 Certificates.</li>
<li>PKCS#12 now supports PKCS12-AES256-AES128, PKCS12-AES256-AES128-GCM, PKCS12-DEF-AES256-AES128, and PKCS12-DEF-AES256-AES128-GCM.</li>
<li>The default type for the KeyStore.getInstance("PKCS12", "BC") can now be set using the org.bouncycastle.pkcs12.default system/security property.</li>
<li>The PGP SExpParser will now handle Ed25519 and Ed448 keys.</li>
<li>Dilithium and Kyber key encoding updated to latest Draft RFCs (<a href="https://datatracker.ietf.org/doc/draft-ietf-lamps-dilithium-certificates/">draft-ietf-lamps-dilithium-certificates</a> and <a href="https://datatracker.ietf.org/doc/draft-ietf-lamps-kyber-certificates/">draft-ietf-lamps-kyber-certificates</a>)</li>
<li>Support has been added for encryption key derivation using HKDF in CMS - see <a href="https://datatracker.ietf.org/doc/draft-housley-lamps-cms-cek-hkdf-sha256/">draft-housley-lamps-cms-cek-hkdf-sha256</a>.</li>
<li>X500Name now recognises jurisdiction{C,ST,L} DNs.</li>
<li>CertPathValidationContext and CertificatePoliciesValidation now include implementations of Memoable.</li>
<li>The Composite post-quantum signatures implementation has been updated to the latest draft <a href="https://datatracker.ietf.org/doc/html/draft-ounsworth-pq-composite-sigs/">draft-ounsworth-pq-composite-sigs</a>.</li>
</ul>
<h3>2.9.4 Notes.</h3>
<ul>
<li>Both versions of NTRUPrime have been updated to produce 256 bit secrets in line with Kyber. This should also bring them into line with other implementations such as those used in OpenSSH now.</li>
<li>BCJSSE: The boolean system property 'org.bouncycastle.jsse.fips.allowRSAKeyExchange" now defaults to false. All RSA
key exchange cipher suites will therefore be disabled when the BCJSSE provider is used in FIPS mode, unless this system
property is explicitly set to true.</li>
<li>OSGi compatibility should now be much improved.</li>
<li>SignedMailValidator now includes a more general rollback method for locating the signature's trust anchor for use when the first approach fails.</li>
<li>The PKCS12 store using GCM does not include the PKCS#12 MAC so no longer includes use of the PKCS#12 PBE scheme and only uses PBKDF2.</li>
<li>In keeping with the current set of experimental OIDs for PQC algorithms, OIDs may have changed to reflect updated versions of the algorithms.</li>
</ul>
<h3>2.9.5 Security Advisories.</h3>
<p>
Release 1.78 deals with the following CVEs:
</p>
<ul>
<li>CVE-2024-29857 - Importing an EC certificate with specially crafted F2m parameters can cause high CPU usage during parameter evaluation.</li>
<li>CVE-2024-30171 - Possible timing based leakage in RSA based handshakes due to exception processing eliminated.</li>
<li>CVE-2024-30172 - Crafted signature and public key can be used to trigger an infinite loop in the Ed25519 verification code.</li>
<li>CVE-2024-34447 - When endpoint identification is enabled in the BCJSSE and an SSL socket is not created with an explicit hostname (as happens with HttpsURLConnection), hostname verification could be performed against a DNS-resolved IP address. This has been fixed.</li>
</ul>

<a id="r1rv77"><h3>2.10.1 Version</h3></a>
Release: 1.77<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2023, November 13th
<h3>2.10.2 Defects Fixed</h3>
<ul>
<li>Using an unescaped '=' in an X.500 RDN would result in the RDN being truncated silently. The issue is now detected and an exception is thrown.</li>
<li>asn1.eac.CertificateBody was returning certificateEffectiveDate from getCertificateExpirationDate(). This has been fixed to return certificateExpirationDate.</li>
<li>DTLS: Fixed retransmission in response to re-receipt of an aggregated ChangeCipherSpec.</li>
<li>(D)TLS: Fixed compliance for supported_groups extension. Server will no longer negotiate an EC cipher suite using a default curve when the ClientHello includes
the supported_groups extension but it contains no curves in common with the server. Similarly, a DH cipher suite will not be negotiated when the ClientHello includes
supported_groups, containing at least one FFDHE group, but none in common with the server.</li>
<li>IllegalStateException was being thrown by the Ed25519/Ed448 SignatureSpi. This has been fixed.</li>
<li>TLS: class annotation issues that could occur between the BC provider and the TLS API for the GCMParameterSpec class when the jars were loaded on the boot class path have been addressed.</li>
<li>Attempt to create an ASN.1 OID from a zero length byte array is now caught at construction time.</li>
<li>Attempt to create an X.509 extension block which is empty will now be blocked cause an exception.</li>
<li>IES implementation will now accept a null ParameterSpec if no nonce is needed.</li>
<li>An internal method in Arrays was failing to construct its failure message correctly on an error. This has been fixed.</li>
<li>HSSKeyPublicParameters.generateLMSContext() would fail for a unit depth key. This has been fixed.</li>
</ul>
<h3>2.10.3 Additional Features and Functionality</h3>
<ul>
<li>BCJSSE: Added org.bouncycastle.jsse.client.omitSigAlgsCertExtension and org.bouncycastle.jsse.server.omitSigAlgsCertExtension boolean system properties
to control (for client and server resp.) whether the signature_algorithms_cert extension should be omitted if it would be identical to signature_algorithms.
Defaults to true, the historical behaviour.</li>
<li>The low-level HPKE API now allows the sender to specify an ephemeral key pair.</li>
<li>Support has been added for the delta-certificate requests in line with the current Chameleon Cert draft from the IETF.</li>
<li>Some accommodation has been added for historical systems to accommodate variations in the SHA-1 digest OID for CMS SignedData.</li>
<li>TLS: the TLS API will now try "RSAwithDigestAndMFG1" as well as the newer RSAPSS algorithm names when used with the JCA.</li>
<li>TLS: RSA key exchange cipher suites are now disabled by default.</li>
<li>Support has been added for PKCS#10 requests to allow certificates using the altSignature/altPublicKey extensions.</li>
</ul>
<h3>2.10.4 Notes.</h3>
<ul>
<li>Kyber and Dilithium have been updated according to the latest draft of the standard. Dilithium-AES and Kyber-AES have now been removed. Kyber now produces 256 bit secrets for all parameter sets (in line with the draft standard).</li>
<li>NTRU has been updated to produce 256 bit secrets in line with Kyber.</li>
<li>SPHINCS+ can now be used to generate certificates in line with those used by (Open Quantum Safe) OQS.</li>
<li>Falcon object identifiers are now in line with OQS as well.</li>
<li>PQC CMS SignedData now defaults to SHA-256 for signed attributes rather than SHAKE-256. This is also a compatibility change, but may change further again as the IETF standard for CMS is updated.</li>
</ul>

