Release Notes
========================================

Version 3.14.0, 2026-11-04
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

General Notes
-------------

* Botan4 is expected to be released in May 2027. This new major release will
  remove significant deprecated functionality.  Please consult the deprecation
  notes in ``doc/deprecated.rst`` and if your usage would be impacted by any
  such deprecations, please comment in GH #4666

* Add a warning to the documentation regarding recent research on the security
  of Classic McEliece. Following the current recommendations of BSI, Classic
  McEliece should only be used in a hybrid scheme. (GH #5993)

* The API documentation now consistently warns about algorithms and operations
  with known side channel issues. (GH #6007)

New APIs and Features
----------------------------------------

* Add types ``PK_Signature_Options`` ``PK_Encryption_Options``, ``PK_KEM_Options``,
  and ``PK_Key_Agreement_Options`` which allow an application to precisely control
  how public key operations (signature, encryption, decryption, KEM, etc) are
  performed. (GH #5489 #5864)

* Add an implementation of HPKE from RFC 9180 (GH #5989)

* Add an implementation of the BLS12-381 pairing friendly curve, including the
  groups G1, G2, and Gt and the pairing operation. (GH #5718)

* Add ``Work_Executor``, which allows an application to replace the library's
  internal thread pool with its own executor. (GH #5990)

* ML-DSA signatures now support the application context string of FIPS 204, passed
  via ``PK_Signature_Options::with_context``. (GH #5531)

* Add an experimental C API for TLS in the new ``ffi_tls`` module, currently
  covering policies, credentials, and session managers. Experimental modules
  are not built by default and not covered by SemVer. (GH #2492 #5941 #5963)

* Introduce a new design for entropy sources. (GH #5928 #5945)

* Add ``EC_Group::register_custom_group``, which makes explicit the registration
  behavior previously only available as a side effect of the ``EC_Group``
  constructor taking the curve parameters. (GH #5922)

* Add ``group`` functions returning the associated ``EC_Group`` to ``EC_Scalar``
  and ``EC_AffinePoint``. (GH #5948)

* Add ``TLS::Callbacks::tls_register_deferred_operation``, which gives the
  library explicit control over DTLS retransmission timers, as an alternative
  to polling ``Channel::timeout_check``. Use of ``timeout_check`` is deprecated.
  (GH #5915 #6096)

* In TLS 1.3 send KeyUpdate requests when the number of records sent or
  received approaches a policy-set limit. (GH #5877)

* Add ``TelephoneNumber`` and ``TelephoneNumberRange`` types modeling the
  telephone numbers and number ranges used in RFC 8226 STIR certificates.
  (GH #5979)

* Add ``PKCS12::mac_protected`` which indicates if the PKCS #12 file was
  protected using a MAC. (GH #5902)

* ``Jitter_RNG`` now accepts the compliance mode and the oversampling rate which
  should be used by the jitterentropy library. AIS 20/31 NTG.1 compliance can be
  requested with ``Jitter_RNG::Mode::NTG1`` if jitterentropy 3.7.0 or later is
  used. Note that ``Jitter_RNG`` no longer forces the FIPS mode of jitterentropy
  by default; use ``Jitter_RNG::Mode::FIPS`` to retain the previous behavior.
  (GH #5832)

* FFI handles can now share ownership of the underlying object. The RNG passed
  to ``botan_tpm2_ctx_enable_crypto_backend`` is now retained for the lifetime
  of the TPM2 context, rather than being borrowed. Add ``botan_is_shared`` and
  ``botan_use_count`` to query the ownership of a handle. (GH #5959 #6038 #6048
  #6052)

* Add FFI functions ``botan_ec_scalar_get_group``, ``botan_ec_point_get_group``,
  and ``botan_ec_point_to_mp_xy``. (GH #6080)

* Add FFI functions ``botan_x509_crl_view_issuer_dn`` and
  ``botan_x509_crl_view_issuer_dn_count`` for accessing the issuer DN of a CRL.
  (GH #6077)

* ``Processor_RNG`` now supports the ARMv8.5-A FEAT_RNG extension (the ``RNDR``
  instruction) on aarch64. (GH #5228 #6084)

Security and Hardening
----------------------------------------

* CVE-2026-118770 Fix a use after free in the TLS asio integration which
  depending on application usage patterns may allow leaking heap memory
  to the peer.

* CVE-2026-118771 Fix a bug in TLS 1.3 which could allow an unauthenticated
  peer to pin unlimited amounts of memory in the handshake by sending many
  dummy ChangeCipherSpec messages.

* Fix a bug in DTLS which allowed a peer to skip the cookie exchange even
  if the policy required it.

* Address various DTLS handshake desync bugs (GH #5783)

* Fix a number of minor TLS conformance bugs and validate peer input with
  respect to some RFC requirements which were previously ignored. (GH #6061)

* During X.509 path validation, signatures are now verified starting from the
  trust anchor down to the leaf, stopping at the first invalid signature.
  (GH #5982)

* CRL signatures are now checked against the trusted hashes policy, as already
  done for certificate signatures. (GH #5981)

* Ed25519, Ed448, X25519, and X448 public keys are now fully validated
  on deserialization, rejecting points of low order. (GH #5594)

* Harden EC, RSA, DL, and Ed25519 private key loading, rejecting various invalid
  encodings and parameters. (GH #5994 #5995 #5996 #5997 #6009 #6041)

* All paths which decode or construct an ``EC_Group`` now verify the complete
  set of group parameters, including generator validity, the Hasse bound, and
  the curve discriminant. Anomalous curves (where the order equals the field
  prime) are now rejected, and the deprecated ``EC_Group`` constructor rejects
  cofactors of zero or greater than 16. (GH #5921)

* ECIES now verifies that the peer's public point is encoded using the point
  format specified in the ECIES parameters. Also, ``EC_AffinePoint::deserialize``
  now rejects hybrid encoded points of the wrong length. (GH #5913 #5920)

* Rework how stateful RNGs decide that they are seeded. Previously a call of
  ``randomize_with_input`` with an empty output and a non-empty input of
  sufficient length was treated as sufficient for seeding. Now only an explicit
  call of ``initialize_with`` or ``add_entropy`` is treated as a possible seeding
  event. (GH #5928 #5945)

* The TLS server now validates that the host name received in the SNI extension
  is a syntactically valid DNS name. The name passed to the ``Credentials_Manager``
  and other callbacks is now the canonical (lowercased) form. (GH #5937)

* Fix various bugs in decoding the RFC 3779 IP address and AS identifier
  extensions. Add interop between ``IPAddressBlocks`` and the IPv4/IPv6 name
  types. (GH #5957 #5978)

* Fix lenient decoding of the RFC 8226 TNAuthList extension, and add
  support for encoding it. (GH #5977)

* Replace the algorithm name parser with a stricter and faster one. Previously,
  invalid or trailing parameters were sometimes silently ignored, for example
  ``HMAC(SHA-512,Foo)`` was accepted. (GH #5956)

* Fix several bugs and missing validations in the HTTP client. Control
  characters in headers are now rejected, ``RequestLimits`` now caps the
  response body at 8 MiB by default, and timeouts are tracked using a monotonic
  clock with the budget carried across redirects. (GH #5980)

* SPAKE2+ now rejects a ``ProverSecret`` with w0 or w1 equal to zero, and the
  context moves to a failed state if any peer message fails to decode, rather
  than allowing further attempts. (GH #5976)

* Avoid an information leak during RSA key generation, where the number of
  candidate primes rejected after sieving leaked some bits of the final prime.
  (GH #6068)

* The Lucas primality test is now constant time; previously the search for the
  parameter D leaked information about the prime being tested. (GH #6067)

* Fix various minor side channels, including a value dependent branch when
  storing BigInt words, a value dependent loop in modular multiplication,
  variable length blinding of RSA exponents, and a branch when negating Ed25519
  field elements. Many more secrets are now marked for the valgrind based
  constant time checks. (GH #6069 #6071)

* Improve validation of ML-KEM, ML-DSA, FrodoKEM, Classic McEliece, McEliece,
  and XMSS keys. Invalid keys now consistently throw ``Decoding_Error``, and
  various cheap consistency checks are performed during deserialization.
  (GH #6083)

* Fix two bugs in TLS session resumption. A server now verifies that a resumed
  session satisfies the current policy, including client certificate
  authentication requirements and (in TLS 1.2) the ciphersuite requirements,
  rather than accepting any previously established session. Additionally a
  session manager shared between a client and a server role no longer allows a
  session established in one role to be resumed in the other. (GH #5797 #5837)

* TLS now limits the number of consecutive useless records (empty records,
  warning alerts, and TLS 1.3 compatibility mode ChangeCipherSpec) accepted
  from the peer, closing the connection if the limit is exceeded. The default
  limit of 32 can be changed using ``TLS::Policy::max_useless_records``.
  (GH #6051)

* ``AutoSeeded_RNG`` now mixes a high resolution timestamp along with output
  from the system RNG into each request, to help recover from a VM rollback or
  process duplication which the kernel RNG did not detect. (GH #6054)

* The stateful key index registry used by XMSS and HSS-LMS now detects a fork
  using the fork generation counter rather than only the process ID, and
  ``Stateful_RNG`` now detects a fork which occurs before it is first seeded.
  (GH #6058)

* The baseline SM4 implementation (used if there is no suitable AES or SIMD
  hardware) is now constant time. (GH #6090)

Behavior Changes
----------------------------------------

* TLS now enforces that certificates contain the digitalSignature bit (or, for
  TLS 1.2 RSA key exchange, keyEncipherment). Previously nonRepudiation or
  dataEncipherment key usages were also accepted. (GH #6061)

* If the TLS policy requires client authentication then PSK ciphersuites will no
  longer be accepted, since PSK plus client auth is not supported in the handshake.
  (GH #6061)

* Update the ML-DSA private key encoding in PKCS #8 containers to conform to
  RFC 9881. All three encodings of the RFC (seed, expanded key, both) are
  supported. The old formats can still be decoded. (GH #5002 #5307)

* Update the ML-KEM private key encoding in PKCS #8 containers to conform to
  RFC 9935. The old formats can still be decoded. (GH #5934)

* By default, ECDSA signatures are now randomized rather than deterministic even
  when RFC 6979 support is available at build time. Deterministic signatures can
  be requested using the API ``PK_Signature_Options::with_deterministic_signature``
  or by appending ",Deterministic" to the normal hash specifier string. (GH #5489)

* ``AutoSeeded_RNG`` now uses HMAC_DRBG with SHA-256 rather than SHA-512 when
  hardware support for SHA-256 is available. (GH #6003)

* Rework ``ChaCha_RNG``: it now uses HMAC(SHA-512) instead of HMAC(SHA-256) and
  also derives the ChaCha nonce from the key material. Optional fast key erasure
  can be enabled with ``ChaCha_RNG::KeyErasure::WithKeyErasure`` to gain
  backtracking resistance. As a result the output of ``ChaCha_RNG`` for a given
  seed has changed; it was never guaranteed to be stable across versions and may
  change again in the future. (GH #5121)

* Password hash tuning (``PasswordHashFamily::tune_params``) now measures the
  CPU time of the calling thread where available (falling back to a monotonic
  clock), and uses the fastest of several samples rather than the mean. This
  makes the result much less sensitive to concurrent load and clock adjustments.
  (GH #5898)

* During X.509 path validation the self-signature of the trust anchor is no
  longer verified; the anchor is trusted because the application provided it.
  For a typical chain this removes about a third of the cost of path
  validation. (GH #6008)

* DSA now rejects parameters where p is smaller than 512 bits or larger than
  3072 bits, or where q is larger than 256 bits. Previously only a minimum of
  160 bits for q was enforced. (GH #6039)

* The ASN.1 pretty printer now formats integers of fewer than 32 bits in
  decimal; previously the limit was 16 bits. (GH #6025)

Optimizations
----------------------------------------

* Add support for parallel hash function invocations, including AVX2/AVX512
  implementations of SHA-256, SHA-512, and SHAKE (GH #5493 #5865 #5867 #5869
  #5871 #5872 #5873)

* Optimize SLH-DSA, XMSS, HSS-LSM, FrodoKEM, and ML-KEM using parallel hash
  function execution. (GH #5866 #5868 #5870 #5876 #5878)

* Refactor and optimize Ed25519 (GH #5893)

* Refactor and optimize X25519, especially improving key generation (GH #6010)

* Elliptic curve optimizations, especially improving P-256 and SM2.
  (GH #6012 #6013 #6020 #6021 #6024 #6031 #6059)

* Add AVX-512+IFMA modular exponentiation support, improving RSA and FFDHE by 3-4x
  (GH #6026)

* Add a fused Montgomery multiplication using BMI2/ADX, improving modular
  exponentiation on x86-64 processors without IFMA by about 30%, and optimize
  the corresponding Montgomery squaring. (GH #6044 #6053)

* Add AVX2 codepath for ML-KEM (GH #5964 #6032 #6033)

* Enable many SIMD optimizations on POWER systems (GH #6027 #6028)

* Improve the performance of one-shot RSA private key operations (GH #6004)

* Optimize multiprecision integer division operations, and convert all
  such divisions to be constant time with respect to their inputs.
  (GH #5849 #5880 #5883 #5884)

* Optimize primality testing by performing trial division by small primes
  before running Miller-Rabin, rewriting the Lucas test to use Montgomery form,
  using faster variable time variants when testing public parameters, and
  running the Miller-Rabin and Lucas tests in the thread pool when it is
  available. (GH #5886 #6040)

* Improve the performance of X.509 certificate parsing, including PEM decoding,
  OID decoding, and extension handling. (GH #5888 #5889 #5890 #5891)

* Avoid quadratic behavior when decoding an X.509 distinguished name with many
  attributes. (GH #6063)

* Add a certificate cache to the macOS system certificate store, implement
  ``contains()`` directly, and query the keychain by issuer DN and serial
  number instead of scanning all certificates of an issuer. (GH #5541 #5929)

* Resolve a performance regression in TLS 1.3 record processing introduced
  in 3.13.0, and avoid several copies and allocations on the send side.
  (GH #6002 #6046)

* Reduce memory allocations during TLS 1.2 record processing. (GH #5887)

* Use the AES instructions to compute the key schedule on x86, ARMv8, and
  POWER8, making ``AES::set_key`` substantially faster, especially on ARMv8 and
  POWER8 which previously used the bitsliced software key schedule.
  (GH #6078 #6081)

* Modify the bitsliced AES implementation to use the native word size of the
  processor, instead of always 32 bits. (GH #5826)

* The AVX-512/GFNI Twofish implementation is now used for all blocks, including
  any tail of fewer than 16 blocks, so the table based implementation is never
  used on processors which support these extensions. (GH #5975)

* Optimize the Whirlpool compression function on x86-64 and aarch64. (GH #5857 #5892)

* Add an AVX-512 implementation of base64 encoding and decoding (GH #5999)

* Optimize base58 encoding and decoding (GH #5858)

* Enable support for NEON/ARMv8 codepaths on Windows aarch64 (GH #5863)

Bug Fixes
----------------------------------------

* Fix a bug where a TLS 1.2 client configured with multiple certificate chains
  selected among them arbitrarily, without considering the server's
  signature_algorithms extension. (GH #5932)

* Fix the in-memory TLS session manager, which ordered stored sessions by
  session ID rather than by recency, so the wrong session could be evicted or
  returned. (GH #5847)

* Fix a bug introduced in 3.13.0 where, in builds without the system RNG,
  ``RandomNumberGenerator::randomize_with_ts_input`` passed only the low 32 bits
  of the timestamp, and never the process id, as additional input. (GH #5924 #5926)

* Fix various bugs in RNGs and entropy sources, including some edge cases
  involving fork safety. (GH #5987)

* Fix several bugs in the PKCS #11 wrapper, including typed key searches
  matching keys of the wrong type, EC public keys always being encoded in
  compressed form, ECDH accepting peer points with a small order component,
  and ``Object::destroy`` leaving a stale handle. (GH #5983)

* Fix a race in the FFI layer where the thread-local storage for the last exception
  message could be accessed after its destruction during process shutdown. (GH #5859)

* Fix libsodium compatibility issues in the sodium compat layer (GH #5966)

* Fix various edge cases in the sqlite3 database wrapper. (GH #5972)

* ``TOTP::verify_totp`` now takes an optional ``forward_drift_accepted``
  parameter to accept codes from a client whose clock is ahead of the
  server's, as allowed by RFC 6238. The existing ``clock_drift_accepted``
  parameter is unchanged and still only applies backwards. (GH #6035 #6070)

* Fix several corner case bugs in CPU feature detection. (GH #6036)

* Fix the move operators of ``Dynamically_Loaded_Library``, which previously
  caused the library to be closed twice. (GH #5967)

* Fix various bugs in the TLS ASIO stream. Cancellation slots are now forwarded
  to the next layer so that timeouts reach pending operations, synchronous
  operations are refused while an asynchronous write is in flight, operations
  attempted before the handshake no longer cause all later handshakes to fail,
  and move assignment of ``Stream`` now compiles. (GH #6060)

* Fix various bugs and edge cases in the stateful hash signature schemes XMSS
  and HSS-LMS (GH #6066)

Deprecations and Cleanups
----------------------------------------

* Deprecate the public header ``pem.h``; it will become internal in Botan4.
  (GH #5891)

* Deprecate the modules ``filters``, ``comb4p``, ``passhash9``, ``emsa_x931``,
  ``ofb``, ``rc4``, ``certstor_sql``, and ``certstor_sqlite3``. Additionally SRP6,
  the X9.42 PRF, and the TLS OCB ciphersuites are now documented as deprecated.
  (GH #5971)

* Remove many unused header includes, including from public headers.
  Applications which relied on transitive includes may need to add explicit
  includes. (GH #5897)

Command Line Utility
----------------------------------------

* Add a ``create_cert_for_key`` command, which issues a certificate directly for
  a public key without requiring a PKCS #10 request. This allows creating
  certificates for KEM keys such as ML-KEM. (GH #5529)

* Add a ``--one-shot`` flag to the ``speed`` command which causes the public key
  benchmarks to create a new operation object (``PK_Signer``, ``PK_Verifier``, ...)
  for each measured operation, rather than creating one and reusing it. (GH #5951)

* Remove the sandboxing support (``sandbox_init``, ``pledge``, Capsicum) from
  the command line tool. Recent versions of macOS kill any process which calls
  ``sandbox_init``, and the other implementations were dead or untested code.
  (GH #5940 #5942)

* Fix many bugs in the command line tool. Commands now consistently report
  failures through the exit status, integer and option arguments are strictly
  validated, I/O errors are consistently detected, and passing the same file as
  input and ``--output`` no longer truncates the input. (GH #6037)

Python Binding
----------------------------------------

* The Python binding now can adapt itself to any version of Botan3. (GH #5851)

* Add ``X509Cert.binary_values``/``string_values`` and the equivalents on ``X509CRL``.
  (GH #5984)

* Fix a number of bugs in the Python binding (GH #5969 #6064)

Build and Infrastructure
----------------------------------------

* Add support for precompiled headers with GCC and Clang, enabled using
  ``--enable-pch``. (GH #5298)

* SIMD support on POWER now requires POWER8 (VSX). (GH #6029)

* Add ``--disable-lsx`` and ``--disable-lasx`` options for LoongArch. (GH #5108)

* Various build fixes, including for MinGW with libc++ 20 or later, the import
  library output directory with GCC on MinGW, and Clang on Aarch64.
  (GH #5850 #5854 #5875 #5901 #5953 #5954)

* The ``aes_ni``, ``aes_armv8``, and ``aes_power8`` modules have been merged
  into a single ``aes_hwaes`` module. Build configurations which referenced the
  old module names must be updated. (GH #6081)

* Fix the CMake package configuration on MinGW, which did not set
  ``IMPORTED_IMPLIB`` for the imported target. (GH #6057)

* CI updates including moving most builds to Ubuntu 26.04, adding Windows Aarch64
  builders, dropping the 32-bit MIPS cross build, updating dependencies used in
  CI, and improving resilience to slow package mirrors.
  (GH #5768 #5846 #5848 #5860 #5861 #6065)

Version 3.13.0, 2026-08-13
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* CVE-2026-118766 Fix a blind SSRF during OCSP request processing. A malicious
  OCSP responder or network attacker could cause the application to perform a
  blind GET to an internal service. (GH #5815)

* CVE-2026-118765 Fix a bug in ``AutoSeeded_RNG``, affecting only platforms
  without a system RNG, where an API sequence of calling first ``clear``,
  followed by ``randomize`` writing to an empty buffer, resulted in the RNG
  object being considered seeded even though it was not. (GH #5839 #5838)

* CVE-2026-104267 Fix an integer overflow in Scrypt parameter handling,
  affecting 32-bit platforms.  (GH #5820 #5629)

* CVE-2026-48057 Fix a bug where certain DN name constraints were not correctly
  enforced. (GH #5618)

* CVE-2026-118769 Fix an integer overflow in the FFI interface which might be
  exploitable in unusual scenarios involving attacker-control cipher specifiers
  and the raw block cipher (ECB) APIs. (GH #5805)

* Add URI and email name constraint processing to X509 path validation (GH #5598)

* Add ``DNSName``, ``URI``, and ``EmailAddress`` types. (GH #5598 #5601 #5622 #5663
  #5683 #5750)

* The default policy for TLS now no longer lists finite field Diffie-Hellman.
  If required for compatibility it must be enabled by the application. (GH #5782)

* By default OCSP no longer accepts soft-fail conditions such as network failure.
  (GH #5785 #5804)

* DTLS 1.2 servers now must either set a DTLS cookie secret and provide the peer
  network identity, or explicitly opt out of the cookie exchange by overriding
  ``dtls_server_require_cookie_exchange`` to return false. (GH #5792)

* Fix DTLS 1.2 handshake edge cases, including pacing of repeated timeout checks,
  replay of final flights after local activation, partial server-flight delivery,
  and delayed server-side flight handling. (GH #2310 #2498 #4022 #4036 #5696 #5790
  #5791 #5792 #5793 #5800 #5801 #5802 #5803 #5811 #5829 #5834 #5835 #5836)

* Add support for SPAKE2+ from RFC 9383 (GH #5711)

* Add support for PKCS #12 (GH #5478 #5625)

* Add support for GCM-SIV from RFC 8452 (GH #5770)

* Add support for the RFC 9608 No Revocation Available extension (GH #5595)

* Add support for encoding name constraint extensions (GH #5734)

* Add ``X509_DN::parse`` and improve the parsing and printing of Distinguished
  Name strings, including capturing RDN groupings and escaping control
  characters (GH #5618 #5657 #5658)

* Optimize ``X509_DN`` comparison and name constraint checks using precomputed
  canonical encodings (GH #5652)

* During path validation, by default require that OCSP responses are no more than
  seven days old. Previously any age was accepted as long as it preceded the
  response's ``nextUpdate``. (GH #5623)

* Improve OCSP request and response serialization (GH #5678 #5741)

* Improve handling of the authority and subject key identifier extensions (GH #5735 #5737)

* Properly decode and handle the X509 CRL Distribution Point and Authority Information Access
  extensions (GH #5712)

* Add an explicit ``X509_Serial_Number`` type (GH #5740)

* Improve CRL decoding and encoding, including support for CRL numbers larger than
  32 bits (GH #5687 #5694 #5697)

* Various X509/PKIX hardenings, optimizations, bug fixes, and additional sanity checks.
  (GH #5593 #5598 #5605 #5611 #5633 #5637 #5643 #5660 #5668 #5670 #5682 #5685 #5689 #5698)

* Various ASN.1 hardening and decoder strictness improvements (GH #5693 #5703 #5710 #5720)

* Various BigInt and number-theoretic hardening and bug fixes.
  (GH #5581 #5585 #5586 #5588 #5592 #5650 #5688)

* Reject RSA signature and ciphertext values which are not exactly the length of
  the modulus (GH #5592 #5630 #5675)

* Introduce ``PK_Decryptor::ciphertext_length`` (GH #5717)

* Fix several bugs in ISO 9796-2 signature verification, and deprecate the
  ``iso9796`` module (GH #5680)

* Fix several edge cases in stateful hash-based signatures, including rejecting HSS
  public keys with L = 0 and detecting ``fork`` in the stateful key index
  (GH #5662 #5666 #5723)

* Add support for parsing EC keys which contain the ECC domain parameters within
  the key rather than in the algorithm identifier (GH #5532)

* Various fixes and improvements for SLH-DSA (GH #5730)

* Various fixes for SM2 signatures and encryption (GH #5713)

* Improve input validation in the McEliece implementations, and avoid using
  ``bool`` for secret data in Classic McEliece (GH #5667 #5676)

* In Ed25519 verification also reject the non-canonical encoding of the identity
  element (GH #5731)

* Add hash to curve support for brainpool256r1, brainpool384r1, brainpool512r1,
  and numsp512d1 (GH #5754)

* The hash to curve and and hash to scalar functions now enforce RFC 9380's rules
  on hash function security, namely that the hash must have a security level at
  least as strong as the curve itself. (GH #5758)

* Improve the HTTP 1.0 client used for OCSP and CRL fetching (GH #5609)

* Extend Blowfish to support keys up to 72 bytes in length (GH #5714)

* Fix various edge case bugs in AEAD, cipher mode, stream cipher, MACs, and KDFs
  (GH #5610 #5628 #5642 #5659 #5665 #5672 #5674 #5742 #5743)

* Add ``HashFunction::security_level`` (GH #5746)

* Add an AVX-512/GFNI implementation of the Streebog compression function (GH #5655)

* Add optimized Salsa20 implementations using 128-bit SIMD (SSSE3, NEON), AVX2, and AVX-512
  (GH #5759)

* Add an AVX-512/GFNI implementation of ZFEC, optimize the existing vperm code (GH #5747)

* Convert the SM4 key schedule to constant time code, including hwaes variant (GH #5638 #5639)

* In the default TLS policy, prefer ECDSA over RSA signatures (GH #5727)

* Add support for the Brainpool ECDH/ECDSA groups in TLS 1.3 as specified in RFC 8734
  (GH #5691 #5771 #5772)

* Add ``TLS::Policy::record_padding_bytes``, which allows padding TLS 1.3
  records, for example out to a minimum plaintext size or to a multiple of
  some block size (GH #5752 #5843)

* TLS 1.3 handshake hardening and various minor TLS fixes (GH #5664 #5721 #5767 #5810)

* Improve ``Database`` abstraction type and make it easier to support databases
  other than SQLite, and validate SQL table names. (GH #5607 #5673)

* Fix various bugs in the PKCS #11 wrapper (GH #5602)

* Fix various bugs in the Pipe/Filter library (GH #5724 #5809)

* Fix several issues in the compression wrappers (GH #5733)

* Fix several errors in the Python binding (GH #5722 #5796 #5807 #5814)

* Add getters for the RFC 3779 extensions to the FFI interface and Python binding
  (GH #5491)

* Add ``PublicKey.load_x25519`` and ``PublicKey.load_x448`` to the Python binding
  (GH #5748)

* The Python binding documentation is now generated from the docstrings in
  ``botan3.py`` using Sphinx (GH #5233 #5765)

* Add missing, or correct erroneous, documentation comments in many headers
  (GH #5760 #5761 #5762 #5763 #5764 #5766 #5774)

* On MSVC, deprecation warnings now include the file and line number (GH #5749)

* Upgrade to TLS-Anvil 1.5 (GH #5630)

Version 3.12.0, 2026-05-06
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* CVE-2026-44378: Resolve a CPU based denial of service when decoding
  BER encoded data.

* Optimize and improve certificate store search operations (GH #5510)

* Require strict DER when decoding PKIX types such as certificates (#5521)

* Discard TLS handshake state once the handshake has completed, retaining
  only the data needed for the active connection (GH #5517)

* Various TLS conformance, hardening, and performance fixes. (GH #5550
  #5551 #5568 #5555)

* Various X509/PKIX/OCSP optimizations and bug fixes (GH #5535 #5536 #5546 #5554
  #5561 #5562 #5569)

* Skip OCSP/CRL revocation checks on certificate chains which were already
  going to be rejected due to path validation errors (GH #5512)

* Add ``BER_Decoder::Limits`` which allows controlling what DER/BER syntax is
  accepted while decoding. (GH #5507 #5514)

* Add support for IPv6 name constraints in X.509 certificate path validation,
  and add IPv6 address parsing and formatting utilities (GH #5534 #5537)

* Refactor the Windows system certificate store and add a cache of materialized
  certificates to avoid repeated parsing. (GH #5539)

* Improve handling of unknown X.509 certificate extensions (GH #5518)

* Skip checking the self-signature of self-signed certificates during parsing (GH #5515)

* Add an index to ``X509_CRL`` for fast revocation checks (GH #5511)

* Add ``X509_Certificate::Tag`` for fast searching/indexing of certificates (GH #5509)

* Change ``X509_Object`` to share immutable state between copies (GH #5504)

* Fix bugs in handling of indefinite length BER data, including missing
  EOC markers being silently accepted (GH #5545)

* Make certificate path building DFS incremental (GH #5513 #5520 #5521)

* Avoid sending the TLS ``certificate_type`` extension unless TLS 1.2 is
  disabled, since raw public keys are not currently supported in 1.2 (GH #5523)

* Add support for RFC 9258 PSK import in TLS 1.3 (GH #5523)

* Avoid truncation of large handshake messages in DTLS (GH #5522)

* Add ALPN support to the Boost ASIO TLS stream (GH #5428)

* Upgrade TLS-Anvil and add client-side TLS-Anvil testing (GH #5503)

* Upgrade BoGo tests (GH #5523 #5556)

* Add a script for running the NIST ACVP test vectors (GH #5527)

