s2n Files

Release Summary:

• Delete all code that references Kyber.
• Fix the alignment used in the Rust bindings custom allocator to match the C malloc alignment contract.
• s2n-tls now errors if a peer sent an ECDSA signature with a mislabeled curve.
• each connection now uses 57 less bytes.
• We would like to thank Joshua Rogers (https://joshua.hu/) of AISLE Research Team (https://aisle.com/) for reporting the following issues:
• fix(bindings): use max_align_t for allocator alignment in https://github.com/aws/s2n-tls/pull/5745
• fix(quic support): Wipe buffers after reading post-handshake message in https://github.com/aws/s2n-tls/pull/5750
• fix(bindings): tie ClientHello lifetime to Fingerprint in https://github.com/aws/s2n-tls/pull/5747
• fix: add bound check for Yc_length against server DH params in https://github.com/aws/s2n-tls/pull/5737
• Memory overallocation in aws-kms-tls-auth, addressed in https://github.com/aws/s2n-tls/security/advisories/GHSA-5whh-4q9j-7v28

What's Changed

• fix: restrict mldsa signatures based on certificate by @jmayclin in https://github.com/aws/s2n-tls/pull/5713
• feat(bindings): expose signature scheme API by @jmayclin in https://github.com/aws/s2n-tls/pull/5708
• build(deps): update crabgrind requirement from 0.1 to 0.2 in /tests/regression in the all-cargo-updates group across 1 directory by @dependabot[bot] in https://github.com/aws/s2n-tls/pull/5716
• ci: fix typo in readme by @CarolYeh910 in https://github.com/aws/s2n-tls/pull/5718
• feat(bindings): add support for metric aggregation by @jmayclin in https://github.com/aws/s2n-tls/pull/5709
• fix: correct calculation of extensions bitfield size by @WesleyRosenblum in https://github.com/aws/s2n-tls/pull/5719
• build(deps): bump aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 in /.github/workflows in the all-gha-updates group by @dependabot[bot] in https://github.com/aws/s2n-tls/pull/5722
• nix: Use rustup toolchain over nix packages rustc in devshell by @kaukabrizvi in https://github.com/aws/s2n-tls/pull/5712
• Add X25519MLKEM768 benchmarks by @WillChilds-Klein in https://github.com/aws/s2n-tls/pull/5616
• ci: temporary replace clang-format-action by @jouho in https://github.com/aws/s2n-tls/pull/5735
• fix(benches): reduce flakiness in s2n-tls-bench daily job by @kaukabrizvi in https://github.com/aws/s2n-tls/pull/5728
• chore: fix sidetrail timings by @maddeleine in https://github.com/aws/s2n-tls/pull/5729
• ci: Add CI guardrail for BoringSSL fork by @kaukabrizvi in https://github.com/aws/s2n-tls/pull/5715
• feat(metrics): add EMF emitter by @jmayclin in https://github.com/aws/s2n-tls/pull/5730
• ci: fix fuzz failure artifact upload by @jouho in https://github.com/aws/s2n-tls/pull/5742
• chore: unpin rtshark version by @jouho in https://github.com/aws/s2n-tls/pull/5743
• ci: fix conventional commit check by @jouho in https://github.com/aws/s2n-tls/pull/5744
• fix(bindings): tie ClientHello lifetime to Fingerprint by @WesleyRosenblum in https://github.com/aws/s2n-tls/pull/5747
• fix: add bound check for Yc_length against server DH params by @CarolYeh910 in https://github.com/aws/s2n-tls/pull/5737
• chore: unpin rust integration dependencies by @jouho in https://github.com/aws/s2n-tls/pull/5748
• build(deps): bump actions/checkout from 4 to 6 in /.github/workflows in the all-gha-updates group by @dependabot[bot] in https://github.com/aws/s2n-tls/pull/5746
• fix: Add additional verification checks to ECDSA curves by @maddeleine in https://github.com/aws/s2n-tls/pull/5736
• fix(bindings): use max_align_t for allocator alignment by @WesleyRosenblum in https://github.com/aws/s2n-tls/pull/5745
• chore: Delete all code that references Kyber by @alexw91 in https://github.com/aws/s2n-tls/pull/5705
• ci: revert clang-format workflow by @jouho in https://github.com/aws/s2n-tls/pull/5751
• ci: trigger PR title check upon edit by @jouho in https://github.com/aws/s2n-tls/pull/5749
• fix(quic support): Wipe buffers after reading post-handshake message by @maddeleine in https://github.com/aws/s2n-tls/pull/5750
• refactor(integration): utilities module with cert materials by @jmayclin in https://github.com/aws/s2n-tls/pull/5753
• build(deps): bump baptiste0928/cargo-install from 3.3.2 to 3.4.0 in /.github/workflows in the all-gha-updates group by @dependabot[bot] in https://github.com/aws/s2n-tls/pull/5758
• build(deps): update strum requirement from 0.27 to 0.28 in /bindings/rust/standard by @dependabot[bot] in https://github.com/aws/s2n-tls/pull/5759
• test(integration): add coverage of error types for cert related failures by @jmayclin in https://github.com/aws/s2n-tls/pull/5755
• refactor: Use strong libcrypto randomness instead of custom random by @kaukabrizvi in https://github.com/aws/s2n-tls/pull/5726
• feat: add clearer errors for hostname, security policy failures by @jmayclin in https://github.com/aws/s2n-tls/pull/5761
• docs: Add security reporting policy by @WesleyRosenblum in https://github.com/aws/s2n-tls/pull/5734
• fix: rust alert getter should not modify by @lrstewart in https://github.com/aws/s2n-tls/pull/5756
• Necessary changes were made in the s2n module to support AIX OS. by @patel-parth7 in https://github.com/aws/s2n-tls/pull/5724
• fix: Use logical OR instead of bitwise OR by @maddeleine in https://github.com/aws/s2n-tls/pull/5763
• build(deps): bump actions/upload-artifact from 6 to 7 in /.github/workflows in the all-gha-updates group by @dependabot[bot] in https://github.com/aws/s2n-tls/pull/5764
• revert: "fix: rust alert getter should not modify" by @kaukabrizvi in https://github.com/aws/s2n-tls/pull/5766

New Contributors

• @patel-parth7 made their first contribution in https://github.com/aws/s2n-tls/pull/5724

Full Changelog: https://github.com/aws/s2n-tls/compare/v1.7.0...1.7.1