<a id="r1rv76"><h3>2.11.1 Version</h3></a>
Release: 1.76<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2023, July 29th
<h3>2.11.2 Defects Fixed</h3>
<ul>
<li>Service allocation in the provider could fail due to the lack of a permission block. This has been fixed.</li>
<li>JceKeyFingerPrintCalculator has been generalised for different providers by using "SHA-256" for the algorithm string.</li>
<li>BCJSSE: Fixed a regression in 1.74 (NullPointerException) that prevents a BCJSSE server from negotiating TLSv1.1 or earlier.</li>
<li>DTLS: Fixed server support for client_certificate_type extension.</li>
<li>Cipher.unwrap() for HQC could fail due to a miscalculation of the length of the KEM packet. This has been fixed.</li>
<li>There was exposure to a Java 7 method in the Java 5 to Java 8 BCTLS jar which could cause issues with some TLS 1.2 cipher suites running on older JVMs. This is now fixed.</li>
</ul>
<h3>2.11.3 Additional Features and Functionality</h3>
<ul>
<li>BCJSSE: Following OpenJDK, finalizers have been removed from SSLSocket subclasses. Applications should close sockets and not rely on garbage collection.</li>
<li>BCJSSE: Added support for boolean system property "jdk.tls.client.useCompatibilityMode" (default "true").</li>
<li>DTLS: Added server support for session resumption.</li>
<li>JcaPKCS10CertificationRequest will now work with EC on the OpenJDK provider.</li>
<li>TimeStamp generation now supports the SHA3 algorithm set.</li>
<li>The SPHINCS+ simple parameters are now fully supported in the BCPQC provider.</li>
<li>Kyber, Classic McEliece, HQC, and Bike now supported by the CRMF/CMS/CMP APIs.</li>
<li>Builder classes have been add for PGP ASCII Armored streams allowing CRCs and versions to now be optional.</li>
<li>An UnknownPacket type has been added to the PGP APIs to allow for forwards compatibility with upcoming revisions to the standard.</li>
</ul>

<a id="r1rv75"><h3>2.12.1 Version</h3></a>
Release: 1.75<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2023, June 21st
<h3>2.12.2 Defects Fixed</h3>
<ul>
<li>Several Java 8 method calls were accidentally introduced in the Java 5 to Java 8 build. The affected classes have been refactored to remove this.</li>
<li>(D)TLS: renegotiation after resumption now fixed to avoid breaking connection.</li>
</ul>
<h3>2.12.3 Notes.</h3>
<ul>
<li>The ASN.1 core package has had some dead and retired methods cleaned up and removed.</li>
</ul>

<a id="r1rv74"><h3>2.13.1 Version</h3></a>
Release: 1.74<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2023, June 12th
<h3>2.13.2 Defects Fixed</h3>
<ul>
<li>AsconEngine: Fixed a buffering bug when decrypting across multiple processBytes calls (ascon128a unaffected).</li>
<li>Context based sanity checking on PGP signatures has been added.</li>
<li>The ParallelHash clone constructor was not copying all fields. This is now fixed.</li>
<li>The maximimum number of blocks for CTR/SIC modes was 1 block less than it should have been. This is now fixed.</li>
</ul>
<h3>2.13.3 Additional Features and Functionality</h3>
<ul>
<li>The PGP API now supports wildcard key IDs for public key based data encryption.</li>
<li>LMS now supports SHA256/192, SHAKE256/192, and SHAKE256/256 (the additional SP 8000-208 parameter sets).</li>
<li>The PGP API now supports V5 and V6 AEAD encryption for encrypted data packets.</li>
<li>The PGP examples have been updated to reflect key size and algorithm changes that have occurred since they were first written (10+ years...).</li>
<li>(D)TLS: A new callback 'TlsPeer.notifyConnectionClosed' will be called when the connection is closed (including by failure).</li>
<li>BCJSSE: Improved logging of connection events and include unique IDs in connection-specific log messages.</li>
<li>BCJSSE: Server now logs the offered cipher suites when it fails to select one.</li>
<li>BCJSSE: Added support for SSLParameters namedGroups and signatureSchemes properties (can also be used via BCJSSE extension API in earlier Java versions).</li>
<li>DTLS: The initial handshake re-send time is now configurable by overriding 'TlsPeer.getHandshakeResendTimeMillis'.</li>
<li>DTLS: Added support for connection IDs per RFC 9146.</li>
<li>DTLS: Performance of DTLSVerifier has been improved so that it can reasonably be used for all incoming packets.</li>
<li>Initial support has been added for <a href="https://datatracker.ietf.org/doc/draft-bonnell-lamps-chameleon-certs/">A Mechanism for Encoding Differences in Paired Certificates</a>.</li>
<li>The PGP API now supports parsing, encoding, and fingerprinting of V6 EC/EdEC keys.</li>
<li>A thread safe verifier API has been added to the PGP API to support multi-threaded verification of certifications on keys and user IDs.</li>
<li>The number of keys/sub-keys in a PGPKeyRing can now be found by calling PGPKeyRing.size().</li>
<li>The PQC algorithms LMS/HSS, SPHINCS+, Dilithium, Falcon, and NTRU are now supported directly by the BC provider.</li>
</ul>
<h3>2.13.4 Notes.</h3>
<ul>
<li>The now defunct PQC SIKE algorithm has been removed, this has also meant the removal of its resource files so the provider is now quite a bit smaller.</li>
<li>As a precaution, HC128 now enforces a 128 bit IV, previous behaviour for shorter IVs can be supported where required by padding the IV to the 128 bits with zero.</li>
<li>PGP encrypted data generation now uses integrity protection by default. Previous behaviour for encrypted data can be supported where required by calling PGPDataEncryptorBuilder.setWithIntegrityPacket(false) when data encryption is set up.</li>
<li>There are now additional sanity checks in place to prevent accidental mis-use of PGPSignature objects. If this change causes any issues, you might want to check what your code is up to as there is probably a bug.</li>
</ul>
<h3>2.13.5 Security Advisories.</h3>
<ul>
<li>CVE-2023-33201 - this release fixes an issue with the X509LDAPCertStoreSpi where a specially crafted certificate subject could be used to try and extract extra information out of an LDAP server with wild-card matching enabled.</li>
</ul>

