s2n Files

Weekly release for July 24 2025

Release Summary

• The aws-kms-tls-auth crate is now available, which provides utilities to do TLS-PSK based authentication using IAM and KMS.
• Created a new hybrid KEM group s2n_secp384r1_mlkem_1024.
• Updated the default_pq security policy to include the secp384r1_mlkem_1024 hybrid KEM group.

What's Changed

• fix(ci): adding set -e to prevent nix develop to hide failing tests by @boquan-fang in https://github.com/aws/s2n-tls/pull/5393
• chore: release 0.3.22 by @boquan-fang in https://github.com/aws/s2n-tls/pull/5397
• docs: note that s2n_shutdown may keep reading by @lrstewart in https://github.com/aws/s2n-tls/pull/5370
• feat(aws-kms-tls-auth): add codec and parsing by @jmayclin in https://github.com/aws/s2n-tls/pull/5398
• ci: start codebuild jobs from github actions by @lrstewart in https://github.com/aws/s2n-tls/pull/5383
• ci: Migrate Duvet GitHub Action to duvet-action repo by @johubertj in https://github.com/aws/s2n-tls/pull/5400
• feat(aws-kms-tls-auth): add psk identity by @jmayclin in https://github.com/aws/s2n-tls/pull/5402
• feat: add ML-KEM-1024 kem definition by @johubertj in https://github.com/aws/s2n-tls/pull/5367
• Flip Nix integration tests to use uv/pytest by @dougch in https://github.com/aws/s2n-tls/pull/5352
• feat(aws-kms-tls-auth): add provider & receiver structs by @jmayclin in https://github.com/aws/s2n-tls/pull/5408
• ci: require repo write permissions for codebuild by @lrstewart in https://github.com/aws/s2n-tls/pull/5421
• docs(aws-kms-tls-auth): add readme by @jmayclin in https://github.com/aws/s2n-tls/pull/5409
• docs(aws-kms-tls-auth): clarify security impact of failure modes by @jmayclin in https://github.com/aws/s2n-tls/pull/5424
• ci: run rustfmt/clippy on standard crates by @jmayclin in https://github.com/aws/s2n-tls/pull/5333
• feat: add secp384r1_mlkem_1024 kem group by @johubertj in https://github.com/aws/s2n-tls/pull/5395
• feat(bench): add generic shutdown functionality by @jmayclin in https://github.com/aws/s2n-tls/pull/5426
• chore: Nix Corretto version bump/upstream by @dougch in https://github.com/aws/s2n-tls/pull/5427
• feature: update default_pq to support secp384r1_mlkem_1024 by @johubertj in https://github.com/aws/s2n-tls/pull/5433
• build(deps): bump cross-platform-actions/action from 0.28.0 to 0.29.0 in /.github/workflows in the all-gha-updates group by @dependabot[bot] in https://github.com/aws/s2n-tls/pull/5435

Full Changelog: https://github.com/aws/s2n-tls/compare/v1.5.22...v1.5.23