Noteworthy changes in version 1.9.1 (2021-01-29)
* Bug fixes:
- **Fix exploitable bug** in hash functions introduced with 1.9.0.
[T5275]
- Return an error if a negative MPI is used with sexp scan
functions. [T4964]
- Check for operational FIPS in the random and KDF functions.
[T5243]
- Fix compile error on ARMv7 with NEON disabled. [T5251]
- Fix self-test in KDF module. [T5254]
- Improve assembler checks for better LTO support. [T5255]
- Fix assember problem on macOS running on M1. [T5157]
- Support older macOS without posix_spawn. [T5159]
- Fix 32-bit cross build on x86. [T5257]
- Fix non-NEON ARM assembly implementation for SHA512. [T5263]
- Fix build problems with the cipher_bulk_ops_t typedef. [T5264]
- Fix Ed25519 private key handling for preceding ZEROs. [T5267]
- Fix overflow in modular inverse implementation. [T5269]
- Fix register access for AVX/AVX2 implementations of Blake2.
[T5271].
* Performance:
- Add optimized cipher and hash functions for s390x/zSeries.
- Use hardware bit counting functionx when available.
* Internal changes:
- The macOS getentropy syscall is used when available. [T5268]
- Update DSA functions to match FIPS 186-3. [rC30ed9593f6]
- New self-tests for CMACs and KDFs. [rC385a89e35b,rC7a0da24925]
- Add bulk cipher functions for OFB and GCM modes.
[rCf12b6788f2,rCf4e63e92dc]
(prev T4294, next T5276)