<a id="r1rv73"><h3>2.14.1 Version</h3></a>
Release: 1.73<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2023, April 8th
<h3>2.14.2 Defects Fixed</h3>
<ul>
<li>BCJSSE: Instantiating a JSSE provider in some contexts could cause an AccessControl exception. This has been fixed.</li>
<li>The EC key pair generator can generate out of range private keys when used with SM2. A specific SM2KeyPairGenerator has been added to the low-level API and is used by KeyPairGenerator.getInstance("SM2", "BC"). The SM2 signer has been updated to check for out of range keys as well..</li>
<li>The attached signature type byte was still present in Falcon signatures as well as the detached signature byte. This has been fixed.</li>
<li>There was an off-by-one error in engineGetOutputSize() for ECIES. This has been fixed.</li>
<li>The method for invoking read() internally in BCPGInputStream could result in inconsistent behaviour if the class was extended. This has been fixed.</li>
<li>Fixed a rounding issue with FF1 Format Preserving Encryption algorithm for certain radices.</li>
<li>Fixed RFC3394WrapEngine handling of 64 bit keys.</li>
<li>Internal buffer for blake2sp was too small and could result in an ArrayIndexOutOfBoundsException. This has been fixed.</li>
<li>JCA PSS Signatures using SHAKE128 and SHAKE256 now support encoding of algorithm parameters.</li>
<li>PKCS10CertificationRequest now checks for empty extension parameters.</li>
<li>Parsing errors in the processing of PGP Armored Data now throw an explicit exception ArmoredInputException.</li>
<li>PGP AEAD streams could occassionally be truncated. This has been fixed.</li>
<li>The ESTService class now supports processing of chunked HTTP data.</li>
<li>A constructed ASN.1 OCTET STRING with a single member would sometimes be re-encoded as a definite-length OCTET STRING. The encoding has been adjusted to preserve the BER status of the object.</li>
<li>PKIXCertPathReviewer could fail if the trust anchor was also included in the certificate store being used for path analysis. This has been fixed.</li>
<li>UTF-8 parsing of an array range ignored the provided length. This has been fixed.</li>
<li>IPAddress has been written to provide stricter checking and avoid the use of Integer.parseInt().</li>
<li>A Java 7 class snuck into the Java 5 to Java 8 build. This has been addressed.</li>
</ul>
<h3>2.14.3 Additional Features and Functionality</h3>
<ul>
<li>The Rainbow NIST Post Quantum Round-3 Candidate has been added to the low-level API and the BCPQC provider (level 3 and level 5 parameter sets only).</li>
<li>The GeMSS NIST Post Quantum Round-3 Candidate has been added to the low-level API.</li>
<li>The org.bouncycastle.rsa.max_mr_tests property check has been added to allow capping of MR tests done on RSA moduli.</li>
<li>Significant performance improvements in PQC algorithms, especially BIKE, CMCE, Frodo, HQC, Picnic.</li>
<li>
    EdDSA verification now conforms to the recommendations of <a href="https://ia.cr/2020/1244">Taming the many EdDSAs</a>, in particular cofactored verification.
    As a side benefit, <a href="https://ia.cr/2020/454">Pornin's basis reduction</a> is now used for EdDSA verification, giving a significant performance boost.
</li>
<li>Major performance improvements for Anomalous Binary (Koblitz) Curves.</li>
<li>The lightweight Cryptography finalists Ascon, ISAP, Elephant, PhotonBeetle, Sparkle, and Xoodyak have been added to the light-weight cryptography API.</li>
<li>BLAKE2bp and BLAKE2sp have been added to the light-weight cryptography API.</li>
<li>Support has been added for X.509, Section 9.8, hybrid certificates and CRLs using alternate public keys and alternate signatures.</li>
<li>The property "org.bouncycastle.emulate.oracle" has been added to signal the provider should return algorithm names on some algorithms in the same manner as the Oracle JCE provider.</li>
<li>An extra replaceSigners method has been added to CMSSignedData which allows for specifying the digest algorithm IDs to be used in the new CMSSignedData object.</li>
<li>Parsing and re-encoding of ASN.1 PEM data has been further optimized to prevent unecessary conversions between basic encoding, definite length, and DER.</li>
<li>Support has been added for KEM ciphers in CMS in accordance with <a href="https://www.ietf.org/id/draft-ietf-lamps-cms-kemri-00.html">draft-ietf-lamps-cms-kemri</a></li>
<li>Support has been added for certEncr in CRMF to allow issuing of certificates for KEM public keys.</li>
<li>Further speedups have been made to CRC24.</li>
<li>GCMParameterSpec constructor caching has been added to improve performance for JVMs that have the class available.</li>
<li>The PGPEncrytedDataGenerator now supports injecting the session key to be used for PGP PBE encrypted data.</li>
<li>The CRMF CertificateRequestMessageBuilder now supports optional attributes.</li>
<li>Improvements to the s calculation in JPAKE.</li>
<li>A general purpose PQCOtherInfoGenerator has been added which supports all Kyber and NTRU.</li>
<li>An implementation of HPKE (RFC 9180 - Hybrid Public Key Encryption) has been added to the light-weight cryptography API.
</ul>
<h3>2.14.4 Security Advisories.</h3>
<ul>
<li>The PQC implementations have now been subject to formal review for secret leakage and side channels, there were issues in BIKE, Falcon, Frodo, HQC which have now been fixed. Some weak positives also showed up in Rainbow, Picnic, SIKE, and GeMSS - for now this last set has been ignored as the algorithms will either be updated if they reappear in the Signature Round, or deleted, as is already the case for SIKE (it is now in the legacy package). Details on the group responsible for the testing can be found in the <a href="../CONTRIBUTORS.html">CONTRIBUTORS</a> file.</li>
<li>For at least some ECIES variants (e.g. when using CBC) there is an issue with potential malleability of a nonce (implying silent malleability of the plaintext) that must be sent alongside the ciphertext but is outside the IES integrity check. For this reason the automatic generation of nonces with IED is now disabled and they have to be passed in using an IESParameterSpec. The current advice is to agree on a nonce between parties and then rely on the use of the ephemeral key component to allow the nonce (rather the so called nonce) usage to be extended.</li>
</ul>
<h3>2.14.5 Notes.</h3>
<ul>
<li>Most test data files have now been migrated to a separate project bc-test-data which is also available on github. If you clone bc-test-data at the same level as the bc-java project the tests will find the test data they require.</li>
<li>There has been further work to make entropy collection more friendly in container environments. See <a hef="https://github.com/bcgit/bc-java/blob/master/prov/src/main/java/org/bouncycastle/jcajce/provider/drbg/DRBG.java">DRBG.java</a> for details. We would welcome any further feedback on this as we clearly cannot try all situations first hand.</li>
</ul>

<a id="r1rv72.3"><h3>2.15.1 Version</h3></a>
Release: <a id="r1rv72.2">1.72.2</a>, 1.72.3<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2022, November 20th
<h3>2.15.2 Defects Fixed</h3>
<ul>
<li>PGP patch release - fix for OSGI and version header in 1.72.1 jar file.
</ul>


<a id="r1rv72.1"><h3>2.16.1 Version</h3></a>
Release: 1.72.1<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2022, October 25th
<h3>2.16.2 Defects Fixed</h3>
<ul>
<li>PGP patch release - fix for regression in OpenPGP PGPEncryptedData.java which could result in checksum failures on correct files.</li>
</ul>

