• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1
2 OpenSSL CHANGES
3 _______________
4
5 This is a high-level summary of the most important changes.
6 For a full list of changes, see the git commit log; for example,
7 https://github.com/openssl/openssl/commits/ and pick the appropriate
8 release branch.
9
10 Changes between 1.1.1s and 1.1.1t [xx XXX xxxx]
11  *) Corrected documentation of X509_VERIFY_PARAM_add0_policy() to mention
12     that it does not enable policy checking. Thanks to
13     David Benjamin for discovering this issue. (CVE-2023-0466)
14     [Tomas Mraz]
15
16  *) Fixed a type confusion vulnerability relating to X.400 address processing
17     inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING
18     but subsequently interpreted by GENERAL_NAME_cmp as an ASN1_TYPE. This
19     vulnerability may allow an attacker who can provide a certificate chain and
20     CRL (neither of which need have a valid signature) to pass arbitrary
21     pointers to a memcmp call, creating a possible read primitive, subject to
22     some constraints. Refer to the advisory for more information. Thanks to
23     David Benjamin for discovering this issue. (CVE-2023-0286)
24
25     This issue has been fixed by changing the public header file definition of
26     GENERAL_NAME so that x400Address reflects the implementation. It was not
27     possible for any existing application to successfully use the existing
28     definition; however, if any application references the x400Address field
29     (e.g. in dead code), note that the type of this field has changed. There is
30     no ABI change.
31
32     [Hugo Landau]
33
34 Changes between 1.1.1r and 1.1.1s [1 Nov 2022]
35
36  *) Fixed a regression introduced in 1.1.1r version not refreshing the
37     certificate data to be signed before signing the certificate.
38
39     [Gibeom Gwon]
40
41 Changes between 1.1.1q and 1.1.1r [11 Oct 2022]
42
43  *) Fixed the linux-mips64 Configure target which was missing the
44     SIXTY_FOUR_BIT bn_ops flag. This was causing heap corruption on that
45     platform.
46     [Adam Joseph]
47
48  *) Fixed a strict aliasing problem in bn_nist. Clang-14 optimisation was
49     causing incorrect results in some cases as a result.
50     [Paul Dale]
51
52  *) Fixed SSL_pending() and SSL_has_pending() with DTLS which were failing to
53     report correct results in some cases
54     [Matt Caswell]
55
56  *) Fixed a regression introduced in 1.1.1o for re-signing certificates with
57     different key sizes
58     [Todd Short]
59
60  *) Added the loongarch64 target
61     [Shi Pujin]
62
63  *) Fixed a DRBG seed propagation thread safety issue
64     [Bernd Edlinger]
65
66  *) Fixed a memory leak in tls13_generate_secret
67     [Bernd Edlinger]
68
69  *) Fixed reported performance degradation on aarch64. Restored the
70     implementation prior to commit 2621751 ("aes/asm/aesv8-armx.pl: avoid
71     32-bit lane assignment in CTR mode") for 64bit targets only, since it is
72     reportedly 2-17% slower and the silicon errata only affects 32bit targets.
73     The new algorithm is still used for 32 bit targets.
74     [Bernd Edlinger]
75
76  *) Added a missing header for memcmp that caused compilation failure on some
77     platforms
78     [Gregor Jasny]
79
80 Changes between 1.1.1p and 1.1.1q [5 Jul 2022]
81
82  *) AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
83     implementation would not encrypt the entirety of the data under some
84     circumstances.  This could reveal sixteen bytes of data that was
85     preexisting in the memory that wasn't written.  In the special case of
86     "in place" encryption, sixteen bytes of the plaintext would be revealed.
87
88     Since OpenSSL does not support OCB based cipher suites for TLS and DTLS,
89     they are both unaffected.
90     (CVE-2022-2097)
91     [Alex Chernyakhovsky, David Benjamin, Alejandro Sedeño]
92
93 Changes between 1.1.1o and 1.1.1p [21 Jun 2022]
94
95  *) In addition to the c_rehash shell command injection identified in
96     CVE-2022-1292, further bugs where the c_rehash script does not
97     properly sanitise shell metacharacters to prevent command injection have been
98     fixed.
99
100     When the CVE-2022-1292 was fixed it was not discovered that there
101     are other places in the script where the file names of certificates
102     being hashed were possibly passed to a command executed through the shell.
103
104     This script is distributed by some operating systems in a manner where
105     it is automatically executed.  On such operating systems, an attacker
106     could execute arbitrary commands with the privileges of the script.
107
108     Use of the c_rehash script is considered obsolete and should be replaced
109     by the OpenSSL rehash command line tool.
110     (CVE-2022-2068)
111     [Daniel Fiala, Tomáš Mráz]
112
113  *) When OpenSSL TLS client is connecting without any supported elliptic
114     curves and TLS-1.3 protocol is disabled the connection will no longer fail
115     if a ciphersuite that does not use a key exchange based on elliptic
116     curves can be negotiated.
117     [Tomáš Mráz]
118
119 Changes between 1.1.1n and 1.1.1o [3 May 2022]
120
121  *) Fixed a bug in the c_rehash script which was not properly sanitising shell
122     metacharacters to prevent command injection.  This script is distributed
123     by some operating systems in a manner where it is automatically executed.
124     On such operating systems, an attacker could execute arbitrary commands
125     with the privileges of the script.
126
127     Use of the c_rehash script is considered obsolete and should be replaced
128     by the OpenSSL rehash command line tool.
129     (CVE-2022-1292)
130     [Tomáš Mráz]
131
132 Changes between 1.1.1m and 1.1.1n [15 Mar 2022]
133
134  *) Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever
135     for non-prime moduli.
136
137     Internally this function is used when parsing certificates that contain
138     elliptic curve public keys in compressed form or explicit elliptic curve
139     parameters with a base point encoded in compressed form.
140
141     It is possible to trigger the infinite loop by crafting a certificate that
142     has invalid explicit curve parameters.
143
144     Since certificate parsing happens prior to verification of the certificate
145     signature, any process that parses an externally supplied certificate may
146     thus be subject to a denial of service attack. The infinite loop can also
147     be reached when parsing crafted private keys as they can contain explicit
148     elliptic curve parameters.
149
150     Thus vulnerable situations include:
151
152      - TLS clients consuming server certificates
153      - TLS servers consuming client certificates
154      - Hosting providers taking certificates or private keys from customers
155      - Certificate authorities parsing certification requests from subscribers
156      - Anything else which parses ASN.1 elliptic curve parameters
157
158     Also any other applications that use the BN_mod_sqrt() where the attacker
159     can control the parameter values are vulnerable to this DoS issue.
160     (CVE-2022-0778)
161     [Tomáš Mráz]
162
163  *) Add ciphersuites based on DHE_PSK (RFC 4279) and ECDHE_PSK (RFC 5489)
164     to the list of ciphersuites providing Perfect Forward Secrecy as
165     required by SECLEVEL >= 3.
166
167     [Dmitry Belyavskiy, Nicola Tuveri]
168
169 Changes between 1.1.1l and 1.1.1m [14 Dec 2021]
170
171  *) Avoid loading of a dynamic engine twice.
172
173     [Bernd Edlinger]
174
175  *) Fixed building on Debian with kfreebsd kernels
176
177     [Mattias Ellert]
178
179  *) Prioritise DANE TLSA issuer certs over peer certs
180
181     [Viktor Dukhovni]
182
183  *) Fixed random API for MacOS prior to 10.12
184
185     These MacOS versions don't support the CommonCrypto APIs
186
187     [Lenny Primak]
188
189 Changes between 1.1.1k and 1.1.1l [24 Aug 2021]
190
191  *) Fixed an SM2 Decryption Buffer Overflow.
192
193     In order to decrypt SM2 encrypted data an application is expected to call the
194     API function EVP_PKEY_decrypt(). Typically an application will call this
195     function twice. The first time, on entry, the "out" parameter can be NULL and,
196     on exit, the "outlen" parameter is populated with the buffer size required to
197     hold the decrypted plaintext. The application can then allocate a sufficiently
198     sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL
199     value for the "out" parameter.
