cryptopp-modern: Maintained Fork of the Crypto++ Library
Version 2026.8.0 - August 2026

cryptopp-modern is an actively maintained fork of the Crypto++ library,
a free C++ class library of cryptographic schemes. The library contains
the following algorithms:

                   algorithm type  name

 authenticated encryption schemes  GCM, CCM, EAX, ChaCha20Poly1305,
                                   XChaCha20Poly1305, XAES-256-GCM,
                                   AES-CTR-HMAC

        high speed stream ciphers  ChaCha (8/12/20), ChaCha (IETF), Panama, Salsa20,
                                   Sosemanuk, XSalsa20, XChaCha20

           AES and AES candidates  AES (Rijndael), RC6, MARS, Twofish, Serpent,
                                   CAST-256

                                   ARIA, Blowfish, Camellia, CHAM, HIGHT, IDEA,
                                   Kalyna (128/256/512), LEA, SEED, RC5, SHACAL-2,
              other block ciphers  SIMON (64/128), Skipjack, SPECK (64/128),
                                   Simeck, SM4, Threefish (256/512/1024),
                                   Triple-DES (DES-EDE2 and DES-EDE3), TEA, XTEA

  block cipher modes of operation  ECB, CBC, CBC ciphertext stealing (CTS),
                                   CFB, OFB, counter mode (CTR), XTS

     message authentication codes  BLAKE2s, BLAKE2b, CMAC, CBC-MAC, DMAC, GMAC, HMAC,
                                   Poly1305, Poly1305 (IETF), SipHash, Two-Track-MAC,
                                   VMAC

                                   BLAKE2s, BLAKE2b, BLAKE3 (with AVX-512),
                   hash functions  Keccak (F1600), LSH (256/512),
                                   SHA-1, SHA-2 (224/256/384/512),
                                   SHA-3 (224/256/384/512), SHAKE (128/256),
                                   SipHash, SM3, Tiger, RIPEMD (128/160/256/320), WHIRLPOOL

  password-based key derivation  Argon2 (Argon2d/Argon2i/Argon2id, RFC 9106),
                                   HKDF, PBKDF1, PBKDF2, PBKDF (PKCS #12), Scrypt

                                   RSA, DSA, Deterministic DSA, ElGamal,
          public-key cryptography  Nyberg-Rueppel (NR), Rabin-Williams (RW), LUC,
                                   LUCELG, EC-based German Digital Signature (ECGDSA),
                                   DLIES (variants of DHAES), ESIGN,
                                   ML-DSA (FIPS 204), SLH-DSA (FIPS 205),
                                   LMS/HSS (SP 800-208, stateful)

   padding schemes for public-key  PKCS#1 v2.0, OAEP, PSS, PSSR, IEEE P1363
                          systems  EMSA2 and EMSA5

                                   Diffie-Hellman (DH), Unified Diffie-Hellman (DH2),
            key agreement schemes  Menezes-Qu-Vanstone (MQV), Hashed MQV (HMQV),
                                   Fully Hashed MQV (FHMQV), LUCDIF, XTR-DH,
                                   ML-KEM (FIPS 203), X-Wing (X25519 + ML-KEM-768)

      elliptic curve cryptography  ECDSA, Deterministic ECDSA, ed25519, ECNR, ECIES,
                                   ECDH, ECMQV, x25519

   post-quantum cryptography (PQC) ML-KEM (FIPS 203) key encapsulation,
                                   ML-DSA (FIPS 204) digital signatures,
                                   SLH-DSA (FIPS 205) stateless hash-based signatures,
                                   LMS/HSS (SP 800-208) stateful hash-based signatures,
                                   X-Wing hybrid KEM (X25519 + ML-KEM-768)

          insecure or obsolescent  MD2, MD4, MD5, Panama Hash, DES, ARC4, SEAL
algorithms retained for backwards  3.0, WAKE-OFB, DESX (DES-XEX3), RC2,
     compatibility and historical  SAFER, 3-WAY, GOST, SHARK, CAST-128, Square
                            value

Other features include:

  * pseudo random number generators (PRNG): ANSI X9.17 appendix C, RandomPool,
    DARN, VIA Padlock, RDRAND, RDSEED, NIST Hash and HMAC DRBGs
  * password based key derivation functions: PBKDF1 and PBKDF2 from PKCS #5,
    PBKDF from PKCS #12 appendix B, HKDF from RFC 5869, Scrypt from RFC 7914,
    Argon2 from RFC 9106
  * Shamir's secret sharing scheme and Rabin's information dispersal algorithm
    (IDA)
  * fast multi-precision integer (bignum) and polynomial operations
  * finite field arithmetics, including GF(p) and GF(2^n)
  * prime number generation and verification
  * useful non-cryptographic algorithms
      + DEFLATE (RFC 1951) compression/decompression with gzip (RFC 1952) and
        zlib (RFC 1950) format support
      + Hex, base-32, base-64, URL safe base-64 encoding and decoding
      + 32-bit CRC, CRC-C and Adler32 checksum
  * class wrappers for these platform and operating system features (optional):
      + high resolution timers on Windows, Unix, and Mac OS
      + /dev/random, /dev/urandom, /dev/srandom
      + Microsoft's CryptGenRandom or BCryptGenRandom on Windows
  * A high level interface for most of the above, using a filter/pipeline
    metaphor
  * benchmarks and validation testing
  * x86, x64 (x86-64), x32 (ILP32), ARM-32, Aarch32, Aarch64 and Power8
    in-core code for the commonly used algorithms
      + run-time CPU feature detection and code selection
      + supports GCC-style and MSVC-style inline assembly, and MASM for x64
      + x86, x64 (x86-64), x32 provides MMX, SSE2, and SSE4 implementations
      + ARM-32, Aarch32 and Aarch64 provides NEON, ASIMD and ARMv8 implementations
      + Power8 provides in-core AES using NX Crypto Acceleration

The Crypto++ library was originally written by Wei Dai. cryptopp-modern is
maintained by CoraleSoft and the community. You are welcome to use it for any
purpose without paying anyone, but see LICENSE for the fine print.

The following compilers are supported for this release. Please visit
https://cryptopp-modern.com for build instructions and documentation.

  * Visual Studio 2019 - 2022
  * GCC 11 - 14
  * Apple Clang 14 - 16
  * LLVM Clang 15 - 18

*** Important Usage Notes ***

1. If a constructor for A takes a pointer to an object B (except primitive
types such as int and char), then A owns B and will delete B at A's
destruction.  If a constructor for A takes a reference to an object B,
then the caller retains ownership of B and should not destroy it until
A no longer needs it.

2. Crypto++ is thread safe at the class level. This means you can use
Crypto++ safely in a multithreaded application, but you must provide
synchronization when multiple threads access a common Crypto++ object.

*** Build Systems ***

cryptopp-modern supports multiple build systems:

  * CMake (recommended for IDE integration and find_package support)
  * GNUmakefile (traditional Make-based workflows)
  * Visual Studio solution files (cryptest.sln)
  * nmake (Windows command-line builds)

See CMAKE.md, GNUMAKEFILE.md, or GETTING_STARTED.md for detailed instructions.

*** MSVC-Specific Information ***

To compile with MSVC, open "cryptest.sln" in Visual Studio 2019 or later
and build one or more of the following projects:

cryptest Non-DLL-Import Configuration - This builds the full static library
  along with a full test driver.
cryptest DLL-Import Configuration - This builds a static library containing
  only algorithms not in the DLL, along with a full test driver that uses
  both the DLL and the static library.
cryptdll - This builds the DLL. Please note that if you wish to use Crypto++
  as a FIPS validated module, you must use a pre-built DLL that has undergone
  the FIPS validation process instead of building your own.
dlltest - This builds a sample application that only uses the DLL.

The DLL used to provide FIPS validated cryptography. The library was moved
to the CMVP's [Historical Validation List](http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-historical.htm).
The library and the DLL are no longer considered
validated. You should no longer use the DLL.

To use the Crypto++ DLL in your application, #include "dll.h" before including
any other Crypto++ header files, and place the DLL in the same directory as
your .exe file. dll.h includes the line #pragma comment(lib, "cryptopp")
so you don't have to explicitly list the import library in your project
settings. Otherwise, to use a static library form of Crypto++, make the "cryptlib"
project a dependency of your application project, or specify it as
an additional library to link with in your project settings.
In either case you should check the compiler options to
make sure that the library and your application are using the same C++
run-time libraries and calling conventions.

*** DLL Memory Management ***

Because it's possible for the Crypto++ DLL to delete objects allocated
by the calling application, they must use the same C++ memory heap. Three
methods are provided to achieve this.
1.  The calling application can tell Crypto++ what heap to use. This method
    is required when the calling application uses a non-standard heap.
2.  Crypto++ can tell the calling application what heap to use. This method
    is required when the calling application uses a statically linked C++ Run
    Time Library. (Method 1 does not work in this case because the Crypto++ DLL
    is initialized before the calling application's heap is initialized.)
3.  Crypto++ can automatically use the heap provided by the calling application's
    dynamically linked C++ Run Time Library. The calling application must
    make sure that the dynamically linked C++ Run Time Library is initialized
    before Crypto++ is loaded. (At this time it is not clear if it is possible
    to control the order in which DLLs are initialized on Windows 9x machines,
    so it might be best to avoid using this method.)

When Crypto++ attaches to a new process, it searches all modules loaded
into the process space for exported functions "GetNewAndDeleteForCryptoPP"
and "SetNewAndDeleteFromCryptoPP". If one of these functions is found,
Crypto++ uses methods 1 or 2, respectively, by calling the function.
Otherwise, method 3 is used.

*** Linux and Unix-like Specific Information ***

A makefile is included for you to compile Crypto++ with GCC and compatibles.
Make sure you are using GNU Make and GNU ld. The make process will produce
two files, libcryptopp.a and cryptest.exe. Run "cryptest.exe v" for the
validation suite and "cryptest.exe tv all" for additional test vectors.

The makefile uses '-DNDEBUG -g2 -O2' CXXFLAGS by default. If you use an
alternate build system, like Autotools or CMake, then ensure the build system
includes '-DNDEBUG' for production or release builds. The Crypto++ library uses
asserts for debugging and diagnostics during development; it does not
rely on them to crash a program at runtime.

If an assert triggers in production software, then unprotected sensitive
information could be egressed from the program to the filesystem or the
platform's error reporting program, like Apport on Ubuntu or CrashReporter
on Apple.

The makefile orders object files to help remediate problems associated with
C++ static initialization order. The library does not use custom linker scripts.
If you use an alternate build system, like Autotools or CMake, and collect source
files into a list, then ensure these three are at the head of the list: 'cryptlib.cpp
cpu.cpp integer.cpp <other sources>'. They should be linked in the same order:
'cryptlib.o cpu.o integer.o <other objects>'.

If your linker supports initialization attributes, like init_priority, then you can
define CRYPTOPP_INIT_PRIORITY to control object initialization order. Set it to a
value like 250. User programs can use CRYPTOPP_USER_PRIORITY to avoid conflicts with
library values. Initialization attributes are more reliable than object file ordering,
but its not ubiquitously supported by linkers.

The makefile links to the static version of the Crypto++ library to avoid binary
planting and other LD_PRELOAD tricks. You should use the static version of the
library in your programs to help avoid unwanted redirections.

*** Side Channel Attacks ***

Crypto++ attempts to resist side channel attacks using various remediations.
The remediations are applied as a best effort but are probably incomplete. They
are incomplete due to cpu speculation bugs like Spectre, Meltdown, Foreshadow.
The attacks target both cpu caches and internal buffers. Intel generally refers
to internal buffer attacks as "Microarchitectural Data Sampling" (MDS).

The library uses hardware instructions when possible for block ciphers, hashes
and other operations. The hardware acceleration remediates some timing
attacks. The library also uses cache-aware algorithms and access patterns
to minimize leakage cache evictions.

Elliptic curves over binary fields are believed to leak information. The task is a
work in progress. We don't believe binary fields are used in production, so we feel it
is a low risk at the moment.

Crypto++ does not engage Specter remediations at this time. The GCC options
for Specter are -mfunction-return=thunk and -mindirect-branch=thunk, and the
library uses them during testing. If you want the Specter workarounds then add
the GCC options to your CXXFLAGS when building the library.

To help resist attacks you should disable hyperthreading on cpus. If you
suspect or find an information leak then please report it.

*** Documentation and Support ***

cryptopp-modern documentation is available at https://cryptopp-modern.com,
including algorithm references, code examples, and migration guides.

The library is also documented through inline comments in header files,
which are processed through Doxygen to produce an HTML reference manual.

If you run into any problems, please open an issue on GitHub:
https://github.com/cryptopp-modern/cryptopp-modern/issues

*** Source Code and Contributing ***

The source code is available at:

  * https://github.com/cryptopp-modern/cryptopp-modern
  * See ROADMAP.md for development direction and future plans
  * Upstream Crypto++: https://github.com/weidai11/cryptopp

Contributions of all types are welcomed. Contributions include the following.

  * Bug finding and fixes
  * Features and enhancements
  * Test scripts and test cases
  * Branch and release testing
  * Documentation and updates

If you think you have found a bug in the library, then you should discuss it on the
Users mailing list. Discussing it will help bring the issue to the attention of folks
who can help resolve the issue. If you want to contribute a bug fix to the library,
then make a Pull Request or make a Diff available somewhere. Also see Bug Reports on
the wiki.

Features and enhancements are welcomed additions to the library. This category tends
to be time consuming because algorithms and their test cases need to be reviewed and
merged. Please be mindful of the test cases, and attempt to procure them from an
independent source.

The library cherishes test scripts and test cases. They ensure the library is fit and
they help uncover issues with the library before users experience them. If you have
some time, then write some test cases, especially the ones that are intended to break
things.

Branch and release testing is your chance to ensure Master (and planned merges) meets
your expectations and perform as expected. If you have a few spare cycles, then please
test Master on your favorite platform. We need more testing on MinGW, Windows Phone,
Windows Store, Solaris 10 (and below), and modern iOS and OS X (including TV and
Watch builds).

Documentation and updates includes both the inline source code annotations using
Doxygen, and the online information provided in the wiki. The wiki is more verbose and
usually provides more contextual information than the API reference. Besides testing,
documentation is one of the highest returns on investment.

*** History ***

The items in this section comprise the most recent history. Please see History.txt
for the record back to Crypto++ 1.0.

2026.8.0 - August 2026
      - minor release (Unix shared libraries, mixed-parameter HSS, ChaCha SIMD fix)
      - fixed ChaCha counter carry in the NEON, SSE2, and Altivec backends
        * keystream was wrong when the 32-bit block counter overflowed inside
          a multi-block request
        * fixes upstream issue 1362; also merged upstream (PR 1363)
      - added Unix shared-library builds (issue 48)
        * CMake and GNUmakefile support shared-library builds on Unix-like
          platforms
        * SONAME starts an independent ABI series at libcryptopp.so.9
      - added mixed-parameter HSS (PR 56)
        * per-level LMS and LM-OTS parameters in HSS_Params
        * new HSS_SHA256_H10W4_H5W8_L2 typedef; LM-OTS W1, W2, W4 parameter sets
        * verified against RFC 8554 Appendix F Test Case 2
        * source break for direct HSS_Params users; named typedefs, wire
          formats, key encodings, and state files unchanged
      - validated BLAKE3 public inputs at runtime (PR 57)
        * invalid keys, output lengths, and KDF contexts now throw
        * keyed-mode MIN_KEYLENGTH is 32
        * AlgorithmProvider no longer reports NEON on ARM
      - rejected zero-length AEAD authentication tags (PR 58, upstream issue 1364)
      - rejected zero PBKDF iterations without a positive time budget (PR 59,
        upstream issue 1366)
      - fixed MSVC MASM object paths under CMake; added Windows ARM64 CI (issue 43)
      - fixed variable collisions in setenv-ios.sh

2026.7.1 - July 2026
      - packaging patch (no cryptographic code changes)
      - moved CMake and pkg-config files under CMAKE_INSTALL_LIBDIR (issue 47)
      - restored libcryptopp.pc; kept cryptopp-modern.pc as an alias (issue 51)
      - added .tar.gz releases and normalised repository line endings (issue 49)
      - published the release-signing key and verification steps (issue 46)

2026.7.0 - July 2026
      - minor release (SLH-DSA external interface, stateful-signing hardening)
      - changed SLH-DSA to the FIPS 205 external pure signature interface
        * restores interoperability with OpenSSL, X.509, and CMS
        * empty context by default; SLHDSA_MessageAccumulator gains SetContext
        * signatures from 2026.3.0 through 2026.6.0 used the internal message
          form and are not interoperable with the external-interface format
          introduced in 2026.7.0
        * fixes issue 40
      - hardened LMS/HSS stateful signing
        * signing fails closed on invalid state reservations
        * StateReservation bound to its issuing store; cross-store use rejected
        * null state-store access throws SignerStateIntegrityFailure
      - hardened FileStateStore
        * validates the state-file size on open and rejects zero-capacity stores
        * POSIX exclusive locking with retry on interrupted I/O
      - fixed HSS capacity helpers and public-header hygiene for the C++11 baseline

2026.6.0 - June 2026
      - minor release (LMS/HSS stateful hash-based signatures)
      - added LMS single-tree signatures
        * H5 (32 sigs) and H10 (1024 sigs) with Winternitz W=8
        * SHA-256 only
        * follows NIST SP 800-208 and RFC 8554
      - added HSS hierarchical signatures
        * L=2 (1024 sigs at H5) and L=3 (32k sigs at H5)
        * uniform parameter sets at every level
      - added stateful signing framework
        * PK_StatefulSigner deliberately not a subtype of PK_Signer
        * SignerStateStore backend contract; reserved indexes never reissued
        * StateReservation move-only capability token
      - added FileStateStore durable backend
        * write-ahead persistence with HMAC-SHA256 integrity
        * fail-closed poisoning on integrity failure
        * Win32 / POSIX / macOS F_FULLFSYNC flush handling
      - added ASN.1 wiring for LMS public keys
        * X.509 SubjectPublicKeyInfo with RFC 8708 id-alg-hss-lms-hashsig
        * library-local PKCS#8 wrapper carrying SEED || I
      - added Save/Load round-trip tests for ML-KEM, ML-DSA, SLH-DSA
      - added Android x86_64 and x86 build coverage in CI
      - added legacy compiler CI lanes (GCC 9-10, Clang 11-14)
      - fixed sanitizer CI grep gap (cryptest tv output now checked)
      - guarded zero-length memcpy in DL_DecryptorBase::Decrypt (UBSan hygiene)

2026.5.2 - May 2026
      - patch release (security + conformance)
      - capped DERReencode recursion depth at 32 levels
        * matches OpenSSL ASN1_MAX_CONSTRUCTED_NEST
        * deeper nested constructed indefinite BER throws BERDecodeError
        * addresses upstream Crypto++ issue 1353
      - rejected Ed25519 signatures where S >= L
        * Donna verifier and NaCl C API verifier both patched
        * scalar canonicality check added before existing verification path
        * addresses the signature-scalar part of upstream Crypto++ issue 1352
      - rejected small-order Ed25519 public keys at validation level 2 or higher
        * ed25519PublicKey::Validate wires in the existing HasSmallOrder helper
        * level 0 behaviour is unchanged
        * addresses the small-order part of upstream Crypto++ issue 1352

2026.5.1 - May 2026
      - patch release (correctness + build fixes)
      - fixed BLAKE3 incorrect hashes on AArch64
        * removed fork-local NEON single-block compress (Issue #27)
        * AArch64 now uses portable compress_internal, matching BLAKE3 reference
        * affected 2026.1.0 through 2026.5.0 on Apple Silicon, ARM64 Linux,
          Android arm64-v8a
      - fixed armv7 NEON build failure in rot8_neon
        * AArch64-only intrinsic replaced with portable form
        * armeabi-v7a Android builds compile again
      - fixed Android CMake builds
        * NDK cpu-features.h staged automatically when ANDROID is set
      - added Android build-only CI jobs (arm64-v8a, armeabi-v7a)
      - added legacy compiler CI (GCC 9/10, Clang 13/14)
      - bumped actions/checkout from v4 to v5 (Node.js 24 prep)
      - ValidateBLAKE3 now part of default validation suite

2026.5.0 - May 2026
      - security release (defence-in-depth)
      - hardened CVE-2023-50980 path: BERDecodeGF2NP
        * strict ordering for trinomial and pentanomial exponents
        * field degree capped at MAX_GF2N_FIELD_DEGREE = 4096
      - hardened CVE-2023-50981 path: Rabin private-key BERDecode
        * IsPrime checks now throw BERDecodeError at runtime
      - hardened CVE-2023-50981 path: ModularSquareRoot iteration cap
        * non-residue search and Tonelli-Shanks loop capped at 10000
      - fixed Issue #23: version-metadata drift
        * META_VERSION_* and CRYPTOPP_* now bumped automatically per release

2026.4.0 - April 2026
      - security release
      - fixed Ed25519 accepting non-canonical public keys (Issue #1348)
        * Validate() and verifier now reject y >= p per RFC 8032
        * covers both 32-bit and 64-bit Donna paths

2026.3.0 - March 2026
      - major release, recompile of programs required
      - added post-quantum cryptography (PQC) implementations
        * ML-KEM (FIPS 203) key encapsulation (512/768/1024)
        * ML-DSA (FIPS 204) digital signatures (44/65/87)
        * SLH-DSA (FIPS 205) hash-based signatures (all 12 parameter sets)
        * X-Wing hybrid KEM (X25519 + ML-KEM-768, IETF draft)
      - added ASN.1/DER key encoding for PQC algorithms (PKCS#8, X.509)
      - added PQC validation tests and NIST ACVP test vectors
      - added PQC benchmarks for all algorithms
      - updated build systems for PQC sources
        * GNUmakefile, nmake, Visual Studio project files

2026.2.1 - February 2026
      - minor release
      - fixed DSA/ECDSA invalid signature (r=0 or s=0) in release builds
        * probabilistic signatures retry with fresh random k (Issue #1342)
        * deterministic signatures (RFC 6979) abort with exception

2026.2.0 - February 2026
      - security release
      - fixed CVE-2024-28285: Hardened hybrid DL decryption (ElGamal,
        ECIES, DLIES) against fault injection attacks
        * validate ciphertext length before processing
        * exponent blinding verification detects faulted computations
        * no-write-on-failure guarantee: caller buffer untouched unless success

2026.1.0 - January 2026
      - minor release
      - added BLAKE3 AVX-512 16-way parallel chunk hashing
        * over 4000 MiB/s on supported processors
        * automatic runtime CPU detection with fallback
      - added XAES-256-GCM extended-nonce authenticated encryption
        * 256-bit (32-byte) nonces safe for random generation
        * C2SP specification
      - added AES-CTR-HMAC authenticated encryption
        * encrypt-then-MAC construction using AES-CTR + HMAC
        * template-based: works with any block cipher and hash function
      - hardened XAES-256-GCM and AES-CTR-HMAC against misuse
      - improved exception safety and portability
      - dropped non-standard stdext namespace usage

2025.12.0 - December 2025
      - major release, recompile of programs required
      - complete project reorganization
        * organized 204 source files into categorized src/ subdirectories
        * src/core/ - core infrastructure (37 files)
        * src/hash/ - hash functions (32 files)
        * src/kdf/ - key derivation (2 files)
        * src/symmetric/ - block/stream ciphers (58 files)
        * src/pubkey/ - public key cryptography (26 files)
        * src/mac/ - message authentication codes (6 files)
        * src/modes/ - cipher modes (9 files)
        * src/encoding/ - encoding/compression (8 files)
        * src/random/ - random number generation (9 files)
        * src/util/ - utilities (3 files)
        * src/test/ - test files (23 files)
      - updated all build systems for new structure
        * GNUmakefile, MSVC project files, nmake
      - maintained backward compatibility
        * flat include/cryptopp/ structure preserved
        * drop-in replacement for Crypto++ 8.9.0
      - multi-platform CI/CD testing
        * 45+ build configurations on GitHub Actions
        * Windows MSVC 2022, Linux GCC/Clang, macOS Apple Clang
        * sanitizer testing (ASan, UBSan)

2025.11.0 - November 2025
      - minor release, recompile of programs required
      - expanded community input and support
        * cryptopp-modern fork for active development
      - migrated to calendar versioning (YEAR.MONTH.INCREMENT)
      - add BLAKE3 cryptographic hash function
      - add Argon2 password hashing (RFC 9106)
        * supports Argon2d, Argon2i, and Argon2id variants
      - fix timing attack in PKCS#1 v1.5 padding validation (CVE-2023-50979)
      - improve ESIGN compatibility with static analyzers

8.9.0 - October 1, 2023
      - minor release, recompile of programs required
      - expanded community input and support
        * 88 unique contributors as of this release
      - fix SIMON128 Asan finding on POWER8
      - fix AES/CFB and AES/CTR modes self test failures when using Cryptogams AES on ARMv7
      - fix ARIA/CTR mode self test failures when inString==outString
      - fix HIGHT/CTR mode self test failures when inString==outString
      - fix Rabbit/CTR mode self test failures when inString==outString
      - fix Prime Table and dangling reference to a temporary>
      - fix Singleton::Ref when using C++11 memory fences
      - remove unneeded call to Crop() in Randomize()

8.8.0 - June 25, 2023
      - minor release, recompile of programs required
      - expanded community input and support
        * 88 unique contributors as of this release
      - fix crash in cryptest.exe when invoked with no options
      - fix crash in library due to GCC removing live code
      - fix RSA with key size 16 may provide an invalid key
      - fix failure to build on 32-bit x86
      - fix failure to build on iPhone Simulator for arm64
      - fix failure to build on Windows arm64
      - test for SSSE3 before using the ISA
      - fix include of <x86intrin.h> when using MSVC
      - improve performance of CRC32C_Update_SSE42 for x86-64
      - update documentation

8.7.0 - August 7, 2022
      - minor release, recompile of programs required
      - expanded community input and support
        * 81 unique contributors as of this release
      - fix RSA key generation for small moduli
      - fix AES-GCM with AESNI but without CLMUL
      - fix Clang warning with C++17
      - fix MinGW builds due to use of O_NOFOLLOW
      - rework CFB_CipherTemplate::ProcessData and AdditiveCipherTemplate::ProcessData
        * restored performance and avoided performance penalty of a temp buffer
      - fix undersized SecBlock buffer in Integer bit operations
      - work around several GCC 11 & 12 problems

8.6.0 - September 21, 2021
      - minor release, recompile of programs required
      - expanded community input and support
        * 74 unique contributors as of this release
      - fix ElGamal encryption
      - fix ChaCha20 AVX2 implementation
      - add octal and decimal literal prefix parsing to Integer
      - add missing overload in ed25519Signer and ed25519Verifier
      - make SHA-NI independent of AVX and AVX2
      - fix OldRandomPool GenerateWord32
      - use CPPFLAGS during feature testing
      - fix compile on CentOS 5
      - fix compile on FreeBSD
      - fix feature testing on ARM A-32 and Aarch64
      - enable inline ASM for CRC and PMULL on Apple M1
      - fix Intel oneAPI compile
      - rename test files with *.cpp extension
      - fix GCC compile error due to missing _mm256_set_m128i
      - add LSH-256 and LSH-512 hash functions
      - add ECIES_P1363 for backwards compatibility
      - fix AdditiveCipherTemplate<T> ProcessData
      - remove CRYPTOPP_NO_CXX11 define
      - add -fno-common for Darwin builds
      - update documentation

8.5.0 - March 7, 2021
      - minor release, no recompile of programs required
      - expanded community input and support
        * 70 unique contributors as of this release
      - port to Apple M1 hardware

8.4.0 - January 2, 2021
      - minor release, recompile of programs required
      - expanded community input and support
        * 67 unique contributors as of this release
      - fix SIGILL on POWER8 when compiling with GCC 10
      - fix potential out-of-bounds write in FixedSizeAllocatorWithCleanup
      - fix compile on AIX POWER7 with IBM XLC 12.01
      - fix compile on Solaris with SunCC 12.6
      - revert changes for constant-time elliptic curve algorithms
      - fix makefile clean and distclean recipes