<a id="r1rv72"><h3>2.17.1 Version</h3></a>
Release: 1.72<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2022, September 25th
<h3>2.17.2 Defects Fixed</h3>
<ul>
<li>There were parameter errors in XMSS^MT OIDs for XMSSMT_SHA2_40/4_256 and XMSSMT_SHA2_60/3_256. These have been fixed.</li>
<li>There was an error in Merkle tree construction for the Evidence Records (ERS) implementation which could result in invalid roots been timestamped. ERS now produces an ArchiveTimeStamp for each data object/group with an associated reduced hash tree. The reduced hash tree is now calculated as a simple path to the root of the tree for each record.</li>
<li>OpenPGP will now ignore signatures marked as non-exportable on encoding.</li>
<li>A tagging calculation error in GCMSIV which could result in incorrect tags has been fixed.</li>
<li>Issues around Java 17 which could result in failing tests have been addressed.</li>
</ul>
<h3>2.17.3 Additional Features and Functionality</h3>
<ul>
<li>BCJSSE: TLS 1.3 is now enabled by default where no explicit protocols are supplied (e.g. "TLS" or "Default" SSLContext algorithms, or SSLContext.getDefault() method).</li>
<li>BCJSSE: Rewrite SSLEngine implementation to improve compatibility with SunJSSE.</li>
<li>BCJSSE: Support export of keying material via extension API.</li>
<li>(D)TLS: Add support for 'tls-exporter' channel binding per RFC 9266.</li>
<li>(D)TLS (low-level API): By default, only (D)TLS 1.2 and TLS 1.3 are offered now. Earlier versions are still supported if explicitly enabled. Users may need to check they are offering suitable cipher suites for TLS 1.3.</li>
<li>(D)TLS (low-level API): Add support for raw public keys per RFC 7250.</li>
<li>CryptoServicesRegistrar now has a setServicesConstraints() method on it which can be used to selectively turn off algorithms.</li>
<li>The NIST PQC Alternate Candidate, Picnic, has been added to the low level API and the BCPQC provider.</li>
<li>SPHINCS+ has been upgraded to the latest submission, SPHINCS+ 3.1 and support for Haraka has been added.</li>
<li>Evidence records now support timestamp renewal and hash renewal.</li>
<li>The SIKE Alternative Candidate NIST Post Quantum Algorithm has been added to the low-level API and the BCPQC provider.</li>
<li>The NTRU Round 3 Finalist Candidate NIST Post Quantum Algorithm has been added to the low-level API and the BCPQC provider.</li>
<li>The Falcon Finalist NIST Post Quantum Algorithm has been added to the low-level API and the BCPQC provider.</li>
<li>The CRYSTALS-Kyber Finalist NIST Post Quantum Algorithm has been added to the low-level API and the BCPQC provider.</li>
<li>Argon2 Support has been added to the OpenPGP API.</li>
<li>XDH IES has now been added to the BC provider.</li>
<li>The OpenPGP API now supports AEAD encryption and decryption.</li>
<li>The NTRU Prime Alternative Candidate NIST Post Quantum Algorithms have been added to the low-level API and the BCPQC provider.</li>
<li>The CRYSTALS-Dilithium Finalist NIST Post Quantum Algorithm has been added to the low-level API and the BCPQC provider.</li>
<li>The BIKE NIST Post Quantum Alternative/Round-4 Candidate has been added to the low-level API and the BCPQC provider.</li>
<li>The HQC NIST Post Quantum Alternative/Round-4 Candidate has been added to the low-level API and the BCPQC provider.</li>
<li>Grain128AEAD has been added to the lightweight API.</li>
<li>A fast version of CRC24 has been added for use with the PGP API.</li>
<li>Some additional methods and fields have been exposed in the PGPOnePassSignature class to (hopefully) make it easier to deal with nested signatures.</li>
<li>CMP support classes have been updated to reflect the latest editions to the the draft RFC "Lightweight Certificate Management Protocol (CMP) Profile".</li>
<li>Support has been added to the PKCS#12 implementation for the Oracle trusted certificate attribute.</li>
<li>Performance of our BZIP2 classes has been improved.</li>
</ul>
<h3>2.17.4 Notes</h3>
<p>
Keep in mind the PQC algorithms are still under development and we are still at least a year and a half away from published standards. This means the algorithms may still change so by all means experiment, but do not use the PQC algoritms for anything long term.
</p>
<p>
The legacy "Rainbow" and "McEliece" implementations have been removed from the BCPQC provider. The underlying classes are still present if required. Other legacy algorithm implementations can be found under the org.bouncycastle.pqc.legacy package.
</p>
<h3>2.17.5 Security Notes</h3>
<p>
The PQC SIKE algorithm is provided for research purposes only. It should now be regarded as broken. The SIKE implementation will be withdrawn in BC 1.73.
</p>

<a id="r1rv71"><h3>2.18.1 Version</h3></a>
Release: 1.71<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2022, March 31st.
<h3>2.18.2 Defects Fixed</h3>
<ul>
<li>In line with GPG the PGP API now attempts to preserve comments containing non-ascii UTF-8 characters.</li>
<li>An accidental partial dependency on Java 1.7 has been removed from the TLS API.</li>
<li>JcaPKIXIdentityBuilder would fail to process File objects correctly. This is now fixed.</li>
<li>Some byte[] parameters to the CMP API were not being defensively cloned to prevent accidental changes. Extra defensive cloning has been added.</li>
<li>CMS primitives would sometimes convert ASN.1 definite-length encodings into indefinite-length encodings. The primitives will now try and preserve the original encoding where possible.</li>
<li>CMSSignedData.getAttributeCertificates() now properly restricts the tag values checked to just 1 (the obsolete v1 tag) and 2 (for the more current v2 certificates).</li>
<li>BCJSSE now tries to validate a custom KeyManager selection in order to catch errors around a key manager ignoring key type early.</li>
<li>Compressed streams in PGP ending with zero length partial packets could cause failure on parsing the OpenPGP API. This has been fixed.</li>
<li>The fallback mode for JceAsymmetricKeyWrapper/Unwrapper would lose track of any algorithm parameters generated in the initial attempt. The algorithm parameters are now propagated.</li>
<li>An accidental regression introduced by a fix for another issue in PKIXCertPathReviewer around use of the AuthorityKeyIdentifier extension and it failing to match a certificate uniquely when the serial number field is missing has been fixed.</li>
<li>An error was found in the creation of TLS 1.3 Export Keying Material which could cause compatibility issues. This has been fixed.</li>
</ul>
<h3>2.18.3 Additional Features and Functionality</h3>
<ul>
<li>Support has been added for OpenPGP regular expression signature packets.</li>
<li>Support has been added for OpenPGP PolicyURI signature packets.</li>
<li>A utility method has been added to PGPSecretKeyRing to allow for inserting or replacing a PGPPublicKey.</li>
<li>A utility method has been added to PGPSecretKeyRing to allow for inserting or replacing a PGPPublicKey.</li>
<li>The NIST PQC Finalist, Classic McEliece has been added to the low level API and the BCPQC provider.</li>
<li>The NIST PQC Alternate Candidate, SPHINCS+ has been added to the BCPQC provider.</li>
<li>The NIST PQC Alternate Candidate, FrodoKEM has been added to the low level API and the BCPQC provider.</li>
<li>The NIST PQC Finalist, SABER has been added to the low level API and the BCPQC provider.</li>
<li>KMAC128, KMAC256 has been added to the BC provider (empty customization string).</li>
<li>TupleHash128, TupleHash256 has been added to the BC provider (empty customization string).</li>
<li>ParallelHash128, ParallelHash256 has been added to the BC provider (empty customization string, block size 1024 bits).</li>
<li>Two new properties: "org.bouncycastle.rsa.max_size" (default 15360) and "org.bouncycastle.ec.fp_max_size" (default 1042) have been added to cap the maximum size of RSA and EC keys.</li>
<li>RSA modulus are now checked to be provably composite using the enhanced MR probable prime test.</li>
<li>Imported EC Fp basis values are now validated against the MR prime number test before use. The certainty level of the prime test can be determined by "org.bouncycastle.ec.fp_certainty" (default 100).</li>
<li>The BC entropy thread now has a specific name: "BC-ENTROPY-GATHERER".</li>
<li>Utility methods have been added for joining/merging PGP public keys and signatures.</li>
<li>Blake3-256 has been added to the BC provider.</li>
<li>DTLS: optimisation to delayed handshake hash.</li>
<li>Further additions to the ETSI 102 941 support in the ETSI/ITS package: certification request, signed message generation and verification now supported.</li>
<li>CMSSignedDataGenerator now supports the direct generation of definite-length data.</li>
<li>The NetscapeCertType class now has a hasUsages() method on it for querying usage settings on its bit string.</li>
<li>Support for additional input has been added for deterministic (EC)DSA.</li>
<li>The OpenPGP API provides better support for subkey generation.</li>
<li>BCJSSE: Added boolean system properties "org.bouncycastle.jsse.client.dh.disableDefaultSuites" and "org.bouncycastle.jsse.server.dh.disableDefaultSuites".
Default "false". Set to "true" to disable inclusion of DH cipher suites in the default cipher suites for client/server respectively.</li>
<li>ASN.1 object support has been added for the Lightweight Certificate Management Protocol (CMP), currently in draft.</li>
<li>A HybridValueParamterSpec class has been added for use with KeyAgreement to support SP 800-56C hybrid (so classical/post-quantum) key agreement.</li>
</ul>
<h3>2.18.4 Notes</h3>
<ul>
<li>The deprecated QTESLA implementation has been removed from the BCPQC provider.</li>
<li>The <a href="https://groups.google.com/u/1/a/list.nist.gov/g/pqc-forum/c/F9ZUtWCij54">submission update to SPHINCS+</a> has been added. This changes the generation of signatures - particularly deterministic ones.</li>
</ul>