200
201     A bug in the implementation of the SM2 decryption code means that the
202     calculation of the buffer size required to hold the plaintext returned by the
203     first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
204     the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
205     called by the application a second time with a buffer that is too small.
206
207     A malicious attacker who is able present SM2 content for decryption to an
208     application could cause attacker chosen data to overflow the buffer by up to a
209     maximum of 62 bytes altering the contents of other data held after the
210     buffer, possibly changing application behaviour or causing the application to
211     crash. The location of the buffer is application dependent but is typically
212     heap allocated.
213     (CVE-2021-3711)
214     [Matt Caswell]
215
216  *) Fixed various read buffer overruns processing ASN.1 strings
217
218     ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING
219     structure which contains a buffer holding the string data and a field holding
220     the buffer length. This contrasts with normal C strings which are repesented as
221     a buffer for the string data which is terminated with a NUL (0) byte.
222
223     Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's
224     own "d2i" functions (and other similar parsing functions) as well as any string
225     whose value has been set with the ASN1_STRING_set() function will additionally
226     NUL terminate the byte array in the ASN1_STRING structure.
227
228     However, it is possible for applications to directly construct valid ASN1_STRING
229     structures which do not NUL terminate the byte array by directly setting the
230     "data" and "length" fields in the ASN1_STRING array. This can also happen by
231     using the ASN1_STRING_set0() function.
232
233     Numerous OpenSSL functions that print ASN.1 data have been found to assume that
234     the ASN1_STRING byte array will be NUL terminated, even though this is not
235     guaranteed for strings that have been directly constructed. Where an application
236     requests an ASN.1 structure to be printed, and where that ASN.1 structure
237     contains ASN1_STRINGs that have been directly constructed by the application
238     without NUL terminating the "data" field, then a read buffer overrun can occur.
239
240     The same thing can also occur during name constraints processing of certificates
241     (for example if a certificate has been directly constructed by the application
242     instead of loading it via the OpenSSL parsing functions, and the certificate
243     contains non NUL terminated ASN1_STRING structures). It can also occur in the
244     X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions.
245
246     If a malicious actor can cause an application to directly construct an
247     ASN1_STRING and then process it through one of the affected OpenSSL functions
248     then this issue could be hit. This might result in a crash (causing a Denial of
249     Service attack). It could also result in the disclosure of private memory
250     contents (such as private keys, or sensitive plaintext).
251     (CVE-2021-3712)
252     [Matt Caswell]
253
254 Changes between 1.1.1j and 1.1.1k [25 Mar 2021]
255
256  *) Fixed a problem with verifying a certificate chain when using the
257     X509_V_FLAG_X509_STRICT flag. This flag enables additional security checks
258     of the certificates present in a certificate chain. It is not set by
259     default.
260
261     Starting from OpenSSL version 1.1.1h a check to disallow certificates in
262     the chain that have explicitly encoded elliptic curve parameters was added
263     as an additional strict check.
264
265     An error in the implementation of this check meant that the result of a
266     previous check to confirm that certificates in the chain are valid CA
267     certificates was overwritten. This effectively bypasses the check
268     that non-CA certificates must not be able to issue other certificates.
269
270     If a "purpose" has been configured then there is a subsequent opportunity
271     for checks that the certificate is a valid CA.  All of the named "purpose"
272     values implemented in libcrypto perform this check.  Therefore, where
273     a purpose is set the certificate chain will still be rejected even when the
274     strict flag has been used. A purpose is set by default in libssl client and
275     server certificate verification routines, but it can be overridden or
276     removed by an application.
277
278     In order to be affected, an application must explicitly set the
279     X509_V_FLAG_X509_STRICT verification flag and either not set a purpose
280     for the certificate verification or, in the case of TLS client or server
281     applications, override the default purpose.
282     (CVE-2021-3450)
283     [Tomáš Mráz]
284
285  *) Fixed an issue where an OpenSSL TLS server may crash if sent a maliciously
286     crafted renegotiation ClientHello message from a client. If a TLSv1.2
287     renegotiation ClientHello omits the signature_algorithms extension (where
288     it was present in the initial ClientHello), but includes a
289     signature_algorithms_cert extension then a NULL pointer dereference will
290     result, leading to a crash and a denial of service attack.
291
292     A server is only vulnerable if it has TLSv1.2 and renegotiation enabled
293     (which is the default configuration). OpenSSL TLS clients are not impacted
294     by this issue.
295     (CVE-2021-3449)
296     [Peter Kästle and Samuel Sapalski]
297
298 Changes between 1.1.1i and 1.1.1j [16 Feb 2021]
299
300  *) Fixed the X509_issuer_and_serial_hash() function. It attempts to
301     create a unique hash value based on the issuer and serial number data
302     contained within an X509 certificate. However it was failing to correctly
303     handle any errors that may occur while parsing the issuer field (which might
304     occur if the issuer field is maliciously constructed). This may subsequently
305     result in a NULL pointer deref and a crash leading to a potential denial of
306     service attack.
307     (CVE-2021-23841)
308     [Matt Caswell]
309
310  *) Fixed the RSA_padding_check_SSLv23() function and the RSA_SSLV23_PADDING
311     padding mode to correctly check for rollback attacks. This is considered a
312     bug in OpenSSL 1.1.1 because it does not support SSLv2. In 1.0.2 this is
313     CVE-2021-23839.
314     [Matt Caswell]
315
316  *) Fixed the EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate
317     functions. Previously they could overflow the output length argument in some
318     cases where the input length is close to the maximum permissable length for
319     an integer on the platform. In such cases the return value from the function
320     call would be 1 (indicating success), but the output length value would be
321     negative. This could cause applications to behave incorrectly or crash.
322     (CVE-2021-23840)
323     [Matt Caswell]
324
325  *) Fixed SRP_Calc_client_key so that it runs in constant time. The previous
326     implementation called BN_mod_exp without setting BN_FLG_CONSTTIME. This
327     could be exploited in a side channel attack to recover the password. Since
328     the attack is local host only this is outside of the current OpenSSL
329     threat model and therefore no CVE is assigned.
330
331     Thanks to Mohammed Sabt and Daniel De Almeida Braga for reporting this
332     issue.
333     [Matt Caswell]
334
335 Changes between 1.1.1h and 1.1.1i [8 Dec 2020]
336
337  *) Fixed NULL pointer deref in the GENERAL_NAME_cmp function
338     This function could crash if both GENERAL_NAMEs contain an EDIPARTYNAME.
339     If an attacker can control both items being compared  then this could lead
340     to a possible denial of service attack. OpenSSL itself uses the
341     GENERAL_NAME_cmp function for two purposes:
342     1) Comparing CRL distribution point names between an available CRL and a
343        CRL distribution point embedded in an X509 certificate
344     2) When verifying that a timestamp response token signer matches the
345        timestamp authority name (exposed via the API functions
346        TS_RESP_verify_response and TS_RESP_verify_token)
347     (CVE-2020-1971)
348     [Matt Caswell]
349
350  *) Add support for Apple Silicon M1 Macs with the darwin64-arm64-cc target.
351     [Stuart Carnie]
352
353  *) The security callback, which can be customised by application code, supports
354     the security operation SSL_SECOP_TMP_DH. This is defined to take an EVP_PKEY
355     in the "other" parameter. In most places this is what is passed. All these
356     places occur server side. However there was one client side call of this
357     security operation and it passed a DH object instead. This is incorrect
358     according to the definition of SSL_SECOP_TMP_DH, and is inconsistent with all
359     of the other locations. Therefore this client side call has been changed to
360     pass an EVP_PKEY instead.
361     [Matt Caswell]
362
363  *) In 1.1.1h, an expired trusted (root) certificate was not anymore rejected
364     when validating a certificate path. This check is restored in 1.1.1i.
365     [David von Oheimb]
366
367 Changes between 1.1.1g and 1.1.1h [22 Sep 2020]
368
369  *) Certificates with explicit curve parameters are now disallowed in
370     verification chains if the X509_V_FLAG_X509_STRICT flag is used.
371     [Tomas Mraz]
372
373  *) The 'MinProtocol' and 'MaxProtocol' configuration commands now silently
374     ignore TLS protocol version bounds when configuring DTLS-based contexts, and
375     conversely, silently ignore DTLS protocol version bounds when configuring
376     TLS-based contexts.  The commands can be repeated to set bounds of both
377     types.  The same applies with the corresponding "min_protocol" and
378     "max_protocol" command-line switches, in case some application uses both TLS
379     and DTLS.
380
381     SSL_CTX instances that are created for a fixed protocol version (e.g.
382     TLSv1_server_method()) also silently ignore version bounds.  Previously
383     attempts to apply bounds to these protocol versions would result in an
384     error.  Now only the "version-flexible" SSL_CTX instances are subject to
385     limits in configuration files in command-line options.
386     [Viktor Dukhovni]
387
388  *) Handshake now fails if Extended Master Secret extension is dropped
389     on renegotiation.
390     [Tomas Mraz]
391
392  *) Accidentally, an expired trusted (root) certificate is not anymore rejected
393     when validating a certificate path.
394     [David von Oheimb]
395
396  *) The Oracle Developer Studio compiler will start reporting deprecated APIs
397
398 Changes between 1.1.1f and 1.1.1g [21 Apr 2020]
399
400  *) Fixed segmentation fault in SSL_check_chain()
401     Server or client applications that call the SSL_check_chain() function
402     during or after a TLS 1.3 handshake may crash due to a NULL pointer
403     dereference as a result of incorrect handling of the
404     "signature_algorithms_cert" TLS extension. The crash occurs if an invalid
405     or unrecognised signature algorithm is received from the peer. This could
406     be exploited by a malicious peer in a Denial of Service attack.
407     (CVE-2020-1967)
408     [Benjamin Kaduk]
409
410  *) Added AES consttime code for no-asm configurations
411     an optional constant time support for AES was added
412     when building openssl for no-asm.
413     Enable with: ./config no-asm -DOPENSSL_AES_CONST_TIME
414     Disable with: ./config no-asm -DOPENSSL_NO_AES_CONST_TIME
415     At this time this feature is by default disabled.
416     It will be enabled by default in 3.0.
417     [Bernd Edlinger]
418
419 Changes between 1.1.1e and 1.1.1f [31 Mar 2020]
420
421  *) Revert the change of EOF detection while reading in libssl to avoid
422     regressions in applications depending on the current way of reporting
423     the EOF. As the existing method is not fully accurate the change to
424     reporting the EOF via SSL_ERROR_SSL is kept on the current development
425     branch and will be present in the 3.0 release.
426     [Tomas Mraz]
427
428  *) Revised BN_generate_prime_ex to not avoid factors 3..17863 in p-1
429     when primes for RSA keys are computed.
430     Since we previously always generated primes == 2 (mod 3) for RSA keys,
431     the 2-prime and 3-prime RSA modules were easy to distinguish, since
432     N = p*q = 1 (mod 3), but N = p*q*r = 2 (mod 3). Therefore fingerprinting
433     2-prime vs. 3-prime RSA keys was possible by computing N mod 3.
434     This avoids possible fingerprinting of newly generated RSA modules.
435     [Bernd Edlinger]
436
437 Changes between 1.1.1d and 1.1.1e [17 Mar 2020]
438  *) Properly detect EOF while reading in libssl. Previously if we hit an EOF
439     while reading in libssl then we would report an error back to the
440     application (SSL_ERROR_SYSCALL) but errno would be 0. We now add
441     an error to the stack (which means we instead return SSL_ERROR_SSL) and
442     therefore give a hint as to what went wrong.
443     [Matt Caswell]
444
445  *) Check that ed25519 and ed448 are allowed by the security level. Previously
446     signature algorithms not using an MD were not being checked that they were
447     allowed by the security level.
448     [Kurt Roeckx]
449
450  *) Fixed SSL_get_servername() behaviour. The behaviour of SSL_get_servername()
451     was not quite right. The behaviour was not consistent between resumption
452     and normal handshakes, and also not quite consistent with historical
453     behaviour. The behaviour in various scenarios has been clarified and
454     it has been updated to make it match historical behaviour as closely as
455     possible.
456     [Matt Caswell]
457
458  *) [VMS only] The header files that the VMS compilers include automatically,
459     __DECC_INCLUDE_PROLOGUE.H and __DECC_INCLUDE_EPILOGUE.H, use pragmas that
460     the C++ compiler doesn't understand.  This is a shortcoming in the
461     compiler, but can be worked around with __cplusplus guards.
462
463     C++ applications that use OpenSSL libraries must be compiled using the
464     qualifier '/NAMES=(AS_IS,SHORTENED)' to be able to use all the OpenSSL
465     functions.  Otherwise, only functions with symbols of less than 31
466     characters can be used, as the linker will not be able to successfully
467     resolve symbols with longer names.
468     [Richard Levitte]
469
470  *) Corrected the documentation of the return values from the EVP_DigestSign*
471     set of functions.  The documentation mentioned negative values for some
472     errors, but this was never the case, so the mention of negative values
473     was removed.
474
475     Code that followed the documentation and thereby check with something
476     like 'EVP_DigestSignInit(...) <= 0' will continue to work undisturbed.
477     [Richard Levitte]
478
479  *) Fixed an an overflow bug in the x64_64 Montgomery squaring procedure
480     used in exponentiation with 512-bit moduli. No EC algorithms are
481     affected. Analysis suggests that attacks against 2-prime RSA1024,
482     3-prime RSA1536, and DSA1024 as a result of this defect would be very
483     difficult to perform and are not believed likely. Attacks against DH512
484     are considered just feasible. However, for an attack the target would
485     have to re-use the DH512 private key, which is not recommended anyway.
486     Also applications directly using the low level API BN_mod_exp may be
487     affected if they use BN_FLG_CONSTTIME.
488     (CVE-2019-1551)
489     [Andy Polyakov]
490
491  *) Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY.
492     The presence of this system service is determined at run-time.
493     [Richard Levitte]
494
495  *) Added newline escaping functionality to a filename when using openssl dgst.
496     This output format is to replicate the output format found in the '*sum'
497     checksum programs. This aims to preserve backward compatibility.
498     [Matt Eaton, Richard Levitte, and Paul Dale]
499
500  *) Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just
501     the first value.
502     [Jon Spillett]
503
504 Changes between 1.1.1c and 1.1.1d [10 Sep 2019]
505
506  *) Fixed a fork protection issue. OpenSSL 1.1.1 introduced a rewritten random
507     number generator (RNG). This was intended to include protection in the
508     event of a fork() system call in order to ensure that the parent and child
509     processes did not share the same RNG state. However this protection was not
510     being used in the default case.
511
512     A partial mitigation for this issue is that the output from a high
513     precision timer is mixed into the RNG state so the likelihood of a parent
514     and child process sharing state is significantly reduced.
515
516     If an application already calls OPENSSL_init_crypto() explicitly using
517     OPENSSL_INIT_ATFORK then this problem does not occur at all.
518     (CVE-2019-1549)
519     [Matthias St. Pierre]
520
521  *) For built-in EC curves, ensure an EC_GROUP built from the curve name is
522     used even when parsing explicit parameters, when loading a serialized key
523     or calling `EC_GROUP_new_from_ecpkparameters()`/
524     `EC_GROUP_new_from_ecparameters()`.
525     This prevents bypass of security hardening and performance gains,
526     especially for curves with specialized EC_METHODs.
527     By default, if a key encoded with explicit parameters is loaded and later
528     serialized, the output is still encoded with explicit parameters, even if
529     internally a "named" EC_GROUP is used for computation.
530     [Nicola Tuveri]
531
532  *) Compute ECC cofactors if not provided during EC_GROUP construction. Before
533     this change, EC_GROUP_set_generator would accept order and/or cofactor as
534     NULL. After this change, only the cofactor parameter can be NULL. It also
535     does some minimal sanity checks on the passed order.
536     (CVE-2019-1547)
537     [Billy Bob Brumley]
538
539  *) Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey.
540     An attack is simple, if the first CMS_recipientInfo is valid but the
541     second CMS_recipientInfo is chosen ciphertext. If the second
542     recipientInfo decodes to PKCS #1 v1.5 form plaintext, the correct
543     encryption key will be replaced by garbage, and the message cannot be
544     decoded, but if the RSA decryption fails, the correct encryption key is
545     used and the recipient will not notice the attack.
546     As a work around for this potential attack the length of the decrypted
547     key must be equal to the cipher default key length, in case the
548     certifiate is not given and all recipientInfo are tried out.
549     The old behaviour can be re-enabled in the CMS code by setting the
550     CMS_DEBUG_DECRYPT flag.
551     (CVE-2019-1563)
552     [Bernd Edlinger]
553
554  *) Early start up entropy quality from the DEVRANDOM seed source has been
555     improved for older Linux systems.  The RAND subsystem will wait for
556     /dev/random to be producing output before seeding from /dev/urandom.
557     The seeded state is stored for future library initialisations using
558     a system global shared memory segment.  The shared memory identifier
559     can be configured by defining OPENSSL_RAND_SEED_DEVRANDOM_SHM_ID to
560     the desired value.  The default identifier is 114.
561     [Paul Dale]
562
563  *) Correct the extended master secret constant on EBCDIC systems. Without this
564     fix TLS connections between an EBCDIC system and a non-EBCDIC system that
565     negotiate EMS will fail. Unfortunately this also means that TLS connections
566     between EBCDIC systems with this fix, and EBCDIC systems without this
567     fix will fail if they negotiate EMS.
568     [Matt Caswell]
569
570  *) Use Windows installation paths in the mingw builds
571
572     Mingw isn't a POSIX environment per se, which means that Windows
573     paths should be used for installation.
574     (CVE-2019-1552)
575     [Richard Levitte]
576
577  *) Changed DH_check to accept parameters with order q and 2q subgroups.
578     With order 2q subgroups the bit 0 of the private key is not secret
579     but DH_generate_key works around that by clearing bit 0 of the
580     private key for those. This avoids leaking bit 0 of the private key.
581     [Bernd Edlinger]
582
583  *) Significantly reduce secure memory usage by the randomness pools.
584     [Paul Dale]
585
586  *) Revert the DEVRANDOM_WAIT feature for Linux systems
587
588     The DEVRANDOM_WAIT feature added a select() call to wait for the
589     /dev/random device to become readable before reading from the
590     /dev/urandom device.
591
592     It turned out that this change had negative side effects on
593     performance which were not acceptable. After some discussion it
594     was decided to revert this feature and leave it up to the OS
595     resp. the platform maintainer to ensure a proper initialization
596     during early boot time.
597     [Matthias St. Pierre]
598
599 Changes between 1.1.1b and 1.1.1c [28 May 2019]
600
601  *) Add build tests for C++.  These are generated files that only do one
602     thing, to include one public OpenSSL head file each.  This tests that
603     the public header files can be usefully included in a C++ application.
604
605     This test isn't enabled by default.  It can be enabled with the option
606     'enable-buildtest-c++'.
607     [Richard Levitte]
608
609  *) Enable SHA3 pre-hashing for ECDSA and DSA.
610     [Patrick Steuer]
611
612  *) Change the default RSA, DSA and DH size to 2048 bit instead of 1024.
613     This changes the size when using the genpkey app when no size is given. It
614     fixes an omission in earlier changes that changed all RSA, DSA and DH
615     generation apps to use 2048 bits by default.
616     [Kurt Roeckx]
617
618  *) Reorganize the manual pages to consistently have RETURN VALUES,
619     EXAMPLES, SEE ALSO and HISTORY come in that order, and adjust
620     util/fix-doc-nits accordingly.
621     [Paul Yang, Joshua Lock]
622
623  *) Add the missing accessor EVP_PKEY_get0_engine()
624     [Matt Caswell]
625
626  *) Have apps like 's_client' and 's_server' output the signature scheme
627     along with other cipher suite parameters when debugging.
628     [Lorinczy Zsigmond]
629
630  *) Make OPENSSL_config() error agnostic again.
631     [Richard Levitte]
632
633  *) Do the error handling in RSA decryption constant time.
634     [Bernd Edlinger]
635
636  *) Prevent over long nonces in ChaCha20-Poly1305.
637
638     ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input
639     for every encryption operation. RFC 7539 specifies that the nonce value
640     (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length
641     and front pads the nonce with 0 bytes if it is less than 12
642     bytes. However it also incorrectly allows a nonce to be set of up to 16
643     bytes. In this case only the last 12 bytes are significant and any
644     additional leading bytes are ignored.
645
646     It is a requirement of using this cipher that nonce values are
647     unique. Messages encrypted using a reused nonce value are susceptible to
648     serious confidentiality and integrity attacks. If an application changes
649     the default nonce length to be longer than 12 bytes and then makes a
650     change to the leading bytes of the nonce expecting the new value to be a
651     new unique nonce then such an application could inadvertently encrypt
652     messages with a reused nonce.
653
654     Additionally the ignored bytes in a long nonce are not covered by the
655     integrity guarantee of this cipher. Any application that relies on the
656     integrity of these ignored leading bytes of a long nonce may be further
657     affected. Any OpenSSL internal use of this cipher, including in SSL/TLS,
658     is safe because no such use sets such a long nonce value. However user
659     applications that use this cipher directly and set a non-default nonce
660     length to be longer than 12 bytes may be vulnerable.
661
662     This issue was reported to OpenSSL on 16th of March 2019 by Joran Dirk
663     Greef of Ronomon.
664     (CVE-2019-1543)
665     [Matt Caswell]
666
667  *) Add DEVRANDOM_WAIT feature for Linux systems
668
669     On older Linux systems where the getrandom() system call is not available,
670     OpenSSL normally uses the /dev/urandom device for seeding its CSPRNG.
671     Contrary to getrandom(), the /dev/urandom device will not block during
672     early boot when the kernel CSPRNG has not been seeded yet.
673
674     To mitigate this known weakness, use select() to wait for /dev/random to
675     become readable before reading from /dev/urandom.
676
677  *) Ensure that SM2 only uses SM3 as digest algorithm
678     [Paul Yang]
679
680 Changes between 1.1.1a and 1.1.1b [26 Feb 2019]
681
682  *) Added SCA hardening for modular field inversion in EC_GROUP through
683     a new dedicated field_inv() pointer in EC_METHOD.
684     This also addresses a leakage affecting conversions from projective
685     to affine coordinates.
686     [Billy Bob Brumley, Nicola Tuveri]
687
688  *) Change the info callback signals for the start and end of a post-handshake
689     message exchange in TLSv1.3. In 1.1.1/1.1.1a we used SSL_CB_HANDSHAKE_START
690     and SSL_CB_HANDSHAKE_DONE. Experience has shown that many applications get
691     confused by this and assume that a TLSv1.2 renegotiation has started. This
692     can break KeyUpdate handling. Instead we no longer signal the start and end
693     of a post handshake message exchange (although the messages themselves are
694     still signalled). This could break some applications that were expecting
695     the old signals. However without this KeyUpdate is not usable for many
696     applications.
697     [Matt Caswell]
698
699  *) Fix a bug in the computation of the endpoint-pair shared secret used
700     by DTLS over SCTP. This breaks interoperability with older versions
701     of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2. There is a runtime
702     switch SSL_MODE_DTLS_SCTP_LABEL_LENGTH_BUG (off by default) enabling
703     interoperability with such broken implementations. However, enabling
704     this switch breaks interoperability with correct implementations.
705
706  *) Fix a use after free bug in d2i_X509_PUBKEY when overwriting a
707     re-used X509_PUBKEY object if the second PUBKEY is malformed.
708     [Bernd Edlinger]
709
710  *) Move strictness check from EVP_PKEY_asn1_new() to EVP_PKEY_asn1_add0().
711     [Richard Levitte]
712
713  *) Remove the 'dist' target and add a tarball building script.  The
714     'dist' target has fallen out of use, and it shouldn't be
715     necessary to configure just to create a source distribution.
716     [Richard Levitte]
717
718 Changes between 1.1.1 and 1.1.1a [20 Nov 2018]
719
720  *) Timing vulnerability in DSA signature generation
721
722     The OpenSSL DSA signature algorithm has been shown to be vulnerable to a
723     timing side channel attack. An attacker could use variations in the signing
724     algorithm to recover the private key.
725
726     This issue was reported to OpenSSL on 16th October 2018 by Samuel Weiser.
727     (CVE-2018-0734)
728     [Paul Dale]
729
730  *) Timing vulnerability in ECDSA signature generation
731
732     The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a
733     timing side channel attack. An attacker could use variations in the signing
734     algorithm to recover the private key.
735
736     This issue was reported to OpenSSL on 25th October 2018 by Samuel Weiser.
737     (CVE-2018-0735)
738     [Paul Dale]
739
740  *) Added EVP_PKEY_ECDH_KDF_X9_63 and ecdh_KDF_X9_63() as replacements for
741     the EVP_PKEY_ECDH_KDF_X9_62 KDF type and ECDH_KDF_X9_62(). The old names
742     are retained for backwards compatibility.
743     [Antoine Salon]
744
745  *) Fixed the issue that RAND_add()/RAND_seed() silently discards random input
746     if its length exceeds 4096 bytes. The limit has been raised to a buffer size
747     of two gigabytes and the error handling improved.
748
749     This issue was reported to OpenSSL by Dr. Falko Strenzke. It has been
750     categorized as a normal bug, not a security issue, because the DRBG reseeds
751     automatically and is fully functional even without additional randomness
752     provided by the application.
753
754 Changes between 1.1.0i and 1.1.1 [11 Sep 2018]
755
756  *) Add a new ClientHello callback. Provides a callback interface that gives
757     the application the ability to adjust the nascent SSL object at the
758     earliest stage of ClientHello processing, immediately after extensions have
759     been collected but before they have been processed. In particular, this
760     callback can adjust the supported TLS versions in response to the contents
761     of the ClientHello
762     [Benjamin Kaduk]
763
764  *) Add SM2 base algorithm support.
765     [Jack Lloyd]
766
767  *) s390x assembly pack: add (improved) hardware-support for the following
768     cryptographic primitives: sha3, shake, aes-gcm, aes-ccm, aes-ctr, aes-ofb,
769     aes-cfb/cfb8, aes-ecb.
770     [Patrick Steuer]
771
772  *) Make EVP_PKEY_asn1_new() a bit stricter about its input.  A NULL pem_str
773     parameter is no longer accepted, as it leads to a corrupt table.  NULL
774     pem_str is reserved for alias entries only.
775     [Richard Levitte]
776
777  *) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder
778     step for prime curves. The new implementation is based on formulae from
779     differential addition-and-doubling in homogeneous projective coordinates
780     from Izu-Takagi "A fast parallel elliptic curve multiplication resistant
781     against side channel attacks" and Brier-Joye "Weierstrass Elliptic Curves
782     and Side-Channel Attacks" Eq. (8) for y-coordinate recovery, modified
783     to work in projective coordinates.
784     [Billy Bob Brumley, Nicola Tuveri]
785
786  *) Change generating and checking of primes so that the error rate of not
787     being prime depends on the intended use based on the size of the input.
788     For larger primes this will result in more rounds of Miller-Rabin.
789     The maximal error rate for primes with more than 1080 bits is lowered
790     to 2^-128.
791     [Kurt Roeckx, Annie Yousar]
792
793  *) Increase the number of Miller-Rabin rounds for DSA key generating to 64.
794     [Kurt Roeckx]
795
796  *) The 'tsget' script is renamed to 'tsget.pl', to avoid confusion when
797     moving between systems, and to avoid confusion when a Windows build is
798     done with mingw vs with MSVC.  For POSIX installs, there's still a
799     symlink or copy named 'tsget' to avoid that confusion as well.
800     [Richard Levitte]
801
802  *) Revert blinding in ECDSA sign and instead make problematic addition
803     length-invariant. Switch even to fixed-length Montgomery multiplication.
804     [Andy Polyakov]
805
806  *) Use the new ec_scalar_mul_ladder scaffold to implement a specialized ladder
807     step for binary curves. The new implementation is based on formulae from
808     differential addition-and-doubling in mixed Lopez-Dahab projective
809     coordinates, modified to independently blind the operands.
810     [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
811
812  *) Add a scaffold to optionally enhance the Montgomery ladder implementation
813     for `ec_scalar_mul_ladder` (formerly `ec_mul_consttime`) allowing
814     EC_METHODs to implement their own specialized "ladder step", to take
815     advantage of more favorable coordinate systems or more efficient
816     differential addition-and-doubling algorithms.
817     [Billy Bob Brumley, Sohaib ul Hassan, Nicola Tuveri]
818
819  *) Modified the random device based seed sources to keep the relevant
820     file descriptors open rather than reopening them on each access.
821     This allows such sources to operate in a chroot() jail without
822     the associated device nodes being available. This behaviour can be
823     controlled using RAND_keep_random_devices_open().
824     [Paul Dale]
825
826  *) Numerous side-channel attack mitigations have been applied. This may have
827     performance impacts for some algorithms for the benefit of improved
828     security. Specific changes are noted in this change log by their respective
829     authors.
830     [Matt Caswell]
831
832  *) AIX shared library support overhaul. Switch to AIX "natural" way of
833     handling shared libraries, which means collecting shared objects of
834     different versions and bitnesses in one common archive. This allows to
835     mitigate conflict between 1.0 and 1.1 side-by-side installations. It
836     doesn't affect the way 3rd party applications are linked, only how
837     multi-version installation is managed.
838     [Andy Polyakov]
839
840  *) Make ec_group_do_inverse_ord() more robust and available to other
841     EC cryptosystems, so that irrespective of BN_FLG_CONSTTIME, SCA
842     mitigations are applied to the fallback BN_mod_inverse().
843     When using this function rather than BN_mod_inverse() directly, new
844     EC cryptosystem implementations are then safer-by-default.
845     [Billy Bob Brumley]
846
847  *) Add coordinate blinding for EC_POINT and implement projective
848     coordinate blinding for generic prime curves as a countermeasure to
849     chosen point SCA attacks.
850     [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley]
851
852  *) Add blinding to ECDSA and DSA signatures to protect against side channel
853     attacks discovered by Keegan Ryan (NCC Group).
854     [Matt Caswell]
855
856  *) Enforce checking in the pkeyutl command line app to ensure that the input
857     length does not exceed the maximum supported digest length when performing
858     a sign, verify or verifyrecover operation.
859     [Matt Caswell]
860
861  *) SSL_MODE_AUTO_RETRY is enabled by default. Applications that use blocking
862     I/O in combination with something like select() or poll() will hang. This
863     can be turned off again using SSL_CTX_clear_mode().
864     Many applications do not properly handle non-application data records, and
865     TLS 1.3 sends more of such records. Setting SSL_MODE_AUTO_RETRY works
866     around the problems in those applications, but can also break some.
867     It's recommended to read the manpages about SSL_read(), SSL_write(),
868     SSL_get_error(), SSL_shutdown(), SSL_CTX_set_mode() and
869     SSL_CTX_set_read_ahead() again.
870     [Kurt Roeckx]
871
872  *) When unlocking a pass phrase protected PEM file or PKCS#8 container, we
873     now allow empty (zero character) pass phrases.
874     [Richard Levitte]
875
876  *) Apply blinding to binary field modular inversion and remove patent
877     pending (OPENSSL_SUN_GF2M_DIV) BN_GF2m_mod_div implementation.
878     [Billy Bob Brumley]
879
880  *) Deprecate ec2_mult.c and unify scalar multiplication code paths for
881     binary and prime elliptic curves.
882     [Billy Bob Brumley]
883
884  *) Remove ECDSA nonce padding: EC_POINT_mul is now responsible for
885     constant time fixed point multiplication.
886     [Billy Bob Brumley]
887
888  *) Revise elliptic curve scalar multiplication with timing attack
889     defenses: ec_wNAF_mul redirects to a constant time implementation
890     when computing fixed point and variable point multiplication (which
891     in OpenSSL are mostly used with secret scalars in keygen, sign,
892     ECDH derive operations).
893     [Billy Bob Brumley, Nicola Tuveri, Cesar Pereida García,
894      Sohaib ul Hassan]
895
896  *) Updated CONTRIBUTING
897     [Rich Salz]
898
899  *) Updated DRBG / RAND to request nonce and additional low entropy
900     randomness from the system.
901     [Matthias St. Pierre]
902
903  *) Updated 'openssl rehash' to use OpenSSL consistent default.
904     [Richard Levitte]
905
906  *) Moved the load of the ssl_conf module to libcrypto, which helps
907     loading engines that libssl uses before libssl is initialised.
908     [Matt Caswell]
909
910  *) Added EVP_PKEY_sign() and EVP_PKEY_verify() for EdDSA
911     [Matt Caswell]
912
913  *) Fixed X509_NAME_ENTRY_set to get multi-valued RDNs right in all cases.
914     [Ingo Schwarze, Rich Salz]
915
916  *) Added output of accepting IP address and port for 'openssl s_server'
917     [Richard Levitte]
918
919  *) Added a new API for TLSv1.3 ciphersuites:
920        SSL_CTX_set_ciphersuites()
921        SSL_set_ciphersuites()
922     [Matt Caswell]
923
924  *) Memory allocation failures consistently add an error to the error
925     stack.
926     [Rich Salz]
927
928  *) Don't use OPENSSL_ENGINES and OPENSSL_CONF environment values
929     in libcrypto when run as setuid/setgid.
930     [Bernd Edlinger]
931
932  *) Load any config file by default when libssl is used.
933     [Matt Caswell]
934
935  *) Added new public header file <openssl/rand_drbg.h> and documentation
936     for the RAND_DRBG API. See manual page RAND_DRBG(7) for an overview.
937     [Matthias St. Pierre]
938
939  *) QNX support removed (cannot find contributors to get their approval
940     for the license change).
941     [Rich Salz]
942
943  *) TLSv1.3 replay protection for early data has been implemented. See the
944     SSL_read_early_data() man page for further details.
945     [Matt Caswell]
946
947  *) Separated TLSv1.3 ciphersuite configuration out from TLSv1.2 ciphersuite
948     configuration. TLSv1.3 ciphersuites are not compatible with TLSv1.2 and
949     below. Similarly TLSv1.2 ciphersuites are not compatible with TLSv1.3.
950     In order to avoid issues where legacy TLSv1.2 ciphersuite configuration
951     would otherwise inadvertently disable all TLSv1.3 ciphersuites the
952     configuration has been separated out. See the ciphers man page or the
953     SSL_CTX_set_ciphersuites() man page for more information.
954     [Matt Caswell]
955
956  *) On POSIX (BSD, Linux, ...) systems the ocsp(1) command running
957     in responder mode now supports the new "-multi" option, which
958     spawns the specified number of child processes to handle OCSP
959     requests.  The "-timeout" option now also limits the OCSP
960     responder's patience to wait to receive the full client request
961     on a newly accepted connection. Child processes are respawned
962     as needed, and the CA index file is automatically reloaded
963     when changed.  This makes it possible to run the "ocsp" responder
964     as a long-running service, making the OpenSSL CA somewhat more
965     feature-complete.  In this mode, most diagnostic messages logged
966     after entering the event loop are logged via syslog(3) rather than
967     written to stderr.
968     [Viktor Dukhovni]
969
970  *) Added support for X448 and Ed448. Heavily based on original work by
971     Mike Hamburg.
972     [Matt Caswell]
973
974  *) Extend OSSL_STORE with capabilities to search and to narrow the set of
975     objects loaded.  This adds the functions OSSL_STORE_expect() and
976     OSSL_STORE_find() as well as needed tools to construct searches and
977     get the search data out of them.
978     [Richard Levitte]
979
980  *) Support for TLSv1.3 added. Note that users upgrading from an earlier
981     version of OpenSSL should review their configuration settings to ensure
982     that they are still appropriate for TLSv1.3. For further information see:
983     https://wiki.openssl.org/index.php/TLS1.3
984     [Matt Caswell]
985
986  *) Grand redesign of the OpenSSL random generator
987
988     The default RAND method now utilizes an AES-CTR DRBG according to
989     NIST standard SP 800-90Ar1. The new random generator is essentially
990     a port of the default random generator from the OpenSSL FIPS 2.0
991     object module. It is a hybrid deterministic random bit generator
992     using an AES-CTR bit stream and which seeds and reseeds itself
993     automatically using trusted system entropy sources.
994
995     Some of its new features are:
996      o Support for multiple DRBG instances with seed chaining.
997      o The default RAND method makes use of a DRBG.
998      o There is a public and private DRBG instance.
999      o The DRBG instances are fork-safe.
1000      o Keep all global DRBG instances on the secure heap if it is enabled.
1001      o The public and private DRBG instance are per thread for lock free
1002        operation
1003     [Paul Dale, Benjamin Kaduk, Kurt Roeckx, Rich Salz, Matthias St. Pierre]
1004
1005  *) Changed Configure so it only says what it does and doesn't dump
1006     so much data.  Instead, ./configdata.pm should be used as a script
1007     to display all sorts of configuration data.
1008     [Richard Levitte]
1009
1010  *) Added processing of "make variables" to Configure.
1011     [Richard Levitte]
1012
1013  *) Added SHA512/224 and SHA512/256 algorithm support.
1014     [Paul Dale]
1015
1016  *) The last traces of Netware support, first removed in 1.1.0, have
1017     now been removed.
1018     [Rich Salz]
1019
1020  *) Get rid of Makefile.shared, and in the process, make the processing
1021     of certain files (rc.obj, or the .def/.map/.opt files produced from
1022     the ordinal files) more visible and hopefully easier to trace and
1023     debug (or make silent).
1024     [Richard Levitte]
1025
1026  *) Make it possible to have environment variable assignments as
1027     arguments to config / Configure.
1028     [Richard Levitte]
1029
1030  *) Add multi-prime RSA (RFC 8017) support.
1031     [Paul Yang]
1032
1033  *) Add SM3 implemented according to GB/T 32905-2016
1034     [ Jack Lloyd <jack.lloyd@ribose.com>,
1035       Ronald Tse <ronald.tse@ribose.com>,
1036       Erick Borsboom <erick.borsboom@ribose.com> ]
1037
1038  *) Add 'Maximum Fragment Length' TLS extension negotiation and support
1039     as documented in RFC6066.
1040     Based on a patch from Tomasz Moń
1041     [Filipe Raimundo da Silva]
1042
1043  *) Add SM4 implemented according to GB/T 32907-2016.
1044     [ Jack Lloyd <jack.lloyd@ribose.com>,
1045       Ronald Tse <ronald.tse@ribose.com>,
1046       Erick Borsboom <erick.borsboom@ribose.com> ]
1047
1048  *) Reimplement -newreq-nodes and ERR_error_string_n; the
1049     original author does not agree with the license change.
1050     [Rich Salz]
1051
1052  *) Add ARIA AEAD TLS support.
1053     [Jon Spillett]
1054
1055  *) Some macro definitions to support VS6 have been removed.  Visual
1056     Studio 6 has not worked since 1.1.0
1057     [Rich Salz]
1058
1059  *) Add ERR_clear_last_mark(), to allow callers to clear the last mark
1060     without clearing the errors.
1061     [Richard Levitte]
1062
1063  *) Add "atfork" functions.  If building on a system that without
1064     pthreads, see doc/man3/OPENSSL_fork_prepare.pod for application
1065     requirements.  The RAND facility now uses/requires this.
1066     [Rich Salz]
1067
1068  *) Add SHA3.
1069     [Andy Polyakov]
1070
1071  *) The UI API becomes a permanent and integral part of libcrypto, i.e.
1072     not possible to disable entirely.  However, it's still possible to
1073     disable the console reading UI method, UI_OpenSSL() (use UI_null()
1074     as a fallback).
1075
1076     To disable, configure with 'no-ui-console'.  'no-ui' is still
1077     possible to use as an alias.  Check at compile time with the
1078     macro OPENSSL_NO_UI_CONSOLE.  The macro OPENSSL_NO_UI is still
1079     possible to check and is an alias for OPENSSL_NO_UI_CONSOLE.
1080     [Richard Levitte]
1081
1082  *) Add a STORE module, which implements a uniform and URI based reader of
1083     stores that can contain keys, certificates, CRLs and numerous other
1084     objects.  The main API is loosely based on a few stdio functions,
1085     and includes OSSL_STORE_open, OSSL_STORE_load, OSSL_STORE_eof,
1086     OSSL_STORE_error and OSSL_STORE_close.
1087     The implementation uses backends called "loaders" to implement arbitrary
1088     URI schemes.  There is one built in "loader" for the 'file' scheme.
1089     [Richard Levitte]
1090
1091  *) Add devcrypto engine.  This has been implemented against cryptodev-linux,
1092     then adjusted to work on FreeBSD 8.4 as well.
1093     Enable by configuring with 'enable-devcryptoeng'.  This is done by default
1094     on BSD implementations, as cryptodev.h is assumed to exist on all of them.
1095     [Richard Levitte]
1096
1097  *) Module names can prefixed with OSSL_ or OPENSSL_.  This affects
1098     util/mkerr.pl, which is adapted to allow those prefixes, leading to
1099     error code calls like this:
1100
1101         OSSL_FOOerr(OSSL_FOO_F_SOMETHING, OSSL_FOO_R_WHATEVER);
1102
1103     With this change, we claim the namespaces OSSL and OPENSSL in a manner
1104     that can be encoded in C.  For the foreseeable future, this will only
1105     affect new modules.
1106     [Richard Levitte and Tim Hudson]
1107
1108  *) Removed BSD cryptodev engine.
1109     [Rich Salz]
1110
1111  *) Add a build target 'build_all_generated', to build all generated files
1112     and only that.  This can be used to prepare everything that requires
1113     things like perl for a system that lacks perl and then move everything
1114     to that system and do the rest of the build there.
1115     [Richard Levitte]
1116
1117  *) In the UI interface, make it possible to duplicate the user data.  This
1118     can be used by engines that need to retain the data for a longer time
1119     than just the call where this user data is passed.
1120     [Richard Levitte]
1121
1122  *) Ignore the '-named_curve auto' value for compatibility of applications
1123     with OpenSSL 1.0.2.
1124     [Tomas Mraz <tmraz@fedoraproject.org>]
1125
1126  *) Fragmented SSL/TLS alerts are no longer accepted. An alert message is 2
1127     bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such
1128     alerts across multiple records (some of which could be empty). In practice
1129     it make no sense to send an empty alert record, or to fragment one. TLSv1.3
1130     prohibits this altogether and other libraries (BoringSSL, NSS) do not
1131     support this at all. Supporting it adds significant complexity to the
1132     record layer, and its removal is unlikely to cause interoperability
1133     issues.
1134     [Matt Caswell]
1135
1136  *) Add the ASN.1 types INT32, UINT32, INT64, UINT64 and variants prefixed
1137     with Z.  These are meant to replace LONG and ZLONG and to be size safe.
1138     The use of LONG and ZLONG is discouraged and scheduled for deprecation
1139     in OpenSSL 1.2.0.
1140     [Richard Levitte]
1141
1142  *) Add the 'z' and 'j' modifiers to BIO_printf() et al formatting string,
1143     'z' is to be used for [s]size_t, and 'j' - with [u]int64_t.
1144     [Richard Levitte, Andy Polyakov]
1145
1146  *) Add EC_KEY_get0_engine(), which does for EC_KEY what RSA_get0_engine()
1147     does for RSA, etc.
1148     [Richard Levitte]
1149
1150  *) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target
1151     platform rather than 'mingw'.
1152     [Richard Levitte]
1153
1154  *) The functions X509_STORE_add_cert and X509_STORE_add_crl return
1155     success if they are asked to add an object which already exists
1156     in the store. This change cascades to other functions which load
1157     certificates and CRLs.
1158     [Paul Dale]
1159
1160  *) x86_64 assembly pack: annotate code with DWARF CFI directives to
1161     facilitate stack unwinding even from assembly subroutines.
1162     [Andy Polyakov]
1163
1164  *) Remove VAX C specific definitions of OPENSSL_EXPORT, OPENSSL_EXTERN.
1165     Also remove OPENSSL_GLOBAL entirely, as it became a no-op.
1166     [Richard Levitte]
1167
1168  *) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c.
1169     VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1,
1170     which is the minimum version we support.
1171     [Richard Levitte]
1172
1173  *) Certificate time validation (X509_cmp_time) enforces stricter
1174     compliance with RFC 5280. Fractional seconds and timezone offsets
1175     are no longer allowed.
1176     [Emilia Käsper]
1177
1178  *) Add support for ARIA
1179     [Paul Dale]
1180
1181  *) s_client will now send the Server Name Indication (SNI) extension by
1182     default unless the new "-noservername" option is used. The server name is
1183     based on the host provided to the "-connect" option unless overridden by
1184     using "-servername".
1185     [Matt Caswell]
1186
1187  *) Add support for SipHash
1188     [Todd Short]
1189
1190  *) OpenSSL now fails if it receives an unrecognised record type in TLS1.0
1191     or TLS1.1. Previously this only happened in SSLv3 and TLS1.2. This is to
1192     prevent issues where no progress is being made and the peer continually
1193     sends unrecognised record types, using up resources processing them.
1194     [Matt Caswell]
1195
1196  *) 'openssl passwd' can now produce SHA256 and SHA512 based output,
1197     using the algorithm defined in
1198     https://www.akkadia.org/drepper/SHA-crypt.txt
1199     [Richard Levitte]
1200
1201  *) Heartbeat support has been removed; the ABI is changed for now.
1202     [Richard Levitte, Rich Salz]
1203
1204  *) Support for SSL_OP_NO_ENCRYPT_THEN_MAC in SSL_CONF_cmd.
1205     [Emilia Käsper]
1206
1207  *) The RSA "null" method, which was partially supported to avoid patent
1208     issues, has been replaced to always returns NULL.
1209     [Rich Salz]
1210
1211
1212 Changes between 1.1.0h and 1.1.0i [xx XXX xxxx]
1213
1214  *) Client DoS due to large DH parameter
1215
1216     During key agreement in a TLS handshake using a DH(E) based ciphersuite a
1217     malicious server can send a very large prime value to the client. This will
1218     cause the client to spend an unreasonably long period of time generating a
1219     key for this prime resulting in a hang until the client has finished. This
1220     could be exploited in a Denial Of Service attack.
1221
1222     This issue was reported to OpenSSL on 5th June 2018 by Guido Vranken
1223     (CVE-2018-0732)
1224     [Guido Vranken]
1225
1226  *) Cache timing vulnerability in RSA Key Generation
1227
1228     The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to
1229     a cache timing side channel attack. An attacker with sufficient access to
1230     mount cache timing attacks during the RSA key generation process could
1231     recover the private key.
1232
1233     This issue was reported to OpenSSL on 4th April 2018 by Alejandro Cabrera
1234     Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia.
1235     (CVE-2018-0737)
1236     [Billy Brumley]
1237
1238  *) Make EVP_PKEY_asn1_new() a bit stricter about its input.  A NULL pem_str
1239     parameter is no longer accepted, as it leads to a corrupt table.  NULL
1240     pem_str is reserved for alias entries only.
1241     [Richard Levitte]
1242
1243  *) Revert blinding in ECDSA sign and instead make problematic addition
1244     length-invariant. Switch even to fixed-length Montgomery multiplication.
