Noteworthy changes in version 2.5.24 (2026-09-23)
- scd: Fix for regression in 2.5.23 related to the new Nitrokey detection. [T8331]
Noteworthy changes in version 2.5.23 (2026-09-22)
- New and extended features:
- gpg: New option --allow-9980 to enable the processing of RFC-9980 specified data structures. The use of this option is only recommended if external policy requirements demand the use of these governmental approved specification. PGP folks requiring some PQC resistance should keep on using the standard LibrePGP Kyber algorithm introduced 2 years ago. [rG6803ce215c]
- gpg: In 9980 mode support PQC encryption using ML-KEM (aka Kyber) with X448, X25519, Brainpool, or NIST curves as specified by RFC-9980 et al.
- gpg: In 9980 mode support ED25519 and X25519 as specified by RFC-9580 under the names "ietf27" and "ietf27".
- gpg: Add experimental support for a --compliance=fips mode to use GCM for bulk encryption. [rG05c271f45a]
- scd: Add Nitrokey 3 to pcsc-shared interference detection. [T8331]
- Bug fixes:
- gpgsm: Fix an exploitable printf bug when using the debug option "--debug x509". [rGe6d92ff7af]
- dirmngr: Make the LDAP upload flags also work for KS_SEARCH. [T7866]
- dirmngr: Fix OOB read in DNS CERT record parser. [T8464]
- scd: Fix OOB access in DO parsing of faulty cards. [T8465]
- Other changes:
- dirmngr: Add a mitigation for badly configured web key directories. [rGbc7686ad7c]
- New option --debug-no-libgcrypt for gpg, gpgsm, and agent. This debug option is useful to avoid cluttering other debug output with libgcrypt generated debug details.
- gpg: New --list-options "debug-show-sexp" to print a secret key as an s-expression. [rG1e0261fe50]