What's Changed

• 800-131Ar1: length of the key-derivation key shall be at least 112 bits. by @skmcgrail in 800-131Ar1: length of the key-derivation key shall be at least 112 bits. #1924
• Marshalling/Unmarshalling DH public keys by @justsmth in Marshalling/Unmarshalling DH public keys #1916
• Also prune SSM documents from ec2-test-framework by @samuel40791765 in Also prune SSM documents from ec2-test-framework #1925
• Use illegal_parameter instead of decode_error for invalid key shares by @justsmth in Use illegal_parameter instead of decode_error for invalid key shares #1923
• Add null check in dh testing by @torben-hansen in Add null check in dh testing #1937
• DH paramgen callback by @justsmth in DH paramgen callback #1928
• Upstream merge 2024 10 17 by @torben-hansen in Upstream merge 2024 10 17 #1934
• Remove old Intel CPU types by @justsmth in Remove old Intel CPU types #1942
• Remove retries on PCT failure in EC and RSA key generation. by @nebeid in Remove retries on PCT failure in EC and RSA key generation. #1938
• Add p4p, bump up time by @justsmth in Add p4p, bump up time #1943
• PQ README by @jakemas in PQ README #1932
• bump mysql CI to 9.1.0 by @justsmth in bump mysql CI to 9.1.0 #1939
• HKDF, HKDF_expand, and PBKDF Truncated SHA2-512 by @skmcgrail in HKDF, HKDF_expand, and PBKDF Truncated SHA2-512 #1946
• Missing functionality + Adding Nmap to our CI by @smittals2 in Missing functionality + Adding Nmap to our CI #1915
• Fix FIPS.md typo by @justsmth in Fix FIPS.md typo #1950
• Support encode or decode ∞ like OpenSSL by @samuel40791765 in Support encode or decode ∞ like OpenSSL #1930
• Expand support for EVP_PKEY_HMAC by @justsmth in Expand support for EVP_PKEY_HMAC #1933
• Add PKCS7-internal BIO_f_cipher by @WillChilds-Klein in Add PKCS7-internal BIO_f_cipher #1836
• Add PKCS7-internal BIO_f_md by @WillChilds-Klein in Add PKCS7-internal BIO_f_md #1886
• Ruby Support - DSA custom md by @justsmth in Ruby Support - DSA custom md #1953
• Add support for POINT_CONVERSION_HYBRID by @samuel40791765 in Add support for POINT_CONVERSION_HYBRID #1936
• Fixes for Coverity Alerts by @smittals2 in Fixes for Coverity Alerts #1960
• Also test w/ gcc 4.8 by @justsmth in Also test w/ gcc 4.8 #1962
• Actually add support for SSL_get_server/peer_tmp_key by @samuel40791765 in Actually add support for SSL_get_server/peer_tmp_key #1945
• Coverity Fix Null Check by @smittals2 in Coverity Fix Null Check #1965
• ML-KEM keygen Pairwise Consistency Test by @dkostic in ML-KEM keygen Pairwise Consistency Test #1964
• EDDSA PCT by @torben-hansen in EDDSA PCT #1968
• Expose AES_cfb1_encrypt and AES_cfb8_encrypt by @skmcgrail in Expose AES_cfb1_encrypt and AES_cfb8_encrypt #1967

Full Changelog: v1.37.0...v1.38.0

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.