gnuk/NEWS

Gnuk NEWS - User visible changes

* Major changes in Gnuk 0.19

  Released 2012-06-XX, by NIIBE Yutaka

** System service blocks at the beginning of flash ROM.

** USB strings for revision detail, configure options, and system service.

** Firmware upgrade feature

** New tool: gnuk_upgrade.py


* Major changes in Gnuk 0.18

  Released 2012-05-15, by NIIBE Yutaka

** New mandatory option '--vidpid' for configure
You must specify USB vendor ID and product ID for Gnuk.
The file GNUK_USB_DEVICE_ID lists valid USB device IDs.

** New tool: gnuk_remove_keys.py
The tool gnuk_remove_keys.py is to remove all keys in Gnuk Token
and reset PW1 and RC (if any).

** New USB stack
Gnuk used to use USB stack of USB-FS-Device_Lib by ST.  Now, it has
original implementation.  Hopefully, size and quality are improved.


* Major changes in Gnuk 0.17

  Released 2012-02-02, by NIIBE Yutaka

** USB CCID/ICCD protocol implementation change
Gnuk now only supports short APDU level exchange, not support.
extended APDU level exchange.  Thus, Gnuk could be compatible to older
host side software implementation.

** ISO 7816 SELECT command behavior is somewhat strict now
Old implementations do not check DF name for SELECT command.
This causes some trouble when Gnuk Token is identified as if it were
different card/token.  Now, DF name of OpenPGP card is checked.

** USB CCID/ICCD low-level bug is fixed
When the size of command APDU data is just 49, the lower level packet
size is 64.  This is maximum size of BULK-OUT transfer packet, and
caused trouble in the past implementations.  Example is setting url
(0x5f50) as: http://www.gniibe.org/adpu-string-size-is-just-49
This is because the past implementations expect ZLP (zero length
packet).  Now, it has been fixed.  You can use any size of string.

** CERT.3 Data Object (0x7f21) is now optional
As there's no valid use case for this data object and it does not
work as current version of GnuPG, this is now optional feature.
You can enable this data object by specifying --enable-certdo at
configure time.

** With DnD pinentry, user can cancel pin input
Now, user can cancel pin input by unmounting device before finishing
DnD.

** New tool: pinpadtest.py
The tool pinpadtest.py is PC/SC test tool for pinentry of pinpad with
OpenPGP card v2.


* Major changes in Gnuk 0.16

  Released 2011-12-14, by NIIBE Yutaka

** DnD pinentry support is added and it's default to pinentry support
DnD pinentry support doesn't require any hardware extension, but
emulates mass storage class device of USB.  User inputs pass phrase
by "drag and drop"-ing folders using file manager or something.

** Bug fix for VERIFY for CHV2
With no keys, VERIFY command for CHV2 used to fail even if pass phrase
is correct.  It was intentional, because CHV2 verification would be
useless with no keys.  But there is a corner case for PRIVATE-DOs,
which may requires CHV2 verification.  Even though Gnuk doesn't
support any PRIVATE-DOs, it is good to be fixed.

** Changed bcdUSB = 1.1
Gnuk device conforms to USB 2.0 full speed device, but when it was
2.0, some OS informs users, "you can connect the device to 2.0
compliant hub so that it can have better bandwidth", which is not
the case for full speed device.


* Major changes in Gnuk 0.15

  Released 2011-11-24, by NIIBE Yutaka

** New targets: FST_01 and FST_01_00
Flying Stone Technology's open hardware, Flying Stone Tiny 01 is
supported.

** Flash writing tool for "DfuSe" is improved
Now, it supports holes and unaligned blocks in hex file.

** Experimental PIN-pad support (by TV controller) change
Now, Gnuk has codetables for conversion from CIR code to ASCII code.
Note that only four controllers (of Dell, Sharp, Sony, and Toshiba)
are supported and tested.

** It is possible for users to keep using OPENPGP_CARD_INITIAL_PW1
With a bug fix of verify_user_0, it's now possible.  Although it's not
recommended.

** Important bug fix and a workaround
In version 0.14, __main_stack_size__ (for interrupt handler) was too
small for some cases.  This is fixed in 0.15.

In src/Makefile.in, added -mfix-cortex-m3-ldrd for correctly linking C
library for thumb2.  This is needed for newer summon-arm-toolchain.


* Major changes in Gnuk 0.14

  Released 2011-10-07, by NIIBE Yutaka

** Random number generator change
NeuG, Gniibe's True RNG implementation for STM32F103, has been
integrated to Gnuk.  It is not needed to put random number bytes
(generated by host) to Token any more.


* Major changes in Gnuk 0.13

  Released 2011-06-15, by NIIBE Yutaka

** Improved RSA routine.
About 20% speed improvement.

** New tool: hub_ctrl.
It is a Python implementation ported from original C implementation.
It is useful for development of USB target if you have a good hub.
You can power off/on the port to reset Gnuk Token.


* Major changes in Gnuk 0.12

  Released 2011-05-13, by NIIBE Yutaka

** Admin-less mode is supported.
The OpenPGP card specification assumes existence of a security officer
(admin), who has privilege to manage the card.  On the other hand,
many use cases of Gnuk are admin == user.

Thus, Gnuk now supports "admin-less" mode.  In this mode, user can get
privilege with the password of PW1.

At the initialization of the card, Gnuk becomes compatible mode by
setting PW3.  Without setting PW3, it becomes "admin-less" mode
by setting PW1.

** Important two bug fixes.
Gnuk (<= 0.11) has a bug which makes possible for attacker to change
user password to unknown state without knowing original password (when
no keys are loaded yet).  No, attacker could not steal your identity
(cannot sign or decrypt), but it would be possible to disturb you.

Gnuk (<= 0.11) has a bug which makes possible for attacker to guess
admin password easily.  When admin password is not set (the default
value of factory setting), failure of VERIFY doesn't increment error
counter in older versions.  Observing no increment of error counter,
attacker could know that admin password is the one of factory setting.

** tool/gnuk_put_binary.py now uses pyscard.
Instead of PyUSB, it uses Python binding of PC/SC.  PyUSB version is
still available as tool/gnuk_put_binary_libusb.py.

** Logo for Gnuk is updated.

** Gnuk Sticker SVG is available.


* Major changes in Gnuk 0.11

  Released 2011-04-15, by NIIBE Yutaka

This is bug fixes only release.


* Major changes in Gnuk 0.10

  Released 2011-02-10, by NIIBE Yutaka

** The executable can be installed to multiple devices.
So far, users of Gnuk should have not shared single executable among
multiple devices because the executable includes random bits (or
fixed serial number).  Now, random_bits and fixed serial number are
configured *after* compilation, we can install single executable image
to multiple devices.  Note that we need to configure random_bits for
each device.

** Removed configure option: --with-fixed-serial
It is not compile time option any more.  After installation, we can
modify serial number in AID by tool/gnuk_put_binary.py.  Modification
is possible only once.  If you don't modify, Gnuk uses unique chip ID
of STM32 processor for AID.


* Major changes in Gnuk 0.9

  Released 2011-02-01, by NIIBE Yutaka

** Card Holder Certificate is supported (still this is experimental).
Gnuk can support card holder certificate now.  Note that GnuPG is not
ready yet.  The tool/gnuk_update_binary.py is for writing card holder
certificate to Gnuk Token.

** Better interoperability to OpenSC.
Gnuk is not yet supported by OpenSC, but it could be.  With the
changes in Gnuk, it could be relatively easily possible to support
Gnuk Token by OpenSC with a few changes to libopensc/card-openpgp.c,
and libopensc/pkcs15-openpgp.c.

** New board support "STBee"
STBee is a board by Strawberry Linux Co., Ltd., and it has
STM32F103VET6 on the board.  The chip is High Density CPU with 512KB
flash memory and many I/O.  If you want to connect sensor, display,
etc., this board would be a good candidate.

