liboqs 0.14.0

[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

Details

release notes

liboqs version 0.14.0
=====================
About
The Open Quantum Safe (OQS) project has the goal of developing and prototyping quantum-resistant cryptography.  More information on OQS can be found on our website: https://openquantumsafe.org/ and on Github at https://github.com/open-quantum-safe/.
liboqs is an open source C library for quantum-resistant cryptographic algorithms.  Details about liboqs can be found in README.md.  See in particular limitations on intended use.
liboqs can be used with the following Open Quantum Safe application integrations:

oqs-provider: A standalone prototype OpenSSL 3 provider enabling liboqs-based quantum-safe and hybrid key authentication and exchange for TLS 1.3, X.509 certificate generation and CMS operations.
OQS-BoringSSL: A prototype integration of liboqs-based authentication and key exchange into TLS 1.3 in our fork of BoringSSL; see https://github.com/open-quantum-safe/boringssl.
OQS-OpenSSH: A prototype integration of liboqs-based authentication and key exchange into Secure Shell (SSH) version 2 in our fork of OpenSSH; see https://github.com/open-quantum-safe/openssh.

Several demos are available for using the above libraries in applications, including Apache, Chromium, curl, haproxy, nginx, and Wireshark.
liboqs can also be used in the following programming languages via language-specific wrappers:

C++, via https://github.com/open-quantum-safe/liboqs-cpp
Go, via https://github.com/open-quantum-safe/liboqs-go
Java, via https://github.com/open-quantum-safe/liboqs-java
Python 3, via https://github.com/open-quantum-safe/liboqs-python
Rust, via https://github.com/open-quantum-safe/liboqs-rust

Release notes
This is version 0.14.0 of liboqs. It was released on July 10, 2025.
This release contains a security fix for secret-dependent branching in HQC. It introduces support for SNOVA, a NIST Additional Signatures Round 2 candidate, and a new optimized implementation of SHA3 using AVX-512VL instructions. Additionally, this is the first liboqs release to include the stable 1.0.0 version of PQ Code Package's mlkem-native.
This release also introduces a number of improvements to testing and infrastructure. The OQS project is now publishing benchmarking data on https://openquantumsafe.org/benchmarking and code coverage data on https://coveralls.io/github/open-quantum-safe/liboqs.
Deprecation notice
This will be the last release of liboqs to include Dilithium (that is, the NIST Round 3 version of Dilithium, prior to its standardization by NIST as ML-DSA in FIPS 204). Applications should switch to ML-DSA (FIPS 204). Please contact us if you have any concerns.
Security issues

CVE-2025-52473: Disabled compiler optimizations for HQC to avoid secret-dependent branches. Thank you to Zhenzhi Lai and Zhiyuan Zhang from from the University of Melbourne and the Max Planck Institute for Security and Privacy for identifying the issue.

What's New
This release continues from the 0.13.0 release of liboqs.
Key encapsulation mechanisms

HQC: Disabled compiler optimizations to avoid secret-dependent branching in certain configurations. HQC remains disabled by default.
ML-KEM: Updated the default ML-KEM implementation to PQCP's mlkem-native v1.0.0.

Digital signature schemes

New API: added an API function to check if a signature scheme supports signing with a context string.
SNOVA: added SNOVA from NIST Additional Signature Schemes Round 2.

Other changes

Added an AVX512VL-optimized backend for SHA3.
Improved memory management throughout the codebase.


