
.. _section-whats-new-760:

What's New in 7.6.0
===================

This section describes what's new in *Security Plugins* 7.6.0, compared 
to :ref:`section-whats-new-750`.

*Connext* 7.6.0 is an early access release (EAR).
See `Connext Versions and Lifecycle <https://community.rti.com/connext-releases>`__ 
for more information on RTI's software release model.


For what's new in other products in the |CONNEXT| suite, see
those products' release notes on the `RTI Community Portal <https://community.rti.com/documentation>`__ 
or in your installation. 
Or start with `RTI Connext What's New 
<https://community.rti.com/static/documentation/connext-dds/7.6.0/doc/manuals/connext_dds_professional/whats_new/index.html>`__ 
for a launchpad to all products.

.. note::
   For backward compatibility information between 7.6.0 and previous releases, 
   see the *Migration Guide* on the `RTI Community Portal <https://community.rti.com/documentation>`__.

.. Release Notes from this point.

.. _section-760-whatsnew-SEC-2717:

Additional Authenticated Data (AAD) enabled by default for Builtin Security Plugins when using PSK or RTPS Header Extension
---------------------------------------------------------------------------------------------------------------------------
In the *Builtin Security Plugins*, Additional Authenticated Data (AAD)
is now enabled by default for pre-shared key protected communication and
for RTPS messages that include an RTPS Header Extension. 
You can change this default behavior by setting
``cryptography.enable_additional_authenticated_data`` to a value other
than ``AUTO``. 
For details, see `RTPS Protection <https://community.rti.com/static/documentation/connext-dds/7.6.0/doc/manuals/connext_dds_secure/users_manual/p2_core/cryptography.html#rtps-protection>`__
in the *RTI Security Plugins User's Manual*.

Note: This change only applies to the *Builtin Security Plugins;* the
*Lightweight Builtin Security Plugins* always use AAD. 
See :ref:`section-760-whatsfixed-SEC-2718`.

.. Cryptography
.. [RTI Issue ID SEC-2717]


Enforcement of DomainParticipant permissions expiration enhances security
-------------------------------------------------------------------------
Previously, the *Builtin Security Plugins* only enforced the times
provided in the ``validity`` tag of the Permissions Document upon
creation of the local *DomainParticipant* or authentication of remote
*DomainParticipants*. Now, permissions are enforced at run-time, as long
as Key Revisions are enabled.

When permissions expire with Key Revisions enabled, remote
*DomainParticipants* are removed from the system, and local
*DomainParticipants* log an error message. You can also configure the
local *DomainParticipant* to notify you about the upcoming expiration of the
local Permissions Document. For more information, see `Permissions
Expiration <https://docserver.rti.com/docs/connext-docs/7.6.0.0/doc/manuals/connext_dds_secure/users_manual/p2_core/access_control.html#permissions-expiration>`__.

.. Dynamic Participant Renewal, Revocation, and Expiration
.. [RTI Issue ID SEC-1898]

Support for runtime extension of Permissions Document validity and enforcement of expiration
--------------------------------------------------------------------------------------------
The *Builtin Security Plugins* now allow you to extend the validity
period of Permissions Documents at runtime. This allows
*DomainParticipants* to continue operating without interruption as long
as their permissions remain valid. Local *DomainParticipants* propagate
the updated Permissions Document to remote *DomainParticipants*. Only
changes to the validity dates are supported; the allowed actions cannot
be modified.

In addition, this release of the *Builtin Security Plugins* enforces
permissions expiration. Together with permissions renewal, it is now
possible to implement a short-lived permissions approach that requires
*DomainParticipants* to periodically re-validate their permissions to
maintain access. This practice enables secure, short-lived permissions
in dynamic environments and limits access to required participants only.

.. Dynamic Participant Renewal, Revocation, and Expiration
.. [RTI Issue ID SEC-2762]

Pre-Shared Key Protection now fully aligns with DDS Security 1.2 specification
------------------------------------------------------------------------------
This release of the *Security Plugins* implements in full the DDS
Security 1.2 specification. The following enhancements were applied:

- The passphrase identifier can extend beyond the value of 254, 
  up to 2^32-1 (specification limits apply). For details, see 
  `Passphrase Identifier 
  <https://community.rti.com/static/documentation/connext-dds/7.6.0/doc/manuals/connext_dds_secure/users_manual/p3_advanced/pre-shared_key.html#passphrase-identifier>`__
  in the *RTI Security Plugins User's Manual*.

- Now you can use extra passphrases configured via the
  ``dds.sec.crypto.rtps_psk_secret_passphrase_extra`` property to ensure
  seamless transition between PSK passphrases without communication
  interruptions. For details, see 
  `Updating the PSK Passphrase Without Message Loss 
  <https://community.rti.com/static/documentation/connext-dds/7.6.0/doc/manuals/connext_dds_secure/users_manual/p3_advanced/pre-shared_key.html#updating-the-psk-passphrase-without-message-loss>`__
  in the *RTI Security Plugins User's Manual*.

