##### MODERN_TLS versions

* **NEW:** TLSv1.3
* TLSv1.2
* TLSv1.1
* TLSv1

##### COMPATIBLE_TLS versions

* TLSv1

[OkHttp 3.11][OkHttp311]
------------------------

_2018-07-12_

Added a new extra strict RESTRICTED_TLS configuration inspired by [Google Cloud’s similar policy][googlecloud_ssl_policy]. It is appropriate when both the host platform
(JVM/Conscrypt/Android) and target webserver are current.

     * @return 8-byte DES key with parity
     */
    static byte[] des7to8(final byte[] key) {
        final byte key8[] = new byte[8];
        key8[0] = (byte) (key[0] & 0xFE);
        key8[1] = (byte) (key[0] << 7 | (key[1] & 0xFF) >>> 1);
        key8[2] = (byte) (key[1] << 6 | (key[2] & 0xFF) >>> 2);
        key8[3] = (byte) (key[2] << 5 | (key[3] & 0xFF) >>> 3);
        key8[4] = (byte) (key[3] << 4 | (key[4] & 0xFF) >>> 4);

        }

        @Test
        @DisplayName("Negative maxSize throws when allocating a new buffer")
        void negativeMaxSizeThrowsOnAllocation() {
            BufferCacheImpl impl = new BufferCacheImpl(0, -7);
            assertThrows(NegativeArraySizeException.class, impl::getBuffer);
        }
    }

    // Heterogeneous buffer sizes: cache should return exactly what was released
    @Test

    assertThat(formEncode(4)).isEqualTo("%04")
    assertThat(formEncode(5)).isEqualTo("%05")
    assertThat(formEncode(6)).isEqualTo("%06")
    assertThat(formEncode(7)).isEqualTo("%07")
    assertThat(formEncode(8)).isEqualTo("%08")
    assertThat(formEncode(9)).isEqualTo("%09")
    // Browsers convert '\n' to '\r\n'
    assertThat(formEncode(10)).isEqualTo("%0A")

    void testDecodeNonAlignedNextOffset() {
        byte[] buffer = new byte[100];
        // Write non-aligned next entry offset (not divisible by 4)
        SMBUtil.writeInt4(7, buffer, 0); // 7 is not aligned to 4 bytes
        SMBUtil.writeInt4(FileNotifyInformation.FILE_ACTION_ADDED, buffer, 4);
        SMBUtil.writeInt4(8, buffer, 8); // file name length

    void testE_blockSplitConsistency() throws ShortBufferException {
        // Arrange
        byte[] key14 = hex("01020304050607 11121314151617"); // two 7-byte chunks
        byte[] key7 = Arrays.copyOfRange(key14, 0, 7);
        byte[] data8 = NtlmUtil.S8;
        byte[] out14 = new byte[16];
        byte[] out7 = new byte[8];

        // Act
        NtlmUtil.E(key14, data8, out14);
        NtlmUtil.E(key7, data8, out7);

## Version 3.4.1

_2016-07-10_

 *  **Fix a major bug in encoding HTTP headers.** In 3.4.0 and 3.4.0-RC1 OkHttp
    had an off-by-one bug in our HPACK encoder. This bug could have caused the
    wrong headers to be emitted after a sequence of HTTP/2 requests! Everyone
    who is using OkHttp 3.4.0 or 3.4.0-RC1 should upgrade for this bug fix.


## Version 3.4.0

_2016-07-08_

        final byte[] key7 = new byte[7];
        final byte[] e8 = new byte[8];

        for (int i = 0; i < key.length / 7; i++) {
            System.arraycopy(key, i * 7, key7, 0, 7);
            final Cipher des = Crypto.getDES(key7);
            des.update(data, 0, data.length, e8);
            System.arraycopy(e8, 0, e, i * 8, 8);
        }
    }

    Android, including Android 6. We were using a feature of `SimpleDateFormat` that wasn't
    available in those versions!


## Version 4.8.0

_2020-07-11_

 *  New: Change `HeldCertificate.Builder` to use its own ASN.1 certificate encoder. This is part
    of our effort to remove the okhttp-tls module's dependency on Bouncy Castle. We think Bouncy

        final int[] pc1m = new int[56];
        final int[] pcr = new int[56];
        final int[] kn = new int[32];

        for (j = 0; j < 56; ++j) {
            l = pc1[j];
            m = l & 07;
            pc1m[j] = (keyBlock[l >>> 3] & bytebit[m]) != 0 ? 1 : 0;
        }

        for (i = 0; i < 16; ++i) {

            if (encrypting) {
                m = i << 1;
            } else {