v1.0

TlsLib4Pascal v1.0.0

First release. A fully managed, from-scratch TLS 1.2 + TLS 1.3 stack for Delphi and FreePascal — one sans-IO engine, no OpenSSL dependency.

Highlights

• TLS 1.3 + hardened TLS 1.2 — client and server, AEAD-only, forward-secret; no CBC-HMAC, RC4, 3DES, static-RSA/DH, or compression
• Post-quantum hybrid key exchange by default — X25519MLKEM768 in every preset
• Secure by default, fail-closed — refuses to build an unauthenticated client; every unsafe option lives behind an explicit dangerous surface
• Complete trust pipeline — PKIX path validation, RFC 6125 endpoint identity, public-key pinning, stapled + live OCSP/CRL, opt-in OS system trust
• Resumption, PSK & 0-RTT — 1.3 tickets with STEK rotation, 1.2 session IDs + RFC 5077, RFC 9258 external PSKs, anti-replay early data
• Certificate compression (RFC 8879) with decompression-bomb defense
• Three integration tiers — TTlsLib facade, TTlsStream, and drop-in adapters for mORMot, Indy, Synapse, and fcl-net
• Conformance-tested — RFC 8448 byte-exact vectors, fuzzing, and BoringSSL's BoGo suite as a required CI gate, plus an OpenSSL interop matrix

Cipher Suites, Groups & Signatures

• AEAD suites: TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256 (+ hardened ECDHE 1.2 suites)
• Groups: X25519, X25519MLKEM768, secp256r1/384r1/521r1
• Signatures: ECDSA (P-256/384/521), RSA-PSS (SHA-256/384/512), Ed25519, Ed448
• CPU-adaptive AEAD selection and server-preference negotiation

Security Invariants

Bounds-checked no-over-read parser, constant-time secret comparison, AEAD nonce non-reuse + usage limits, peer key-share validation, full secret zeroization, and DoS resource limits — each a tested contract (see the security model).

Requirements

• Delphi Sydney (10.4)+ or FreePascal 3.2.2+
• CryptoLib4Pascal