diff --git a/libqpdf/QPDFCrypto_gnutls.cc b/libqpdf/QPDFCrypto_gnutls.cc index beababc..2b7fcae 100644 --- a/libqpdf/QPDFCrypto_gnutls.cc +++ b/libqpdf/QPDFCrypto_gnutls.cc @@ -18,9 +18,7 @@ QPDFCrypto_gnutls::QPDFCrypto_gnutls() : if (fips_mode) { // Relax FIPS mode for the lifetime of this object - gnutls_fips140_set_mode( - GNUTLS_FIPS140_LAX, - GNUTLS_FIPS140_SET_MODE_THREAD); + gnutls_fips140_set_mode(GNUTLS_FIPS140_LAX, GNUTLS_FIPS140_SET_MODE_THREAD); } } @@ -38,8 +36,7 @@ QPDFCrypto_gnutls::~QPDFCrypto_gnutls() if (fips_mode) { // Restore saved FIPS mode gnutls_fips140_set_mode( - static_cast(fips_mode), - GNUTLS_FIPS140_SET_MODE_THREAD); + static_cast(fips_mode), GNUTLS_FIPS140_SET_MODE_THREAD); } } diff --git a/manual/release-notes.rst b/manual/release-notes.rst index 9ddd1f7..c00f994 100644 --- a/manual/release-notes.rst +++ b/manual/release-notes.rst @@ -71,6 +71,12 @@ more detail. - Other changes + - When running in a FIPS environment using the GnuTLS crypto provider, + calls to GnuTLS now use 'LAX' mode as the use of weak algorithms is + required to decrypt existing files and is specified by the PDF standards + for purposes unrelated to encryption. It is up to users to ensure + they comply with FIPS where required. + - Calling ``QPDF::getRoot`` on a file with invalid trailer now throws a ``damaged_pdf`` error with message "unable to find /Root dictionary" rather than an internal error.