Release Notes

ManualsBrandsDell ManualsBSAFEBSAFE Micro Edition Suite

Release Notes

30.08.19

RSA BSAFE

Micro Edition Suite 4.4

Release Notes

RSA BSAFE Micro Edition Suite 4.4 (MES) is a software development toolkit for

building cryptographic, certificate, and Transport Layer Security (TLS) security

technologies into C and C++ applications, devices and systems.

This document summarizes the new features, changes, platform information, and

resolved and known issues in this release of MES.

For details of the MES End of Primary Support dates, see the Product Version Life

Cycle Web site at

https://community.rsa.com/docs/DOC-73366.

Contents:

New Features ...................................................................................................2

Changes ............................................................................................................4

Deprecated Functionality .........................................................................6

Operating Environment Information ..............................................................7

New Operating Environments ...............................................................13

Discontinued Operating Environments ................................................13

Linux Standard Base ..............................................................................14

FIPS 140-2 Compliance .........................................................................14

Microsoft Visual C++ Redistributable Packages ................................. 15

Algorithms and Key Sizes .............................................................................16

Elliptic Curve Support .............................................................................16

FIPS 140-2 Operations .................................................................................17

Interoperability ................................................................................................17

Cipher Suites ..................................................................................................17

Hardware Devices ..........................................................................................18

Enhancements and Resolved Issues ..........................................................19

Known Issues .................................................................................................20

Documentation ...............................................................................................24

Support and Service ...................................................................................... 25

Summary of content (25 pages)