* Add ``BigInt::signum`` to simplify sign comparisons (GH #5519)

* Fixes for compiling with GCC 16 (GH #5564)

* Add DRBG helpers to the C89/FFI interface and Python binding (GH #5527)

* Add EC scalar and point operations to the C89/FFI interface (GH #5404 #5565)

* Add NIST key wrap with padding to the Python binding (GH #5521)

* Enforce maximum input length limits for ChaCha20Poly1305 and GHASH/GCM (GH #5521)

* Add ``configure.py --without-include-namespace`` to allow installing
  headers without the ``botan-3/`` subdirectory (GH #5528)

Version 3.11.1, 2026-03-31
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* CVE-2026-34580: Resolve certificate verification bypass bug introduced in 3.11.0 (GH #5500)

* CVE-2026-34582: Resolve TLS 1.3 client authentication bypass (GH #5599)

* Add optimized Argon2 implementation using AVX512 (GH #5471)

* Add optimized and constant-time Twofish implementation using AVX512/GFNI (GH #5465)

* Add optimized and constant-time SEED implementation using AVX512/GFNI (GH #5472)

* Add optimized and constant-time Whirlpool implementations using AVX2 and AVX512 (GH #5453 #5473)

* Add SSSE3/NEON and AVX2 optimized codepaths for CTR (GH #5474 #5480)

* Add constant time implementations of Camellia, ARIA, SEED and SM4 using AES-NI
  or ARMv8 AES instructions to implement sbox lookups (GH #5476 #5477 #5479 #5481 #5485 #5492)

* Improve performance of the AVX512 implementation of SHA-512 especially for Clang (GH #5490)

* Optimizations for the IDEA modular multiplication (GH #5484)

* Fix various minor TLS conformance issues flagged by TLS-Anvil (GH #5494 #5498)

* Fix bug in Ed25519 where an invalid signature checked with PK_Verifier might
  cause a later valid signature to be rejected. (GH #5454)

* Fix a bug in handling of ECDSA DER-encode signatures where an invalid signature
  checked with PK_Verifier might cause a later valid signature to be rejected.
  (GH #5455)

* Fix a problem introduced in 3.11.0 which could cause crashes on processors
  without SSSE3 support, particularly when compiled by GCC. (GH #5460 #5463 #5469)

* Fix various new warnings from ``clang-tidy`` 22 (GH #5456)

* Fix a compilation error introduced in 3.11.0 which prevented using ``ffi`` unless
  ``bcrypt`` was also enabled. (GH #5462)

* Avoid a macro collision with Microsoft headers that could cause a compilation
  problem in amalgamation mode. (GH #5486)

* Enable explicit_bzero, getentropy, getrandom on Hurd (GH #5488)

Version 3.11.0, 2026-03-15
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* CVE-2026-32877: Fix a heap over-read during SM2 decryption (GH #5450)

* CVE-2026-32883: Fix an OCSP response forgery vulnerability (GH #5449)

* CVE-2026-32884: Fix a name constraints bypass for DNS names (GH #5448)

* Upgrade PKCS #11 wrapper to support v3.2 of the standard (GH #4540)

* Add support for verifying X509 certificate chains when the trust anchor is
  not self signed. (GH #5047)

* Add support for multiple OCSP responders in an Authority Information Acesss
  extension. (GH #5231)

* Many additions to the C89/FFI interface, especially regarding X.509
  certificates and CRLs, also XOF support (GH #5148 #5166 #5188 #5217 #5220
  #5221 #5222 #5225 #5230 #5232 #5234 #5235 #5236 #5252)

* Avoid using ISA enabling flags (like `-mavx2` or `/arch:AVX`) in the build
  anymore, as this conflicts with precompiled headers and has been known to cause
  miscompilations in certain circumstances. (GH #5297 #5260)

* Add optimized Keccak permutation implementation using AVX-512 (GH #5191)

* Add optimized SM3 implementations using AVX2/BMI2 (GH #5178), SM3-NI (GH #5183),
  and ARMv8 instructions (GH #5444)

* Add optimized SM4 implementation using AVX-512/GFNI (GH #5192 #5333)

* Add optimized Camellia implementations using AVX2/GFNI and AVX-512/GFNI (GH #5442)

* Add optimized ARIA implementation using AVX-512/GFNI (GH #5440)

* Add AVX2 implementation of IDEA (GH #5447)

* Ed448 and X448 optimizations (GH #5383)

* Add AVX-512/CLMUL optimized XTS mode (GH #5251)

* GCM and GMAC optimizations including new AVX-512 codepaths (GH #5273 #5278 #5379 #5418)

* Poly1305 optimizations, including AVX2 and AVX-512 implementations (GH #5227)

* Add new DES implementation using bitslicing (GH #5433)

* Rewrite Twofish key schedule to avoid use of large tables (GH #5432)

* Generate Streebog and Whirlpool tables at compile time (GH #5427 #5430 #5434)

* Various elliptic curve arithmetic optimizations (GH #5186 #5194 #5195 #5196
  #5275 #5387 #5393 #5394 #5400 #5403)

* Add some inline asm for aarch64 improving multiprecision integer performance (GH #5407)

* Certain signature and KEM schemes, including XMSS, LMS, FrodoKEM,
  ML-KEM/Kyber, and ML-DSA/Dilithium, would fail or produce incorrect results if
  multiple threads attempted operations on the same key object concurrently. In
  a strict sense uncoordinated multithreaded use of the same object was never
  supported, but this usage did work for RSA, ECDSA, and other schemes, and the
  previous behavior is potentially quite surprising. Tests have been added to
  ensure this usage works for all schemes going forward. (GH #5359 #5361 #5366
  #5367 #5371 #5376 #5380 #5382)

* Improve handling of constant time and variable time divisions (GH #5176 #5177 #5180)

* In finite-field Diffie-Hellman use exponent lengths as prescribed in NIST SP 800-56A
  and SP 800-56B. (GH #5384)

* Optimize ECDSA signature setup phase (GH #5173)

* The R3 versions of Kyber and Dilithium are official deprecated (GH #5368)

* Check for already known/validated groups when decoding explicit EC parameters (GH #5268)

* Add support for WebAssembly SIMD, optimizing various algorithms including AES, GCM,
  ChaCha, SHA-1, SHA-256, Argon2 and others. (GH #5155 #5163 #5201)

* Emscripten/WebAssembly improvements including using the new Wasm exception mechanism
  (GH #5202) and re-enabling testing in CI with Emscripten (GH #5209)

* Allow building TLS 1.3 without TLS 1.2 (GH #5292 #5293 #5303 #5309 #5318)

* Add optional callback to provide a user-defined TLS 1.2 key derivation function (GH #5107)

* Add scripts to run Wycheproof tests every night in CI (GH #5269)

* Support for AltiVec on 32-bit PowerPC platforms has been dropped (GH #5266)

* Many changes to improve library build times (GH #5279 #5280 #5284 #5285 #5286 #5287 #5288
  #5289 #5291 #5294 #5295 #5296 #5300 #5302 #5304 #5314 #5315 #5321 #5323 #5343 #5344 #5345
  #5346 #5347 #5354)

* Test suite infrastructure cleanups (GH #5327 #5328 #5329 #5330 #5334 #5337 #5338 #5340
  #5341 #5342 #5348 #5351 #5352 #5357)

* Unroll loops to improve Montgomery reduction performance. (GH #5150)

* Increase maximum HMAC key length to 8192 bytes. (GH #5156)

* Python binding additions including custom RNG (GH #5271) and checks for explicit
  EC parameter encoding (GH #5282)

* On MSVC default to using embedded debug info rather than the PDB (GH #5349)

* Fix various clang-tidy and cppcheck warnings (GH #5172 #5207 #5204 #5205)

Version 3.10.0, 2025-11-06
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Add support for Ascon AEAD, hash and XOF from NIST SP 800-232 (GH #5061 #5076 #5097)

* Add support for building with clang-cl (GH #4255)

* Optimizations for base58 encoding and decoding (GH #5051)

* Optimizations for SHA-3/SHAKE (GH #5133)

* Optimizations for SEED (GH #5147)

* Optimizations and cleanups for BLAKE2s (GH #5117)

* Optimizations for Streebog (GH #5111)

* Add new interface to ``Certificate_Store`` allowing search by issuer DN
  plus serial. (GH #5072)

* Fix a bug preventing botan_srp6_server_session_step1 from being reinvoked
  (GH #5112 #5135)

* Modify some bit operation functions to reduce risk of compilers introducing
  non-constant time behavior (GH #5066)

* Add new FFI functions for loading elliptic curve keys in SEC1 format (GH #5083)

* Add new FFI functions for viewing the value of a ``botan_mp_t`` (GH #5131)

* New faster implementation of Jacobi function (GH #5057)

* Add optimized integer division logic for various special cases (GH #5068 #5077)

* Correct documentation/comments relating to the maximum output length
  that ``botan_mp_to_hex`` might write (GH #5131 #5129)

* Fix an issue when trying to use CMake older than 3.18 (GH #5098 #5099)

* Add typing hints to the Python binding (GH #5086 #5092)

* Fix various issues flagged by the ``ruff`` Python linter (GH #5089)

* Fix a bug in the Python binding which prevented signing raw bytes with ``PKSign``
  (GH #5082)

* Update configure to check for Fedora's new location for trust roots (GH #5052)

* Remove various internal references to "EME", an obsolete term used for RSA
  encryption padding that originates from IEEE 1363. (GH #5055)

* Fix various typos in the source and documentation (GH #5071 #5075 #5114)

* Add a ``.devcontainer`` setup (GH #5094)

Version 3.9.0, 2025-08-05
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Add SHA-1 implementation using AVX2/BMI2 (GH #4852)

* Add Camellia implementation using GFNI/AVX2 (GH #4848)

* Add SHACAL2 implementation using AVX512 (GH #4878)

* The eFrodoKEM TLS 1.3 ciphersuites have changed the suite code to match changes
  in OQS. (GH #4900)

