Adding upstream version 1:115.7.0.upstream/1%115.7.0upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1879 insertions, 0 deletions

diff --git a/comm/third_party/botan/news.rst b/comm/third_party/botan/news.rst
new file mode 100644
index 0000000000..7da4db1890
--- /dev/null
+++ b/comm/third_party/botan/news.rst
@@ -0,0 +1,1879 @@
+Release Notes
+========================================
+
+Version 2.18.2, 2021-10-25
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Avoid using short exponents when encrypting in ElGamal, as some PGP
+  implementations generate keys with parameters that are weak when
+  short exponents are used (GH #2794)
+
+* Fix a low risk OAEP decryption side channel (GH #2797)
+
+* Work around a miscompilation of SHA-3 caused by a bug in Clang 12
+  and XCode 13. (GH #2826)
+
+* Remove support in OpenSSL provider for algorithms which are
+  disabled by default in OpenSSL 3.0 (GH #2823, #2814)
+
+* Add CI based on GitHub actions to replace Travis CI (GH #2632)
+
+* Fix the online OCSP test, as the certificate involved had expired.
+  (GH #2799)
+
+* Fix some test failures induced by the expiration of the trust root
+  "DST Root CA X3" (GH #2820)
+
+Version 2.18.1, 2021-05-09
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Fix a build regression in 2.18.0 which caused linker flags which
+  contain ``-l`` within them (such as ``-fuse-linker-plugin``) to
+  be misinterpreted. (GH #2715)
+
+* Fix a bug which caused decoding a certificate which contained
+  more than one name in a single RDN. (GH #2611 #2630 #2724)
+
+* Fix a bug which caused OID lookup failures when run in a locale
+  which uses thousands separators (pt_BR was reported as having
+  this issue). (GH #2732 #2730 #2237)
+
+* DNS names in name constraints were compared with case sensitivity, which
+  could cause valid certificates to be rejected. (GH #2739 #2735)
+
+* X.509 name constraint extensions were rejected if non-critical. RFC 5280
+  requires conforming CAs issue such extensions as critical, but not all
+  certificates are compliant, and all other known implementations do not
+  require this. (GH #2739 #2736)
+
+* X.509 name constraints were incorrectly applied to the certificate which
+  included the constraint. (GH #2739 #2737)
+
+Version 2.18.0, 2021-04-15
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Add support for implementing custom RNG objects through the
+  FFI interface (GH #2627 #2600)
+
+* Improve safegcd bounds, improving runtime performance (GH #2628 #2619)
+
+* Fix a bug introduced in 2.9.0 where BigInt::operator< would return
+  an incorrect result if both operands were negative. (GH #2641 #2638)
+
+* Reject non-TLS messages as quickly as possible without waiting for
+  a full record. (GH #2676)
+
+* Add build support for RISC-V 32
+
+* Fixes for TLS::Stream::async_shutdown (GH #2673)
+
+* Fix a regression introduced in 2.17.0 where LDFLAGS which add an extra
+  library (such as ``-latomic`` needed on SPARC) were not always applied
+  effectively. (GH #2622 #2623 #2625)
+
+Version 2.17.3, 2020-12-21
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* CVE-2021-24115 Change base64, base58, base32, and hex encoding and
+  decoding operations to run in constant time (GH #2549)
+
+* Fix a build problem on PPC64 building with Clang (GH #2547)
+
+* Fix an install problem introduced in 2.17.2 affecting MSVC 2015
+
+* Fix use of -L flag in linking when configured using ``--with-external-libdir``
+  (GH #2496)
+
+* Fix a build problem on big-endian PowerPC related to VSX instructions
+  in the AES code. (GH #2515)
+
+Version 2.17.2, 2020-11-13
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Fix an build problem on ppc64 introduced with certain recent
+  versions of GCC or binutils where using the DARN instruction
+  requires using an appropriate -mcpu flag to enable the instruction
+  in the assembler. (GH #2481 2463)
+
+* Resolve an issue in the modular square root algorithm where a loop
+  to find a quadratic non-residue could, for a carefully chosen
+  composite modulus, not terminate in a timely manner. (GH #2482 #2476)
+
+* Fix a regression in MinGW builds introduced in 2.17.1
+
+Version 2.17.1, 2020-11-07
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Fix a build problem that could occur if Python was not in the PATH.
+  This was known to occur on some installations of macOS.
+
+* Re-enable support for the x86 CLMUL instruction on Visual C++, which was
+  accidentally disabled starting in 2.12.0. (GH #2460)
+
+Version 2.17.0, 2020-11-05
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Fix a bug in ECDSA which could occur when the group size and hash length
+  differ. In this case, on occasion the generated signature would not be
+  accepted by other ECDSA implementations. This was particularly likely to
+  affect users of 160-bit or 239-bit curves. (GH #2433 #2415)
+
+* Fix a bug in ECDSA verification when the public key was chosen to be
+  a small multiple of the group generator. In that case, verification
+  would fail even if the signature was actually valid. (GH #2425)
+
+* SIV's functionality of supporting multiple associated data inputs has been
+  generalized onto the AEAD_Mode interface. However at the moment SIV is the
+  only AEAD implemented which supports more than one AD. (GH #2440)
+
+* The contents of ASN.1 headers ``asn1_str.h``, ``asn1_time.h``, ``asn1_oid.h``
+  and ``alg_id.h`` have been moved to ``asn1_obj.h``. The header files remain
+  but simply forward the include to ``asn1_obj.h``. These now-empty header files
+  are deprecated, and will be removed in a future major release. (GH #2441)
+
+* The contents of X.509/PKIX headers ``asn1_attribute.h`` ``asn1_alt_name.h``
+  ``name_constraint.h`` ``x509_dn.h`` ``cert_status.h`` and ``key_constraint.h``
+  have been merged into ``pkix_enums.h`` (for enumerations) and ``pkix_types.h``
+  (for all other definitions). The previous header files remain but simply
+  forward the include to the new header containing the definition. These
+  now-empty header files are deprecated, and will be removed in a future major
+  release. (GH #2441)
+
+* A number of other headers including those related to HOTP/TOTP, XMSS,
+  PKCS11, PSK_DB have also been merged. Any now deprecated/empty headers
+  simply include the new header and issue a deprecation warning.
+  (GH #2443 #2446 #2447 2448 #2449)
+
+* Small optimizations in the non-hardware assisted AES key generation
+  code path (GH #2417 #2418)
+
+* Move the GHASH code to a new module in utils, making it possible
+  to build GMAC support without requiring GCM (GH #2416)
+
+* Add more detection logic for AVX-512 features (GH #2430)
+
+* Avoid std::is_pod which is deprecated in C++20 (GH #2429)
+
+* Fix a bug parsing deeply nested cipher names (GH #2426)
+
+* Add support for ``aarch64_be`` target CPU (GH #2422)
+
+* Fix order of linker flags so they are always applied effectively (GH #2420)
+
+* Prevent requesting DER encoding of signatures when the algorithm
+  did not support it (GH #2419)
+
+Version 2.16.0, 2020-10-06
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Now userspace PRNG objects (such as AutoSeeded_RNG and HMAC_DRBG)
+  use an internal lock, which allows safe concurrent use. This however
+  is purely a precaution in case of accidental sharing of such RNG
+  objects; for performance reasons it is always preferable to use
+  a RNG per thread if a userspace RNG is needed. (GH #2399)
+
+* DL_Group and EC_Group objects now track if they were created from a
+  known trusted group (such as P-256 or an IPsec DH parameter).  If
+  so, then verification tests can be relaxed, as compared to
+  parameters which may have been maliciously constructed in order to
+  pass primality checks. (GH #2409)
+
+* RandomNumberGenerator::add_entropy_T assumed its input was a POD
+  type but did not verify this. (GH #2403)
+
+* Support OCSP responders that live on a non-standard port (GH #2401)
+
+* Add support for Solaris sandbox (GH #2385)
+
+* Support suffixes on release numbers for alpha/beta releases (GH #2404)
+
+* Fix a bug in EAX which allowed requesting a 0 length tag, which had
+  the effect of using a full length tag. Instead omit the length field,
+  or request the full tag length explicitly. (GH #2392 #2390)
+
+* Fix a memory leak in GCM where if passed an unsuitable block cipher
+  (eg not 128 bit) it would throw an exception and leak the cipher
+  object. (GH #2392 #2388)
+
+Version 2.15.0, 2020-07-07
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Fix a bug where the name constraint extension did not constrain the
+  alternative DN field which can be included in a subject alternative name. This
+  would allow a corrupted sub-CA which was otherwise constrained by a name
+  constraint to issue a certificate with a prohibited DN.
+
+* Fix a bug in the TLS server during client authentication where where
+  if a (disabled by default) static RSA ciphersuite was selected, then
+  no certificate request would be sent. This would have an equivalent
+  effect to a client which simply replied with an empty Certificate
+  message. (GH #2367)
+
+* Replace the T-Tables implementation of AES with a 32-bit bitsliced
+  version. As a result AES is now constant time on all processors.
+  (GH #2346 #2348 #2353 #2329 #2355)
+
+* In TLS, enforce that the key usage given in the server certificate
+  allows the operation being performed in the ciphersuite. (GH #2367)
+
+* In X.509 certificates, verify that the algorithm parameters are
+  the expected NULL or empty. (GH #2367)
+
+* Change the HMAC key schedule to attempt to reduce the information
+  leaked from the key schedule with regards to the length of the key,
+  as this is at times (as for example in PBKDF2) sensitive information.
+  (GH #2362)
+
+* Add Processor_RNG which wraps RDRAND or the POWER DARN RNG
+  instructions. The previous RDRAND_RNG interface is deprecated.
+  (GH #2352)
+
+* The documentation claimed that mlocked pages were created with a
+  guard page both before and after. However only a trailing guard page
+  was used. Add a leading guard page. (GH #2334)
+
+* Add support for generating and verifying DER-encoded ECDSA signatures
+  in the C and Python interfaces. (GH #2357 #2356)
+
+* Workaround a bug in GCC's UbSan which triggered on a code sequence
+  in XMSS (GH #2322)
+
+* When building documentation using Sphinx avoid parallel builds with
+  version 3.0 due to a bug in that version (GH #2326 #2324)
+
+* Fix a memory leak in the CommonCrypto block cipher calls (GH #2371)
+
+* Fix a flaky test that would occasionally fail when running the tests
+  with a large number of threads. (GH #2325 #2197)
+
+* Additional algorithms are now deprecated: XTEA, GOST, and Tiger.
