4. What’s New in 7.3.1

This section describes what’s new in Security Plugins 7.3.1, compared to 7.3.0.

Security Plugins 7.3.1 is a maintenance release in the 7.3 long-term support (LTS) series. See the Connext Versions and Lifecycle page for more information on RTI’s software release model.

Note

For backward compatibility information between 7.3.1 and previous releases, see the Migration Guide on the RTI Community Portal (https://community.rti.com/documentation).

4.1. Upgraded to OpenSSL 3.5.1

The following third-party software used by the Security Plugins has been upgraded:

Third party tool	Old version	New version
OpenSSL	3.0.12	3.5.1

In addition to the upgrade, the OpenSSL target packages for armv8Linux4gcc7.3.0, QNX, and Android systems now include assembly implementations for cryptographic operations (the packages were built using the asm_arch and perlasm_scheme options described in this OpenSSL README file). This change affects only the libcrypto and libssl libraries; the openssl executable is still configured with no-asm.

4.2. Upgraded to wolfSSL 5.8.2

The Security Plugins for wolfSSL are now based on wolfSSL version 5.8.2.

For release 7.3.1, the Security Plugins are API-compatible with wolfSSL version 5.8.2, not with earlier versions. Note that the Security Plugins 7.3.1 have only been tested by RTI using wolfSSL 5.8.2.

In addition to the upgraded version of wolfSSL, the Security Plugins for wolfSSL now support partial chains. The certificate of the Identity Certificate Authority no longer has to be self-signed; intermediate Certificate Authorities are also supported.

4.3. Additional Authenticated Data (AAD) enabled by default for Builtin Security Plugins when using PSK or RTPS Header Extension

In the Builtin Security Plugins, Additional Authenticated Data (AAD) is now enabled by default for pre-shared key protected communication and for RTPS messages that include an RTPS Header Extension.

You can change this default behavior by setting cryptography.enable_additional_authenticated_data to a value other than AUTO. For details, see RTPS Protection, in the RTI Security Plugins User’s Manual.

Note: This change only applies to the Builtin Security Plugins; the Lightweight Builtin Security Plugins always use AAD (see [Major] Lightweight Security Plugins did not use Additional Authenticated Data by default*).

4.4. New error message when Core and Security Plugins library versions differ

If the Security Plugins library version is different from the Connext Core library version, the Security Plugins will log the following error message during DomainParticipant creation:

ERROR [CREATE DP|CREATE DP|LC:Discovery,Security] RTI_Security_PluginSuite_create:!
There is a mismatch between the version of the Builtin Security Plugins library
and the version of the Core library. SP: 1.2.3.4, Core: 7.6.0.0.

This error notes the library mismatch but does not stop or prevent creation of DomainParticipants.

4.5. Authentication class_id now conforms to value in DDS Security 1.2 Specification

The Builtin Security Plugins now propagate the DDS:Auth:PKI-DH:1.2 class_id by default, instead of the previous value of DDS:Auth:PKI-DH:1.0. This change has been made to conform with the DDS Security 1.2 Specification.

DomainParticipants will still propagate the DDS:Auth:PKI-DH:1.0 class_id to remote DomainParticipants from previous RTI releases (Connext Professional 7.3.0 or older, and Connext Micro 3.0.3).