* Add support for TLS 1.2 NULL cipher suites. These suites are disabled in the
  build by default, enable ``tls_null`` module to use. (GH #4776)

* Add support for X.509 extensions from RFC 3779 (GH #4699 #4883 #4884 #4886)

* Elliptic curve improvements (GH #4841 #4934 #4935 #4937 #4949 $4953 #4991)

* Add ``EC_Scalar::hash`` following RFC 9380's hash_to_field (GH #4950)

* Modify the OID lookup system to use a static switch for builtin OIDs. (GH #4896 #4888)

* Optimizations for X448 and Ed448 (GH #5037)

* Modify ``BOTAN_CLEAR_CPUID`` so that clearing ``ssse3`` also disables AVX2/AVX512
  (GH #4853)

* Remove various internal references to "EMSA", an obsolete term used for RSA
  signature padding that originates from IEEE 1363. (GH #5008 #5024)

* Enable support for GCC's "strub" stack clearing. This is disabled by default, use
  the ``--enable-stack-scrubbing`` option to turn on. (GH #4882 #4925)

* Use ``std::span`` in the internal block cipher padding mode interfaces (GH #4873)

* Properly check DNS label length restrictions when checking wildcards. (GH #4876 #4881)

* Work around a GCC 13/14 miscompilation when LTO is used (GH #4863 #4862)

* Fix a bug preventing building ``System_RNG`` with only ``getrandom`` enabled. (GH #4932 #4930)

* Document the specific threat model the library uses (GH #4955)

* Remove ``configure.py`` options to disable specific CPU instructions. (GH #4927)

* Remove ``configure.py`` option ``--with-local-config`` (GH #4905)

* Add a better interface for encoding optional ASN.1 elements using ``std::optional`` (GH #5001)

* Internal cleanups relating to multiprecision integers (GH #5009 #5010 #5012 #5014 #5017)

* Resolve many warnings from ``clang-tidy`` (GH #4907 #4908 #4910 #4912 #4913 #4919 #4920 #4923
  #4924 #4931 #4956 #4957 #4958 #4959 #4960 #4961 #4962 #4963 #4964 #4968 #4969 #4971 #4972 #4973
  #4974 #4975 #4976 #4977 #4978 #4979 #4980 #4981 #4982 #4983 #4984 #4985 #4986 #4987 #4988 #4989
  #4990 #4992 #4993 #4998 #5004 #5005 #5031 #5032 #5034 #5035 #5036)

* CMake improvements (GH #5022 #5027)

* CI improvements (GH #4920 #4294 #4926 #4929)

Version 3.8.1, 2025-05-07
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Fix a bug that prevented building using the ``fips140`` or ``modern`` module
  policies. (GH #4854 #4856)

* Fix a missing include that caused compilation failures with libc++20
  (GH #4855 #4857)

Version 3.8.0, 2025-05-06
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Discussion has started regarding plans for Botan4, current ETA 2027. Check the
  tracking ticket in https://github.com/randombit/botan/issues/4666 for the
  current plans.

* Ongoing elliptic curve optimizations and cleanups (GH #4554 #4620 #4623 #4625
  #4627 #4632 #4634 #4686 #4687 #4688 #4689 #4690 #4692 #4695 #4703 #4706 #4708
  #4710 #4711 #4746 #4794)

* Add support for extended private keys in ML-KEM to handle certain implementations
  which do not use the seed encoding. (GH #4817)

* Add support for SHA-512 instructions added in upcoming Intel processors (GH #4766)

* Add support for SM4 instructions added in upcoming Intel processors (GH #4768)

* The SHA-1 implementation using SSE2 has been extended to support NEON and LoongArch LSX.
  (GH #4809)

* Add SHA-256 and SHA-512 implementations using AVX2/BMI2 (GH #4818 #4821)

* Add SHA-512 implementation using AVX-512/BMI2 (GH #4842 #4849)

* Add SHA-256 implementation using SSSE3 or NEON for message expansion (GH #4819)

* The default TLS policy now prefers AES/GCM over ChaCha20Poly1305 (GH #4843)

* Add support for TLS 1.3 post-quantum KEM secp384r1/ML-KEM-1024 (GH #4752)

* Fix bugs in the server-side implementation of TLS 1.3 post-quantum hybrid
  encryption which affected ciphersuites using NIST curves. (GH #4752)

* Previously ``build.h`` included various parameters which could be modified by
  end users prior to compilation. These have been removed. (GH #4639)

* Previously ``build.h`` had macros reflecting various information about the
  target system, such as ``BOTAN_TARGET_OS_IS_LINUX``. Now all such macros have
  been moved to a new internal header. This allows sharing all installed
  headers, including ``build.h``, across multiple different builds of the
  library, as long as they all have the same version and module selection. This
  simplifies vendoring the library. (GH #4642 #4747)

* Various headers have been modified to minimize the number of inclusions they
  make. You may need to modify your application to directly include any headers
  which up until now had been implicitly pulled in. (GH #4650)

* Add an FFI example which also works as a test in CI that prevents accidentally
  making changes to ``ffi.h`` or ``build.h`` that make them incompatible with C. (GH #4640)

* Add new FFI functions regarding stateful private keys (GH #4700), OIDS (GH #4816),
  and EC_Group (GH #4834)

* Add missing checks for null pointer arguments in FFI (#4704)

* Faster base32 encoding using SWAR technique (GH #4765)

* Add support for X.509 CRLs with the ``nextUpdate`` field unset. Such CRLs
  are prohibited by RFC 5280, but do unfortunately exist within the ecosystem. (GH #4732)

* When encoding a RSASSA-PSS-Params struct, skip encoding the trailer field
  default value, as required by RFC 4055 (GH #4731)

* Extend vector permute AES to support big-endian AltiVec/VMX systems. (GH #4738)

* Extend use of POWER VMULL instruction to also support big-endian systems. (GH #4743)

* Fix encoding extended key usage in PKCS10 requests (GH #4725)

* Add internal API for hybrid PQ combiner keys (GH #4067)

* Internal refactorings of CPU feature detection. (GH #4718)

* Add support for CPU feature detection on RISCV64 (GH #4800 #4815)

* Add support for the LoongArch LSX SIMD extension in AES, SHA-1, ZFEC, ChaCha (GH #4799)

* Various SIMD-enabled implementations which previously only required SSE2 now additionally
  require SSSE3. Such optimizations will no longer be used on (now quite rare) CPUs which
  support SSE2 but not SSSE3. (GH #4803)

* Optimize parsing of large CRLs (GH #4789 #4790 #4792)

* Improve performance of RSA public and private key parsing (GH #4793)

* Add a couple examples of using format preserving encryption (GH #4758)

* CI cleanups and improvements (GH #4756 #4761 #4762 #4767 #4770 #4812 #4813)

* The ``Ed25519_PrivateKey`` constructor had behavior that varied based on the
  input length. Add explicit ``from_seed`` and ``from_bytes`` functions which
  make the two options explicit. (GH #4701 #4702)

* Add a new cleaner interface for handling ECIES flags (GH #4691)

* Reduce use of heap in GCM/GMAC (GH #4826) and hex/base64 (GH #4832)

* New faster Barrett reduction implementation (GH #4835)

* Internal RSA signature padding cleanups (GH #4635)

* Cleanups to the implementations of SHA-1 and SHA-256 using SHA-NI (GH #4773 #4774)

* Cleanups to reduce code size where possible (GH #4775 #4777 #4781 #4825)

* Fix a bug that caused the tests to skip testing AES-NI if AES-VAES was supported.
  (GH #4649)

* Fix issues with CMake integration when built in Debian-style multiarch setups.
  (GH #4839)

* Now even for purely static library builds, ``-fPIC`` is used to compile the
  library objects. This allows linking position independent executables (PIE)
  against the static library. (GH #4716)

* Remove support for NetBSD ``_dlauxinfo`` which did not provide the information
  that the library had expected it to. (GH #4736)

* Add a script for comparing the performance between versions (GH #4693 #4754)

* Update GHA CodeQL actions (GH #4644)

Version 3.7.1, 2025-02-05
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Revert a change that prevented ``build.h`` from being usable from
  C applications. (GH #4636 #4637)

Version 3.7.0, 2025-02-04
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Add post-quantum scheme Classic McEliece (GH #3883 #4448 #4458 #4508 #4605)

* In TLS enable the hybrid x25519/ML-KEM-768 post quantum secure key
  exchange by default for clients and servers. (GH #4305)

* Support for the pre-standard Kyber-r3 key exchange has been removed from TLS
  (GH #4507 #4403)

* In TLS add support for "pure" ML-KEM key exchange, in addition
  to the existing hybrid ML-KEM + EC suites. (GH #4393)

* Add new EC key constructors (GH #4437 #4563)

* Internal EC optimizations and improvements (GH #4385 #4432 #4436
  #4492 #4479 #4510 #4511 #4512 #4517 #4518 #4532 #4533 #4549 #4550
  #4552 #4556 #4557 #4564 #4566 #4570 #4601 #4604 #4608 #4619 #4624 #4626)

* An important note relating to EC groups, especially for users who do not build
  the library using the default module settings (ie using ``--minimized-build``
  or ``--disable-deprecated-features``). Until 3.7.0, including support for an
  elliptic curve algorithm such as ECDSA also implicitly pulled in support for
  all elliptic curves. This is no longer the case. You can re-enable support for
  specific named curves by adding a ``pcurves`` module, for example
  ``pcurves_secp256r1`` or ``pcurves_brainpool384r1``. Also in 3.7.0, the old
  BigInt based EC arithmetic implementation was moved to ``legacy_ec_point``,
  which is marked as deprecated. Disabling this module will disable support for
  certain (also deprecated) elliptic curves such as "x962_p239v1" and
  "secp224k1". It will also disable support for application specific
  curves. Depending on your usage you may need to enable the ``legacy_ec_point``
  module. (GH #4027)

* Change OID formatting and PK signature padding naming to avoid
  obsolete IEEE 1363 naming (GH #4600)

* Improve performance of RSA private key parsing (GH #4588)

* Fix a regression introduced in 3.6.0 which would cause many P-521
  secret keys to be rejected as invalid due to not having the expected
  length. (GH #4541 #4539)

* Add new operations to EC_AffinePoint (GH #4433 #4503 #4618)

* Add support for PSS-signed certificates using SHA-3 (GH #4610)

* Expose ``PSS_Params`` type (GH #3867 #4606)

* Optimize modular inversions (GH #4569)

* KDF internals modernization (GH #4455)

* Split compiler.h into api.h and compiler.h (GH #4599)

* Deprecate creating uninitialized DL_Group or EC_Group (GH #4598)

* Extend SP800-108 KDFs to support variable length fields (GH #4551)

* TPM 2.0 improvements (GH #4429 #4430 #4482)

* Add support for invoking Entropy Source and DRNG Manager (ESDM) RNG (GH #4309)

* Improve support for baremetal environments (GH #4519 #4521 #4531)

* Fix a bug preventing parsing of OCSP responses containing more than
  one pinned certificate (GH #4536)

* Expand constant-time testing in CI to cover both GCC and Clang,
  and multiple optimization levels. (GH #4421)

* Allow configuring at build time how constant-time value barriers
  are implemented. (GH #4447)

* GCM/GHASH internal cleanups (GH #4469)

* Documentation updates (GH #4586)

* Internal cleanups related to calling ``getauxval`` (GH #4471)

* Add a ``--timer-unit=`` option to ``botan speed`` (GH #4456 #4490)

* Rename the ``nist`` policy to ``fips140`` to more accurately reflect
  usage. Update with regards to latest NIST standards. (GH #4614)

* Update the Limbo test suite (GH #4406)

* Mark several classes not intended for derivation as ``final`` (GH #4419)

* Add iterator debugging to CI (GH #4413)

* Starting in 3.6.0, ``configure.py`` would pass through any values set as
  ``CXXFLAGS`` into the link invocation as well. This was done to support
  LTO style options. However it causes build regressions, especially with MSVC,
  and so has been reverted. Using the new option ``--lto-cxxflags-to-ldflags``
  will cause this passthrough behavior to continue. (GH #4196 #4200 #4451 #4452)

* Fix an iterator error in the test suite (GH #4413)

* Fix build issues caused by incompatible changes in Boost 1.87 (GH #4484)

* Fix a build issue when AVX2 support is disabled (GH #4493)

* Fix a build issue when compiling with MSVC on ARM (GH #4483)

* Address some new warnings from Clang 19 (GH #4544 #4545 #4548)

Version 3.6.1, 2024-10-26
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Notice: Botan 3.7.0 will remove support for the currently supported
  experimental Kyber r3 TLS ciphersuites, leaving only the standardized
  ML-KEM suites. (GH #4407 #4403)

* Fix a bug in x86 CPUID detection introduced in 3.6.0 which would cause
  crashes on systems which have BMI1 but not BMI2. (GH #4402 #4401)

* Fix a bug in SLH-DSA signing, which did not default to the FIPS
  required randomized variant. (GH #4398)

* Modify how elliptic curve blinding is performed, reducing the number
  of self-additions that may occur during multiplication. (GH #4408)

* In ``speed`` command line utility, also iterate keygen several times.
  (GH #4381)

Version 3.6.0, 2024-10-21
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Fully integrate and further optimize the new ECC library first introduced in
  3.5.0. For common curves, operations are 2 to 3 times faster. This also
  introduces a new API for low level EC operations, such a point multiplication,
  using ``EC_Scalar`` and ``EC_AffinePoint`` types.
  (GH   #4042 #4113 #4147 #4190 #4191 #4113 #4143 #4171 #4203 #4205 #4207
  #4209 #4210 #4211 #4212 #4213 #4215 #4217 #4218 #4221 #4225 #4226 #4235
  #4237 #4240 #4242 #4256 #4257 #4261 #4264 #4276 #4284 #4300)

* Add support for FIPS 203 ML-KEM, the NIST standardized version of Kyber (GH #3893)

* Add support for FIPS 204 ML-DSA, the NIST standardized version of Dilithium (GH #4270)

* Add support for FIPS 205 SLH-DSA, the NIST standardized version of SPHINCS+ (GH #4291)

* Add support for TPM2 hardware (GH #4337 #4357 #4361)

* Add support for jitterentropy RNG (GH #4325)

* Constant time programming improvements including ``CT::Option``
  (GH #4175 #4197 #4198 #4204 #4207 #4254 #4260)

* Improve performance of hex (GH #4275) and base64 (GH #4271)

* In ECDSA blind the constant time inversion of the nonce, as an extra precaution
  against side channel attacks. (GH #4259)

* Add support for AVX2-VAES instructions (GH #4286 #4287)

* Add GFNI-AVX2 acceleration for SM4 (GH #4289)

* Add support for elliptic curve numsp512d1 (GH #4251)

* Apply const-time checking annotations to Dilithium and Kyber (GH #4223),
  X448/Ed448 (GH #4204), FrodoKEM (GH #4198), LMS (GH #4272)

* Refactor internals of Dilithium and Kyber to share common elements (GH #4024)

* Add a test suite for validating the const-time annotations (GH #4182)

* Internal refactorings of public key encryption to improve memory
  safety and side channel resistance. (GH #4238 #4239)

* Cache the DER encoding of the OID format of an elliptic curve (GH #4193)

* Correct inconsistencies with use of ``BOTAN_CLEAR_CPUID`` where dependent
  instruction sets were not always disabled. (GH #4290)

* Deprecate the x25519/Kyber-512-r3 TLS ciphersuite. (GH #4347)

* Add CI nightly test using Intel SDE to test AVX-512 (GH #4296)

* Fix armv7/aarch64 CPU feature detection on FreeBSD (GH #4315)

* Add support for armv7/aarch64/ppc64 CPU feature detection on OpenBSD,
  using a new API added in OpenBSD 7.6 (GH #4312)

* Fix a bug in the ``speed`` cli utility which caused it to report incorrect
  values, especially for ciphers/hashes with small input sizes. (GH #4311)

* Fix a bug where CMake and pkg-config files might be installed to the
  wrong path (GH #4236 #4231)

* Fix certificate validation when the trust root is a self-signed MD2 cert.
  (GH #4247 #4248)

* Internal "strong types" improvements (GH #4170)

* Refactor the ``speed`` cli utility (GH #4364 #4367 #4369)

* Fix a test that was somewhat brittle and would fail if a specific
  certificate was not in the system trust root store. (GH #4280)

* Update some documentation comments (GH #4185)

* In Argon2, avoid instantiating a thread pool when ``p == 1`` (GH #4195 #4199)

* Disable the thread pool by default on Emscripten target (GH #4195 #4199)

* Add compile time option to disable all use of inline assembly (GH #4273 #4265)

Version 3.5.0, 2024-07-08
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* CVE-2024-34702: Fix a DoS caused by excessive name constraints. (GH #4186)

* CVE-2024-39312: Fix a name constraint processing error, where if
  permitted and excluded rules both applied to a certificate, only the
  permitted rules would be checked.

* Add a new much faster elliptic curve implementation. In this release,
  this implementation is only used for hash2curve. (GH #3979)

* Add support for LMS hash based signatures (GH #3716 #4059)

* Add support for SSLKEYLOGFILE logging (GH #4043)

* Optimize processing in FFI ``botan_cipher_update`` (GH #3951)

* Add ``Public_Key::raw_public_key_bits`` (GH #3985)

* Optimize XTS mode (GH #4047)

* Optimize name constraint processing (GH #4047)

* Optimize FrodoKEM-AES (GH #4176 #4174 #4173)

* The build system now distinguishes between LLVM Clang and XCode's Clang
  fork. For the latter, use compiler target "xcode". (GH #4010)

* Fix a bug in ``scrypt`` autotune where, if it was called with a
  nominal maximum memory limit of zero (meant to indicate no limit)
  would only ever return parameters using 1 MB.

* Constant time programming improvements including ``CT::value_barrier``
  and ``CT::Choice`` (GH #4154 #4115 #4096 #4108)

* Refactor and optimize AlternativeName. This includes a new API.
  The old API is retained but deprecated. (GH #4034)

* Kyber internals refactoring (GH #3887)

* Generate Kuznyechik tables at compile time instead of hard coding them.
  (GH #4017)

* Enable using ``sysctlbyname`` on iOS (GH #4018)

* Previously Curve25519 was used to refer to key exchange over the Montgomery
  curve modulo 2**255-19. This is now called X25519 in all cases. Typedefs and a
  deprecated header are retained for compatibility with older versions. (GH
  #4012)

* Fix several bugs related to encoding and decoding ASN.1 object identifiers
  when the second arc is larger than 40. (GH #4063 #4023)

* Avoid sending IP addresses in the Server Name Indicator TLS extension, if
  an IP address is used to initialize the TLS_Server_Info struct. (GH #4059)

* During X.509 certificate verification, first verify the entire sequence
  of signatures, then do other validation. (GH #4045)

* In DTLS fix a bug affecting retransmission of client hellos. (GH #4037)

* Fix a number of bugs related to name constraint processing. (GH #4074)

* Add support for parsing TNAuthList (secure telephony identity credentials
  extension) from RFC 8226. (GH #4116)

* Add One-Step KDF from SP 800-56C (GH #4121)

* Fix a bug in RFC 6979 mode ECDSA. This only caused problems when
  testing with certain curves and does not have any security or interop
  implications. (GH #4040)

* Previously elliptic curve private keys could be of any size, with the
  effective key reduced modulo the group order. Now during decoding the
  private key must be in the specified bound. (GH #4040)

* Elliptic curve groups now verify that the prime and group order are
  related in the manner expected. (GH #4039 #4041)

* Add a script to run the Limbo X.509 path validation test suite.

