Download Bouncy Castle for C# .NET

Defects Fixed

• ASN.1: Fixed tagging of LinkedCertificate.certIssuer field (CHOICE type).
• ASN.1: Grow definite-length contents incrementally; avoid allocating the full declared length up front, so a short crafted header over a raw
  stream cannot drive a heap-sized allocation before any data is read.
• ASN.1: Read BMPString through DefiniteLengthInputStream.ToArray for short-header/large-allocation protection.
• ASN.1: Rework sequence-parsing pattern to avoid throwing IndexOutOfRangeException.
• ASN.1: Apply sequence minimum size restriction in X.509 extension types.
• BigInteger: Fix IndexOutOfRangeException for some (negative) signed array inputs.
• BIKE: Make decapsulation Fujisaki-Okamoto-robust and constant-time; avoid a null return/NRE out of Decaps. and a conditional branch.
• CCM: Validate tag length on decryption as well as encryption (CcmBlockCipher).
• CCM: Don’t release plaintext on failed decryption (CcmBlockCipher).
• CMS: Fix generation of certs-only signed-data (regression in 2.6.0).
• CMS: Make OriginatorIdentifierOrKey IssuerAndSerialNumber property correctly optional.
• CMS: Reject malformed/empty CMS content (or content-less ContentInfo) with CmsException instead of NullReferenceException.
• CMS: Validate RFC 5084 ICV length in CcmParameters/GcmParameters.
• CMS: Cap the PasswordRecipient PBKDF2 iteration count (CPU-DoS guard).
• CMS: constant-time RSA PKCS#1 v1.5 key-transport unwrap. Avoid a Bleichenbacher padding oracle when unwrapping content keys using RSA/PKCS1.
  A random-key fallback is used when the padding is invalid, instead of raising a bad padding error. Only possible for fixed size CEK; others
  are rejected by default (configurable; see CmsAllowLenientRsaPkcs1 in Properties).
• DH: Add proper validation of peer ephemeral values in DHAgreement (small subgroup checks).
• DTLS: Bound handshake reassembly buffer by peer max message size. Without this bound, the reassembly buffer was sized from the attacker-controlled
  uint24 handshake message length, a memory exhaustion DoS.
• EAX: Validate tag length on init (EaxBlockCipher).
• ElGamal: validate ciphertext components on decryption (small-subgroup confinement).
• Frodo: Fix error sampling to be constant-time.
• HQC: Fix implicit rejection to cover the full 32-byte secret. The conditional move in Decaps was incorrectly bounded by the message length k,
  instead of SharedSecretBytes. For HQC-128/192 this gave a plaintext-checking oracle on the underlying PKE (HQC-256 unaffected).
• IES: Derive MAC key from a fixed KDF prefix in stream mode to close static-key cross-message forgery (IesEngine).
• IES: When decrypting, verify MAC before DoFinal call to avoid padding oracle (IesEngine).
• JKS: Handle `keytool` ASN.1 format change for key entries as of `v20`.
• KCCM: Propagate carry in gamma counter to stop keystream repeating every 256 blocks (KCcmBlockCipher).
• KCCM: Process G1 nonce-binding block even when no AAD is present (KCcmBlockCipher).
• KCCM: Fix decryption to only output plaintext (i.e. without the MAC); clear plaintext output if MAC verification fails (KCcmBlockCipher).
• KCCM: Fix GetOutputSize, GetUpdateOutputSize methods (KCcmBlockCipher).
• KCCM: Fix nonce expansion (KCcmBlockCipher).
• LMS: public key parsing (including HSS) now enforces the RFC 8554 well-formedness rules.
• ML-KEM: Fix MLKemPrivateKeyParameters.WithPreferredFormat.
• OpenPGP: Fix the issue that bodyLen may exceed int.MaxValue.
• OpenPgp: Fix NPE when encoding signature without hashed area.
• OpenPgp: Fix expiry time calc when later packets increase or remove it.
• OpenPgp: Cap signature and user-attribute subpacket body lengths to avoid potential ~2GB allocation before any read; a pre-auth DoS.
• OpenPgp: Reject bare CR in ASCII-armor header values to stop armor injection.