8.3.0 - December 20, 2020
      - minor release, recompile of programs required
      - expanded community input and support
        * 66 unique contributors as of this release
      - fix use of macro CRYPTOPP_ALIGN_DATA
      - fix potential out-of-bounds read in ECDSA
      - fix std::bad_alloc when using ByteQueue in pipeline
      - fix missing CRYPTOPP_CXX17_EXCEPTIONS with Clang
      - fix potential out-of-bounds read in GCM mode
      - add configure.sh when preprocessor macros fail
      - fix potential out-of-bounds read in SipHash
      - fix compile error on POWER9 due to vec_xl_be
      - fix K233 curve on POWER8
      - add Cirrus CI testing
      - fix broken encryption for some 64-bit ciphers
      - fix Android cpu-features.c using C++ compiler
      - disable RDRAND and RDSEED for some AMD processors
      - fix BLAKE2 hash calculation using Salt and Personalization
      - refresh Android and iOS build scripts
      - add XTS mode
      - fix circular dependency between misc.h and secblock.h
      - add Certificate interface
      - fix recursion in AES::Encryption without AESNI
      - add missing OID for ElGamal encryption
      - fix missing override in KeyDerivationFunction-derived classes
      - fix RDSEED assemble under MSVC
      - fix elliptic curve timing leaks (CVE-2019-14318)
      - add link-library variable to Makefiles
      - fix SIZE_MAX definition in misc.h
      - add GetWord64 and PutWord64 to BufferedTransformation
      - use HKDF in AutoSeededX917RNG::Reseed
      - fix Asan finding in VMAC on i686 in inline asm
      - fix undeclared identifier _mm_roti_epi64 on Gentoo
      - fix ECIES and GetSymmetricKeyLength
      - fix possible divide by zero in PKCS5_PBKDF2_HMAC
      - refine ASN.1 encoders and decoders
      - disable BMI2 code paths in Integer class
      - fix use of CRYPTOPP_CLANG_VERSION
      - add NEON SHA1, SHA256 and SHA512 from Cryptogams
      - add ARM SHA1, SHA256 and SHA512 from Cryptogams
      - make config.h more autoconf friendly
      - handle Clang triplet armv8l-unknown-linux-gnueabihf
      - fix reference binding to misaligned address in xed25519
      - clear asserts in TestDataNameValuePairs

8.2.0 - April 28, 2019
      - minor release, no recompile of programs required
      - expanded community input and support
        * 56 unique contributors as of this release
      - use PowerPC unaligned loads and stores with Power8
      - add SKIPJACK test vectors
      - fix SHAKE-128 and SHAKE-256 compile
      - removed IS_NEON from Makefile
      - fix Aarch64 build on Fedora 29
      - fix missing GF2NT_233_Multiply_Reduce_CLMUL in FIPS DLL
      - add missing BLAKE2 constructors
      - fix missing BlockSize() in BLAKE2 classes

8.1.0 - February 22, 2019
      - minor release, no recompile of programs required
      - expanded community input and support
        * 56 unique contributors as of this release
      - fix OS X PowerPC builds with Clang
      - add Microsoft ARM64 support
      - fix iPhone Simulator build due to missing symbols
      - add CRYPTOPP_BUGGY_SIMD_LOAD_AND_STORE
      - add carryless multiplies for NIST b233 and k233 curves
      - fix OpenMP build due to use of OpenMP 4 with down-level compilers
      - add SignStream and VerifyStream for ed25519 and large files
      - fix missing AlgorithmProvider in PanamaHash
      - add SHAKE-128 and SHAKE-256
      - fix AVX2 build due to _mm256_broadcastsi128_si256
      - add IETF ChaCha, XChaCha, ChaChaPoly1305 and XChaChaPoly1305

8.0.0 - December 28, 2018
      - major release, recompile of programs required
      - expanded community input and support
         * 54 unique contributors as of this release
      - add x25519 key exchange and ed25519 signature scheme
      - add limited Asymmetric Key Package support from RFC 5958
      - add Power9 DARN random number generator support
      - add CHAM, HC-128, HC-256, Hight, LEA, Rabbit, Simeck
      - fix FixedSizeAllocatorWithCleanup may be unaligned on some platforms
      - cutover to GNU Make-based cpu feature tests
      - rename files with dashes to underscores
      - fix LegacyDecryptor and LegacyDecryptorWithMAC use wrong MAC
      - fix incorrect AES/CBC decryption on Windows
      - avoid Singleton<T> when possible, avoid std::call_once completely
      - fix SPARC alignment problems due to GetAlignmentOf<T>() on word64
      - add ARM AES asm implementation from Cryptogams
      - remove CRYPTOPP_ALLOW_UNALIGNED_DATA_ACCESS support

June 2015 - Changing of the guard. Wei Dai turned the library over to the
        community. The first community release was Crypto++ 5.6.3. Wei is
        no longer involved with the daily operations of the project. Wei
        still provides guidance when we have questions.

Originally written by Wei Dai, maintained by CoraleSoft and the community