<a id="r1rv70"><h3>2.19.1 Version</h3></a>
Release: 1.70<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2021, November 29th.
<h3>2.19.2 Defects Fixed</h3>
<ul>
<li>Blake 3 output limit is enforced.</li>
<li>The PKCS12 KeyStore was relying on default precedence for its key Cipher implementation so was sometimes failing if used from the keytool. The KeyStore class now makes sure it uses the correct Cipher implementation.</li>
<li>Fixed bzip2 compression for empty contents (GH #993).</li>
<li>ASN.1: More robust handling of high tag numbers and definite-length forms.</li>
<li>BCJSSE: Fix a concurrent modification issue in session contexts (GH#968).</li>
<li>BCJSSE: Don't log sensitive system property values (GH#976).</li>
<li>BCJSSE: Fixed a priority issue amongst imperfect-match credentials in KeyManager classes.</li>
<li>The IES AlgorithmParameters object has been re-written to properly support all the variations of IESParameterSpec.</li>
<li>getOutputSize() for ECIES has been corrected to avoid occassional underestimates.</li>
<li>The lack of close() in the ASN.1 Dump command line utility was triggering false positives in some code analysis tools. A close() call has been added.</li>
<li>PGPPublicKey.getBitStrength() now properly recognises EdDSA keys.</li>
</ul>
<h3>2.19.3 Additional Features and Functionality</h3>
<ul>
<li>Missing PGP CRC checksums can now be optionally ignored using setDetectMissingCRC() (default false) on ArmoredInputStream.</li>
<li>PGPSecretKey.copyWithNewPassword() now has a variant which uses USAGE_SHA1 for key protection if a PGPDigestCalculator is passed in.</li>
<li>PGP ASCII armored data now skips "\t", "\v", and "\f".</li>
<li>PKCS12 files with duplicate localKeyId attributes on certificates will now have the incorrect attributes filtered out, rather than the duplicate causing an exception.</li>
<li>PGPObjectFactory will now ignore packets representing unrecognised signature versions in the input stream.</li>
<li>The X.509 extension generator will now accumulate some duplicate X.509 extensions into a single extension where it is possible to do so.</li>
<li>Removed support for maxXofLen in Kangaroo digest.</li>
<li>Ignore marker packets in PGP Public and Secret key ring collection.</li>
<li>An implementation of LEA has been added to the low-level API.</li>
<li>Access, recovery, and direct use for PGP session keys has been added to the OpenPGP API for processing encrypted data.</li>
<li>A PGPCanonicalizedDataGenerator has been added which converts input into canonicalized literal data for text and UTF-8 mode.</li>
<li>A getUserKeyingMaterial() method has been added to the KeyAgreeRecipientInformation class.</li>
<li>ASN.1: Tagged objects (and parsers) now support all tag classes. Special code for ApplicationSpecific has been deprecated and
re-implemented in terms of TaggedObject.</li>
<li>ASN.1: Improved support for nested tagging.</li>
<li>ASN.1: Added support for GraphicString, ObjectDescriptor, RelativeOID.</li>
<li>ASN.1: Added support for constructed BitString encodings, including efficient parsing for large values.</li>
<li>TLS: Added support for external PSK handshakes.</li>
<li>TLS: Check policy restrictions on key size when determining cipher suite support.</li>
<li>A performance issue in KeccakDigest due to left over debug code has been identified and dealt with.</li>
<li>BKS key stores can now be used for collecting protected keys (note: any attempt to store such a store will cause an exception).</li>
<li>A method for recovering user keying material has been added to KeyAgreeRecipientInformation.</li>
<li>Support has been added to the CMS API for SHA-3 based PLAIN-ECDSA.</li>
<li>The low level BcDefaultDigestProvider now supports the SHAKE family of algorithms and the SM3 alogirthm.</li>
<li>PGPKeyRingGenerator now supports creation of key-rings with direct-key identified keys.</li>
<li>The PQC NIST candidate, signature algorithm SPHINCS+ has been added to the low-level API.</li>
<li>ArmoredInputStream now explicitly checks for a '\n' if in crLF mode.</li>
<li>Direct support for NotationDataOccurances, Exportable, Revocable, IntendedRecipientFingerPrints, and AEAD algorithm preferences has been added to PGPSignatureSubpacketVector.</li>
<li>Further support has been added for keys described using S-Expressions in GPG 2.2.X.</li>
<li>Support for OpenPGP Session Keys from the (draft) Stateless OpenPGP CLI has been added.</li>
<li>Additional checks have been added for PGP marker packets in the parsing of PGP objects.</li>
<li>A CMSSignedData.addDigestAlgorithm() has been added to allow for adding additional digest algorithm identifiers to CMS SignedData structures when required.</li>
<li>Support has been added to CMS for the LMS/HSS signature algorithm.</li>
<li>The system property "org.bouncycastle.jsse.client.assumeOriginalHostName" (default false) has been added for dealing with SNI problems related to the host name not being propagate by the JVM.</li>
<li>The JcePKCSPBEOutputEncryptorBuilder now supports SCRYPT with ciphers that do not have algorithm parameters (e.g. AESKWP).</li>
<li>Support is now added for certificates using ETSI TS 103 097, "Intelligent Transport Systems (ITS)" in the bcpkix package.</li>
</ul>
<h3>2.19.4 Notes.</h3>
<ul>
<li>While this release should maintain source code compatibility, developers making use of some parts of the ASN.1 library will find that some classes need recompiling. Apologies for the inconvenience.</li>
</ul>