+  They will be removed in a future major release.
+
+Version 2.14.0, 2020-04-06
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Add support for using POWER8+ VPSUMD instruction to accelerate GCM
+  (GH #2247)
+
+* Optimize the vector permute AES implementation, especially improving
+  performance on ARMv7, Aarch64, and POWER. (GH #2243)
+
+* Use a new algorithm for modular inversions which is both faster and
+  more resistant to side channel attacks. (GH #2287 #2296 #2301)
+
+* Address an issue in CBC padding which would leak the length of the
+  plaintext which was being padded. Unpadding during decryption was
+  not affected. Thanks to Maximilian Blochberger for reporting this.
+  (GH #2312)
+
+* Optimize NIST prime field reductions, improving ECDSA by 3-9% (GH #2295)
+
+* Increase the size of the ECC blinding mask and scale it based on the
+  size of the group order. (GH #880 #893 #2308)
+
+* Add server side support for the TLS asio wrapper. (GH #2229)
+
+* Add support for using Windows certificate store on MinGW (GH #2280)
+
+* Use the library thread pool instead of a new thread for RSA computations,
+  improving signature performance by up to 20%. (GH #2257)
+
+* Precompute and cache additional fields in ``X509_Certificate`` (GH #2250)
+
+* Add a CLI utility ``cpu_clock`` which estimates the speed of the
+  processor cycle counter. (GH #2251)
+
+* Fix a bug which prevented using DER-encoded ECDSA signatures with a PKCS11
+  key (GH #2293)
+
+* Enable use of raw block ciphers from CommonCrypto (GH #2278)
+
+* Support for splitting up the amalgamation file by ABI extension has
+  been removed. Instead only ``botan_all.cpp`` and ``botan_all.h`` are
+  generated. (GH #2246)
+
+* Improve support for baremetal systems with no underlying OS, with
+  target OS ``none`` (GH #2303 #2304 #2305)
+
+* The build system now avoids using ``-rpath=$ORIGIN`` or (on macOS)
+  install_name which allowed running the tests from the build
+  directory without setting ``LD_LIBRARY_PATH``/``DYLD_LIBRARY_PATH``
+  environment variables. Instead set the dynamic linker variables
+  appropriately, or use ``make check``. (GH #2294 #2302)
+
+* Add new option ``--name-amalgamation`` which allows naming the
+  amalgamation output, instead of the default ``botan_all``. (GH #2246)
+
+* Avoid using symbolic links on Windows (GH #2288 #2286 #2285)
+
+* Fix a bug that prevented compilation of the amalgamation on ARM and
+  POWER processors (GH #2245 #2241)
+
+* Fix some build problems under Intel C++ (GH #2260)
+
+* Remove use of Toolhelp Windows library, which was known to trigger
+  false positives under some antivirus systems. (GH #2261)
+
+* Fix a compilation problem when building on Windows in Unicode mode.
+  Add Unicode build to CI to prevent regressions. (GH #2254 #2256)
+
+* Work around a GCC bug affecting old libc (GH #2235)
+
+* Workaround a bug in macOS 10.15 which caused a test to crash.
+  (GH #2279 #2268)
+
+* Avoid a crash in PKCS8::load_key due to a bug in Clang 8.
+  (GH #2277)
+
+Version 2.13.0, 2020-01-06
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Add Roughtime client (GH #2143 #1842)
+
+* Add support for XMSS X.509 certificates (GH #2172)
+
+* Add support for X.509 CRLs in FFI layer and Python wrapper (GH #2213)
+
+* It is now possible to disable TLS v1.0/v1.1 and DTLS v1.0 at build time.
+  (GH #2188)
+
+* The format of encrypted TLS sessions has changed, which will invalidate all
+  existing session tickets. The new format will make it easier to support ticket
+  key rotation in the future. (GH #2225)
+
+* Improve RSA key generation performance (GH #2148)
+
+* Make gcd computation constant-time (GH #2147)
+
+* Add AVX2 implementation of SHACAL2 (GH #2196)
+
+* Update BSI policy to reflect 2019 update of TR 02102-2 (GH #2195)
+
+* Support more functionality for X.509 in the Python API (GH #2165)
+
+* Add ``generic`` CPU target useful when building for some new or unusual
+  platform.
+
+* Disable MD5 in BSI or NIST modes (GH #2188)
+
+* Disable stack protector on MinGW as it causes crashes with some recent
+  versions. (GH #2187)
+
+* On Windows the DLL is now installed into the binary directory (GH #2233)
+
+* Previously Windows required an explicit ``.lib`` suffix be added when
+  providing an explicit library name, as is used for example for Boost.
+  Now the ``.lib`` suffix is implicit, and should be omitted.
+
+* Remove the 32-bit x86 inline asm for Visual C++ as it seemed to not offer
+  much in the way of improved performance. (GH #2204 #256)
+
+* Resolve all compile time warnings generated by GCC, Clang and MSVC.
+  Modify CI to compile with warnings-as-errors. (GH #2170 #2206 #2211 #2212)
+
+* Fix bugs linking to 3rd party libraries on Windows due to invalid
+  link specifiers. (GH #2210 #2215)
+
+* Add long input and NIST Monte-Carlo hash function tests.
+
+* Fix a bug introduced in 2.12.0 where ``TLS::Channel::is_active`` and
+  ``TLS::Channel::is_closed`` could simultaneously return true.
+  (GH #2174 #2171)
+
+* Use ``std::shared_ptr`` instead of ``boost::shared_ptr`` in some examples.
+  (GH #2155)
+
+Version 2.12.1, 2019-10-14
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Fix a bug that prevented building with nmake (GH #2142 #2141)
+
+* Fix an issue where make install would attempt to build targets which
+  were disabled. (GH #2140)
+
+* If the option ``--without-documentation`` is used, avoid invoking the
+  documentation build script. (GH #2138)
+
+* Fix a bug that prevented compilation on x86-32 using GCC 4.9 (GH #2139)
+
+* Fix a bug in CCM encryption, where it was possible to call ``finish`` without
+  ever setting a nonce (GH #2151 #2150)
+
+* Improve ECIES/DLIES interfaces. If no initialization vector was set, they
+  would typically produce hard to understand exceptions. (GH #2151 #2150)
+
+Version 2.12.0, 2019-10-07
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Many currently public headers are being deprecated. If any such header is
+  included by an application, a warning is issued at compile time. Headers
+  issuing this warning will be made internal in a future major release.
+  (GH #2061)
+
+* RSA signature performance improvements (GH #2068 #2070)
+
+* Performance improvements for GCM (GH #2024 #2099 #2119), OCB (#2122),
+  XTS (#2123) and ChaCha20Poly1305 (GH #2117), especially for small messages.
+
+* Add support for constant time AES using NEON and AltiVec (GH #2093 #2095 #2100)
+
+* Improve performance of POWER8 AES instructions (GH #2096)
+
+* Add support for the POWER9 hardware random number generator (GH #2026)
+
+* Add support for 64-bit version of RDRAND, doubling performance on x86-64 (GH #934 #2022)
+
+* In DTLS server, support a client crashing and then reconnecting from
+  the same source port, as described in RFC 6347 sec 4.2.8 (GH #2029)
+
+* Optimize DTLS MTU splitting to split precisely to the set MTU (GH #2042)
+
+* Add support for the TLS v1.3 downgrade indicator. (GH #2027)
+
+* Improve the error messages generated when an invalid TLS state transition occurs
+  (GH #2030)
+
+* Fix some edge cases around TLS close_notify support. (GH #2054)
+
+* Modifications to support GOST 34.10-2012 signatures (GH #2055 #2056 #1860 #1897)
+
+* Add some new APIs on ``OID`` objects (GH #2057)
+
+* Properly decode OCSP responses which indicate an error (GH #2110)
+
+* Add a function to remove an X.509 extension from an Extensions object.
+  (GH #2101 #2073 #2065)
+
+* Support Argon2 outputs longer than 64 bytes (GH #2079 #2078)
+
+* Correct a bug in CAST-128 which caused incorrect computation using
+  11, 13, 14, or 15 byte keys. (GH #2081)
+
+* Fix a bug which would cause Streebog to produce incorrect outputs for
+  certain messages (GH #2082 #2083)
+
+* Fix a bug that prevented loading EC points with an affine x or y
+  value of 0. For certain curves such points can exist. (GH #2102)
+
+* Fix a bug which would cause PBKDF2 to go into a very long loop if
+  it was requested to use an iteration count of 0. (GH #2090 #2088)
+
+* The BearSSL provider has been removed (GH #2020)
+
+* Add a new ``entropy`` cli which allows sampling the output of the entropy sources.
+
+* Add new ``base32_enc`` and ``base32_dec`` cli for base32 encoding operations. (GH #2111)
+
+* Support setting TLS policies in CLIs like ``tls_client`` and ``tls_proxy_server`` (GH #2047)
+
+* The tests now run in multithreaded mode by default. Provide option ``--test-threads=1`` to
+  return to previous single-threaded behavior. (GH #2071 #2075)
+
+* Cleanups in TLS record layer (GH #2021)
+
+* Fix typos in some OCSP enums which used "OSCP" instead. (GH #2048)
+
+* In the Python module, avoid trying to load DLLs for names that don't match the current
+  platform (GH #2062 #2059)
+
+* In the Python module, also look for ``botan.dll`` so Python wrapper can run on Windows.