* Update the BoGo TLS test suite (GH #4078)

* Deprecate various low level BigInt and elliptic curve interfaces (GH #4038 #4056)

* In 3.3.0, support for application specific curves in EC_Group with
  parameters larger than 521 bits was deprecated. This release expands
  that deprecation to further restrict future use of application
  specific curves (see deprecated.rst for details). Add a new EC_Group
  constructor which enforces these restrictions. (GH #4038)

* Fix a bug when creating a PKCS10 request or X.509 self signed certificate
  when SubjectAlternativeName was included in the provided extensions. If
  this occurred, any other values (eg opts.dns) would be ignored. (GH #4032)

* Various low level multi precision integer refactorings and improvements.
  (GH #4156 #4149 #4007 #4008 #3989 #3987)

* Increase the maximum supported key length of KMAC to 192 bytes (GH #4109)

* Improve the utilities for checked (overflow safe) addition and multiplication.
  (GH #3999)

* Optimize parsing of IPv4 dotted quad strings (GH #4058)

* A system for marking modules as deprecated was introduced in 3.4.0, but it did
  not mark any modules as deprecated. This has now been applied to various
  modules, which will then be disabled if ``--disable-deprecated-features``
  option is used at build time. (GH #4050)

* Fix a bug in ``configure.py`` that caused ``--with-stack-protector`` to not
  work. (GH #3996)

* Upgrade CI to use XCode 15.2 on x86-64 and XCode 15.3 on aarch64. (GH #4005)

* Update most CI builds to run on Ubuntu 24.04 (GH #4098)

* Various ``clang-tidy`` fixes (GH #4070 #4075)

* Fixes for GCC 14 (GH #4046)

* Fix Roughtime to not reference a deprecated Cloudflare server. (GH #4002 #3937)

Version 3.4.0, 2024-04-08
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Add Ed448 signatures and X448 key exchange (GH #3933)

* X.509 certificate verification now can optionally ignore the
  expiration date of root certificates. (GH #3938)

* Support for "hybrid" EC point encoding is now deprecated. (GH #3981)

* Support for creating EC_Group objects with parameters larger than
  521 bits is now deprecated (GH #3980)

* Add new build options to disable deprecated features, and to enable
  experimental features. (GH #3910)

* Fix a bug affecting use of SIV and CCM ciphers in the FFI interface.
  (GH #3971)

* Add new FFI interface ``botan_cipher_requires_entire_message`` (GH #3969)

* Internal refactorings of the mp layer to support a new elliptic
  curve library. (GH #3973 #3977 #3962 #3957 #3964 #3956 #3961 #3950)

* Use a new method for constant time division in Kyber to avoid a possible
  side channel where the compiler inserts use of a variable time division.
  (GH #3959)

* Refactor test RNG usage to improve reproducibility. (GH #3920)

* Add ``std::span`` interfaces to ``BigInt`` (GH #3866)

* Refactorings and improvements to low level load/store utility
  functions. (GH #3869)

* Fix the amalgamation build on ARM64 (GH #3931)

* Add Mac ARM based CI build (GH #3931)

* Fix a thread serialization bug that caused sporadic test failures.
  (GH #3922)

* Update GH Actions to v4 (GH #3923)

* Add examples of password based encryption and HTTPS+ASIO client.
  (GH #3935 #3910)

Version 3.3.0, 2024-02-20
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* CVE-2024-34703 Fix a potential denial of service caused by accepting
  arbitrary length primes as potential elliptic curve parameters in
  ASN.1 encodings. With very large inputs the primality verification
  can become computationally expensive. Now any prime field larger
  than 1024 bits is rejected immediately. Reported by Bing Shi. (GH #3913)

* Add FrodoKEM post-quantum KEM (GH #3679 #3807 #3892)

* Add support for Blake2s (GH #3796)

* Add support for RFC 7250 in TLS 1.3 to allow authenticating peers
  using raw public keys (GH #3771)

* Update the BSI TLS policy to match the latest TR, particularly
  enabling support for TLS 1.3 (GH #3809)

* Add AsymmetricKey::generate_another() to generate a new key of the
  same type and parameters as an existing key (GH #3770 #3786)

* Add Private_Key::remaining_operations() that indicates the number of
  remaining signatures for stateful hash-based signatures (GH #3821)

* Add implementation of EC_PrivateKey::check_key() (GH #3782 #3804)

* Add hardware acceleration for SHA-512 on ARMv8 (GH #3860 #3864)

* X.509 certificates that contain Authority Information Access (AIA)
  extensions can now be encoded (GH #3784)

* Various functions defined in ``mem_ops.h`` are now deprecated
  for public use (GH #3759 #3752 #3757)

* The ASIO TLS stream can now be used with C++20 coroutines (GH #3764)

* New public header asio_compat.h to check compatibility of the ASIO
  TLS stream with the available boost version (1.73.0+) (GH #3765)

* Flatten input buffer sequences in the ASIO TLS stream to avoid
  creating unnecessarily small TLS records (GH #3839)

* Hard-rename the potentially harmful build configuration flag
  --terminate-on-asserts to --unsafe-terminate-on-asserts (GH #3755)

* Use modern SQLite3 APIs with integer width annotations from SQLite3 3.37
  (GH #3788 #3793)

* Generate and install a CMake package config file (botan-config.cmake)
  (GH #3722 #3827 #3830 #3825)

* Add TLS::Channel::is_handshake_complete() predicate method (GH #3762)

* Add support for setting thread names on Haiku OS and DragonflyBSD
  (GH #3758 #3785)

* Use /Zc:throwingNew with MSVC (GH #3858)

* Work around a warning in GCC 13 (GH #3852)

* Add a CLI utility for testing RSA side channels using the MARVIN
  toolkit (GH #3749)

* CLI utility 'tls_http_server' is now based on Boost Beast
  (GH #3763 #3791)

* CLI utility 'tls_client_hello' can detect and handle TLS 1.3 messages
  (GH #3820)

* Add a detailed migration guide for users of OpenSSL 1.1 (GH #3815)

* Various updates to the documentation and code examples
  (GH #3777 #3805 #3802 #3794 #3815 #3823 #3828 #3842 #3841 #3849 #3745)

* Fixes and improvements to the build experience using ``ninja``
  (GH #3751 #3750 #3769 #3798 #3848)

* Fix handling of cofactors when performing scalar blinding in EC (GH #3803)

* Fix potential timing side channels in Kyber (GH #3846 #3874)

* Fix a potential dangling reference resulting in a crash in the OCB
  mode of operation (GH #3814)

* Fix validity checks in the construction of the ASIO TLS stream
  (GH #3766)

* Fix error code handling in ASIO TLS stream (GH #3795 #3801 #3773)

* Fix a TLS 1.3 assertion failure that would trigger if the
  application callback returned an empty certificate chain. (GH #3754)

* Fix a RFC 7919 conformance bug introduced in 3.2.0, where the TLS
  server would fail to reject a client hello that advertised (only)
  FFDHE groups that are not known to us. (GH #3743 #3742 #3729)

* Fix that modifications made in TLS::Callbacks::tls_modify_extensions()
  for the TLS 1.3 Certificate message were not being applied. (GH #3792)

* Fix string mapping of the PKCS#11 mechanism RSA signing mechanism that
  use SHA-384 (GH #3868)

* Fix a build issue on NetBSD (GH #3767)

* Fix the configure.py to avoid recursing out of our source tree (GH #3748)

* Fix various clang-tidy warnings (GH #3822)

* Fix CLI tests on windows and enable them in CI (GH #3845)

* Use ``BufferStuffer`` and ``concat`` helpers in public key code
  (GH #3756 #3753)

* Add a nightly test to ensure hybrid TLS 1.3 PQ/T compatibility with
  external implementations (GH #3740)

* Internal memory operation helpers are now memory container agnostic
  using C++20 ranges (GH #3715 #3707)

* Public and internal headers are now clearly separated in the build
  directory. That restricts the examples build target to public headers.
  (GH #3880)

* House keeping for better code formatting with clang-format
  (GH #3862 #3865)

* Build documentation in CI and fail on warnings or errors (GH #3838)

* Work around a GitHub Actions CI issue (actions/runner-images#8659)
  (GH #3783 #3833 #3888)

Version 3.2.0, 2023-10-09
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Add support for (experimental!) post-quantum secure key exchange
  in TLS 1.3 (GH #3609 #3732 #3733 #3739)

* Add support for TLS PSK (GH #3618)

* Add a first class interface for XOFs (GH #3671 #3672 #3701)

* Add KMAC from NIST SP 800-185 (GH #3689)

* Add cSHAKE XOF; currently this is not exposed to library users but
  is only for deriving further cSHAKE derived functions. (GH #3671)

* Add improved APIs for key encapsulation (GH #3611 #3652 #3653)

* As Kyber's 90s mode is not included in the NIST draft specification,
  and most implementations only support the SHAKE based mechanism,
  the Kyber 90s mode is now deprecated. (GH #3695)

* Previously ``KyberMode`` enums had elements like ``Kyber512`` to identify the
  scheme. These have changed to have ``_R3`` suffixes (like ``Kyber512_R3``) to
  clearly indicate these are not the final version but is instead the version
  from round3 of the PQC competition. The old names continue on as (deprecated)
  aliases. (GH #3695)

* Fix bugs in various signature algorithms where if a signature
  operation was used after the key object had been deleted, a use
  after free would occur. (GH #3702)

* The types defined in pubkey.h can now be moved (GH #3655)

* Add the Russian block cipher Kuznyechik (GH #3680 #3724)

* The ``TLS::Group_Params`` enum is now a class which emulates the
  behavior of the enumeration. (GH #3729)

* Implement serialization for the Certificate Authority TLS extension
  (GH #3687)

* Refactored the internal buffering logic of most hash functions
  (GH #3705 #3693 #3736)

* Add OS support for naming threads; now Botan thread pool threads
  are identified by name. (GH #3628 #3738)

* Updated the TLS documentation to reflect TLS 1.3 support and
  the removal of TLS 1.0 and 1.1. (GH #3708)

* Upon deserialization, the ``EC_Group`` type now tracks the encoding
  which was used to create it. This is necessary to implement policies
  which prohibit use of explicit curve encodings (which are in any case
  deprecated). (GH #3665)

