[ol10_u2_baseos_base] crypto-policies-scripts-20260216-1.git0e54016.el10.noarch

This package provides a tool update-crypto-policies, which applies
the policies provided by the crypto-policies package. These can be
either the pre-built policies from the base package or custom policies
defined in simple policy definition files.

Changelog (Show File list) (Show related packages)

• Mon Feb 16 2026 Alexander Sosedkin <asosedkin@redhat.com> - 20260216-1.git0e54016

  - FIPS: allow NIST hybrid kexes for openssh
  - libssh: enable NIST ML-KEM hybrids
  - libssh: add mlkem768x25519-sha256

• Thu Nov 27 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20251127-1.git27c2902

  - FUTURE: disable kex other than KEM-ECDH

• Wed Nov 26 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20251126-1.git918f03d

  - openssl: let TLS 1.3 brainpool groups get used for key shares
  - openssh: support mlkem768nistp256-sha256 and mlkem1024nistp384-sha384
  - FUTURE: disable non-PQ groups, keep ML-KEM only
  - sequoia: register "eddsa" as an alias to EDDSA-ED25519

• Thu Sep 25 2025 Clemens Lang <cllang@redhat.com> - 20250905-2.gitc7eb7b2

  - add Obsoletes: crypto-policies-pq-preview to ease transition
    Resolves: RHEL-113008

• Fri Sep 05 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20250905-1.gitc7eb7b2

  - rpm-sequoia: enable MLDSA65-ED25519 and MLDSA87-ED448 in all policies
  - rpm-sequoia: force enable all PQ algorithms for now

• Mon Aug 04 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20250804-1.git2ca4115

  - nss: enable mlkem1024secp384r1, rename mlkem768secp256r1
  - nss: enable ML-DSA

• Mon Jul 14 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20250714-1.git95bf40e

  -  sequoia: add sha3, x25519, ed25519, x448, ed448, but not for rpm-sequoia
  -  sequoia, rpm-sequoia: use ignore_invalid with sha3, x25519, ...
  -  sequoia: Add PQC algorithm
  -  sequoia: Do not include EdDSA in FIPS policy
  -  sequoia: Generate AEAD policy
  -  openssl: send one PQ and one classic key_share; prioritize PQ groups
  -  FIPS: deprioritize X25519-MLKEM768 over P256-MLKEM768 for openssl...
  -  python, policies, tests: alias X25519-MLKEM768 to MLKEM768-X25519
  -  gnutls: enable ML-DSA, for both secure-sig and secure-sig-for-cert

• Mon Jun 02 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20250602-1.gita6d4d0c

  - openssl: fix mistakes in integrity-only cipher definitions
  - FIPS: enable hybrid ML-KEM (TLS only) and pure ML-DSA
  - AD-SUPPORT-LEGACY: resurrect subpolicy as present in RHEL-9

• Sat Apr 26 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20250424-2.git9267dee

  - add Provides: crypto-policies-pq-preview to ease transition
  - require openssl 3.5 outright

• Thu Apr 24 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20250424-1.git9267dee

  - LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
  - drop crypto-policies-pq-preview subpackage, TEST-PQ goes into main one
  - NO-PQ: introduce
  - openssl: fix enabling integrity-only ciphersuites (still need min_rsa_size=0)