X-Git-Url: https://git.eyrie.org/?a=blobdiff_plain;f=NEWS;h=5274ac01d601f34abe321a2b0dd5bbe1a8b61214;hb=73fb0839695dbc4a943af0f8236b16f5d82e8c8a;hp=286f7c4f4c41829d6dfb289137823a6586967f3a;hpb=14cf7a48ebe72564920b90cda62288471d1ed235;p=kerberos%2Fkrb5-strength.git

diff --git a/NEWS b/NEWS
index 286f7c4..5274ac0 100644
--- a/NEWS
+++ b/NEWS
@@ -1,11 +1,54 @@
                     User-Visible krb5-strength Changes
 
-krb5-strength 3.2 (unreleased)
+krb5-strength 3.3 (unreleased)
+
+    heimdal-history now requires the Perl modules Const::Fast and
+    JSON::MaybeXS instead of Readonly and JSON.
+
+    Explicitly erase the copy of the password made in the Heimdal plugin.
+
+    Update to rra-c-util 10.5:
+
+    * Assume a working snprintf rather than supplying a replacement.
+    * Fix detection of reallocarray on NetBSD.
+    * Check that Kerberos header files were found during configure.
+    * Use AS_ECHO in all Autoconf macros.
+    * Always use lib32 or lib64 if it exists, even on Debian.
+    * Fix rejection of unknown Clang warning flags.
+    * Disable -Wreserved-identifier for Clang warning builds.
+
+krb5-strength 3.2 (2020-05-17)
+
+    Add new -c (--check-only) option to heimdal-history to check whether a
+    password would be accepted without updating the history or password
+    length databases.  Based on work by macrotex.
+
+    Increase hash iterations for heimdal-history by roughly a factor of
+    four to increase the time required for a password hash to about 0.1
+    seconds on modern hardware.  This will affect newly-stored history
+    entries but will not invalidate existing password history entries.
 
     Support building without CrackLib support by passing
     --without-cracklib to configure.  This makes the code a bit simpler
     and lighter if you don't intend to ever use the CrackLib support.
 
+    krb5-strength-wordlist now requires Perl 5.010 or later.
+
+    Use explicit_bzero instead of memset, where available, to overwrite
+    copies of passwords before freeing memory.  This reduces the lifetime
+    of passwords in memory.
+
+    Skip tests that require the stronger rule configuration in the
+    embedded CrackLib when built against system CrackLib.  This avoids
+    test failures when built with system CrackLib.
+
+    Rework the check-valgrind target to use the new C TAP Harness valgrind
+    support and automatically check the valgrind log files for errors at
+    the end of the test suite.
+
+    Add SPDX-License-Identifier headers to all substantial source files
+    other than those in the bundled version of CrackLib.
+
     Update to rra-c-util 8.2:
 
     * Implement explicit_bzero with memset if it is not available.
@@ -18,6 +61,7 @@ krb5-strength 3.2 (unreleased)
     * Skip more build system files when running the test suite.
     * Fix warnings with Clang 10, GCC 10, and the Clang static analyzer.
     * Exclude more valgrind false positives with Kerberos libraries.
+    * Improve support for AIX's bundled Kerberos.
 
     Update to C TAP Harness 4.7: