Home Page Download Manual GitHub Mediawiki Mailing lists Contributions Related links

Crypto++ 8.3

Crypto++ 8.3 was released on December 20, 2020. The 8.3 release was a minor, planned release. There was one CVE and no memory errors. A recompile of programs is required due to an unintentional ABI break in Crypto++ 8.3.

The 8.3 release cleared CVE-2019-14318. Ján Jančár discovered multiple information leaks in elliptic curve algorithms. The CVE was tracked under Issue 869. See the section CVE-2019-14318 below for more details.

Download

The download is available from the Crypto++ website. The checksums for the download are below. Release signatures can be verified using GnuPG according to Release Signing.

Mirrors for the download are below. Note that GitHub checksums on the ZIP or TAR are different because the service creates the archive from sources.

Release Notes

The release notes for Crypto++ 8.3 follows.

Bug fixes and Minor Issues

The bug fix and minor issue list for Crypto++ 8.3 follows. Many non-trivial issues are tracked for auditing and C&A purposes, but the list may not be complete. A number in parenthesis is the GitHub Issue number, if it was tracked. Sometimes a Git commit is referenced, but many trivial GitHub commits are omitted. Missing Issue numbers or lack of consecutiveness usually indicates feature requests and "won't fix/can't fix" type reports.

CVE-2019-14318

Ján Jančár discovered multiple information leaks in elliptic curve algorithms. The first is in ECDSA due to leaking nonce length information. The second is information leaks in elliptic curve ECP class (prime fields) and the Add, Double and Multiply class member functions. The third is information leaks in elliptic curve EC2N class (binary fields) and the Add, Double and Multiply class member functions.

Based on research of antique Crypto++, it appears the issue affects Crypto++ 3.2 and forward. Crypto++ 3.2 was released March 2000.

The CVE was tracked under Issue 869.

Configure.sh script

The Crypto++ 8.3 release added a configure.sh script. The script helps fix misdetected features on Android, Clang, OS X and iOS. You should use the script before a build if the library misdetects features for you.

The script fixes misdetected features by rewriting config_asm.h and config_cxx.h for the platform it is run on. To run the script perform these steps. You should set CXX and CXXFLAGS to your preferred flags before running the script.

$ cp -p TestScripts/configure.sh .
$ CXX=g++ ./configure.sh
Configuring for x86_64
Compiler: /usr/bin/g++
Linker: /usr/bin/ld
Done writing config_asm.h
Done writing config_cxx.h

The configure.sh script is located in TestScripts/. It was placed there to avoid confusing users because the script is usually not needed.

A wiki page is available at Configure.sh script.

X.509 Certificate interface

Crypto++ was modified to support certificates by way of a Certificate base class. The library does not provide concrete certificate classes, however. An X.509 Certificate class is available as an add-on at noloader | cryptopp-pem.

FIPS DLL deprecation

The FIPS DLL used to be an important artifact for Windows builds. NIST moved the Crypto++ library to the Historical Validation List in 2014. The Windows DLL is no longer validated.

The project files to build the FIPS DLL are cryptdll.vcxproj and dlltest.vcxproj. The projects are now deprecated and subject to removal.

File Changes

Below is a list of all files that were added at Crypto++ 8.3.

$ git diff-tree -r --summary CRYPTOPP_8_2_0 CRYPTOPP_8_3_0 | grep -v "change" | awk '{$2=$3=""; print $0}' | egrep '(\.h|\.cpp|\.S|\.txt|\.dat)'
create   TestData/ecies_p160.dat
create   TestData/ecies_t163.dat
create   TestVectors/xts.txt
create   allocate.cpp
create   allocate.h
create   config_align.h
create   config_asm.h
create   config_cpu.h
create   config_cxx.h
create   config_dll.h
create   config_int.h
create   config_misc.h
create   config_ns.h
create   config_os.h
create   config_ver.h
create   secblockfwd.h
create   sha1_armv4.S
create   sha1_armv4.h
create   sha256_armv4.S
create   sha256_armv4.h
create   sha512_armv4.S
create   sha512_armv4.h
create   xts.cpp
create   xts.h