Change-Id: Iba9c1fc2895adca0d3455f8068b040d0ca006408 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/639575 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Ian Lance Taylor <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]> Auto-Submit: Ian Lance Taylor <[email protected]>

Update golang.org/x dependencies to their latest tagged versions. Change-Id: I86bc4657bf10e469231536cff39cbdb86c1135c7 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/640455 Reviewed-by: Dmitri Shuralyov <[email protected]> Auto-Submit: Gopher Robot <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: David Chase <[email protected]>

…mpty JSON body in a response to the challenge. A new extension to the ACME protocol is proposed to support device attestation: https://datatracker.ietf.org/doc/draft-acme-device-attest/ Based on the recent IETF meetings, the proposal is likely to be accepted. To support the new extension, the ACME client will need to send a non-empty JSON body in the response to a "device-attest-01" challenge. Fixesgolang/go#68674 Change-Id: I29b420ec837f682e3d59071a4a82af56dc319134 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/608975 Reviewed-by: Roland Shoemaker <[email protected]> Reviewed-by: Michael Knyszek <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Roland Shoemaker <[email protected]>

… interface Fixesgolang/go#68688 Change-Id: Id5f72b32c61c9383a26ec182339486a432c7cdf5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/613856 LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Nicola Murino <[email protected]> Reviewed-by: Jonathan Amsterdam <[email protected]> Reviewed-by: Nicola Murino <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]>

This is an automated CL which updates the NSS root bundle. Change-Id: I3a4388574221a77486b184e73f4b776ff0afc09f Reviewed-on: https://go-review.googlesource.com/c/crypto/+/646215 Auto-Submit: Gopher Robot <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Dmitri Shuralyov <[email protected]>

Update golang.org/x dependencies to their latest tagged versions. Change-Id: Ib9440df43bc2fde0268cbe327c1df839e793f675 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/646220 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: David Chase <[email protected]> Auto-Submit: Gopher Robot <[email protected]> Reviewed-by: Dmitri Shuralyov <[email protected]>

Fixesgolang/go#71612 Change-Id: I5cb0596b33cb18016eb1883d1518319588ae1454 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/647975 Reviewed-by: Roland Shoemaker <[email protected]> Reviewed-by: Nicola Murino <[email protected]> Reviewed-by: Dmitri Shuralyov <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Nicola Murino <[email protected]>

By now Go 1.24.0 has been released, and Go 1.22 is no longer supported per the Go Release Policy (https://go.dev/doc/devel/release#policy). For golang/go#69095. [git-generate] (cd . && go get [email protected] && go mod tidy && go fix ./... && go mod edit -toolchain=none) (cd x509roots/fallback && go get [email protected] && go mod tidy && go fix ./... && go mod edit -toolchain=none) Change-Id: I879bced994b310927c41f820ec272a518aa0c8a5 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/649715 LUCI-TryBot-Result: Go LUCI <[email protected]> Reviewed-by: Dmitri Shuralyov <[email protected]> Auto-Submit: Gopher Robot <[email protected]> Reviewed-by: Cherry Mui <[email protected]>

Change-Id: Ieb2f0d45f82647978f0bd1eb47bb347f0bfb7d13 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/649499 Reviewed-by: Dmitri Shuralyov <[email protected]> Reviewed-by: Dmitri Shuralyov <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>

Back when Go 1.20 and 1.19 were supported, the go1.20 build constraint was there to establish 1.20 as the minimum for the package, because it requires an API that was added only in Go 1.20 and there was no way to make it work with 1.19's APIs. By now only Go 1.24 and 1.23 are supported, and the minimum is set via the go directive in go.mod. For golang/go#57792. Change-Id: Ie4d37d34993374cdd380667930ee667af97eeccb Reviewed-on: https://go-review.googlesource.com/c/crypto/+/649716 Reviewed-by: Dmitri Shuralyov <[email protected]> Reviewed-by: Cherry Mui <[email protected]> Auto-Submit: Dmitri Shuralyov <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>

Avoid unnessecary cache probes for names that don't match the host policy. Fixesgolang/go#71199 Change-Id: I11e8465b0416e960a549b0c0d74a622026c39931 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/651296 Reviewed-by: Dmitri Shuralyov <[email protected]> Reviewed-by: Dmitri Shuralyov <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Gopher Robot <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]>

In the SSH protocol, clients and servers execute the key exchange to generate one-time session keys used for encryption and authentication. The key exchange is performed initially after the connection is established and then periodically after a configurable amount of data. While a key exchange is in progress, we add the received packets to an internal queue until we receive SSH_MSG_KEXINIT from the other side. This can result in high memory usage if the other party is slow to respond to the SSH_MSG_KEXINIT packet, or memory exhaustion if a malicious client never responds to an SSH_MSG_KEXINIT packet during a large file transfer. We now limit the internal queue to 64 packets: this means 2MB with the typical 32KB packet size. When the internal queue is full we block further writes until the pending key exchange is completed or there is a read or write error. Thanks to Yuichi Watanabe for reporting this issue. Change-Id: I1ce2214cc16e08b838d4bc346c74c72addafaeec Reviewed-on: https://go-review.googlesource.com/c/crypto/+/652135 Reviewed-by: Neal Patel <[email protected]> Auto-Submit: Gopher Robot <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>