New release of StreamSec Tools, our Object Pascal crypto/TLS library for Delphi (XE3 and up, Win32/Win64, macOS, Android, iOS, Linux).

UPGRADE IF YOU BUILD FOR WIN64 ON 4.1.3.356

That release, and only that release, access-violated on the first AES-NI CBC, OFB or GCM operation - in practice the first TLS record it tried to protect. 356 had removed 24 bytes of fields from an ancestor class, which moved the round-key schedule to 8 modulo 16, and the Win64 assembler reaches it with SSE operands that require 16-byte alignment. The $ALIGN 16 directive does not save you: it is a cap, not a floor, and an array of UInt32 is entitled to 4-byte placement. There is now explicit padding plus a check at unit initialization that raises instead of registering an implementation that will fault on first use. Win32 was never affected and no ciphertext changed - an affected build produced no output at all.

It reached a release because every AES harness was Win32 and each linked all four implementations at once, so nothing ever asked whether one implementation works on one platform. The pre-release rig now builds and runs each implementation alone across both Windows platforms and every supported compiler, 84 combinations.

SLH-DSA (FIPS 205) FOR CERTIFICATES, CRLS AND CSRS

SLHDSASign joins MLDSASign, EdDSASign and CompositeMLDSASign on every signable object. Verification accepts all twelve parameter sets and CSOR OIDs; certificates signed here verify in OpenSSL 3.5 and vice versa, both hash families, both directions. An SLH-DSA certificate can now also be a trust anchor, which is the point: its security rests only on hash-function security, and it is stateless, so backup and restore cannot cause the state-reuse failures that make stateful hash-based schemes unforgiving. Mind the signature size - 29792 bytes for SLH-DSA-256s.

See the PKIX/CMS page, and where the rest of the PQ story stands on Post-Quantum Readiness.

HARDWARE AES AND GHASH ON DELPHI LINUX64

Delphi's Linux64 compiler has no inline assembler, so every assembler arm compiled out and AES resolved to the constant-time implementation on hardware that had AES-NI all along. The instructions now reach that target through two small objects Free Pascal assembles from the same include files the library already had, so there is one copy of each sequence. Same machine, same harness: AES-128 at 1526 MB/s against 29 MB/s, and GHASH moves with it, so the difference reaches AES-GCM in TLS rather than stopping at the block cipher.

Cost is one line of project configuration - the two .o files on your object path (DCC_ObjPath, or -O for dcclinux64) - or define ST4_NO_LINUX64_AESNI and keep the old software path.

CMS SIGNATURE VERIFICATION WORKED FOR RSA AND NOTHING ELSE

The signer's public key was cast to the RSA interface before testing whether the algorithm was RSASSA-PSS, so for ECDSA, EdDSA, ML-DSA and Composite ML-DSA the cast raised. The symptom is the bad part: the exception was swallowed upstream, so callers were told "the signature does not verify", with no error flags set, on messages that were perfectly well signed.

ALSO IN THIS RELEASE

A CRL entry's revocation date was displaced by whole days (OffsetFromUTC is hours, TDateTime arithmetic is days) - serial numbers in circulating CRLs are fine, the dates are not, and reissuing over the same set is enough. A stored Composite ML-KEM private key can now be matched to its own certificate, and StreamSec.DSI.SecretSharing is in every runtime package instead of XE4's alone.

SIDE CHANNELS

Since it rarely gets written down anywhere you can check: scalar blinding and a fixed-width ladder on EC scalar multiplication, RFC 6979 deterministic nonces in the fixed-time DSA/ECDSA scheme that TLS switches keys to before signing, fixed-time RSA and finite-field exponentiation, constant-time AES and GHASH wherever the CPU has no instruction for them, and a division-free ML-KEM compression step closing the KyberSlash class. Written up with its caveats on Secure by design.

LICENSING

Since it comes up: the SBOM is down from six entries to four - the JEDI Winsock headers and the NexusDB lock-free list are no longer in the distribution at all. A normal build contains no copyleft code and its third-party notices amount to a single MIT line for the BearSSL constant-time primitives; the Gladman AES assembler carries the one documentation-attribution clause and sits in an opt-in unit you almost certainly do not want. The CycloneDX 1.6 SBOM ships with every release and is the authority - each entry states its licence, whether it can reach your binary, and the define that removes it. Reasoning in The Whole Iceberg.

BREAKING: THE LEGACY UNIT FAMILIES ARE GONE

The stMP* arithmetic and key-management units, all 27 stSSH* units, stRijndael*, stPkixCert / stPkixCRL / stPkixSigned, stPkcs1 / stPkcs10, the stJwa* Winsock headers and a few others are no longer shipped. Each has a named successor and the changelog lists the mapping; for most projects it is editing uses clauses - the SSH family moved to StreamSec.SSH.* under the same names (SSH page). Every historical zip stays available to registered users, so an unmigrated project can still fetch the old unit unchanged. Delphi 5 through XE2 packages go too - supported is StrSecIV170 through StrSecIV370, demos XE3 through Delphi 13.

Evaluation builds and the full changelog (DCU-only, Win32/Win64, one per Delphi version). Happy to answer questions here.