PAGE 1
Release Notes 30.08.19 RSA BSAFE® Micro Edition Suite 4.4 Release Notes RSA BSAFE Micro Edition Suite 4.4 (MES) is a software development toolkit for building cryptographic, certificate, and Transport Layer Security (TLS) security technologies into C and C++ applications, devices and systems. This document summarizes the new features, changes, platform information, and resolved and known issues in this release of MES.
PAGE 2
RSA BSAFE Micro Edition Suite 4.4 Release Notes New Features This release of MES is designed to include the following new features: • Support for the FIPS 140-2 provider for applications running on an iOS operating system. • An iOS FIPS provider, as a static library file, libmes_iosprov.a.
PAGE 3
RSA BSAFE Micro Edition Suite 4.4 Release Notes – – – Password-based key derivation using PBKDF2 with: • HMAC-SHA-1 • HMAC-SHA-224 • HMAC-SHA-256 • HMAC-SHA-384 • HMAC-SHA-512. Digital signature generation and verification: • Generation and verification using RSA PKCS #1 with SHA-256 • Verification only using RSA with SHA-1. A FIPS 140-2 mode feature for the iOS FIPS provider.
PAGE 4
RSA BSAFE Micro Edition Suite 4.4 Release Notes Changes This release of MES is designed to include the following changes: • Updated operating environment support. For more information, see Operating Environment Information. • Fixes for specific issues. For more information, see Enhancements and Resolved Issues. • The two separate signature files, which were used for the FIPS 140-2 module integrity check, are now embedded into the main FIPS 140-2 module shared library file.
PAGE 5
RSA BSAFE Micro Edition Suite 4.4 Release Notes • DH key reuse in a TLS session is disabled by default. Reuse, and the maximum number of times a DH key can be reused, can be set using R_SSL_CTX_set_info() and R_SSL_CTX_INFO_KEY_USE_COUNT, for an SSL context, or R_SSL_set_info() and R_SSL_INFO_KEY_USE_COUNT, for an SSL object. For more information, see the RSA BSAFE Micro Edition Suite Developers Guide.
PAGE 6
RSA BSAFE Micro Edition Suite 4.4 Release Notes Deprecated Functionality With this release of MES the following element of functionality is deprecated. While it is still available and can still be used, RSA recommends that alternatives be used. This API entity will be removed in a future release of MES. • ASN.1 Object Identifier (OID) identifiers are deprecated. Applications should use the R_OID_INFO_* set of functions and identifiers for working with OID values.
PAGE 7
RSA BSAFE Micro Edition Suite 4.4 Release Notes Operating Environment Information The following table lists the operating environments MES is designed and tested to support, on either physical or virtual hosts, at the time of release. Note: Subsequent patches or hotfixes to this release of MES will be tested on and support the latest operating system patch levels, unless otherwise specified.
PAGE 8
RSA BSAFE Micro Edition Suite 4.4 Release Notes Table 1 Operating Environment Information (continued) CPU Architecture Compiler Version FIPS1 Package Name x86_64 Clang 4.0 Yes freebsd-x64-clang40 Android™ 8.0 ARMv8 Android NDK r10e and GCC 4.9 Yes android-multi-ndkr10e Android 7.1.1 ARMv8 Android NDK r10e and GCC 4.9 VA android-multi-ndkr10e Android 6.0 ARMv8 Android NDK r10e and GCC 4.9 VA android-multi-ndkr10e Operating System FreeBSD® Foundation FreeBSD 11.
PAGE 9
RSA BSAFE Micro Edition Suite 4.4 Release Notes Table 1 Operating Environment Information (continued) Operating System CPU Architecture Compiler Version FIPS1 Package Name LSB 4.0 and GCC 4.4 VA lsb40-x64-gcc4_4 Micro Focus (continued) SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 11 SP4 x86_64 x86 lsb40-x86-gcc4_4 PowerPC 64-bit GCC 4.8 ARMv8 GCC 4.8 x86_64 LSB 4.0 and GCC 4.
PAGE 10
RSA BSAFE Micro Edition Suite 4.4 Release Notes Table 1 Operating Environment Information (continued) Operating System CPU Architecture Compiler Version x86 Visual Studio 2017 (/MD) VA FIPS1 Package Name Microsoft (continued) Windows 8.
PAGE 11
RSA BSAFE Micro Edition Suite 4.
PAGE 12
RSA BSAFE Micro Edition Suite 4.4 Release Notes Table 1 Operating Environment Information (continued) CPU Architecture Compiler Version FIPS1 Package Name Enterprise Linux 7.4 ARMv8 GCC 4.8 VA linux-arm64l-gcc4_8 Enterprise Linux 6.10 x86_64 LSB 4.0 and GCC 4.4 VA lsb40-x64-gcc4_4 Enterprise Linux 5.8 IBM S/390®x 64-bit Operating System Red Hat (continued) x86 IBM S/390 31-bit 1For lsb40-x86-gcc4_4 LSB 3.0 and GCC 4.
PAGE 13
RSA BSAFE Micro Edition Suite 4.4 Release Notes New Operating Environments This release of MES is designed to include support for new operating environments: • Apple: – iOS 12 on ARMv8 – iOS 11 on ARMv8 and x86_64 – iOS 10 on ARMv8, ARMv7, x86_64, and x86 – macOS 10.13 and 10.12 on x86_64 and x86 • Canonical Ubuntu 16.04 LTS on x86_64, x86, and ARMv7 • FreeBSD 11.2 on x86_64 • Google Android 7.x on ARMv8 • IBM AIX 7.
PAGE 14
RSA BSAFE Micro Edition Suite 4.4 Release Notes Linux Standard Base The goal of the LSB project is to deliver interoperability between applications and the Linux operating system. The distributions of MES built using the LSB 4.0 Software Development Kits (SDKs) are designed to be compatible with Linux operating systems that support LSB 4.0 on the CPU architectures listed in Table 1. FIPS 140-2 Compliance For all operating environments, MES uses RSA BSAFE Crypto-C Micro Edition 4.1.
