nss-3.45

[Bruce Dubbs]

New minor version.

[Bruce Dubbs]

Notable Changes in NSS 3.45

• Bug 1540403 - Implement Delegated Credentials (draft-ietf-tls-subcerts)
  • This adds a new experimental function: SSL_DelegateCredential Note: In 3.45, selfserv does not yet support delegated credentials. See Bug 1548360.
  • Note: In 3.45 the SSLChannelInfo is left unmodified, while an upcoming change in 3.46 will set SSLChannelInfo.authKeyBits to that of the delegated credential for better policy enforcement. See Bug 1563078.
• Bug 1550579 - Replace ARM32 Curve25519 implementation with one from fiat-crypto
• Bug 1551129 - Support static linking on Windows
• Bug 1552262 - Expose a function PK11_FindRawCertsWithSubject for finding certificates with a given subject on a given slot
• Bug 1546229 - Add IPSEC IKE support to softoken
• Bug 1554616 - Add support for the Elbrus lcc compiler (<=1.23)
• Bug 1543874 - Expose an external clock for SSL
  • This adds new experimental functions: SSL_SetTimeFunc, SSL_CreateAntiReplayContext, SSL_SetAntiReplayContext, and SSL_ReleaseAntiReplayContext.
  • The experimental function SSL_InitAntiReplay is removed.
• Bug 1546477 - Various changes in response to the ongoing FIPS review
  • Note: The source package size has increased substantially due to the new FIPS test vectors. This will likely prompt follow-on work, but please accept our apologies in the meantime.

Certifiate Authority Changes

• The following CA certificates were Removed:
  • Bug 1552374 - CN = Certinomis - Root CA

[Bruce Dubbs]

Fixed at revision 21823.