Dell BSAFE Micro Edition Suite 5.0 Release Advisory

Initially published on October 13th, 2022.

Announcement

• A new set of APIs that support the new client-side and server-side implementations of TLS 1.3 and TLS 1.2.
  The Secure Connection APIs replace the now deprecated R_SSL APIs. Review the Release Notes for known limitations.
• Support for more TLS extensions for TLS 1.2 and TLS 1.3 via the new API, including in addition to the required extension:
  • Encrypt-Then-Mac
  • Extended Master Secret
  • Application Layer Application Negotiation (ALPN)
  • Post-Handshake Client Authentication
  • Server Name Indicator (SNI)
• New BIO functions have been added to assist with flow control on BIO input/output abstractions:
  • R_BIO_can_read()
  • R_BIO_can_write()
  • R_BIO_wait_readable()
  • R_BIO_wait_writable()
  • R_BIO_select()

• Use of IPv6 is enabled by default when performing the DNS resolution. The operating environment controls the prioritization of IPv4 and IPv6 addresses.
• All Apple iOS APIs and the IOS Provider have been removed.
• New APIs to manage application data on BIO chains are introduced:
  • R_BIO_appdata_set()
  • R_BIO_appdata_get()
  • R_BIO_appdata_remove()
• New certificate verification flags R_FLAG_VERY_NO_WEAK_DIGEST and R_FLAG_VERIFY_NO_WEAK_DIGEST_AT_ROOT reject certificate signatures based on digest algorithms with poor security strength. These settings are included in the default verification flags.
• Certificate compatibility modes include settings to provide more control over the validation of the keyUsage extension in X.509 v3 certificates. The new flags R_VERIFY_MODE_REQUIRE_CA_KU_DIGITAL_SIGN and R_VERIFY_MODE_REQUIRE_KEY_USAGE_EXT are not included in the default verification mode. The certificate validation failure codes are updated to include error indicators for the new mode settings.
• Updated platform support.
• Minor issues fixed