Revision history for Perl extension Crypt-DSA

1.22 -- Fri Jul 03 09:27:46 ADT 2026

    - This module is deprecated as of 1.20.  Crypt-DSA-GMP is a possible replacement.
    - Hardening: Use a fresh, independent CSPRNG witness every round
    - Security fix: Fixes CVE-2026-14570 modulo bias in key generation.
    An attack with hundreds of signatures could lead to full private-key compromise.
    Keys should be considered compromised and new keys should be generated.

1.21 -- Sun Jun 14 16:52:15 ADT 2026

    - This module is now makred as deprecated.  Crypt-DSA-GMP is a possible replacement.
    - Fixed CVE-2026-12205 key material reuse for multiple signing events
    - SECURITY (CWE-323): sign() reused the DSA nonce k across signatures
    (r and k^-1 were cached on the key and not regenerated), allowing
    private-key recovery from two signatures over different messages. Now
    generates a fresh nonce per signature. Keys used to sign more than
    once with an affected version should be considered compromised.

1.20 -- Fri May 15 19:00:36 ADT 2026

    - This module is now makred as deprecated.  Crypt-DSA-GMP is a possible replacement.
    - Improve the call to IPC::Open3::open3
    - Security Fix CVE-2026-8704: replace two arg open
    - Security Fix CVE-2026-8700: replace rand()
    - Add a security policy
    - Add use warnings
    - Fixes #86424: typo fix

1.19 -- Wed Dec 04 10:49:10 AST 2024

    [Changes since 1.17]
    - Release 1.18-TRIAL as a production release
    - New Maintainer
    - This release resolves CVE-2011-3599 
    - Added a statement to recommend against using DSA
    - Fixed a few long standing bugs
    - The build process is moved to Dist::Zilla
    - Thanks to all the people who contributed to the tickets that were closed

    [Detailed Change List]
    - 47bda33 Increment Repo Version
    - ffd39e8 (tag: 1.18) Update Changes for a Release

    [Changes since 1.17]
    - New Maintainer
    - This release resolves CVE-2011-3599 
    - Added a statement to recommend against using DSA
    - Fixed a few long standing bugs
    - The build process is moved to Dist::Zilla
    - Thanks to all the people who contributed to the tickets that were closed

    [Detailed Change List]
    - 3411005 Add a SECURITY statement about DSA
    - 1f5df72 Fixes RT#71342: Patch to use Digest::SHA
    - 06f420d Fix missed version numbers
    - 1946ead Remove old MANIFEST and META.yml from repo
    - 6c813c7 Fixes #19477: Crypt::DSA::Key -write comment wrong for public key
    - c28a8a3 Fix some of the Dependencies in dist.ini
    - fe15637 Fixed RT#71421: Systems without /dev/random may leak secret key
    - cf81bfc Fixes RT #156495 for Crypt-DSA t/04-pem.t
    - 24ac55b Convert build process to Dist::Zilla
    - b680374 (tag: 1.17) Import Crypt::DSA-1.17 from CPAN release

1.17 2011.06.16
	- Upgrade to Module::Install 1.01
	- Added support for OpenSSL 1.0.0 dsaparam format change.
	- Requires perl 5.6 now
	- Fixes for 64-bit support

1.16 2009.09.11
	- Switching to production release
	- Switching to non-development version

0.15_01 2009.02.13
	- Updated to Module::Install 0.91
	- Added a consistent $VERSION across the entire distro
	- Removed the optional dependency on Convert::PEM for more
	  consistent downstream packaging (it was pointless to ask
	  since most people don't know what it is anyways).
	- Data::Buffer has almost perfect CPAN Testers PASS, so always
	  install it (plus, SSH2 is common now).
	- Added some missing dependencies to the Makefile.PL
	- Removed the sign(1) and auto_install (which was dangerous)
	- Removed all the magic repository tags that would change depending
	  on who was maintaining it.
	- Adding missing test_requires for Test.pm and Test::More (I'll
	  migrate the remaining tests away from Test.pm next release)
	- Merged the ToDo file into the POD

0.14  2006.05.08
	- Win32 fixes: use Data::Random as a fallback in make_random, better
	  support for locating openssl. Thanks to CFRANKS for the patch.
	- Makefile.PL update, to the latest Module::Install. Thanks to Adam
	  Kennedy for the patch.

0.13  2005.05.26
	- Rewrote to use Math::BigInt instead of Math::Pari, including patches
	  from Brad Fitzpatrick for a replacement for the isprime function
	  (both using pure Perl and an external gp program).
	- Added optional Content argument to Crypt::DSA::Key->new, to specify
	  serialized Content to be deserialized.
	- Added Signature serialization and deserialization of ASN.1-encoded
	  structures.
	- Added ability to do key generation using an external openssl binary.
	  Thanks to Brad Fitzpatrick for the patch.
	- Signature object now has better get/set acccessors.
	- Use Module::Install instead of hand-coded Makefile.PL.

0.12  2001.05.03
	- Removed swap file from the distribution. :)

0.11  2001.05.02
	- Added Crypt::DSA::Key::SSH2, which reads SSH2-format DSA
	  key files. These are a different format than those used
	  by OpenSSH (that uses PEM-encoded files). Currently only
	  reading SSH2 key files is supported, and the files must not
	  be encrypted.
	- Added size method to Crypt::DSA::Key. $key->size is number
	  of bits in p.

0.10  2001.04.22
	- Added much better test suite: tests bigint utilities in Util,
	  sign/verify, key generation (512, 768, 1024 bits), PEM
	  encoding/decoding (if Convert::PEM is installed), FIPS 186-2
	  example case.
	- Added interface to Convert::PEM to read/write encrypted
	  PEM files containing ASN.1-encoded DSA keys. Convert::PEM
	  is optional; Makefile.PL will check for it and warn if it
	  can't be found.
	- Get/set accessors now take hex values and store their values
	  internally as strings. Thanks to Crypt::RSA for the idea. :)

0.03  2001.04.07
	- abstracted signature object into Crypt::DSA::Signature object.

0.02  2001.03.23
	- split up code into separate modules (ie. KeyChain, Key, Util, etc.)
	- switched from using GMP to Pari
	- streamlined code
	- added documentation

0.01  2001.03.22
	- original version; created by h2xs 1.19