<a id="r1rv69"><h3>2.20.1 Version</h3></a>
Release: 1.69<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2021, June 7th.
<h3>2.20.2 Defects Fixed</h3>
<ul>
<li>Lightweight and JCA conversion of Ed25519 keys in the PGP API could drop the leading byte as it was zero. This has been fixed.</li>
<li>Marker packets appearing at the start of PGP public key rings could cause parsing failure. This has been fixed.</li>
<li>ESTService could fail for some valid Content-Type headers. This has been fixed.</li>
<li>Originator key algorithm parameters were being passed as NULL in key agreement recipients. The parameters now reflect the value of the parameters in the key's SubjectPublicKeyInfo.</li>
<li>ContentType on encapsulated data was not been passed through correctly for authenticated and enveloped data. This has been fixed.</li>
<li>NTRUEncryptionParameters and NTRUEncryptionKeyGenerationParameters were not correctly cloning the contained message digest. This has been fixed.</li>
<li>CertificateFactory.generateCertificates()/generateCRLs() would throw an exception if extra data was found at the end of a PEM file even if valid objects had been found. Extra data is now ignored providing at least one object found.</li>
<li>Internal class PKIXCRLUtil could throw a NullPointerException for CRLs with an absent nextUpdate field. This has been fixed.</li>
<li>PGP ArmoredInputStream now fails earlier on malformed headers.</li>
<li>The McElieceKobaraImaiCipher was randomly throwing "Bad Padding: invalid ciphertext" exception while decrypting due to leading zeroes been missed during processing of the cipher text. This has been fixed.</li>
<li>Ed25519 keys being passed in via OpenSSH key spec are now validated in the KeyFactory.</li>
<li>Blowfish keys are now range checked on cipher construction.</li>
<li>In some cases PGPSecretKeyRing was failing to search its extraPubKeys list when searching for public keys.</li>
<li>The BasicConstraintsValidation class in the BC cert path validation tools has improved conformance to RFC 5280.</li>
<li>AlgorithmIdentifiers involving message digests now attempt to follow the latest conventions for the parameters field (basically DER NULL appears less).</li>
<li>Fix various conversions and interoperability for XDH and EdDSA between BC and SunEC providers.</li>
<li>TLS: Prevent attempts to use KeyUpdate mechanism in versions before TLS 1.3.</li>
</ul>
<h3>2.20.3 Additional Features and Functionality</h3>
<ul>
<li>GCM-SIV has been added to the lightweight API and the provider.</li>
<li>Blake3 has been added to the lightweight API.</li>
<li>The OpenSSL PEMParser can now be extended to add specialised parsers.</li>
<li>Base32 encoding has now been added, the default alphabet is from RFC 4648.</li>
<li>The KangarooTwelve message digest has been added to the lightweight API.</li>
<li>An implementation of the two FPE algorithms, FF1 and FF3-1 in SP 800-38G has been added to the lightweight API and the JCE provider.</li>
<li>An implementation of ParallelHash has been added to the lightweight API.</li>
<li>An implementation of TupleHash has been added to the lightweight API.</li>
<li>RSA-PSS now supports the use of SHAKE128 and SHAKE256 as the mask generation function and digest.</li>
<li>ECDSA now supports the use of SHAKE128 and SHAKE256.</li>
<li>PGPPBEEncryptedData will now reset the stream if the initial checksum fails so another password can be tried.</li>
<li>Iterators on public and secret key ring collections in PGP now reflect the original order of the public/secret key rings they contain.</li>
<li>KeyAgreeRecipientInformation now has a getOriginator() method for retrieving the underlying orginator information.</li>
<li>PGPSignature now has a getDigestPrefix() method for people wanting exposure to the signature finger print details.</li>
<li>The old BKS-V1 format keystore is now disabled by default. If you need to use BKS-V1 for legacy reasons, it can be re-enabled by adding:
<pre>
org.bouncycastle.bks.enable_v1=true
</pre>
to the java.security file. We would be interested in hearing from anyone that needs to do this.</li>
<li>PLAIN-ECDSA now supports the SHA3 digests.</li>
<li>Some highlevel support for RFC 4998 ERS has been added for ArchiveTimeStamp and EvidenceRecord. The new classes are in
the org.bouncycastle.tsp.ers package.</li>
<li>ECIES has now also support SHA256, SHA384, and SHA512.</li>
<li>digestAlgorithms filed in CMS SignedData now includes counter signature digest algorithms where possible.</li>
<li>A new property "org.bouncycastle.jsse.config" has been added which can be used to configure the BCJSSE provider when it is created using the no-args constructor.</li>
<li>In line with changes in OpenSSL 1.1.0, OpenSSLPBEParametersGenerator can now be configured with a digest.</li>
<li>PGPKeyRingGenerator now includes a method for adding a subkey with a primary key binding signature.</li>
<li>Support for ASN.1 PRIVATE tags has been added.</li>
<li>Performance enhancements to Nokeon, AES, GCM, and SICBlockCipher.</li>
<li>Support for ecoding/decoding McElieceCCA2 keys has been added to the PQC API</li>
<li>BCJSSE: Added support for jdk.tls.maxCertificateChainLength system property (default is 10).</li>
<li>BCJSSE: Added support for jdk.tls.maxHandshakeMessageSize system property (default is 32768).</li>
<li>BCJSSE: Added support for jdk.tls.client.enableCAExtension (default is 'false').</li>
<li>BCJSSE: Added support for jdk.tls.client.cipherSuites system property.</li>
<li>BCJSSE: Added support for jdk.tls.server.cipherSuites system property.</li>
<li>BCJSSE: Extended ALPN support via standard JSSE API to JDK 8 versions after u251/u252.</li>
<li>BCJSSE: Key managers now support EC credentials for use with TLS 1.3 ECDSA signature schemes (including brainpool).</li>
<li>TLS: Add TLS 1.3 support for brainpool curves per RFC 8734.</li>
</ul>
<h3>2.20.4 Notes</h3>
<ul>
<li>There is a small API change in the PKIX package to the DigestAlgorithmIdentifierFinder interface as a find() method that takes an ASN1ObjectIdentifier has been added to it. For people wishing to extend their own implementations, see DefaultDigestAlgorithmIdentifierFinder for a sample implementation.</li>
<li>A version of the bcmail API supporting Jakarta Mail has now been added (see bcjmail jar).</li>
<li>Some work has been done on moving out code that does not need to be in the provider jar. This has reduced the size of the provider jar and should also make it easier for developers to patch the classes involved as they no longer need to be signed. bcpkix and bctls are both dependent on the new bcutil jar.</li>
</ul>

<a id="r1rv68"><h3>2.21.1 Version</h3></a>
Release: 1.68<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2020, December 21st.
<h3>2.21.2 Defects Fixed</h3>
<ul>
<li>Some BigIntegers utility methods would fail for BigInteger.ZERO. This has been fixed.</li>
<li>PGPUtil.isKeyRing() was not detecting secret sub-keys in its input. This has been fixed.</li>
<li>The ASN.1 class, ArchiveTimeStamp was insisting on a value for the optional reducedHashTree field. This has been fixed.</li>
<li>BCJSSE: Lock against multiple writers - a possible synchronization issue has been removed.</li>
</ul>
<h3>2.21.3 Additional Features and Functionality</h3>
<ul>
<li>BCJSSE: Added support for system property com.sun.net.ssl.requireCloseNotify. Note that we are using a default value of 'true'.</li>
<li>BCJSSE: 'TLSv1.3' is now a supported protocol for both client and server. For this release it is only enabled by default for the 'TLSv1.3' SSLContext, but can be explicitly enabled using 'setEnabledProtocols' on an SSLSocket or SSLEngine, or via SSLParameters.</li>
<li>BCJSSE: Session resumption is now also supported for servers in TLS 1.2 and earlier. For this release it is disabled by default, and can be enabled by setting the boolean system property org.bouncycastle.jsse.server.enableSessionResumption to 'true'.</li>
<li>The provider RSA-PSS signature names that follow the JCA naming convention.</li>
<li>FIPS mode for the BCJSSE now enforces namedCurves for any presented certificates.</li>
<li>PGPSignatureSubpacketGenerator now supports editing of a pre-existing sub-packet list.</li>
</ul>


<a id="r1rv67"><h3>2.22.1 Version</h3></a>
Release: 1.67<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2020, November 1st.
<h3>2.22.2 Defects Fixed</h3>
<ul>
<li>BCJSSE: SunJSSE compatibility fix - override of getChannel() removed and 'urgent data' behaviour should now conform to what the SunJSSE expects.
<li>Nested BER data could sometimes cause issues in octet strings. This has been fixed.</li>
<li>Certificates/CRLs with short signatures could cause an exception in toString() in the BC X509 Certificate implmentation. This has been fixed.</li>
<li>In line with latest changes in the JVM, SignatureSpis which don't require parameters now return null on engineGetParameters().</li>
<li>The RSA KeyFactory now always preferentially produces RSAPrivateCrtKey where it can on requests for a KeySpec based on an RSAPrivateKey.</li>
<li>CMSTypedStream$FullReaderStream now handles zero length reads correctly.</li>
<li>Unecessary padding was added on KMAC when the key length was block aligned. This has been fixed.</li>
<li>Zero length data would cause an unexpected exception from RFC5649WrapEngine. This has been fixed.</li>
<li>OpenBSDBcrypt was failing to handle some valid prefixes. This has been fixed.</li>
</ul>
<h3>2.22.3 Additional Features and Functionality</h3>
<ul>
<li>Performance of Argon2 has been improved.</li>
<li>Performance of Noekeon has been improved.</li>
<li>A setSessionKeyObfuscation() method has been added to PublicKeyKeyEncryptionMethodGenerator to allow turning off of session key obfuscation (default is on, method primarily to get around early version GPG issues with AES-128 keys).</li>
<li>Implemented 'safegcd' constant-time modular inversion (as well as a variable-time variant). It has replaced Fermat inversion in all our EC code, and BigInteger.modInverse in several other places, particularly signers. This improves side-channel protection, and also gives a significant performance boost.</li>
<li>Performance of custom binary ECC curves and Edwards Curves has been improved.</li>
<li>BCJSSE: New boolean system property 'org.bouncycastle.jsse.keyManager.checkEKU' allows to disable ExtendedKeyUsage restrictions when selecting credentials (although the peer may still complain).</li>
<li>Initial support has been added for "Composite Keys and Signatures For Use In Internet PKI" using the test OID. Please note there will be further refinements to this as the draft is standardised.</li>
<li>The BC EdDSA signature API now supports keys implementing all methods on the EdECKey and XECKey interfaces directly.</li>
<li>Work has begun on classes to support the ETSI TS 103 097, Intelligent Transport Systems (ITS) in the bcpkix package.</li>
<li>Further optimization work has been done on GCM.</li>
<li>A NewHope based processor, similar to the one for Key Agreement has been added for trying to "quantum hard" KEM algorithms.</li>
<li>PGP clear signed signatures now support SHA-224.</li>
<li>Treating absent vs NULL as equivalent can now be configured by a system property. By default this is not enabled.</li>
<li>Mode name checks in Cipher strings should now make sure an improper mode name always results in a NoSuchAlgorithmException.</li>
<li>In line with changes in OpenSSL, the OpenSSLPBKDF now uses UTF-8 encoding.</li>
</ul>
<h3>2.22.4 Security Advisory</h3>
<ul>
<li>As described in CVE-2020-28052, the OpenBSDBCrypt.checkPassword() method had a flaw in it due to a change for BC 1.65. BC 1.66 is also affected. The issue is fixed in BC 1.67. If you are using OpenBSDBCrypt.checkPassword() and you are using BC 1.65 or BC 1.66 we strongly advise moving to BC 1.67 or later.</li>
</ul>

<a id="r1rv66"><h3>2.23.1 Version</h3></a>
Release: 1.66<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2020, July 4th.
<h3>2.23.2 Defects Fixed</h3>
<ul>
<li>EdDSA verifiers now reset correctly after rejecting overly long signatures.</li>
<li>BCJSSE: SSLSession.getPeerCertificateChain could throw NullPointerException. This has been fixed.</li>
<li>qTESLA-I verifier would reject some valid signatures. This has been fixed.</li>
<li>qTESLA verifiers now reject overly long signatures.</li>
<li>PGP regression caused failure to preserve existing version header when headers were reset. This has now been fixed.</li>
<li>PKIXNameConstraintValidator had a bad cast preventing use of multiple OtherName constraints. This has been fixed.</li>
<li>Serialisation of the non-CRT RSA Private Key could cause a NullPointerException. This has been fixed.</li>
<li>An extra 4 bytes was included in the start of HSS public key encodings. This has been fixed.</li>
<li>CMS with Ed448 using a direct signature was using id-shake256-len rather than id-shake256. This has been fixed.</li>
<li>Use of GCMParameterSpec could cause an AccessControlException under some circumstances. This has been fixed.</li>
<li>DTLS: Fixed high-latency HelloVerifyRequest handshakes.</li>
<li>An encoding bug for rightEncoded() in KMAC has been fixed.</li>
<li>For a few values the cSHAKE implementation would add unnecessary pad bytes where the N and S strings produced encoded data that was block aligned. This has been fixed.</li>
<li>There were a few circumstances where Argon2BytesGenerator might hit an unexpected null. These have been removed.</li>
</ul>
<h3>2.23.3 Additional Features and Functionality</h3>
<ul>
<li>The qTESLA signature algorithm has been updated to v2.8 (20191108).</li>
<li>BCJSSE: Client-side OCSP stapling now supports status_request_v2 extension.</li>
<li>Support has been added for PKIXRevocationChecker for users of Java 8 and later.</li>
<li>Support has been added for "ocsp.enable", "ocsp.responderURL" for users of Java 8 and later.</li>
<li>Support has been added for "org.bouncycastle.x509.enableCRLDP" to the PKIX validator.</li>
<li>BCJSSE: Now supports system property 'jsse.enableFFDHE'</li>
<li>BCJSSE: Now supports system properties 'jdk.tls.client.SignatureSchemes' and 'jdk.tls.server.SignatureSchemes'.</li>
<li>Multi-release support has been added for Java 11 XECKeys.</li>
<li>Multi-release support has been added for Java 15 EdECKeys.</li>
<li>The MiscPEMGenerator will now output general PrivateKeyInfo structures.</li>
<li>A new property "org.bouncycastle.pkcs8.v1_info_only" has been added to make the provider only produce version 1 PKCS8 PrivateKeyInfo structures.</li>
<li>The PKIX CertPathBuilder will now take the target certificate from the target constraints if a specific certificate is given to the selector.</li>
<li>BCJSSE: A range of ARIA and CAMELLIA cipher suites added to supported list.</li>
<li>BCJSSE: Now supports the PSS signature schemes from RFC 8446 (TLS 1.2 onwards).</li>
<li>Performance of the Base64 encoder has been improved.</li>
<li>The PGPPublicKey class will now include direct key sigantures when checking for key expiry times.</li>
</ul>
<h3>2.23.4 Notes</h3>
<p>
The qTESLA update breaks compatibility with previous versions. Private keys now include a hash of the public key at the end, and signatures are no longer interoperable with previous versions.
</p>

<a id="r1rv65"><h3>2.24.1 Version</h3></a>
Release: 1.65<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2020, March 31st.
<h3>2.24.2 Defects Fixed</h3>
<ul>
<li>DLExternal would encode using DER encoding for tagged SETs. This has been fixed.</li>
<li>ChaCha20Poly1305 could fail for large (&gt;~2GB) files. This has been fixed.</li>
<li>ChaCha20Poly1305 could fail for small updates when used via the provider. This has been fixed.</li>
<li>Properties.getPropertyValue could ignore system property when other local overrides set. This has been fixed.</li>
<li>The entropy gathering thread was not running in daemon mode, meaning there could be a delay in an application shutting down due to it. This has been fixed.</li>
<li>A recent change in Java 11 could cause an exception with the BC Provider's implementation of PSS. This has been fixed.</li>
<li>BCJSSE: TrustManager now tolerates having no trusted certificates.</li>
<li>BCJSSE: Choice of credentials and signing algorithm now respect the peer's signature_algorithms extension properly.</li>
<li>BCJSSE: KeyManager for KeyStoreBuilderParameters no longer leaks memory.</li>
</ul>
<h3>2.24.3 Additional Features and Functionality</h3>
<ul>
<li>LMS and HSS (RFC 8554) support has been added to the low level library and the PQC provider.</li>
<li>SipHash128 support has been added to the low level library and the JCE provider.</li>
<li>BCJSSE: BC API now supports explicitly specifying the session to resume.</li>
<li>BCJSSE: Ed25519, Ed448 are now supported when TLS 1.2 or higher is negotiated (except in FIPS mode).</li>
<li>BCJSSE: Added support for extended_master_secret system properties: jdk.tls.allowLegacyMasterSecret, jdk.tls.allowLegacyResumption, jdk.tls.useExtendedMasterSecret .</li>
<li>BCJSSE: KeyManager and TrustManager now check algorithm constraints for keys and certificate chains.</li>
<li>BCJSSE: KeyManager selection of server credentials now prefers matching SNI hostname (if any).</li>
<li>BCJSSE: KeyManager may now fallback to imperfect credentials (expired, SNI mismatch).</li>
<li>BCJSSE: Client-side OCSP stapling support (beta version: via status_request extension only, provides jdk.tls.client.enableStatusRequestExtension, and requires CertPathBuilder support).</li>
<li>TLS: DSA in JcaTlsCrypto now falls back to stream signing to work around NoneWithDSA limitations in default provider.</li>
</ul>

<a id="r1rv64"><h3>2.25.1 Version</h3></a>
Release: 1.64<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2019, October 7th.
<h3>2.25.2 Defects Fixed</h3>
<ul>
<li>OpenSSH: Fixed padding in generated Ed25519 private keys.</li>
<li>Validation of headers in PemReader now looks for tailing dashes in header.</li>
<li>PKIXNameConstraintValidator was throwing a NullPointerException on OtherName. This has been fixed.</li>
<li>Some compatibility issues around the signature encryption algorithm field in CMS SignedData and the GOST algorithms have been addressed.</li>
<li>GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.</li>
</ul>
<h3>2.25.3 Additional Features and Functionality</h3>
<ul>
<li>PKCS12: key stores containing only certificates can now be created without the need to provide passwords.</li>
<li>BCJSSE: Initial support for AlgorithmConstraints; protocol versions and cipher suites.</li>
<li>BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol versions and cipher suites.</li>
<li>BCJSSE: Add SecurityManager check to access session context.</li>
<li>BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.</li>
<li>BCJSSE: SSLContext algorithms updated for SunJSSE compatibility (default enabled protocols).</li>
<li>The digest functions Haraka-256 and Haraka-512 have been added to the provider and the light-weight API</li>
<li>XMSS/XMSS^MT key management now allows for allocating subsets of the private key space using the extraKeyShard() method. Use of StateAwareSignature is now deprecated.</li>
<li>Support for Java 11's NamedParameterSpec class has been added (using reflection) to the EC and EdEC KeyPairGenerator implementations.</li>
</ul>

<h3>2.25.4 Removed Features and Functionality</h3>
<ul>
<li>Deprecated ECPoint 'withCompression' tracking has been removed.</li>
</ul>

<h3>2.25.5 Security Advisory</h3>
<ul>
<li>A change to the ASN.1 parser in 1.63 introduced a regression that can cause an OutOfMemoryError to occur on parsing ASN.1 data. We recommend upgrading to 1.64, particularly where an application might be parsing untrusted ASN.1 data from third parties.</li>
</ul>

<a id="r1rv63"><h3>2.26.1 Version</h3></a>
Release: 1.63<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2019, September 10th.
<h3>2.26.2 Defects Fixed</h3>
<ul>
<li>The ASN.1 parser would throw a large object exception for some objects which could be safely parsed. This has been fixed.</li>
<li>GOST3412-2015 CTR mode was unusable at the JCE level. This has been fixed.</li>
<li>The DSTU MACs were failing to reset fully on doFinal(). This has been fixed.</li>
<li>The DSTU MACs would throw an exception if the key was a multiple of the size as the MAC's underlying buffer size. This has been fixed.</li>
<li>EdEC and QTESLA were not previously usable with the post Java 9 module structure. This is now fixed.
<li>ECNR was not correctly bounds checking the input and could produce invalid signatures. This is now fixed.</li>
<li>ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).</li>
<li>TLS: Fix X448 support in JcaTlsCrypto.</li>
<li>Fixed field reduction for secp128r1 custom curve.</li>
<li>Fixed unsigned multiplications in X448 field squaring.</li>
<li>Some issues over subset Name Constraint validation in the CertPath analyser have now been fixed.</li>
<li>TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null. This has been fixed.</li>
<li>Unnecessary memory usage in the ARGON2 implementation has been removed.</li>
<li>Param-Z in the GOST-28147 algorithm was not resolving correctly. This has been fixed.</li>
<li>It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.</li>
</ul>

<h3>2.26.3 Additional Features and Functionality</h3>
<ul>
<li>QTESLA is now updated with the round 2 changes. Note: the security catergories, and in some cases key generation and signatures, have changed. For people interested in comparison, the round 1 version is now moved to org.bouncycastle.pqc.crypto.qteslarnd1 - this package will be deleted in 1.64. Please keep in mind that QTESLA may continue to evolve.</li>
<li>Support has been added for generating Ed25519/Ed448 signed certificates.</li>
<li>A method for recovering the message/digest value from an ECNR signature has been added.</li>
<li>Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider and the lightweight API.</li>
<li>Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.</li>
<li>Improved performance for multiple ECDSA verifications using same public key.</li>
<li>Support for PBKDF2withHmacSM3 has been added to the BC provider.</li>
<li>The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a hosts name in internal MimeMessage preparation.</li>
<li>The valid path for EST services has been updated to cope with the characters used in the Aruba clearpass EST implementation.</li>
</ul>

<a id="r1rv62"><h3>2.27.1 Version</h3></a>
Release: 1.62<br/>
Date:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2019, June 3rd.
<h3>2.27.2 Defects Fixed</h3>
<ul>
<li>DTLS: Fixed infinite loop on IO exceptions.</li>
<li>DTLS: Retransmission timers now properly apply to flights monolithically.</li>