sharpetronics/liboqs
1
0
Fork 0
mirror of https://github.com/open-quantum-safe/liboqs.git synced 2025-10-04 00:02:01 -04:00
Code Issues Projects Releases Wiki Activity
liboqs/RELEASE.md
Spencer Wilson b5d3dac4eb
liboqs 0.14.0 release candidate 1 (#2180) 
* Prepare 0.14.0 release candidate 1 [full tests] [extended tests]

Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>

* Update release notes with deprecation and security info [skip ci]

Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>

---------

Signed-off-by: Spencer Wilson <spencer.wilson@uwaterloo.ca>
2025-06-26 14:23:12 -04:00

7.5 KiB
Raw Blame History

liboqs version 0.14.0-rc1

About

The Open Quantum Safe (OQS) project has the goal of developing and prototyping quantum-resistant cryptography. More information on OQS can be found on our website: https://openquantumsafe.org/ and on Github at https://github.com/open-quantum-safe/.

liboqs is an open source C library for quantum-resistant cryptographic algorithms. Details about liboqs can be found in README.md. See in particular limitations on intended use.

liboqs can be used with the following Open Quantum Safe application integrations:

  • oqs-provider: A standalone prototype OpenSSL 3 provider enabling liboqs-based quantum-safe and hybrid key authentication and exchange for TLS 1.3, X.509 certificate generation and CMS operations.
  • OQS-BoringSSL: A prototype integration of liboqs-based authentication and key exchange into TLS 1.3 in our fork of BoringSSL; see https://github.com/open-quantum-safe/boringssl.
  • OQS-OpenSSH: A prototype integration of liboqs-based authentication and key exchange into Secure Shell (SSH) version 2 in our fork of OpenSSH; see https://github.com/open-quantum-safe/openssh.

Several demos are available for using the above libraries in applications, including Apache, Chromium, curl, haproxy, nginx, and Wireshark.

liboqs can also be used in the following programming languages via language-specific wrappers:

Release notes

This is release candidate 1 for version 0.14.0 of liboqs. It was released on June 25, 2025.

This release contains a security fix for secret-dependent branching in HQC. It introduces support for SNOVA, a NIST Additional Signatures Round 2 candidate, and a new optimized implementation of SHA3 using AVX-512VL instructions. Additionally, this is the first liboqs release to include the stable 1.0.0 version of PQ Code Package's mlkem-native.

This release also introduces a number of improvements to testing and infrastructure. The OQS project is now publishing benchmarking data on https://openquantumsafe.org/benchmarking and code coverage data on https://coveralls.io/github/open-quantum-safe/liboqs.

Deprecation notice

This will be the last release of liboqs to include Dilithium (that is, the NIST Round 3 version of Dilithium, prior to its standardization by NIST as ML-DSA in FIPS 204). Applications should switch to ML-DSA (FIPS 204). Please contact us if you have any concerns.

Security issues

  • CVE-2025-52473: Disabled compiler optimizations for HQC to avoid secret-dependent branches. Thank you to Zhenzhi Lai and Zhiyuan Zhang from from the University of Melbourne and the Max Planck Institute for Security and Privacy for identifying the issue.

What's New

This release continues from the 0.13.0 release of liboqs.

Key encapsulation mechanisms

  • HQC: Disabled compiler optimizations to avoid secret-dependent branching in certain configurations. HQC remains disabled by default.
  • ML-KEM: Updated the default ML-KEM implementation to PQCP's mlkem-native v1.0.0.

Digital signature schemes

  • New API: added an API function to check if a signature scheme supports signing with a context string.
  • SNOVA: added SNOVA from NIST Additional Signature Schemes Round 2.

Other changes

  • Added an AVX512VL-optimized backend for SHA3.
  • Improved memory management throughout the codebase.

Detailed changelog

What's Changed

New Contributors

Full Changelog: https://github.com/open-quantum-safe/liboqs/compare/0.13.0...0.14.0-rc1