* If compiling against an old glibc which does not support the ``getrandom``
  call, now the raw syscall is used instead. (GH #3688 #3685)

* On MinGW the global thread pool is disabled by default (GH #3726 #2582)

* Various internal functions now use ``std::span`` instead of raw pointers
  plus length field. NOTE: any implementations of ``BlockCipher``, ``HashFunction``
  etc that live outside the library will have to be updated. This is not covered
  by the SemVer guarantee; see ``doc/sem_ver.rst`` (GH #3684 #3681 #3713 #3714
  #3698 #3696)

* Add helper for buffer alignment, and adopt it within the hash function
  implementations. (GH #3693)

* Added support for encoding CRL Distribution Points extension in new
  certificates (GH #3712)

* Internal refactoring of SHA-3 to support further SHA-3 derived functionality
  (GH #3673)

* Add support for testing using TLS-Anvil (GH #3651) and fix a few cases
  where the TLS implementation sent the incorrect alert type in various
  error cases which were discovered using TLS-Anvil (GH #3676)

* Add initial (currently somewhat experimental) support for using the ninja
  build system as an alternative to make. (GH #3677)

* Remove an unused variable in BLAKE2b (GH #3624)

* Fix a number of clang-tidy warnings in the headers (GH #3646)

* Add checks for invalid length AD in Argon2 (GH #3626)

* CI now uses Android NDK 26. Earlier NDK versions are no longer supported
  due to limitations in their C++ library implementations. (GH #3718)

* Improve support for IBM's XLC compiler (GH #3730)

* Avoid compilation failures when using ``-Werror`` mode with GCC 12
  due to spurious warnings in that version. (GH #3711 #3709)

Version 3.1.1, 2023-07-13
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Fix two tests which were insufficiently serialized. This would
  cause sporadic test failures, particularly on machines with
  many cores. (GH #3625 #3623)

Version 3.1.0, 2023-07-11
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Add SPHINCS+ post quantum hash based signature scheme (GH #3564 #3549)

* Several small TLS compliance fixes, primarily around rejecting
  invalid behavior from the peer (GH #3520 #3537)

* Adapt TLS 1.3 to use a KEM interface to prepare for PQ key exchange
  (GH #3608)

* Fix custom key exchange logic integration for TLS 1.2 server (GH #3539)

* Add initial wrappers for using AVX-512, and implement AVX-512 versions
  of ChaCha and Serpent. (GH #3206 #3536)

* Add support for an environmental variable which can disable CPU extensions
  (GH #3535)

* Update the BSI policy to match the latest TR (GH #3482)

* Update the BoringSSL test suite shim (GH #3616)

* Add FFI functions relating to Kyber key management (GH #3546)

* The entire codebase has been reformatted using ``clang-format``.
  (GH #3502 #3558 #3559)

* Fix many warnings generated from ``clang-tidy``.

* ``BigInt::random_integer`` could take a long time if requested to
  generate a number within a small range between two large integers.
  (GH #3594)

* Fix bugs related to ``--library-suffix`` option. (GH #3511)

* Improve cli handling of PBKDF configuration (GH #3518)

* Fix the cli to properly update stateful keys (namely XMSS) when using such
  a key to sign a X.509 certificate (GH #3579)

* Add support for using PSK in the TLS CLI utilities (GH #3552)

* Add an example of hybrid RSA+symmetric encryption (GH #3551)

* In the Python module, the pbkdf function defaulted to 10K iterations.
  This has been changed to 100K.

* Switch to using coveralls.io for coverage report (GH #3512)

* Add a script to analyze the output of ``botan timing_test``

* Due to problems that arise if the build directory and source
  directory are on different filesystems, now hardlinks are only
  used during the build if explicitly requested. (GH #3504)

* The ``ffi.h`` header no longer depends on the ``compiler.h`` header.
  (GH #3531)

* Avoid using varargs macros for ``BOTAN_UNUSED`` (GH #3530)

* Small base64 encoding optimization (GH #3528)

* If the build system detects that the compiler in use is not supported,
  it will error immediately rather than allow a failing build. Currently
  this is only supported for GCC, Clang, and MSVC. (GH #3526)

* The examples are now a first class build target; include
  ``examples`` in the set provided to ``--build-targets=`` option in
  order to enable them. (GH #3527)

* Remove the (undocumented, unsupported) support for CMake (GH #3501)

Version 3.0.0, 2023-04-11
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* Botan is now a C++20 codebase; compiler requirements have been
  increased to GCC 11, Clang 14, or MSVC 2022. (GH #2455 #3086)

Breaking Changes
----------------------------------------

* Remove many deprecated headers. In particular all algorithm specific
  headers (such as ``aes.h``) are no longer available; instead objects
  must be created through the base class ``create`` functions. (GH #2456)

* Removed most functions previously marked as deprecated.

* Remove several deprecated algorithms including CAST-256, MISTY1, Kasumi,
  DESX, XTEA, PBKDF1, MCEIES, CBC-MAC, Tiger, NEWHOPE, and CECPQ1 (GH #2434 #3094)

* Remove the entropy source which walked ``/proc`` as it is no longer
  required on modern systems. (GH #2692)

* Remove the entropy source which reads from ``/dev/random`` as it is
  supplanted by the extant source one which reads from the system RNG.
  (GH #2636)

* Remove use of ``shared_ptr`` from certificate store API, as since
  2.4.0 ``X509_Certificate`` is internally a ``shared_ptr``. (GH #2484)

* Several enums including ``DL_Group::Format``, ``EC_Group_Formatting``,
  ``CRL_Code``, ``ASN1_Tag``, ``Key_Constraints`` and ``Signature_Format`` are
  now ``enum class``.  The ``ASN1_Tag`` enum has been split into ``ASN1_Type``
  and ``ASN1_Class``.  (GH #2551 #2552 #3084 #2584 #3225)

* Avoid using or returning raw pointers whenever possible. (GH #2683 #2684
  #2685 #2687 #2688 #2690 #2691 #2693 #2694 #2695 #2696 #2697 #2700 #2703 #2708
  #3220)

* Remove support for HP and Pathscale compilers, Google NaCL (GH #2455),
  and IncludeOS (GH #3406)

* Remove deprecated ``Data_Store`` class (GH #2461)

* Remove deprecated public member variables of ``OID``, ``Attribute``,
  ``BER_Object``, and ``AlgorithmIdentifier``. (GH #2462)

* "SHA-160" and "SHA1" are no longer recognized as names for "SHA-1"
  (GH #3186)

TLS Changes
----------------------------------------

* Added support for TLS v1.3

* Support for TLS 1.0, TLS 1.1, and DTLS 1.0 have been removed (GH #2631)

* Remove several deprecated features in TLS including DSA ciphersuites (GH #2505),
  anonymous ciphersuites (GH #2497), SHA-1 signatures in TLS 1.2 (GH #2537),
  SRP ciphersuites (GH #2506), SEED ciphersuites (GH #2509),
  Camellia CBC ciphersuites (GH #2509), AES-128 OCB ciphersuites (GH #2511),
  DHE_PSK suites (GH #2512), CECPQ1 ciphersuites (GH #3094)

New Cryptographic Algorithms
----------------------------------------

* Add support for Kyber post-quantum KEM (GH #2872 #2500)

* Add support for Dilithium lattice based signatures (GH #2973 #3212)

* Add support for hashing onto an elliptic curve using the SSWU
  technique of draft-irtf-cfrg-hash-to-curve (GH #2726)

* Add support for keyed BLAKE2b (GH #2524)

New APIs
----------------------------------------

* Add new interface ``T::new_object`` which supplants ``T::clone``. The
  difference is that ``new_object`` returns a ``unique_ptr<T>`` instead of a raw
  pointer ``T*``. ``T::clone`` is retained but simply releases the result of
  ``new_object``. (GH #2689 #2704)

* Add an API to ``PasswordHash`` accepting an AD and/or secret key, allowing
  those facilities to be used without using an algorithm specific API (GH #2707)

* Add new ``X509_DN::DER_encode`` function. (GH #2472)

* New API ``Public_Key::get_int_field`` for getting the integer fields of a public
  (or private) key by name (GH #3200)

* New ``Cipher_Mode`` APIs ``ideal_granularity`` and ``requires_entire_message``
  (GH #3172 #3168)

* New ``Private_Key::public_key`` returns a new object containing the public
  key associated with that private key. (GH #2520)

* ``SymmetricAlgorithm::has_keying_material`` allows checking if a key has
  already been set on an object (GH #3295)

* Many new functions in the C89 interface; see the API reference for more details.

Implementation Improvements
----------------------------------------

* Add AVX2 implementation of Argon2 (GH #3205)

* Use smaller tables in the implementations of Camellia, ARIA, SEED, DES,
  and Whirlpool (GH #2534 #2558)

* Modify DES/3DES to use a new implementation which avoids most
  cache-based side channels. (GH #2565 #2678)

* Optimizations for SHACAL2, especially improving ARMv8 and POWER (GH #2556 #2557)

* Add a fast path for inversion modulo ``2*o`` with ``o`` odd, and modify RSA
  key generation so that ``phi(n)`` is always of this form. (GH #2634)

* Use constant-time code instead of table lookups when computing parity bits
  (GH #2560), choosing ASN.1 string type (GH #2559) and when converting to/from
  the bcrypt variant of base64 (GH #2561)

* Change how DL exponents are sized; now exponents are slightly larger and
  are always chosen to be 8-bit aligned. (GH #2545)

Other Improvements
----------------------------------------

* Changes to ``TLS::Stream`` to make it compatible with generic completion tokens.
  (GH #2667 #2648)

* When creating an ``EC_Group`` from parameters, cause the OID to be set if it
  is a known group. (GH #2654 #2649)

* Fix bugs in GMAC and SipHash where they would require a fresh key be
  provided for each message. (GH #2908)

Older Versions
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

* The release notes for versions 2.0.0 through 2.19.5 can be found in
  ``doc/news_2x.rst``

* The release notes for versions 0.7.0 through 1.11.34 can be found in
  ``doc/old_news.rst``