Detailed changelog
What's Changed

Switch to dev mode after 0.13.0 release by @praveksharma in Switch to dev mode after 0.13.0 release open-quantum-safe/liboqs#2125
Restrict -Wno-maybe-uninitialized to GCC and fix stack size typo by @alraddady in Restrict -Wno-maybe-uninitialized to GCC and fix stack size typo open-quantum-safe/liboqs#2111
Promote @SWilson4 from Committer to Maintainer [skip ci] by @SWilson4 in Promote @SWilson4 from Committer to Maintainer [skip ci] open-quantum-safe/liboqs#2120
Update Nix flake inputs by @aidenfoxivey in Update Nix flake inputs open-quantum-safe/liboqs#2126
Change cuPQC upstream repo by @praveksharma in Change cuPQC upstream repo open-quantum-safe/liboqs#2115
Integrate SNOVA into liboqs by @vacuas in Integrate SNOVA into liboqs open-quantum-safe/liboqs#2109
Update ACVP vectors to latest release by @abhinav-thales in Update ACVP vectors to latest release open-quantum-safe/liboqs#2131
Add a function to check if context string is supported by @M-AlNoaimi in Add a function to check if context string is supported open-quantum-safe/liboqs#2142
Skip failing CI test by @dstebila in Skip failing CI test open-quantum-safe/liboqs#2157
Use OQS_MEM_cleanse() instead of memset() by @Hussain1811 in Use OQS_MEM_cleanse() instead of memset() open-quantum-safe/liboqs#2158
Check for NULL dereference before using secure free by @Hussain1811 in Check for NULL dereference before using secure free open-quantum-safe/liboqs#2151
Update mlkem-native to v1.0.0 by @mkannwischer in Update mlkem-native to v1.0.0 open-quantum-safe/liboqs#2146
test: Use secure free for freeing secret key objects by @Hussain1811 in test: Use secure free for freeing secret key objects open-quantum-safe/liboqs#2149
tests: Remove unused variables by @Hussain1811 in tests: Remove unused variables open-quantum-safe/liboqs#2152
Wycheproof by @h2parson in Wycheproof open-quantum-safe/liboqs#2145
tests: Check OQS_STATUS of RNG and fstore functions by @Hussain1811 in tests: Check OQS_STATUS of RNG and fstore functions open-quantum-safe/liboqs#2153
Adjust constant-time test exception for mlkem-native by @mkannwischer in Adjust constant-time test exception for mlkem-native open-quantum-safe/liboqs#2162
Continuous Benchmarking using Github Actions by @pablo-gf in Continuous Benchmarking using Github Actions open-quantum-safe/liboqs#2134
test: Add basic kem fuzz testing by @nathaniel-brough in test: Add basic kem fuzz testing open-quantum-safe/liboqs#2133
Increase alert threshold for continuous benchmarking by @pablo-gf in Increase alert threshold for continuous benchmarking open-quantum-safe/liboqs#2166
Benchmarking comments only on alerts by @dstebila in Benchmarking comments only on alerts open-quantum-safe/liboqs#2168
Adding code coverage by @aidenfoxivey in Adding code coverage open-quantum-safe/liboqs#2148
Add AVX512VL-Optimized SHA3/SHAKE Implementations by @mdcornu in Add AVX512VL-Optimized SHA3/SHAKE Implementations open-quantum-safe/liboqs#2167
Zeroize memory in SHA3 implementation by @aidenfoxivey in Zeroize memory in SHA3 implementation open-quantum-safe/liboqs#2171
Disable compiler optimizations for HQC by @SWilson4 in open-quantum-safe/liboqs@4215362
liboqs 0.14.0 release candidate 1 by @SWilson4 in liboqs 0.14.0 release candidate 1 open-quantum-safe/liboqs#2180
Document public / internal API split [skip ci] by @SWilson4 in Document public / internal API split [skip ci] open-quantum-safe/liboqs#2182

New Contributors

@alraddady made their first contribution in Restrict -Wno-maybe-uninitialized to GCC and fix stack size typo open-quantum-safe/liboqs#2111
@vacuas made their first contribution in Integrate SNOVA into liboqs open-quantum-safe/liboqs#2109
@M-AlNoaimi made their first contribution in Add a function to check if context string is supported open-quantum-safe/liboqs#2142
@Hussain1811 made their first contribution in Use OQS_MEM_cleanse() instead of memset() open-quantum-safe/liboqs#2158
@h2parson made their first contribution in Wycheproof open-quantum-safe/liboqs#2145
@mdcornu made their first contribution in Add AVX512VL-Optimized SHA3/SHAKE Implementations open-quantum-safe/liboqs#2167

Full Changelog: open-quantum-safe/liboqs@0.13.0...0.14.0

View the full release notes at https://github.com/open-quantum-safe/liboqs/releases/tag/0.14.0.

---

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.