Crypto++ 5.6.5 Released

[Jeffrey Walton]

Hi Everyone,

Crypto++ 5.6.5 was released today. The 5.6.5 release was mostly a maintenance release. The release included two CVE fixes.

The release notes and list of issues fixed can be found at http://www.cryptopp.com/release565.html. The 5.6.5 ZIP archive can be downloaded from http://www.cryptopp.com/cryptopp565.zip.

The checksums for the 5.6.5 ZIP archive are:

  * SHA1: effa1770b81dfe05db48ddc0468ead8660929650
  * SHA256: be430377b05c15971d5ccb6e44b4d95470f561024ed6d701fe3da3a188c84ad7

The 5.6.5 sources can be checked out from GitHub using the following. It is tagged as CRYPTOPP_5_6_5 at GitHub.

  * git clone http://github.com/weidai11/cryptopp.git cryptopp

There are 28 outstanding issues. 26 of them are feature requests and enhancements. 2 of them are actual bugs.

You are encouraged to recompile the library and all dependendt programs due to changes from CVE-2016-7420 (Issue 277).

Jeff

[Jeffrey Walton]

The checksums for the 5.6.5 ZIP archive are:

  * SHA1: effa1770b81dfe05db48ddc0468ead8660929650
  * SHA256: be430377b05c15971d5ccb6e44b4d95470f561024ed6d701fe3da3a188c84ad7

Whoops, here are the correct hashes. The ones above are from 5.6.4.

  * SHA1: a74f207a315b6a133af9640a45bde9d6e378af4d
  * SHA256: a75ef486fe3128008bbb201efee3dcdcffbe791120952910883b26337ec32c34 

Jeff

[Ankur Goyal]

Hi Jeff,

I need to know whether the Cryptopp version 5.6.1 still being supported? We are using this in one of our applications, so we want to make sure the versions we are using are not outdated and still being supported. 

Do let me know about this.

Thanks,

Ankur

[Jeffrey Walton]

I need to know whether the Cryptopp version 5.6.1 still being supported?

I think it mostly falls into the "not supported" category. 5.61 does not receive updates or patches. Since 5.6.1, we cleared a number of small issues, larger issues and about 5 CVEs.

With that said, we are happy to help you with it if we can.
 

We are using this in one of our applications, so we want to make sure the versions we are using are not outdated and still being supported.

It sounds outdated.

You might consider updating to Crypto++ 5.6.5. We had a few unintentional ABI breaks in versions 5.6.3 through 5.6.5, so you should recompile your program if you update Crypto++. We now have better tests in place to detect the ABI breaks.

When it comes out, Crypto++ 5.7 will clear the ABI breaks, one CVE and add new algorithms. I think all the stuff is crossed off our Crypto++ 5.7 TODO list except curve25519. I'm working on it now. It should be out in the next couple of months. Also see http://www.cryptopp.com/wiki/Roadmap.

Jeff