PAGE 15
RSA BSAFE Micro Edition Suite 4.4 Release Notes Microsoft Visual C++ Redistributable Packages For customers developing on a Microsoft Windows operating system, building applications using the MES libraries is supported using Microsoft Visual Studio 2005, Visual Studio 2010, or Visual Studio 2013. To run MES applications on systems that do not have Visual Studio or Visual C++ installed, a Visual C++ Redistributable Package is required to install specific Visual C++ runtime components.
PAGE 16
RSA BSAFE Micro Edition Suite 4.4 Release Notes Algorithms and Key Sizes For the supported algorithms and key sizes, see Algorithms and Key Sizes in the RSA BSAFE Crypto-C Micro Edition Release Notes included with this release. Elliptic Curve Support The following table lists the named elliptic curves this release of MES is designed to support for cryptographic operations in software and on PKCS #11 hardware devices. For more information, see Hardware Devices.
PAGE 17
RSA BSAFE Micro Edition Suite 4.4 Release Notes FIPS 140-2 Operations For all operating environments, FIPS 140-2 providers, created using R_PROV_FIPS140_new(), provide both FIPS 140-2-approved and non-approved algorithms and resources. By default these providers provide only FIPS 140-2 approved algorithms. Applications can change the mode on the library context to control the algorithms available by calling R_LIB_CTX_set_mode() with an appropriate R_MODE_FILTER identifier.
PAGE 18
RSA BSAFE Micro Edition Suite 4.4 Release Notes Hardware Devices While MES cryptographic and certificate functionality can be delegated to a variety of PKCS #11 hardware devices, PKCS #11 functionality is not tested for this release. If PKCS #11 functionality is required, it can be requested through RSA Customer Support.
PAGE 19
RSA BSAFE Micro Edition Suite 4.4 Release Notes Enhancements and Resolved Issues The following table lists the enhancements and resolved issues in this release of MES. Table 4 Enhancements and Resolved Issues ID Description BSFMES-2377 MES is potentially vulnerable to an Information Exposure Through Timing Discrepancy. A malicious remote user could potentially exploit this vulnerability to extract information leaving data at risk of exposure CVE-2019-3731.
PAGE 20
RSA BSAFE Micro Edition Suite 4.4 Release Notes Table 4 Enhancements and Resolved Issues (continued) ID Description BSFMES-1952 Certificates with RSA PSS signatures cannot be verified. BSFMES-1842 Triple-DES is removed from default cipher suite list. BSFMES-1561 A sample makefile for systems running an OS X operating system needs undocumented environment variables. BSFMES-1426 MES is potentially vulnerable to a heap-based buffer overflow when parsing ECDSA signature.
PAGE 21
RSA BSAFE Micro Edition Suite 4.4 Release Notes Table 5 Known Issues (continued) ID Description BSFMES-1591 If a certificate chain being verified contains certificates from multiple authorities with distinct OCSP servers, only the first OCSP server found is used. The server cannot give a definitive answer on behalf of certification authorities for which it is not delegated to answer for, and so cannot reject invalidated certificates.
PAGE 22
RSA BSAFE Micro Edition Suite 4.4 Release Notes Table 5 22 Known Issues (continued) ID Description BSFMES-1371 A signed data Cryptographic Message Syntax (CMS) message can be created with detached content data that is a streamed CMS message. It might not be possible to verify the signature on the signed data message in a non-streaming context. Workaround: A signed data CMS message with detached streaming data can be verified using a CMS BIO with a verification context.
PAGE 23
RSA BSAFE Micro Edition Suite 4.4 Release Notes Table 5 Known Issues Known Issues (continued) ID Description BSFMES-1059 Application processing of the CertificateURL TLS extension cannot set TLS alerts on processing failure. BSFMES-1056 Using R_SSL_set_info() with SSL_INFO_TLS_ADD_EXT (or R_SSL_CTX_set_info() with SSL_CTX_INFO_TLS_ADD_EXT) does not copy in the TLS extension structure. BSFMES-1054 The tls_ext_server.c sample program uses deprecated functionality.
PAGE 24
RSA BSAFE Micro Edition Suite 4.4 Release Notes Documentation The documentation provided with this release of MES includes: • This document, the RSA BSAFE RSA BSAFE Micro Edition Suite Release Notes, in Portable Document Format (PDF), with the latest information on MES. • RSA BSAFE Micro Edition Suite Migration Guide, in PDF, which describes the changes required to migrate existing applications from MES 4.0.1 to MES 4.4.
PAGE 25
RSA BSAFE Micro Edition Suite 4.4 Release Notes Support and Service Access community and support information for your RSA BSAFE products on RSA Link at https://community.rsa.com/community/products/bsafe. RSA Link offers a knowledge base containing answers to common questions and solutions to known problems, product documentation, community discussions, and case management. Customers can also open support cases by sending an email to support@rsa.com. RSA Ready at https://community.rsa.