5.1. What’s New in 7.6.0

This section describes what’s new in Security Plugins 7.6.0, compared to What’s New in 7.5.0.

Connext 7.6.0 is an early access release (EAR). See Connext Versions and Lifecycle for more information on RTI’s software release model.

For what’s new in other products in the Connext suite, see those products’ release notes on the RTI Community Portal or in your installation. Or start with RTI Connext What’s New for a launchpad to all products.

Note

For backward compatibility information between 7.6.0 and previous releases, see the Migration Guide on the RTI Community Portal.

5.1.1. Additional Authenticated Data (AAD) enabled by default for Builtin Security Plugins when using PSK or RTPS Header Extension

In the Builtin Security Plugins, Additional Authenticated Data (AAD) is now enabled by default for pre-shared key protected communication and for RTPS messages that include an RTPS Header Extension. You can change this default behavior by setting cryptography.enable_additional_authenticated_data to a value other than AUTO. For details, see RTPS Protection in the RTI Security Plugins User’s Manual.

Note: This change only applies to the Builtin Security Plugins; the Lightweight Builtin Security Plugins always use AAD. See [Major] Lightweight Security Plugins did not use Additional Authenticated Data by default.

5.1.2. Enforcement of DomainParticipant permissions expiration enhances security

Previously, the Builtin Security Plugins only enforced the times provided in the validity tag of the Permissions Document upon creation of the local DomainParticipant or authentication of remote DomainParticipants. Now, permissions are enforced at run-time, as long as Key Revisions are enabled.

When permissions expire with Key Revisions enabled, remote DomainParticipants are removed from the system, and local DomainParticipants log an error message. You can also configure the local DomainParticipant to notify you about the upcoming expiration of the local Permissions Document. For more information, see Permissions Expiration.

5.1.3. Support for runtime extension of Permissions Document validity and enforcement of expiration

The Builtin Security Plugins now allow you to extend the validity period of Permissions Documents at runtime. This allows DomainParticipants to continue operating without interruption as long as their permissions remain valid. Local DomainParticipants propagate the updated Permissions Document to remote DomainParticipants. Only changes to the validity dates are supported; the allowed actions cannot be modified.

In addition, this release of the Builtin Security Plugins enforces permissions expiration. Together with permissions renewal, it is now possible to implement a short-lived permissions approach that requires DomainParticipants to periodically re-validate their permissions to maintain access. This practice enables secure, short-lived permissions in dynamic environments and limits access to required participants only.

5.1.4. Pre-Shared Key Protection now fully aligns with DDS Security 1.2 specification

This release of the Security Plugins implements in full the DDS Security 1.2 specification. The following enhancements were applied:

The passphrase identifier can extend beyond the value of 254, up to 2^32-1 (specification limits apply). For details, see Passphrase Identifier in the RTI Security Plugins User’s Manual.
Now you can use extra passphrases configured via the dds.sec.crypto.rtps_psk_secret_passphrase_extra property to ensure seamless transition between PSK passphrases without communication interruptions. For details, see Updating the PSK Passphrase Without Message Loss in the RTI Security Plugins User’s Manual.
Other AAD (Additional Authenticated Data) related changes. For details, see RTPS Protection in the RTI Security Plugins User’s Manual, and these related issues:
- Additional Authenticated Data (AAD) enabled by default for Builtin Security Plugins when using PSK or RTPS Header Extension in What’s New in 7.6.0
- [Major] Lightweight Security Plugins did not use Additional Authenticated Data by default in What’s Fixed in 7.6.0

5.1.5. Key revisions enabled by default to improve out-of-the-box security

Key revisions are now enabled by default in the Security Plugins. Key revisions must be enabled to support certificate and permissions mutability, DomainParticipant removal, and OCSP. This setting also ensures that new data cannot be deciphered by DomainParticipants that have been removed from the system, while legitimate remote DomainParticipants retain access. Enabling key revisions by default makes the Security Plugins out-of-the-box security settings stronger.

For more information, see Limiting the Usage of Specific Key Material in the RTI Security Plugins User’s Manual.

5.1.6. RTI Lightweight Security Plugins support ShangMi cryptographic algorithms

In this release, RTI added full support for ShangMi cryptographic algorithms, consisting of SM3 and SM4 algorithms. This addition enables Connext to be used in applications where ShangMi is required by applicable regulations, such as GB 44495. The algorithms are only available in RTI Lightweight Builtin Security Plugins. This error notes the library mismatch but does not stop or prevent creation of DomainParticipants. Although DomainParticipant creation succeeds, the Security Plugins only support a Connext Core library with a matching version number.

5.1.7. New error message when Core and Security Plugins library versions differ

If the Security Plugins library version is different from the Connext Core library version, the Security Plugins log the following error message during DomainParticipant creation:

ERROR [CREATE DP|CREATE DP|LC:Discovery,Security] RTI_Security_PluginSuite_create:!There is a mismatch between the version of the Builtin Security Plugins library and the version of the Core library. SP: 1.2.3.4, Core: 7.6.0.0.

This error notes the library mismatch but does not stop or prevent creation of DomainParticipants.

5.1.8. Upgrade OpenSSL to 3.5.1

The following third-party software used by the Security Plugins has been upgraded:

Third party tool	Old version	New version
OpenSSL	3.0.12	3.5.1

In addition to the upgrade, the OpenSSL target packages for QNX and Android now include assembly implementations for cryptographic operations (the packages were built using the asm_arch and perlasm_scheme options described in this OpenSSL README file). This change affects only the libcrypto and libssl libraries; the openssl executable is still configured with no-asm.

For information on third-party software used by Connext products, see the “3rdPartySoftware” documents in your installation: <NDDSHOME>/doc/manuals/connext_dds_professional/release_notes_3rdparty and <NDDSHOME>/doc/manuals/connext_dds_secure/release_notes_3rdparty.

For more information on the OpenSSL upgrade, see RTI Security Plugins in the Migration Guide.

5.1.9. Deprecations and Removals

Deprecated means that the item is still supported in this release, but will be removed in a future release. Removed means that the item is discontinued or no longer supported.

Any deprecations or removals noted in RTI’s documentation serve as notice under the Real-Time Innovations, Inc., Maintenance Policy #4220 and/or any other agreements by and between RTI and customer regarding maintenance and support of RTI’s software. RTI’s current standard terms and support and maintenance policies are available at https://www.rti.com/terms.

5.1.9.1. Deprecation of authentication.crl and removal of authentication.crl_file

This release of the Security Plugins deprecates the plugin-specific authentication.crl property, and removes the plugin-specific authentication.crl_file property. Instead, you should set the dds.sec.auth.crl property defined in the OMG DDS Security specification. The behavior and configuration of the deprecated and the new property is the same: they are both optional properties that configure the Certificate Revocation List (CRL) used by the Builtin Security Plugins.

5.1.9.2. Support for cryptography.enable_additional_authenticated_data property removed

As described in [Major] Lightweight Security Plugins did not use Additional Authenticated Data by default, support for the cryptography.enable_additional_authenticated_data property has been removed.