• OpenPgp: Add Argon2 parameter limits; S2K Argon2 parameters used with only the RFC memory cap and no policy ceiling can force OOM/hang.
• OpenPgp: Obsolete PgpPublicKey.IsRevoked as a misleading name. Replace with HasRevocation and fix NPE for encryption algorithm primary keys.
• OpenPgp: Fix ArmoredInputStream handling of dash-escaping in cleartext-signed (CSF) messages.
• PKCS12: Validate iteration counts.
• PKCS12: Reject empty Pkcs12Store.Load input with IOException instead of NullReferenceException.
• PKCS12: Fix out of memory on looping certificate chain during Pkcs12Store.Load.
• Pkix: Fix potential unbounded recursion in PkixCertPathBuilder when CRL revocation enabled and a CRL had multiple candidate signers, e.g.
  several trust-anchor roots sharing the issuer DN.
• Pkix: Handle emailAddress values in multi-valued RDNs.
• Pkix: PkixAttrCertPathValidator validates the AC path but never verifies the attribute certificate’s own signature, so a forged AC is accepted. Fixed.
• Pkix: Bound the valid-policy-tree size during path validation. RFC 5280 policy-mapping x anyPolicy expansion (6.1.3/6.1.4) grows the valid-policy-tree
  multiplicatively per certificate with no node cap. Call CheckPolicyTreeSize() during ProcessCertD to guard against excessive growth.
• Pkix: Fix various name-constraint bypasses: matching a directoryName subtree as a substring instead of a prefix; mis-parsing ‘@’ in URI SANs, thus extracting
  the wrong host; deriving the mailbox host of an rfc822Name by splitting at the first ‘@’; failure to normalize trailing dots for URI/rfc822Name; failure to
  match an IPv4-mapped IPv6 address.
• Pkix: Reject ambiguous multi-‘@’ rfc822Name tested names.
• Pkix: Enforce CIDR masks for iPAddress name constraints.
• Pkix: Fix ReasonsMask implementation/usage and simplify IDP/DP intersection. HasNewReasons now correctly checks whether a CRL could contribute any new reasons.
• Pkix: Fix the SortCerts convenience CertPath reorder, which was failing for some inputs due to mutating a collection while iterating.
• Pkix: Enforce minimum size of 1 for NameConstraints permittedSubtrees, excludedSubtrees, and create GeneralSubtrees class for working with them.
• TLS: Server now selects a key_share group before checking for an early key_share.
• TLS: Throw fatal decrypt_error for invalid TLS 1.3 PSK binder (instead of just skipping).
• TLS: Reject non-SEQUENCE TLS Features with a fatal bad_certificate alert.
• TSP: reject empty/truncated input in the request/response parsers.
• X509Name: Allow unescaped ‘=’ in RDN attribute value.
• X509Name: Validate generation of 2 character country codes (still permits parsing non-conforming names).
• X509Name: Fix handling of hex-escaped UTF8 (avoid quadratic buffer inserts).
• X509Name: Reject commonName (CN) attribute values longer than 64 characters when constructing (still permits parsing non-conforming names).
• Restore old raw RSA behaviour (RSA, NONEwithRSA, etc.) in SignerUtilities (regression in 2.6.0).
• Fix CmcePrivateKeyParameters.ReconstructPublicKey method.
• Fix ECGOST3410 keys format.
• SM2 user ID length checks.
• Fix hash size in HashMLDsaSigner.FinishPreHash (in span branch).
• Check that AuthorityKeyIdentifier issuer, serial number are both present, or both absent.
• Bound the DH/DSA modulus size at import to cap a validation ModPow DoS through CPU exhaustion (configurable; see DHMaxSize, DsaMaxSize in Properties).
• Bound PBES2 PBKDF2 iteration count when decrypting PKCS#8 private keys, to avoid CPU-exhaustion DoS decrypting an attacker-supplied container.
• Bound PKCS#5 v1.5 PBE iteration count when decrypting PKCS#8 private keys, to avoid CPU-exhaustion DoS decrypting an attacker-supplied container.
• Bound the PKMAC/CMP password-based-MAC iteration count, to avoid CPU-exhaustion DoS.
• Rfc3394WrapEngine and Rfc5649WrapEngine Init methods now throw on unrecognized parameters.