- Other AAD (Additional Authenticated Data) related changes. For details, see  
  `RTPS Protection <https://community.rti.com/static/documentation/connext-dds/7.6.0/doc/manuals/connext_dds_secure/users_manual/p2_core/cryptography.html#rtps-protection>`__
  in the *RTI Security Plugins User's Manual*, and these related issues:

  - :ref:`section-760-whatsnew-SEC-2717` in *What's New in 7.6.0*
  - :ref:`section-760-whatsfixed-SEC-2718` in *What's Fixed in 7.6.0*
  
.. Cryptography
.. [RTI Issue ID SEC-2431]

Key revisions enabled by default to improve out-of-the-box security
-------------------------------------------------------------------
Key revisions are now enabled by default in the *Security Plugins*. Key
revisions must be enabled to support certificate and permissions
mutability, *DomainParticipant* removal, and OCSP. This setting also
ensures that new data cannot be deciphered by *DomainParticipants* that
have been removed from the system, while legitimate remote
*DomainParticipants* retain access. Enabling key revisions by default
makes the *Security Plugins* out-of-the-box security settings stronger.

For more information, see `Limiting the Usage of Specific Key
Material <https://community.rti.com/static/documentation/connext-dds/7.6.0/doc/manuals/connext_dds_secure/users_manual/p2_core/cryptography.html#limiting-the-usage-of-specific-key-material>`__
in the *RTI Security Plugins User's Manual*.


.. Dynamic Participant Renewal, Revocation, and Expiration
.. [RTI Issue ID SEC-2642]

RTI Lightweight Security Plugins support ShangMi cryptographic algorithms
-------------------------------------------------------------------------
In this release, RTI added full support for ShangMi cryptographic
algorithms, consisting of SM3 and SM4 algorithms. This addition enables
*Connext* to be used in applications where ShangMi is required by
applicable regulations, such as GB 44495. The algorithms are only
available in RTI Lightweight Builtin Security Plugins.
This error notes the library mismatch but does not stop or prevent
creation of *DomainParticipants*. 
Although *DomainParticipant* creation succeeds, the 
*Security Plugins* only support a *Connext* Core library with a 
matching version number.


.. Cryptographic Algorithms
.. [RTI Issue ID SEC-2729]

New error message when Core and Security Plugins library versions differ
------------------------------------------------------------------------
If the *Security Plugins* library version is different from the
*Connext* Core library version, the *Security Plugins* log the following
error message during *DomainParticipant* creation:

::

   ERROR [CREATE DP|CREATE DP|LC:Discovery,Security] RTI_Security_PluginSuite_create:!There is a mismatch between the version of the Builtin Security Plugins library and the version of the Core library. SP: 1.2.3.4, Core: 7.6.0.0.

This error notes the library mismatch but does not stop or prevent
creation of *DomainParticipants*.


.. Usability
.. [RTI Issue ID SEC-2756]

Upgrade OpenSSL to 3.5.1
------------------------
The following third-party software used by the *Security Plugins* has been
upgraded:

==================== =============== ===============
**Third party tool** **Old version** **New version**
==================== =============== ===============
OpenSSL              3.0.12          3.5.1
==================== =============== ===============

In addition to the upgrade, the OpenSSL target packages for
QNX and Android now include assembly implementations for
cryptographic operations (the packages were built using the ``asm_arch`` and
``perlasm_scheme`` options described in `this OpenSSL README file
<https://github.com/openssl/openssl/blob/openssl-3.5.1/Configurations/README.md?plain=1#L167>`__).
This change affects only the ``libcrypto`` and ``libssl`` libraries; the
``openssl`` executable is still configured with ``no-asm``.

For information on third-party software used by *Connext* products, see 
the "3rdPartySoftware" documents in your installation: 
<NDDSHOME>/doc/manuals/connext_dds_professional/release_notes_3rdparty and
<NDDSHOME>/doc/manuals/connext_dds_secure/release_notes_3rdparty.

For more information on the OpenSSL upgrade, see
`RTI Security Plugins <https://community.rti.com/static/documentation/connext-dds/current/doc/manuals/migration_guide/760/product760/security760.html>`__
in the *Migration Guide*.

Deprecations and Removals
-------------------------

.. include:: ../../../../../connext_doc.1.0/srcDoc/whats_new/dep_rem_snippet.txt

Deprecation of authentication.crl and removal of authentication.crl_file
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This release of the Security Plugins deprecates the plugin-specific 
``authentication.crl`` property, and removes the plugin-specific 
``authentication.crl_file`` property. Instead, you should set the 
``dds.sec.auth.crl`` property defined in the `OMG DDS Security specification <https://www.omg.org/spec/DDS-SECURITY/>`__. 
The behavior and configuration of the deprecated and the new property is 
the same: they are both optional properties that configure the Certificate 
Revocation List (CRL) used by the *Builtin Security Plugins*.

.. [RTI Issue ID SEC-2857]

Support for cryptography.enable_additional_authenticated_data property removed
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
As described in :ref:`section-760-whatsfixed-SEC-2718`, support for the
``cryptography.enable_additional_authenticated_data`` property has been removed.

.. SEC-2718