+  (GH #2059 #2060)
+
+* Add support for TOTP algorithm to the Python module. (GH #2112)
+
+* Now the minimum Windows target is set to Windows 7 (GH #2036 #2028)
+
+* Add ``BOTAN_FORCE_INLINE`` macro to resolve a performance issue with BLAKE2b on MSVC
+  (GH #2092 #2089)
+
+* Avoid using ``__GNUG__`` in headers that may be consumed by a C compiler (GH #2013)
+
+* Improve the PKCS11 tests (GH #2115)
+
+* Fix a warning from Klocwork (GH #2128 #2129)
+
+* Fix a bug which caused amalgamation builds to fail on iOS (GH #2045)
+
+* Support disabling thread local storage, needed for building on old iOS (GH #2045)
+
+* Add a script to help with building for Android, using Docker (GH #2016 #2033 #513)
+
+* Add Android NDK build to Travis CI (GH #2017)
+
+Version 2.11.0, 2019-07-01
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Add Argon2 PBKDF and password hash (GH #459 #1981 #1987)
+
+* Add Bcrypt-PBKDF (GH #1990)
+
+* Add a libsodium compat layer in sodium.h (GH #1996)
+
+* XMSS now follows RFC 8391 which is incompatible with previous versions, which
+  had followed draft 6. (GH #1858 #2003)
+
+* Add server side support for issuing DTLS HelloVerifyRequest messages
+  (GH #1999)
+
+* Add a shim allowing testing Botan against the BoringSSL test suite,
+  and fix a number of bugs in TLS found using it.
+  (GH #1954 #1955 #1956 #1959 #1966 #1970)
+
+* Add support for the TLS v1.3 supported_versions extension. (GH #1976)
+
+* Add Ed25519ph compatible with RFC 8032 (GH #1699 #2000)
+
+* Add support for OCSP stapling on server side. (GH #1703 #1967)
+
+* Add a ``boost::asio`` TLS stream compatible with ``boost::asio::ssl``.
+  (GH #1839 #1927 #1992)
+
+* Add a certificate store for Linux/Unix systems. (GH #1885 #1936)
+
+* Add a certificate store for Windows systems. (GH #1931)
+
+* Add a generic ``System_Certificate_Store`` which wraps Windows, macOS,
+  and Linux certificate stores. (GH #1893)
+
+* Fix verification rooted in a v1 certificate which previously would fail.
+  (GH #1890)
+
+* Add ability to specify the maximum age of an OCSP response which does not
+  have the nextUpdate field set. (GH #1974 #1995)
+
+* Fix X509_DN::operator< which could erroneously return true in both
+  directions (ie, DN1 < DN2 && DN2 < DN1). This would break STL
+  containers using a DN as the key. (GH #1938)
+
+* It is now possible to create intermediate CA certificates using the
+  command line interface. (GH #1879 #1889)
+
+* Add a new build time option to set where the system stores trusted
+  certificates. (GH #1888)
+
+* New ``trust_roots`` CLI that examines the system certificate store.
+  (GH #1893)
+
+* Fix bugs and add many new features in the Python wrapper.
+  (GH #1899 #1900 #1901 #1902 #1903 #1904 #1906 #1907 #1915)
+
+* Various FFI interfaces which are redundant with other APIs are now
+  deprecated. The deprecation message suggests the alternate API to use.
+  (GH #1915)
+
+* Fix decoding of RSA-OAEP certificates. (GH #1943 #1944)
+
+* Allow setting multiple organization unit fields in a certificate or
+  certificate request. (GH #1939)
+
+* Increase the maximum allowed year in ASN1_Time to 3100. This works
+  around a problem parsing certs in AppVeyor's trust store.
+
+* Add ``--format`` option to ``rng`` CLI command allowing to format
+  as base64, base58 or binary in addition to hex. (GH #1945)
+
+* Remove use of table lookups for IP/FP transforms in DES (GH #1928)
+
+* Improve the tests for SRP6 (GH #1917 #1923)
+
+* Document the build system
+
+* When available use POSIX ``sysconf`` to detect the number of CPUs (GH #1877)
+
+* Add functionality to handle Boost naming conventions on different platforms,
+  especially affecting Windows. Enable Boost in AppVeyor builds. (GH #1964)
+
+* Add alternate implementation of ``getauxval`` for older Android (GH #1962)
+
+* Add ``configure.py`` option allowing to set arbitrary macros during build.
+  (GH #1960)
+
+* Use FreeBSD's ``elf_aux_info`` to detect ARM and POWER CPU features
+  (GH #1895)
+
+* Use FreeBSD's ``PROT_MAX`` to prevent mmap regions from being made executable
+  later. (GH #2001)
+
+* Fix a memory leak in the tests (GH #1886)
+
+* Fix an issue building with the new Boost 1.70 (GH #1881 #1880)
+
+* Fix an issue with UbSan in the tests (GH #1892)
+
+* Remove use of ``-mabi`` flag when building on MIPS64 (GH #1918)
+
+* Make it possible to specify additional libraries in ``LDFLAGS`` (GH #1916)
+
+* Fix some warnings from Clang 8 (GH #1941)
+
+* Fix the makefile .PHONY syntax (GH #1874)
+
+* Fix build issue with SoftHSM 2.5.0 (GH #1986)
+
+Version 2.10.0, 2019-03-30
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Notice: the developers plan to switch from gzip to xz compression for
+  releases starting in 2.11. If this is a problem please comment at
+  https://github.com/randombit/botan/issues/1872
+
+* Warning: XMSS currently implements draft-06 which is not compatible with the
+  final RFC 8391 specification. A PR is open to fix this, however it will break
+  all current uses of XMSS. If you are currently using XMSS please comment at
+  https://github.com/randombit/botan/pull/1858. Otherwise the PR will be merged
+  and support for draft-06 will be removed starting in 2.11.
+
+* Added a new certificate store implementation that can access the
+  MacOS keychain certificate store. (GH #1830)
+
+* Redesigned ``Memory_Pool`` class, which services allocations out of a
+  set of pages locked into memory (using ``mlock``/``VirtualLock``). It is now
+  faster and with improved exploit mitigations. (GH #1800)
+
+* Add BMI2 implementations of SHA-512 and SHA-3 which improve performance by
+  25-35% on common CPUs. (GH #1815)
+
+* Unroll SHA-3 computation improving performance by 10-12% (GH #1838)
+
+* Add a ``Thread_Pool`` class. It is now possible to run the tests in multiple
+  threads with ``--test-threads=N`` flag to select the number of threads to use.
+  Use ``--test-threads=0`` to run with as many CPU cores as are available on the
+  current system. The default remains single threaded. (GH #1819)
+
+* XMSS signatures now uses a global thread pool instead of spawning new threads
+  for each usage. This improves signature generation performance by between 10%
+  and 60% depending on architecture and core count. (GH #1864)
+
+* Some functions related to encoding and decoding BigInts have been deprecated.
+  (GH #1817)
+
+* Binary encoding and decoding of BigInts has been optimized by performing
+  word-size operations when possible. (GH #1817)
+
+* Rename the exception ``Integrity_Failure`` to ``Invalid_Authentication_Tag`` to make
+  its meaning and usage more clear. The old name remains as a typedef. (GH #1816)
+
+* Support for using Boost ``filesystem`` and MSVC's ``std::filesystem`` have been
+  removed, since already POSIX and Win32 versions had to be maintained for
+  portability. (GH #1814)
+
+* Newly generated McEliece and XMSS keys now default to being encrypted using
+  SIV mode, support for which was added in 2.8.0. Previously GCM was used by
+  default for these algorithms.
+
+* Use ``arc4random`` on Android systems (GH #1851)
+
+* Fix the encoding of PGP-S2K iteration counts (GH #1853 #1854)
+
+* Add a facility for sandboxing the command line util. Currently FreeBSD
+  (Capsicum) and OpenBSD (``pledge``) sandboxes are supported. (GH #1808)
+
+* Use ``if constexpr`` when available.
+
+* Disable building shared libs on iOS as it was broken and it is not clear shared
+  libraries are ever useful on iOS (GH #1865)
+
+* Renamed the ``darwin`` build target to ``macos``. This should not cause any
+  user-visible change. (GH #1866)
+
+* Add support for using ``sccache`` to cache the Windows CI build (GH #1807)
+
+* Add ``--extra-cxxflags`` option which allows adding compilation flags without
+  overriding the default set. (GH #1826)
+
+* Add ``--format=`` option to the ``hash`` cli which allows formatting the output
+  as base64 or base58, default output remains hex.
+
+* Add ``base58_enc`` and ``base58_dec`` cli utils for base58 encoding/decoding.
+  (GH #1848)
+
+* Enable ``getentropy`` by default on macOS (GH #1862)
+
+* Avoid using ``-momit-leaf-frame-pointer`` flags, since ``-fomit-frame-pointer``
+  is already the default with recent versions of GCC.
+
+* Fix XLC sanitizer flags.
+
+* Rename ``Blake2b`` class to ``BLAKE2b`` to match the official name. There is
+  a typedef for compat.
+
+* Fix a bug where loading a raw ``Ed25519_PublicKey`` of incorrect length would
+  lead to a crash. (GH #1850)
+
+* Fix a bug that caused compilation problems using CryptoNG PRNG. (GH #1832)
+
+* Extended SHAKE-128 cipher to support any key between 1 and 160 bytes, instead
+  of only multiples of 8 bytes.
+
+* Minor HMAC optimizations.
+
+* Build fixes for GNU/Hurd.
+
+* Fix a bug that prevented generating or verifying Ed25519 signatures in the CLI
+  (GH #1828 #1829)
+
+* Fix a compilation error when building the amalgamation outside of the original
+  source directory when AVX2 was enabled. (GH #1812)
+
+* Fix a crash when creating the amalgamation if a header file was edited on
+  Windows but then the amalgamation was built on Linux (GH #1763)
+
+Version 2.9.0, 2019-01-04
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* CVE-2018-20187 Address a side channel during ECC key generation,
+  which used an unblinded Montgomery ladder. As a result, a timing
+  attack can reveal information about the high bits of the secret key.
+
+* Fix bugs in TLS which caused negotiation failures when the client
+  used an unknown signature algorithm or version (GH #1711 #1709 #1708)
+
+* Fix bug affecting GCM, EAX and ChaCha20Poly1305 where if the associated data
+  was set after starting a message, the new AD was not reflected in the produced
+  tag. Now with these modes setting an AD after beginning a message throws an
+  exception.
+
+* Use a smaller sieve which improves performance of prime generation.
+
+* Fixed a bug that caused ChaCha to produce incorrect output after encrypting
+  256 GB. (GH #1728)
+
+* Add NEON and AltiVec implementations of ChaCha (GH #1719 #1728 #1729)
+
+* Optimize AVX2 ChaCha (GH #1730)
+
+* Many more operations in BigInt, ECC and RSA code paths are either fully const time
+  or avoid problematic branches that could potentially be exploited in a side
+  channel attack. (GH #1738 #1750 #1754 #1755 #1757 #1758 #1759 #1762 #1765
+  #1770 #1773 #1774 #1779 #1780 #1794 #1795 #1796 #1797)
+
+* Several optimizations for BigInt and ECC, improving ECDSA performance by as
+  much as 30%. (GH #1734 #1737 #1777 #1750 #1737 #1788)
+
+* Support recovering an ECDSA public key from a message/signature pair (GH #664 #1784)
+
+* Add base58 encoding/decoding functions (GH #1783)
+
+* In the command line interface, add support for reading passphrases from the
+  terminal with echo disabled (GH #1756)
+
+* Add ``CT::Mask`` type to simplify const-time programming (GH #1751)
+
+* Add new configure options ``--disable-bmi2``, ``--disable-rdrand``,
+  and ``--disable-rdseed`` to prevent use of those instruction sets.
+
+* Add ``error_type`` and ``error_code`` functions to Exception type (GH #1744)
+
+* Now on POSIX systems ``posix_memalign`` is used instead of ``mmap`` for
+  allocating the page-locked memory pool. This avoids issues with ``fork``.
+  (GH #602 #1798)
+
+* When available, use RDRAND to generate the additional data in
+  ``Stateful_RNG::randomize_with_ts_input``
+
+* Use vzeroall/vzeroupper intrinsics to avoid AVX2/SSE transition penalties.
+
+* Support for Visual C++ 2013 has been removed (GH #1557 #1697)
+
+* Resolve a memory leak when verifying ECDSA signatures with versions
+  of OpenSSL before 1.1.0 (GH #1698)
+
+* Resolve a memory leak using ECDH via OpenSSL (GH #1767)
+
+* Fix an error in XTS which prohibited encrypting values which were
+  exactly the same length as the underlying block size. Messages of
+  this size are allowed by the standard and other XTS implementations.
+  (GH #1706)
+
+* Resolve a bug in TSS which resulted in it using an incorrect length
+  field in the shares. Now the correct length is encoded, but either
+  correct or buggy lengths are accepted when decoding. (GH #1722)
+
+* Correct a bug when reducing a negative ``BigInt`` modulo a small power of 2.
+  (GH #1755)
+
+* Add CLI utils for threshold secret splitting. (GH #1722)
+
+* Fix a bug introduced in 2.8.0 that caused compilation failure if using
+  a single amalgamation file with AVX2 enabled. (GH #1700)
+
+* Add an explicit OS target for Emscripten and improve support for it.
+  (GH #1702)
+
+* Fix small issues when building for QNX
+
+* Switch the Travis CI build to using Ubuntu 16.04 (GH #1767)
+
+* Add options to ``configure.py`` to disable generation of ``pkg-config``
+  file, and (for systems where ``pkg-config`` support defaults to off,
+  like Windows), to enable generating it. (GH #1268)
+
+* Modify ``configure.py`` to accept empty lists or trailing/extra commas.
+  (GH #1705)
+
+Version 2.8.0, 2018-10-01
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Add support for using Apple CommonCrypto library for hashing (GH #1667),
+  cipher modes (GH #1674) and block ciphers (GH #1673).
+
+* Support for negotiating TLS versions 1.0 and 1.1 is disabled in the default
+  TLS policy. In addition, support for negotiating TLS ciphersuites using CBC or
+  CCM mode is disabled by default. Applications which need to interop with old
+  peers must enable these in their TLS policy object. (GH #1651)
+
+* During primality testing, use a Lucas test in addition to Miller-Rabin. It is
+  possible to construct a composite integer which passes n Miller-Rabin tests
+  with probability (1/4)^n. So for a incautious verifier using a small number
+  of tests (under 16 or so) it is possible if unlikely they would accept such a
+  composite as prime. Adding a Lucas test precludes such an attack. (GH #1636)
+
+* Add XChaCha and XChaCha20Poly1305 (GH #1640)
+
+* Add AVX2 implementations of ChaCha (GH #1662) and Serpent (GH #1660)
+
+* Add a new password hashing interface in pwdhash.h (GH #1670)
+
+* C binding improvements. Added functions to get name and supported
+  keylengths of cipher, hash and MAC objects, support for FE1 format
+  preserving encryption (GH #1625 #1646), functions to load and save
+  RSA keys in PKCS #1 format (GH #1621), HOTP and TOTP algorithms,
+  scrypt, certificate verification (GH #1647), functions to get the
+  output length of public key operations (GH #1642), and functions for
+  loading and serializing X25519 keys (GH #1681)
+
+* Support for building with BOTAN_MP_WORD_BITS set to 8 or 16 has been removed.
+
+* Previously SM2 had two distinct key types, one for signatures and another for
+  encryption. They have now been merged into a single key type since in practice
+  it seems the same key is at times used for both operations. (GH #1637)
+
+* The ``Cipher_Mode`` class now derives from ``SymmetricAlgorithm`` (GH #1639)
+
+* Add support for using the ARMv8 instructions for SM4 encryption (GH #1622)
+
+* The entropy source using ``SecRandomCopyBytes`` has been removed as it was
+  redundant with other entropy sources (GH #1668)
+
+* The Python module has much better error checking and reporting, and offers new
+  functionality such as scrypt, MPI and FPE. (GH #1643 #1646)
+
+* Fixed a bug that caused CCM to fail with an exception when used with L=8
+  (GH #1631 #1632)
+
+* The default bcrypt work factor has been increased from 10 to 12.
+
+* The default algorithm used in passhash9 has changed from SHA-256 to SHA-512,
+  and the default work factor increased from 10 to 15.
+
+* In ECC private keys, include the public key data for compatibility with
+  GnuTLS (GH #1634 #1635)
+
+* Add support for using Linux ``getrandom`` syscall to access the system PRNG.
+  This is disabled by default, use ``--with-os-feature=getrandom`` to enable.
+
+* It is now possible to encrypt private keys using SIV mode.
+
+* The FFI function botan_privkey_load now ignores its rng argument.
+
+* Resolve a problem when building under Visual C++ 15.8 (GH #1624)
+
+* Fix a bug in XSalsa20 (192-bit Salsa nonces) where if set_iv was called twice
+  without calling set_key, the resulting encryption was incorrect. (GH #1640)
+
+* Handle an error seen when verifying invalid ECDSA signatures using LibreSSL
+  on non x86-64 platforms (GH #1627 #1628)
+
+* Fix bugs in PKCS7 and X9.23 CBC padding schemes, which would ignore
+  the first byte in the event the padding took up the entire block. (GH #1690)
+
+* Correct bugs which would cause CFB, OCB, and GCM modes to crash when they
+  were used in an unkeyed state. (GH #1639)
+
+* Optimizations for SM4 and Poly1305
+
+* Avoid a cache side channel in the AES key schedule
+
+* Add ``pk_encrypt`` and ``pk_decrypt`` CLI operations
+
+* Now ``asn1print`` CLI defaults to printing context-specific fields.
+
+* Use codec_base for Base64, which matches how Base32 is implemented (GH #1597)
+
+* The ``cast`` module has been split up into ``cast128`` and ``cast256`` (GH #1685)
+
+* When building under Visual C++ 2013, the user must acknowledge the upcoming
+  removal of support using the configure.py flag ``--ack-vc2013-deprecated``
+  (GH #1557)
+
+Version 2.7.0, 2018-07-02
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* CVE-2018-12435 Avoid a side channel in ECDSA signature generation (GH #1604)
+
+* Avoid a side channel in RSA key generation due to use of a non-constant time
+  gcd algorithm. (GH #1542 #1556)
+
+* Optimize prime generation, especially improving RSA key generation. (GH #1542)
+
+* Make Karatsuba multiplication, Montgomery field operations, Barrett reduction
+  and Montgomery exponentiation const time (GH #1540 #1606 #1609 #1610)
+
+* Optimizations for elliptic curve operations especially improving reductions
+  and inversions modulo NIST primes (GH #1534 #1538 #1545 #1546 #1547 #1550)
+
+* Add 24 word wide Comba multiplication, improving 3072-bit RSA and DH by ~25%.
+  (GH #1564)
+
+* Unroll Montgomery reduction for specific sizes (GH #1603)
+
+* Improved performance of signature verification in ECGDSA, ECKCDSA,
+  SM2 and GOST by 10-15%.
+
+* XMSS optimizations (GH #1583 #1585)
+
+* Fix an error that meant XMSS would only sign half as many signatures as is
+  allowed (GH #1582)
+
+* Add support for base32 encoding/decoding (GH #1541)
+
+* Add BMI2 optimized version of SHA-256, 40% faster on Skylake (GH #1584)
+
+* Allow the year to be up to 2200 in ASN.1 time objects. Previously this
+  was limited to 2100. (GH #1536)
+
+* Add support for Scrypt password hashing (GH #1570)
+
+* Add support for using Scrypt for private key encryption (GH #1574)
+
+* Optimizations for DES/3DES, approx 50% faster when used in certain modes such
+  as CBC decrypt or CTR.
+
+* XMSS signature verification did not check that the signature was of
+  the expected length which could lead to a crash. (GH #1537)
+
+* The bcrypt variants 2b and 2y are now supported.
+
+* Support for 192-bit Suite B TLS profile is now implemented, as the 128-bit
+  Suite B is since 2015 not allowed anymore.
+
+* Previously botan allowed GCM to be used with an empty nonce, which is not
+  allowed by the specification. Now such nonces are rejected.
+
+* Avoid problems on Windows when compiling in Unicode mode (GH #1615 #1616)
+
+* Previously for ASN.1 encoded signatures (eg ECDSA) Botan would accept any
+  valid BER encoding. Now only the single valid DER encoding is accepted.
+
+* Correct an error that could in rare cases cause an internal error exception
+  when doing computations with the P-224 curve.
+
+* Optimizations to reduce allocations/copies during DER encoding and BER
+  decoding (GH #1571 #1572 #1600)
+
+* Botan generates X.509 subject key IDs by hashing the public key with whatever
+  hash function is being used to sign the certificate. However especially for
+  SHA-512 this caused SKIDs that were far longer than necessary. Now all SKIDs
+  are truncated to 192 bits.
+
+* In the test suite use ``mkstemp`` to create temporary files instead of
+  creating them in the current working directory. (GH #1533 #1530)
+
+* It is now possible to safely override ``CXX`` when invoking make in addition
+  to when ``configure.py`` is run. (GH #1579)
+
+* OIDs for Camellia and SM4 in CBC and GCM mode are now defined, making it
+  possible to use this algorithms for private key encryption.
+
+* Avoid creating symlinks to the shared object on OpenBSD (#1535)
+
+* The ``factor`` command runs much faster on larger inputs now.
+
+* Support for Windows Phone/UWP was deprecated starting in 2.5. This deprecation
+  has been reversed as it seems UWP is still actively used. (GH #1586 #1587)
+
+* Support for Visual C++ 2013 is deprecated, and will be removed in Jan 2019.
+
+* Added support for GCC's --sysroot option to configure.py for cross-compiling.
+
+Version 2.6.0, 2018-04-10
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* CVE-2018-9860 Fix a bug decrypting TLS CBC ciphertexts which could
+  for a malformed ciphertext cause the decryptor to read and HMAC an
+  additional 64K bytes of data which is not part of the record. This
+  could cause a crash if the read went into unmapped memory. No
+  information leak or out of bounds write occurs.
+
+* Add support for OAEP labels (GH #1508)
+
+* RSA signing is about 15% faster (GH #1523) and RSA verification is
+  about 50% faster.
+
+* Add exponent blinding to RSA (GH #1523)
+
+* Add ``Cipher_Mode::create`` and ``AEAD_Mode::create`` (GH #1527)
+
+* Fix bug in TLS server introduced in 2.5 which caused connection to
+  fail if the client offered any signature algorithm not known to the
+  server (for example RSA/SHA-224).
+
+* Fix a bug in inline asm that would with GCC 7.3 cause incorrect
+  computations and an infinite loop during the tests. (GH #1524 #1529)
+
+Version 2.5.0, 2018-04-02
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Fix error in certificate wildcard matching (CVE-2018-9127), where a
+  wildcard cert for ``b*.example.com`` would be accepted as a match for
+  any host with name ``*b*.example.com`` (GH #1519)
+
+* Add support for RSA-PSS signatures in TLS (GH #1285)
+
+* Ed25519 certificates are now supported (GH #1501)
+
+* Many optimizations in ECC operations. ECDSA signatures are 8-10 times faster.
+  ECDSA verification is about twice as fast. ECDH key agreement is 3-4 times
+  faster. (GH #1457 #1478)
+
+* Implement product scanning Montgomery reduction, which improves Diffie-Hellman
+  and RSA performance by 10 to 20% on most platforms. (GH #1472)
+
+* DSA signing and verification performance has improved by 30-50%.
+
+* Add a new Credentials_Manager callback that specifies which CAs the server
+  has indicated it trusts (GH #1395 fixing #1261)
+
+* Add new TLS::Callbacks methods that allow creating or removing extensions,
+  as well as examining extensions sent by the peer (GH #1394 #1186)
+
+* Add new TLS::Callbacks methods that allow an application to
+  negotiate use of custom elliptic curves. (GH #1448)
+
+* Add ability to create custom elliptic curves (GH #1441 #1444)
+
+* Add support for POWER8 AES instructions (GH #1459 #1393 #1206)
+
+* Fix DSA/ECDSA handling of hashes longer than the group order (GH #1502 #986)
+
+* The default encoding of ECC public keys has changed from compressed
+  to uncompressed point representation. This improves compatibility with
+  some common software packages including Golang's standard library.
+  (GH #1480 #1483)
+
+* It is now possible to create DNs with custom components. (GH #1490 #1492)
+
+* It is now possible to specify the serial number of created certificates,
+  instead of using the default 128-bit random integer. (GH #1489 #1491)
+
+* Change DL_Group and EC_Group to store their data as shared_ptr for
+  fast copying. Also both classes precompute additional useful values
+  (eg for modular reductions). (GH #1435 #1454)
+
+* On Windows platforms RtlGenRandom is now used in preference to CryptoAPI
+  or CryptoNG libraries. (GH #1494)
+
+* Make it possible for PKCS10 requests to include custom extensions. This also
+  makes it possible to use multiple SubjectAlternativeNames of a single type in
+  a request, which was previously not possible. (GH #1429 #1428)
+
+* Add new optimized interface for FE1 format preserving encryption. By caching a
+  number of values computed in the course of the FPE calculation, it provides a
+  6-7x speedup versus the old API. (GH #1469)
+
+* Add DSA and ElGamal keygen functions to FFI (#1426)
+
+* Add ``Pipe::prepend_filter`` to replace deprecated ``Pipe::prepend`` (GH #1402)
+
+* Fix a memory leak in the OpenSSL block cipher integration, introduced in 2.2.0
+
+* Use an improved algorithm for generating safe primes which is several tens of
+  times faster. Also, fix a bug in the prime sieving algorithm which caused
+  standard prime generation (like for RSA keys) to be slower than necessary.
+  (GH #1413 #1411)
+
+* Correct the return value of ``PK_Encryptor::maximum_input_size`` which
+  reported a much too small value (GH #1410)
+
+* Remove use of CPU specific optimization flags, instead the user should set
+  these via CXXFLAGS if desired. (GH #1392)
+
+* Resolve an issue that would cause a crash in the tests if they were run on
+  a machine without SSE2/NEON/VMX instructions. (GH #1495)
+
+* The Python module now tries to load DLLs from a list of names and
+  uses the first one which successfully loads and indicates it
+  supports the desired API level. (GH #1497)
+
+* Various minor optimizations for SHA-3 (GH #1433 #1434)
+
+* The output of ``botan --help`` has been improved (GH #1387)
+
+* Add ``--der-format`` flag to command line utils, making it possible verify
+  DSA/ECDSA signatures generated by OpenSSL command line (GH #1409)
+
+* Add support for ``--library-suffix`` option to ``configure.py`` (GH #1405 #1404)
+
+* Use feature flags to enable/disable system specific code (GH #1378)
+
+* Add ``--msvc-runtime`` option to allow using static runtime (GH #1499 #210)
+
+* Add ``--enable-sanitizers=`` option to allow specifying which sanitizers to
+  enable. The existing ``--with-sanitizers`` option just enables some default
+  set which is known to work with the minimum required compiler versions.
+
+* Use either ``rst2man`` or ``rst2man.py`` for generating man page as
+  distributions differ on where this program is installed (GH #1516)
+
+* The threefish module has been renamed threefish_512 since that is the
+  algorithm it provides. (GH #1477)
+
+* The Perl XS based wrapper has been removed, as it was unmaintained and
+  broken. (GH #1412)
+
+* The sqlite3 encryption patch under ``contrib`` has been removed. It
+  is still maintained by the original author at
+  https://github.com/OlivierJG/botansqlite3
+
+* Support for Windows Phone is deprecated.
+
+Version 2.4.0, 2018-01-08
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Several build improvements requested by downstream packagers, including the
+  ability to disable building the static library. All makefile constructs that
+  were specific to nmake or GNU make have been eliminated, thus the option
+  ``--makefile-style`` which was previously used to select the makefile type has
+  also been removed. (GH #1230 #1237 #1300 #1318 #1319 #1324 #1325 #1346)
+
+* Support for negotiating the DH group as specified in RFC 7919 is now available
+  in TLS (GH #1263)
+
+* Support for ARIA-GCM ciphersuites are now available in TLS. They are disabled
+  by default. (GH #1284)
+
+* Add support for generating and verifying X.509 objects (certificates, CRLs,
+  etc) using RSA-PSS signatures (GH #1270 and #1368)
+
+* Add support for AES key wrapping with padding, as specified in RFC 5649 and
+  NIST SP 800-38F (GH #1301)
+
+* OCSP requests made during certificate verification had the potential to hang
+  forever. Now the sockets are non-blocking and a timeout is enforced. (GH #1360
+  fixing GH #1326)
+
+* Add ``Public_Key::fingerprint_public`` which allows fingerprinting the public key.
+  The previously available ``Private_Key::fingerprint`` is deprecated, now
+  ``Private_Key::fingerprint_private`` should be used if this is required.
+  (GH #1357)
+
+* ECC certificates generated by Botan used an invalid encoding for the
+  parameters field, which was rejected by some certificate validation libraries
+  notably BouncyCastle. (GH #1367)
+
+* Loading an ECC key which used OID encoding for the domain parameters, then
+  saving it, would result in a key using the explicit parameters encoding.
+  Now the OID encoding is retained. (GH #1365)
+
+* Correct various problems in certificate path validation that arose when
+  multiple paths could be constructed leading to a trusted root but due to
+  other constraints only some of them validated. (GH #1363)
+
+* It is now possible for certificate validation to return warning indicators,
+  such as that the distinguished name is not within allowed limits or that a
+  certificate with a negative serial number was observed. (GH #1363 #1359)
+
+* XMSS signatures now are multi-threaded for improved performance (GH #1267)
+
+* Fix a bug that caused the TLS peer cert list to be empty on a resumed session.
+  (GH #1303 #1342)
+
+* Increase the maximum HMAC key length from 512 bytes to 4096 bytes. This allows
+  using a DH key exchange in TLS with a group greater than 4096 bits. (GH #1316)
+
+* Fix a bug in the TLS server where, on receiving an SSLv3 client hello, it
+  would attempt to negotiate TLS v1.2. Now a protocol_version alert is sent.
+  Found with tlsfuzzer. (GH #1316)
+
+* Fix several bugs related to sending the wrong TLS alert type in various error
+  scenarios, caught with tlsfuzzer.
+
+* Add support for a ``tls_http_server`` command line utility which responds to
+  simple GET requests. This is useful for testing against a browser, or various
+  TLS test tools which expect the underlying protocol to be HTTP. (GH #1315)
+
+* Add an interface for generic PSK data stores, as well as an implementation
+  which encrypts stored values with AES key wrapping. (GH #1302)
+
+* Optimize GCM mode on systems both with and without carryless multiply
+  support. This includes a new base case implementation (still constant time), a
+  new SSSE3 implementation for systems with SSSE3 but not clmul, and better
+  algorithms for systems with clmul and pmull. (GH #1253 #1263)
+
+* Various optimizations for OCB, CFB, CTR, SM3, SM4, GMAC, BLAKE2b, Blowfish,
+  Twofish, CAST-128, and CRC24 (GH #1281)
+
+* Salsa20 now supports the seek operation.
+
+* Add ``EC_Group::known_named_groups`` (GH #1339)
+
+* Symmetric algorithms (block ciphers, stream ciphers, MACs) now verify that a
+  key was set before accepting data. Previously attempting to use an unkeyed
+  object would instead result in either a crash or invalid outputs. (GH #1279)
+
+* The X509 certificate, CRL and PKCS10 types have been heavily refactored
+  internally. Previously all data of these types was serialized to strings, then
+  in the event a more complicated data structure (such as X509_DN) was needed,
+  it would be recreated from the string representation. However the round trip
+  process was not perfect and could cause fields to become lost. This approach
+  is no longer used, fixing several bugs (GH #1010 #1089 #1242 #1252). The
+  internal data is now stored in a ``shared_ptr``, so copying such objects is
+  now very cheap. (GH #884)
+
+* ASN.1 string objects previously held their contents as ISO 8859-1 codepoints.
+  However this led to certificates which contained strings outside of this
+  character set (eg in Cyrillic, Greek, or Chinese) being rejected. Now the
+  strings are always converted to UTF-8, which allows representing any
+  character. In addition, UCS-4 strings are now supported.
+  (GH #1113 #1250 #1287 #1289)
+
+* It is now possible to create an uninitialized X509_Certificate object. Such an
+  object will throw if any attempt to access its members is made. (GH #1335)
+
+* In BER decoder, avoid unbounded stack recursion when parsing nested indefinite
+  length values. Now at most 16 nested indefinite length values are accepted,
+  anything deeper resulting in a decoding error.  (GH #1304 OSS-Fuzz 4353).
+
+* A new ASN.1 printer API allows generating a string representation of arbitrary
+  BER data. This is used in the ``asn1print`` command line utility and may be
+  useful in other applications, for instance for debugging.
+
+* New functions for bit rotations that distinguish rotating by a compile-time
+  constant vs a runtime variable rotation. This allows better optimizations in
+  both cases. Notably performance of CAST-128 and CAST-256 are substantially
+  improved. (GH #1247)
+
+* TLS CBC ciphersuites now are implemented using the standard CBC code, instead
+  of reimplementing CBC inside the TLS stack. This allows for parallel
+  decryption of TLS CBC ciphertexts, and improves performance especially when
+  using AES hardware support. (GH #1269)
+
+* Add callbacks to make it possible for an application using TLS to provide
+  custom implementations of signature schemes, eg when offloading the
+  computations to another device. (GH #1332)
+
+* Use a direct calculation for calendar computations instead of relying on
+  non-portable operating system interfaces. (GH #1336)
+
+* Fix a bug in the amalgamation generation which could cause build failures on
+  some systems including macOS. (GH #1264 #1265)
+
+* A particular code sequence in TLS handshake would always (with an ECC
+  ciphersuite) result in an exception being thrown and then caught.  This has
+  changed so no exception is thrown. (GH #1275)
+
+* The code for byteswapping has been improved for ARMv7 and for Windows x86-64
+  systems using MSVC. (GH #1274)
+
+* The GMAC class no longer derives from GHASH. This should not cause any
+  noticeable change for applications. (GH #1253)
+
+* The base implementation of AES now uses a single 4K table, instead of 4 such
+  tables. This offers a significant improvement against cache-based side
+  channels without hurting performance too much. In addition the table is now
+  guaranteed to be aligned on a cache line, which ensures the additional
+  countermeasure of reading each cache line works as expected. (GH #1255)
+
+* In TLS client resumption, avoid sending a OCSP stapling request. This caused
+  resumption failures with some servers. (GH #1276)
+
+* The overhead of making a call through the FFI layer has been reduced.
+
+* The IDs for SHA-3 PKCSv1.5 signatures added in 2.3.0 were incorrect. They have
+  been changed to use the correct encoding, and a test added to ensure such
+  errors do not recur.
+
+* Counter mode allows setting a configurable width of the counter. Previously it
+  was allowed for a counter of even 8 bits wide, which would mean the keystream
+  would repeat after just 256 blocks. Now it requires the width be at least 32
+  bits. The only way this feature could be used was by manually constructing a
+  ``CTR_BE`` object and setting the second parameter to something in the range
+  of 1 to 3.
+
+* A new mechanism for formatting ASN.1 data is included in ``asn1_print.h``.
+  This is the same functionality used by the command line ``asn1print`` util,
+  now cleaned up and moved to the library.
+
+* Add ``Pipe::append_filter``. This is like the existing (deprecated)
+  ``Pipe::append``, the difference being that ``append_filter`` only
+  allows modification before the first call to ``start_msg``. (GH #1306 #1307)
+
+* The size of ASN1_Tag is increased to 32 bits. This avoids a problem
+  with UbSan (GH #751)
+
+* Fix a bug affecting bzip2 compression. In certain circumstances, compression
+  would fail with ``BZ_SEQUENCE_ERROR`` due to calling bzlib in an way it does
+  not support. (GH #1308 #1309)
+
+* In 2.3.0, final annotations were added to many classes including the TLS
+  policies (like ``Strict_Policy`` and ``BSI_TR_02102_2``). However it is
+  reasonable and useful for an application to derive from one of these policies, so
+  as to create an application specific policy that is based on a library-provided
+  policy, but with a few tweaks. So the final annotations have been removed on
+  these classes. (GH #1292)
+
+* A new option ``--with-pdf`` enables building a PDF copy of the handbook.
+  (GH #1337)
+
+* A new option ``--with-rst2man`` enables building a man page for the
+  command line util using Docutils rst2man. (GH #1349)
+
+* Support for NEON is now enabled under Clang.
+
+* Now the compiler version is detected using the preprocessor, instead of trying
+  to parse the output of the compiler's version string, which was subject to
+  problems with localization. (GH #1358)
+
+* By default the gzip compressor will not include a timestamp in the header.
+  The timestamp can be set by passing it to the ``Gzip_Compression``
+  constructor.
+
+* Resolve a performance regression on Windows involving the system stats
+  entropy source. (GH #1369)
+
+* Add an OID for RIPEMD-160
+
+* Fixes for CMake build (GH #1251)
+
+* Avoid some signed overflow warnings (GH #1220 #1245)
+
+* As upstream support for Native Client has been deprecated by Google, support
+  is now also deprecated in Botan and will be removed in a future release.
+
+* The Perl-XS wrapper has not been maintained in many years. It is now deprecated,
+  and if no attempts are made to revive it, it will be removed in a future release.
+
+* Support for building on IRIX has been removed.
+
+Version 2.3.0, 2017-10-02
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Address a side channel affecting modular exponentiation. An attacker
+  capable of a local or cross-VM cache analysis attack may be able
+  to recover bits of secret exponents as used in RSA, DH, etc.
+  CVE-2017-14737
+
+* Add the SHACAL2 block cipher, including optimizations using SIMD and SHA-NI
+  instructions. (GH #1151)
+
+* Add the ARIA block cipher (GH #1004 and #1157)
+
+* Add support for the ARMv8 AES instructions (GH #1182 and #1146)
+
+* Add support for the ARMv8 PMULL instruction (GH #1181 and #842)
+
+* On macOS and iOS the ``System_RNG`` class is now implemented using ``arc4random``.
+  Previously the system RNG class was not available on iOS. (GH #1219)
+
+* Optimized the CMAC polynomial doubling operation, and removed a small timing
+  channel due to a conditional operation.
+
+* Added support for the ECDHE_PSK AEAD TLS ciphersuites from
+  draft-ietf-tls-ecdhe-psk-aead-05.
+
+* SM2 encryption and signature schemes were previously hardcoded to use SM3
+  hash, now any hash is allowed. (GH #1188)
+
+* SM2 encryption in 2.2.0 followed an obsolete version of the standard. The
+  format of the ciphertext changed in a more recent revision of the standard,
+  and now uses an ASN.1 encoding. Botan has changed to reflect this format,
+  which is compatible with GmSSL (GH #1218)
+
+* OCB mode now supports 192, 256 and 512 bit block ciphers. (GH #1205)
+
+* XTS mode now supports 256-bit and 512-bit block ciphers.
+
+* Add ids to allow SHA-3 signatures with PKCSv1.5 (GH #1184)
+
+* Add support for ``PSSR_Raw`` signatures which PSS sign an externally derived
+  hash. (GH #1212 #1211)
+
+* GCM now supports truncated tags in the range 96...128 bits. GCM had
+  previously supported 64-bit truncated tags, but these are known to
+  be insecure and are now deprecated. (GH #1210 #1207)
+
+* Add a new TLS policy hook ``allow_client_initiated_renegotiation`` which is the
+  parallel of the existing ``allow_server_initiated_renegotiation``. If set to
+  false, servers will reject attempts by the client to renegotiation the
+  session, instead sending a ``no_renegotiation`` warning alert. Note that the
+  default is ``false``, ie that client renegotiation is now prohibited by default.
+  (GH #872)
+
+* Add HKDF-Expand-Label function which is used in TLS v1.3 and QUIC protocols.