Additional Features and Functionality

• ASN.1: Add Org.BouncyCastle.Asn1.MaxLimit property (Properties.Asn1MaxLimit) to use when specific Stream limit cannot be determined.
• ASN.1: Add Org.BouncyCastle.Asn1.MaxDepth property (Properties.Asn1MaxDepth) to limit recursion depth of constructed tags (default 64).
• ASN.1: Reduce tmp buffers used by Asn1InputStream.
• ASN.1: High-tag support in streaming generators.
• CCM: Add nonce reuse guard on encryption (CcmBlockCipher).
• EAX: Add nonce reuse guard on encryption (EaxBlockCipher).
• CMS: OriginatorInfo support in parsers.
• CMS: Algorithm Protection attribute support in signed-data classes.
• DotNetUtilities: Add X509Certificate2 interop.
• DTLS: Now throws TlsFatalAlertReceived when fatal alert received, as for TLS.
• DTLS: Set server record layer version(s) earlier, allowing for earlier handshake alerts.
• Ed25519: Add low-level expanded private key support (Org.BouncyCastle.Math.EC.Rfc8032.Ed25519.ExpandedKey).
• HQC: Update to v5.
• ML-KEM: Move public key validation into MLKemPublicKeyParameters.
• ML-KEM: Add private key validation.
• OCB: Add nonce reuse guard on encryption (OcbBlockCipher).
• OpenPgp: Add capped decompression method to PgpCompressedData.
• OpenPgp: Add GetValidSeconds variant that checks subkey bindings. The existing GetValidSeconds() computes a subkey's expiry from SubkeyBinding signature packets without verifying them against the primary key; this is subject to tampering, which could make an expired subkey appear valid.
• OpenSsl: Add support for "EC PARAMETERS" via Asn1.X9.X962Parameters.
• PKCS12: Improve handling of unmarked keys in Pkcs12Store.
• Pkix: Auto-detect SGP.22 certificates and apply special rules during name-constraint validation.
• RSA: Improved modulus validation (configurable; see RsaAllowUnsafeModulus, RsaMaxMRTests, RsaMaxSize in Properties).
• TLS: Expand SrtpProtectionProfile constants.
• TLS: Hybrid ECDHE-MLKEM key shares in TLS 1.3 per draft-ietf-tls-ecdhe-mlkem-00.
• TLS: Server may send supported_groups in TLS 1.3.
• TLS: Server optionally prefers its supported_groups order in TLS 1.3.
• TLS: Support for integrity-only cipher suites in TLS 1.3 per RFC 9150.
• TLS: ML-DSA support in TLS 1.3 per draft-ietf-tls-mldsa-00.
• TLS: SLH-DSA support in TLS 1.3 per draft-reddy-tls-slhdsa-01.
• TLS: Add NegotiatedGroup property to SecurityParameters (TLS 1.3+).
• TLS: Add curveSM2MLKEM768 hybrid group per draft-yang-tls-hybrid-sm2-mlkem-03.
• TLS: (Experimental) ShangMi suites for TLS 1.3 (RFC 8998).
• X509Name: Eager validation of RDN values.
• X509Name: Support "DN", "DNQ" and "dnQualifier" as parsing aliases for the dnQualifier attribute.
• X509Name: Support "S" as a parsing alias for "ST".
• Add ECGOST3410 (ECVKO) key agreement.
• Add ZeroMemory methods to Arrays utility, for unelidable clearing.
• Arrays.Clone now uses explicit allocation, copy; GC.AllocateUninitializedArray when available.
• Add XChaCha20 and XChaCha20-Poly1305 implementations.
• Speed up safe prime generation for DH/ElGamal parameters.
• Unify binary polynomial code, replacing that in F2mCurve, BIKE and HQC. Significant performance improvements and constant-time behaviour.
• Add Lib25519 utility class (in Org.BouncyCastle.Crypto.Utilities), for interop with lib25519.
• Add Properties utility (Org.BouncyCastle.Utilities) to allow thread-local settings influencing library behaviour (will also read through to environment variables).

Additional Notes

• See the (cumulative) list of GitHub pull requests that we have accepted at bcgit/bc-csharp.