** Experimental PIN-pad modification(unblock) support is added.
PIN-pad modification(unblock) is supported.


* Major changes in Gnuk 0.8

  Released 2011-01-19, by NIIBE Yutaka

** Experimental PIN-pad modification support is added.
PIN input using rotally encoder and push switch is tested with STBee
Mini.  By this hardware, PIN-pad modification is supported.


* Major changes in Gnuk 0.7

  Released 2011-01-15, by NIIBE Yutaka

** Bug fix only.
In version 0.6, a severe bug was introduced in usb-icc.c when adding a
work around for libccid 1.3.11.  The fix is one-liner, but it is worth
to release newer version.


* Major changes in Gnuk 0.6

  Released 2011-01-14, by NIIBE Yutaka

** Experimental PIN-pad support is added.
Local PIN-pad input is suppored for boards which have input hardware.
PIN input using consumer IR receive module is tested with STBee Mini
and STM8S Discovery.

** USB device serial number is virtually unique now.
STM32F103 has 96-bit unique chip identifier.  We take advantage of
this, Gnuk Token has virtually unique USB serial number.

** Card serial number is determined at run time by chip identifier.
Until version 0.5, card serial number was compile time option.  If we
used same binary for different devices, card serial number was same.
Now, we use STM32F103's 96-bit unique chip identifier for card serial
number (when you don't use --with-fixed-serial option).

** More improved USB-CCID/ICCD implementation.
The changes in 0.5 was not that good for libccid 1.3.11, which has
small buffer (only 262-byte APDU).  Workaround for libccid 1.3.11 is
implemented.


* Major changes in Gnuk 0.5

  Released 2010-12-13, by NIIBE Yutaka

** LED blink
LED blink now shows status output of the card.  It shows the status of
CHV3, CHV2, and CHV1 when GPG is accessing the card.

** New board support "STM8S Discovery"
ST-Link part (with STM32F103C8T6) of STM8S Discovery board is now supported.

** Digital signing for SHA224/SHA256/SHA384/SHA512 digestInfo is now possible.

** Fixes for password management
Now, you can allow the token to do digital signing multiple times with
single authentication.  You can use "forcesig" subcommand in card-edit
of GnuPG to enable the feature.

** Key management changes
If you remove all keys, it is possible to import keys again.

** More improved USB-CCID/ICCD implementation.
Gnuk works better with GPG's in-stock protocol stack.  You can do
digital signing (not decryption, key import, or get_public_key in
GPG2).  For decryption, key import and get_public_key, changes are
needed for GPG (scd/ccid-driver.c) to support the case of extended
APDU.  In short, you can sign with Gnuk by GPG.

** Windows support.
Gnuk Token could run with GPG4WIN on MS Windows.  GPG4WIN runs with
"usbccid" driver and "winscard" driver.


* Major changes in Gnuk 0.4

  Released 2010-11-09, by NIIBE Yutaka

** New board support "STBee Mini".

** Flash writing tool for "DfuSe" is included now.

** Since Flash GC is now implemented, it can be used longer.


* Major changes in Gnuk 0.3

  Released 2010-10-23, by NIIBE Yutaka

** Now we have 'configure' script to select target.

** Support system with DFU (Device Firmware Upgrade) downloader.

** New board support "CQ STARM".

** Improved USB-ICCD implementation.  Works fine with GPG's protocol stack.


* Major changes in Gnuk 0.2

  Released 2010-09-13, by NIIBE Yutaka

** With DEBUG=1, timeout is more than 3 seconds.

** Flash ROM entries for random numbers are cleared after use. 

** Board support "STM32 Primer 2" now works.
 

* Major changes in Gnuk 0.1

  Released 2010-09-10, by NIIBE Yutaka

** Enabled force_chv1 (in the pw_status_bytes), so that the decipher works.

** Support both of key for digital signing and key for decryption.

** Decipher is supported.

** New board support "STM32 Primer 2" is added by Kaz Kojima.

** LED behavior is meaningful now.  "ON" during execution.

** Fixed bcdCCID revision number.

** Logo.


* Major changes in Gnuk 0.0

  Released 2010-09-06, by NIIBE Yutaka

** This is initial release.  Only it supports digital signing.

Local Variables:
mode: outline
End: