cryptolyzer (1.6.0) unstable; urgency=low

  * add IKE client simulation checker for the acceptance of a client proposal set (#185)
  * add support for ignoring the supported versions extension to the TLS server (#186)
  * read the ALPN protocol names from both codepoints during capability generation (#189)
  * forge the ephemeral key of a Montgomery curve during elliptic-curve Diffie-Hellman key exchange (#194)
  * handle primality and safe primality independently
  * offer the standalone post-quantum signature algorithms in the client hello (#190)
  * do not offer TLS 1.3 only named groups in earlier protocol versions (#191)
  * handle server hello without the supported versions extension (#186)
  * handle connection reset while sending the client hello (#187)
  * handle the missing authentication algorithm of TLS 1.3 cipher suites (#196)
  * handle a named group whose size is unknown (#194)
  * handle servers supporting only ShangMi (SM2) cipher suites (#198)
  * offer supported groups to anonymous elliptic-curve Diffie-Hellman servers (#197)
  * resolve the protocol handler by protocol version instead of by name (#195)
  * handle the GREASE extension in the TLS server (#189)
  * keep the state of the capability converter instances separated (#189)
  * keep the IKEv1 result when the responder picks an unusable Diffie-Hellman group (#199)
  * use a fixed-size private exponent during finite-field Diffie-Hellman key exchange

 -- Szilárd Pfeiffer <coroner@pfeifferszilard.hu>  Tue, 25 Aug 2026 00:00:00 +0200

cryptolyzer (1.5.0) unstable; urgency=low

  * add IKE public keys checker for IKEv1 aggressive-mode and IKEv2 EAP-mode servers (#183)
  * add IKE public key request checker for enumerating accepted certification authority hashes (#183)
  * use a cryptographically secure random generator for IKE probe secrets (#183)

 -- Szilárd Pfeiffer <coroner@pfeifferszilard.hu>  Fri, 31 Jul 2026 00:00:00 +0200

cryptolyzer (1.4.0) unstable; urgency=low

  * add key exchange completion to the SSH server (#184)
  * add certificate request support to the TLS server
  * add OCSP staple, EC point formats, and fallback SCSV support to the TLS server (#184)
  * add IKE extensions checker (#177)
  * do not let a handshake without OCSP staple overwrite the certificate status

 -- Szilárd Pfeiffer <coroner@pfeifferszilard.hu>  Fri, 17 Jul 2026 15:37:42 +0200

cryptolyzer (1.3.0) unstable; urgency=low

  * add Debian and RPM packaging (#181)
  * add JA4 tag generation and decoding (#178)
  * unify the ja3 and hassh commands into the fingerprint command (#178)
  * add TLS 1.3 support to the public key analyzer (#171)
  * add IKE cipher suite checker (#168)
  * report unhandled alert as analysis error instead of stopping the run (#180)

 -- Szilárd Pfeiffer <coroner@pfeifferszilard.hu>  Mon, 15 Jun 2026 21:14:01 +0200

cryptolyzer (1.2.1) unstable; urgency=low

  * Initial Debian packaging.

 -- Szilárd Pfeiffer <coroner@pfeifferszilard.hu>  Sun, 14 Jun 2026 00:00:00 +0200