+  (GH #1226)
+
+* Fix decoding of ECC keys that use extensions from RFC 5915 (GH #1208)
+
+* The entropy source that called CryptGenRandom has been removed, and
+  replaced by a version which invokes the system PRNG, which may
+  be CryptGenRandom or some other source. (GH #1180)
+
+* Add support for gathering entropy using the Crypt-NG BCryptGenRandom
+  API. This is necessary to build for Windows Phone/Windows Store. (GH #1180)
+
+* Extend "Raw" signature padding (which allows signing a hash computed
+  externally) to optionally take a hash function name. In this case, it will be
+  verified that the input matches the expected hash size.  This also will
+  control the hash algorithm used for RFC 6979 deterministic nonces; previously
+  SHA-512 was always used for RFC 6979 nonces with "Raw". (GH #1153)
+
+* The advertised FFI API version has increased. This should have happened
+  already in 2.2 but was neglected. The ``botan_ffi_supports_api`` call will
+  return true for either the current or older versions of the API version since
+  no backwards incompatible changes have occurred.
+
+* Add new C89 API functions ``botan_hex_decode``, ``botan_base64_encode``,
+  ``botan_base64_decode``, ``botan_constant_time_compare``.
+
+* Add new C89 API functions ``botan_privkey_load_dh``, ``botan_pubkey_load_dh``,
+  and ``botan_privkey_create_dh`` (GH #1155)
+
+* Add ``is_passhash9_alg_supported`` (GH #1154)
+
+* The ``power_mod`` function now supports negative bases (GH #1179 #1168)
+
+* Add a new command line utility for examining TLS client hellos.
+
+* Added a new target for LLVM bitcode (GH #1169)
+
+* Improve support for Windows Phone (GH #1180 #796 #794)
+
+* Correct return value of ``botan_pk_op_verify_finish``. In 2.2.0 this function
+  returned -1 on invalid signature, instead of 1 which was used in 2.0, 2.1, and
+  now again in 2.3. (GH #1189 #1187)
+
+* Allow loading unencrypted private keys via FFI API (GH #1197)
+
+* Add new command line options ``--rng-type=drbg`` and ``--drbg-seed`` which
+  allow running commands with a deterministic RNG. (GH #1169)
+
+* Fix a number of warnings seen under Visual C++ (GH #1171 #795)
+
+* Workaround a GCC 7 bug that caused miscompilation of the GOST-34.11 hash
+  function on x86-32. (GH #882 #1148)
+
+* Fix a bug in SIMD_4x32 which affected little-endian PowerPC processors.
+  This would cause test failures for Serpent, among other problems.
+
+* Fix Altivec runtime detection, which was broken starting in Botan 2.1.0
+
+* Optimized the verification of TLS CBC padding bytes. Previously the check
+  examined every byte of the record, even though at most 256 bytes of padding
+  may be appended. (GH #1227)
+
+* Simplified definition of ``Botan::secure_allocator``. In particular, not
+  defining the ``construct`` and ``destroy`` methods avoids a performance problem
+  under MSVC. (GH #1228 and #1229)
+
+* The ``secure_allocator`` class now uses ``calloc`` and ``free`` instead of
+  ``new`` and ``delete``. In addition the actual allocation operation is hidden
+  inside of compiled functions, which significantly reduces code size. (GH #1231)
+
+* The ``secure_scrub_memory`` function now uses ``explicit_bzero`` on OpenBSD.
+
+* Previously ARM feature detection (NEON, AES, ...) relied on getauxval, which
+  is only supported on Linux and Android. Now iOS is supported, by checking the
+  model name/version and matching it against known versions. Unfortunately this
+  is the best available technique on iOS. On Aarch64 systems that are not iOS or
+  Linux/Android, a technique based on trial execution while catching SIGILL is
+  used. (GH #1213)
+
+* The output of ``botan config libs`` was incorrect, it produced ``-lbotan-2.X``
+  where X is the minor version, instead of the actual lib name ``-lbotan-2``.
+
+* Add ``constant_time_compare`` as better named equivalent of ``same_mem``.
+
+* Silence a Clang warning in ``create_private_key`` (GH #1150)
+
+* The fuzzers have been better integrated with the main build. See the
+  handbook for details. (GH #1158)
+
+* The Travis CI and AppVeyor CI builds are now run via a Python script. This
+  makes it easier to replicate the behavior of the CI build locally. Also a
+  number of changes were made to improve the turnaround time of CI builds.
+  (GH #1162 #1199)
+
+* Add support for Win32 filesystem operation, so the tests pass completely
+  on MinGW now (GH #1203)
+
+* Added a script to automate running TLS-Attacker tests.
+
+* The distribution script now creates reproducible outputs, by
+  forcing all modification times, uids, etc to values fixed by the release date.
+  (GH #1217)
+
+* The ``BOTAN_DLL`` macro has been split up into ``BOTAN_PUBLIC_API``,
+  ``BOTAN_UNSTABLE_API`` and ``BOTAN_TEST_API`` which allows
+  indicating in the header the API stability of the export. All three
+  are defined as ``BOTAN_DLL`` so overriding just that macro continues
+  to work as before. (GH #1216)
+
+* Optimize ``bigint_divop`` when a double-word type is available. (GH #494)
+
+* Fix several memory leaks in the tests. Additionally a false positive
+  leak seen under ``valgrind`` in the ``fork`` tests for the RNG was resolved.
+
+* Export ``CurveGFp_Repr`` type (only used internally) to resolve a
+  long standing UBSan warning. (GH #453)
+
+* Now ``-fstack-protector`` and similar flags that affect linking are exported
+  in ``botan config ldflags`` as they already were in the ``pkg-config`` output.
+  (GH #863)
+
+* Remove double underscore in header guards to avoid using names
+  reserved by ISO C++. (GH #512)
+
+* Additions to the SRP documentation (GH #1029)
+
+* The package transform (in ``package.h``) is now deprecated, and will be
+  removed in a future release. (GH #1215)
+
+* Add more tests for the const-time utils (GH #1214)
+
+* Fix a bug in FFI tests that caused the test files not to be found when using
+  ``--data-dir`` option (GH #1149)
+
+* C++ ``final`` annotations have been added to classes which are not
+  intended for derivation. This keyword was already in use but was not
+  applied consistently.
+
+* A typedef ``SecureVector`` has been added for the ``secure_vector`` type.
+  This makes porting code from 1.10 to 2.x API slightly simpler.
+
+* Header files have been cleaned up to remove unnecessary inclusions. In some
+  cases it may be required to include additional botan headers to get all the
+  declarations that were previously visible. For example, ``bigint.h`` no longer
+  includes ``rng.h``, but just forward declares ``RandomNumberGenerator``.
+
+* Improved support for IBM xlc compiler.
+
+Version 2.2.0, 2017-08-07
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Add the Ed25519 signature scheme (GH #1066)
+
+* The format of x25519 keys, which previously used a non-standard encoding,
+  has changed to match the upcoming IETF specification. (GH #1076)
+
+* Add the SM2 signature scheme (GH #1082)
+
+* Add the SM2 public key encryption scheme (GH #1142)
+
+* Add the SM3 hash function (GH #996)
+
+* Add the Streebog (GOST R 34.11-2012) hash function (GH #1114)
+
+* Add the SM4 block cipher (GH #1080)
+
+* Add the PGP S2K algorithm (GH #1060)
+
+* Add SP 800-56A KDF (GH #1040)
+
+* Add ChaCha_RNG which is a very fast and completely non-standard
+  random bit generator (GH #1137)
+
+* Add support for SHA-1 and SHA-2 instructions added in Intel Goldmont
+  (GH #826)
+
+* Add support for SHA-1 and SHA-2 instructions added in ARMv8 (GH #844)
+
+* Add support for HOTP (RFC 4226) and TOTP (RFC 6238)
+  one-time-password algorithms (GH #1054)
+
+* Fix a bug that caused secure_allocator to not fully zeroize blocks
+  when sizeof(T) was greater than 1.
+
+* Add HashFunction::copy_state which allows efficiently computing the
+  hash of several messages with a common prefix (GH #1056 #1037)
+
+* ECC keys now encode their parameters using an OID instead of a literal
+  encoding of the domain parameters. This will lead to smaller public and
+  private keys in most instances. (GH #1093)
+
+* The OpenSSL backend now supports the 1.1.0 API (GH #1056)
+
+* Add a preliminary provider using BearSSL, currently EC and hashes supported
+  (GH #1094)
+
+* Fix a bug in certificate path length checking that could cause valid
+  chains to be rejected. (GH #1053)
+
+* It is possible for CBC, CFB, and stream ciphers to carry over the
+  nonce from the previous message, which is needed by some applications.
+  This worked in 1.10 but broke in 2.0. (GH #1044 fixing GH #864)
+
+* Avoid recursion in BER_Decoder::get_next_object which could cause
+  stack exhaustion. (GH #989)
+
+* Fix missing flush in DataSink_Stream::end_msg. (GH #972 fixing GH #972)
+
+* Allow to seek in the big endian counter mode of operation (GH #999)
+
+* Support loading ElGamal keys through FFI interface (GH #1008)
+
+* Support Windows sockets in ``http_util`` (allowing OCSP checks on Windows),
+  as well as in the TLS command line utils (GH #1138).
+
+* The ``--destdir`` flag to ``configure.py`` has been removed. Instead use
+  the ``DESTDIR`` environment variable at install time. This change was
+  done to more closely match how autoconf handles this case.
+  (GH #1139 #1111 #997 #996).
+
+* Many changes to configure.py and botan2.py to make them pylint clean
+  (GH #1041 #1002 #984)
+
+* Add command line utils ``hmac`` (GH #1001), ``encryption`` (GH #359),
+  ``hex_enc``, and ``hex_dec``.
+
+* Fix an error in ``sign_cert`` command line util, which ignored the
+  ``--ca-key-pass`` option. (GH #1106)
+
+* The ``speed`` util can now benchmark multiple buffer sizes (GH #1084)
+
+* Fix return value of FFI botan_bcrypt_is_valid (GH #1033)
+
+* Support generating RSA keys using OpenSSL (GH #1035)
+
+* Add new FFI functions botan_hash_block_size (GH #1036),
+  botan_hash_copy_state (GH #1059), botan_scrub_mem
+
+* Add support for RFC 3394 keywrap through FFI (GH #1135)
+
+* Support AES-CBC ciphers via OpenSSL (GH #1022)
+
+* Add function to return certificates included in OCSP response (GH #1123)
+
+* Complete wildcard handling for X.509 certificates (GH #1017)
+
+* Add some missing functions to TLS::Text_Policy (GH #1023)
+
+* It was previously possible to use ``--single-amalgamation-file``
+  without ``--amalgamation``, though it did not do anything useful. Now
+  ``--single-amalgamation-file`` requires ``--amalgamation`` also be set
+  on the command line.
+
+Version 2.1.0, 2017-04-04
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Fix incorrect truncation in Bcrypt. Passwords in length between 56 and 72
+  characters were truncated at 56 characters. Found and reported by Solar Designer.
+  (CVE-2017-7252) (GH #938)
+
+* Fix a bug in X509 DN string comparisons that could result in out of bound
+  reads. This could result in information leakage, denial of service, or
+  potentially incorrect certificate validation results. Found independently
+  by Cisco Talos team and OSS-Fuzz. (CVE-2017-2801)
+
+* Correct minimum work factor for Bcrypt password hashes. All other
+  implementations require the work factor be at least 4. Previously Botan simply
+  required it be greater than zero. (GH #938)
+
+* Converge on a single side channel silent EC blinded multiply algorithm.
+  Uses Montgomery ladder with order/2 bits scalar blinding and point randomization
+  now by default. (GH #893)
+
+* Add ability to search for certificates using the SHA-256 of the distinguished name.
+  (GH #900)
+
+* Support a 0-length IV in ChaCha stream cipher. Such an IV is treated
+  identically to an 8-byte IV of all zeros.
+
+* Add new interfaces to the C API including multiple precision integers, key
+  validity tests, block ciphers, and extracting algorithm specific key parameters
+  (such as the modulus and public exponent from RSA public keys). GH #899 #944
+  #946 #961 #964
+
+* The PKCS11 module did not require any external dependencies, so it
+  has been enabled by default. The ``--with-pkcs11`` and ``--without-pkcs11``
+  flags to ``configure.py`` have been removed. PKCS11 can still be disabled
+  using ``--disable-modules=pkcs11`` (GH #837)
+
+* Add ``OS::run_cpu_instruction_probe`` for runtime probing of ISA extensions.
+  Supporting this requires system-specific techniques, currently Windows SEH and
+  Unix signal handling are supported.
+
+* Add support for ARM NEON in the SIMD_4x32 type
+
+* Add support for ARM CPU feature detection using getauxval (GH #843)
+
+* Previously Botan forbid any use of times past 2037 to avoid Y2038 issues.
+  Now this restriction is only in place on systems which have a 32-bit
+  ``time_t``. (GH #933 fixing #917)
+
+* Add generic type decoder function to BER decoder (GH #897)
+
+* Fix portability or build problems affecting Sun Studio compiler (GH #846),
+  Solaris, ppc64le, DragonflyBSD (GH #887)
+
+* Add ``--with-external-libdir`` to configure.py (GH #857 fixing #19 #767)
+
+* Add ``OS::get_high_resolution_clock`` which returns the best resolution
+  clock available on the system.
+
+* Change ``OS::get_processor_timestamp`` to return 0 if no hardware
+  cycle counter is available. Previously it silently fell back on some
+  other clock type.
+
+* Report cycles/byte in the output of ``botan speed``.
+
+* Add speed tests for modular exponentiations and ECC scalar multiplies.
+
+* Avoid using IP address for SNI in ``tls_client``. (GH #942)
+
+* Add command line util ``timing_test`` which enables running
+  timing-based side channel analysis of TLS CBC decryption, ECC scalar
+  multiplies, OAEP decoding, and other operations which are prone to
+  providing an oracle via side channel. This replaces the standalone
+  timing test suite added in 1.11.34, which has been removed.
+
+* Various cleanups and refactorings (GH #965)
+
+* Add wrapper of C++14 make_unique (GH #974)
+
+* Fix pkg-config output when --build-dir was used (GH #936)
+
+* Make it possible to disable `-fstack-protector` using a build-time flag.
+  GH #863
+
+* Add tests for TLS DSA ciphersuites, more Noekeon tests, others.
+
+* Avoid a GCC warning that triggered on the public key types (GH #849)
+
+* Fix various warnings flagged by pylint and pyflakes linters in
+  configure.py and botan.py (GH #832 #836 #839 #962 #975)
+
+* Improve support for OpenBSD including using getentropy (GH #954)
+  for PRNG seeding, and arc4random to access system RNG (GH #953)
+
+* Add ability to build through CMake. As of now this is only supported
+  for development rather than production builds. (GH #967)
+
+* Rename python wrapper to botan2.py (GH #847)
+
+* Change name constraint test to use a fixed reference time. Test certs have expired.
+
+* Increase Miller-Rabin iterations for DSA primes to match FIPS 186-4. (GH #881)
+
+* Fix possible ISO 9796-2 padding side channel, and add a missing length check (GH #891)
+
+* In command line utility, prefer the system RNG if it is available.
+
+Version 2.0.1, 2017-01-09
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Change an unintended behavior of 2.0.0, which named the include
+  directory ``botan-2.0``. Since future release of Botan-2 should be
+  compatible with code written against old versions, there does not
+  seem to be any reason to version the include directory with the
+  minor number. (GH #830 #833)
+
+* Fix a bug which caused an error when building on Cygwin or
+  other platforms where shared libraries are not supported.
+  (GH #821)
+
+* Enable use of readdir on Cygwin, which allows the tests to run (GH #824)
+
+* Switch to readthedocs Sphinx theme by default (GH #822 #823)
+
+Version 2.0.0, 2017-01-06
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* With this release the project adopts Semantic Versioning (GH #766)
+
+* Fix a longstanding bug in modular exponentiation which caused most
+  exponentiations modulo an even number to have an incorrect result; such moduli
+  occur only rarely in cryptographic contexts. (GH #754)
+
+* Fix a bug in BigInt multiply operation, introduced in 1.11.30, which could
+  cause incorrect results. Found by OSS-Fuzz fuzzing the ressol function, where
+  the bug manifested as an incorrect modular exponentiation. OSS-Fuzz bug #287
+
+* Fix a bug that meant the "ietf/modp/6144" and "ietf/modp/8192" discrete log
+  groups used an incorrect value for the generator, specifically the value
+  (p-1)/2 was used instead of the correct value of 2.
+
+* The DL_Group enum value X942_DH_PARAMETERS has been renamed
+  ANSI_X9_42_DH_PARAMETERS to avoid a conflict with Windows headers (GH #482)
+
+* Change default PEM header for X942 DH to match OpenSSL. Either version is
+  accepted on reading. (GH #818)
+
+* DL_Group strong generation previously set the generator to 2. However
+  sometimes 2 generates the entire group mod p, rather than the subgroup mod q.
+  This is invalid by X9.42 standard, and exposes incautious applications to
+  small subgroup attacks. Now DL_Group uses the smallest g which is a quadratic
+  residue. (GH #818)
+
+* Add iOS build target instead of piggybacking on OS X configuration. (GH #793)
+
+* Changes all Public_Key derived class ctors to take a std::vector instead of a
+  secure_vector for the DER encoded public key bits. (GH #768)
+
+* Allow use of custom extensions when creating X.509 certificates (GH #744)
+
+* The default TLS policy now requires 2048 or larger DH groups by default.
+
+* Add BSI_TR_02102_2 TLS::Policy subclass representing BSI TR-02102-2 recommendations.
+
+* The default Path_Validation_Restrictions constructor has changed to
+  require at least 110 bit signature strength. This means 1024 bit RSA
+  certificates and also SHA-1 certificates are rejected by default.
+  Both settings were already the default for certificate validation in
+  TLS handshake, but this changes it for applications also.
+
+* Add ISO 9796-2 signature padding schemes DS2 and DS3. These schemes provide
+  message recovery (part or all of the plaintext message can be recovered from
+  the signature alone) and are used by some industry protocols. (GH #759)
+
+* Rewrite all the code that handles parsing CBC padding bytes to run without
+  conditional jumps or loads. (GH #765 #728)
+
+* Fix deref of invalid memory location in TLS client when the server chooses a
+  ciphersuite value larger than the largest TLS ciphersuite ID compiled into the
+  table. This might conceivably cause a crash in rare circumstances, but does
+  not seem to be further exploitable. (GH #758)
+
+* Rename Public_Key::x509_subject_public_key, which does not return a
+  X.509 SubjectPublicKey, to public_key_bits. Add a new non-virtual function
+  Public_Key::subject_public_key which does exactly that. (GH #685 #757)
+
+* Rename Private_Key::pkcs8_private_key, which does not return a
+  PKCS#8 private key, to private_key_bits. Add a new non-virtual function
+  Private_Key::private_key_info which does exactly that. (GH #685 #757)
+
+* The deprecated ECB Cipher_Mode class has been removed (GH #756)
+
+* The class SRP6_Authenticator_File (in srp6_files.h) was meant to parse GnuTLS
+  SRP files. But it was completely untested, and it turns out due to several
+  problems it was completely unable to parse any SRP file correctly. It has
+  been removed, with a future replacement planned that can handle both
+  flat files (in the actual SRP format) or using a SQL database.
+
+* Fix tests errors when write access to /dev/urandom is prohibited (GH #748)
+
+* Add more Diffie-Hellman tests (GH #790), tests for RSA blinding, others.
+
+* Add `tls_ciphers` command which prints the ciphersuites a client
+  hello will contain, depending on the policy specified.
+
+* Prevent TLS from negotiating SHA-2 ciphersuites in TLS v1.0/v1.1. These
+  ciphersuites are technically not defined except for v1.2, so disable
+  them in older protocols. (GH #496)
+
+* Documentation: add project goals (GH #788) and side channel info (GH #787)
+
+Older Versions
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* The release notes for versions 0.7.0 through 1.11.34 can be found in
+  ``doc/old_news.rst``