1245     [Andy Polyakov]
1246
1247  *) Change generating and checking of primes so that the error rate of not
1248     being prime depends on the intended use based on the size of the input.
1249     For larger primes this will result in more rounds of Miller-Rabin.
1250     The maximal error rate for primes with more than 1080 bits is lowered
1251     to 2^-128.
1252     [Kurt Roeckx, Annie Yousar]
1253
1254  *) Increase the number of Miller-Rabin rounds for DSA key generating to 64.
1255     [Kurt Roeckx]
1256
1257  *) Add blinding to ECDSA and DSA signatures to protect against side channel
1258     attacks discovered by Keegan Ryan (NCC Group).
1259     [Matt Caswell]
1260
1261  *) When unlocking a pass phrase protected PEM file or PKCS#8 container, we
1262     now allow empty (zero character) pass phrases.
1263     [Richard Levitte]
1264
1265  *) Certificate time validation (X509_cmp_time) enforces stricter
1266     compliance with RFC 5280. Fractional seconds and timezone offsets
1267     are no longer allowed.
1268     [Emilia Käsper]
1269
1270  *) Fixed a text canonicalisation bug in CMS
1271
1272     Where a CMS detached signature is used with text content the text goes
1273     through a canonicalisation process first prior to signing or verifying a
1274     signature. This process strips trailing space at the end of lines, converts
1275     line terminators to CRLF and removes additional trailing line terminators
1276     at the end of a file. A bug in the canonicalisation process meant that
1277     some characters, such as form-feed, were incorrectly treated as whitespace
1278     and removed. This is contrary to the specification (RFC5485). This fix
1279     could mean that detached text data signed with an earlier version of
1280     OpenSSL 1.1.0 may fail to verify using the fixed version, or text data
1281     signed with a fixed OpenSSL may fail to verify with an earlier version of
1282     OpenSSL 1.1.0. A workaround is to only verify the canonicalised text data
1283     and use the "-binary" flag (for the "cms" command line application) or set
1284     the SMIME_BINARY/PKCS7_BINARY/CMS_BINARY flags (if using CMS_verify()).
1285     [Matt Caswell]
1286
1287 Changes between 1.1.0g and 1.1.0h [27 Mar 2018]
1288
1289  *) Constructed ASN.1 types with a recursive definition could exceed the stack
1290
1291     Constructed ASN.1 types with a recursive definition (such as can be found
1292     in PKCS7) could eventually exceed the stack given malicious input with
1293     excessive recursion. This could result in a Denial Of Service attack. There
1294     are no such structures used within SSL/TLS that come from untrusted sources
1295     so this is considered safe.
1296
1297     This issue was reported to OpenSSL on 4th January 2018 by the OSS-fuzz
1298     project.
1299     (CVE-2018-0739)
1300     [Matt Caswell]
1301
1302  *) Incorrect CRYPTO_memcmp on HP-UX PA-RISC
1303
1304     Because of an implementation bug the PA-RISC CRYPTO_memcmp function is
1305     effectively reduced to only comparing the least significant bit of each
1306     byte. This allows an attacker to forge messages that would be considered as
1307     authenticated in an amount of tries lower than that guaranteed by the
1308     security claims of the scheme. The module can only be compiled by the
1309     HP-UX assembler, so that only HP-UX PA-RISC targets are affected.
1310
1311     This issue was reported to OpenSSL on 2nd March 2018 by Peter Waltenberg
1312     (IBM).
1313     (CVE-2018-0733)
1314     [Andy Polyakov]
1315
1316  *) Add a build target 'build_all_generated', to build all generated files
1317     and only that.  This can be used to prepare everything that requires
1318     things like perl for a system that lacks perl and then move everything
1319     to that system and do the rest of the build there.
1320     [Richard Levitte]
1321
1322  *) Backport SSL_OP_NO_RENGOTIATION
1323
1324     OpenSSL 1.0.2 and below had the ability to disable renegotiation using the
1325     (undocumented) SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS flag. Due to the opacity
1326     changes this is no longer possible in 1.1.0. Therefore the new
1327     SSL_OP_NO_RENEGOTIATION option from 1.1.1-dev has been backported to
1328     1.1.0 to provide equivalent functionality.
1329
1330     Note that if an application built against 1.1.0h headers (or above) is run
1331     using an older version of 1.1.0 (prior to 1.1.0h) then the option will be
1332     accepted but nothing will happen, i.e. renegotiation will not be prevented.
1333     [Matt Caswell]
1334
1335  *) Removed the OS390-Unix config target.  It relied on a script that doesn't
1336     exist.
1337     [Rich Salz]
1338
1339  *) rsaz_1024_mul_avx2 overflow bug on x86_64
1340
1341     There is an overflow bug in the AVX2 Montgomery multiplication procedure
1342     used in exponentiation with 1024-bit moduli. No EC algorithms are affected.
1343     Analysis suggests that attacks against RSA and DSA as a result of this
1344     defect would be very difficult to perform and are not believed likely.
1345     Attacks against DH1024 are considered just feasible, because most of the
1346     work necessary to deduce information about a private key may be performed
1347     offline. The amount of resources required for such an attack would be
1348     significant. However, for an attack on TLS to be meaningful, the server
1349     would have to share the DH1024 private key among multiple clients, which is
1350     no longer an option since CVE-2016-0701.
1351
1352     This only affects processors that support the AVX2 but not ADX extensions
1353     like Intel Haswell (4th generation).
1354
1355     This issue was reported to OpenSSL by David Benjamin (Google). The issue
1356     was originally found via the OSS-Fuzz project.
1357     (CVE-2017-3738)
1358     [Andy Polyakov]
1359
1360 Changes between 1.1.0f and 1.1.0g [2 Nov 2017]
1361
1362  *) bn_sqrx8x_internal carry bug on x86_64
1363
1364     There is a carry propagating bug in the x86_64 Montgomery squaring
1365     procedure. No EC algorithms are affected. Analysis suggests that attacks
1366     against RSA and DSA as a result of this defect would be very difficult to
1367     perform and are not believed likely. Attacks against DH are considered just
1368     feasible (although very difficult) because most of the work necessary to
1369     deduce information about a private key may be performed offline. The amount
1370     of resources required for such an attack would be very significant and
1371     likely only accessible to a limited number of attackers. An attacker would
1372     additionally need online access to an unpatched system using the target
1373     private key in a scenario with persistent DH parameters and a private
1374     key that is shared between multiple clients.
1375
1376     This only affects processors that support the BMI1, BMI2 and ADX extensions
1377     like Intel Broadwell (5th generation) and later or AMD Ryzen.
1378
1379     This issue was reported to OpenSSL by the OSS-Fuzz project.
1380     (CVE-2017-3736)
1381     [Andy Polyakov]
1382
1383  *) Malformed X.509 IPAddressFamily could cause OOB read
1384
1385     If an X.509 certificate has a malformed IPAddressFamily extension,
1386     OpenSSL could do a one-byte buffer overread. The most likely result
1387     would be an erroneous display of the certificate in text format.
1388
1389     This issue was reported to OpenSSL by the OSS-Fuzz project.
1390     (CVE-2017-3735)
1391     [Rich Salz]
1392
1393 Changes between 1.1.0e and 1.1.0f [25 May 2017]
1394
1395  *) Have 'config' recognise 64-bit mingw and choose 'mingw64' as the target
1396     platform rather than 'mingw'.
1397     [Richard Levitte]
1398
1399  *) Remove the VMS-specific reimplementation of gmtime from crypto/o_times.c.
1400     VMS C's RTL has a fully up to date gmtime() and gmtime_r() since V7.1,
1401     which is the minimum version we support.
1402     [Richard Levitte]
1403
1404 Changes between 1.1.0d and 1.1.0e [16 Feb 2017]
1405
1406  *) Encrypt-Then-Mac renegotiation crash
1407
1408     During a renegotiation handshake if the Encrypt-Then-Mac extension is
1409     negotiated where it was not in the original handshake (or vice-versa) then
1410     this can cause OpenSSL to crash (dependant on ciphersuite). Both clients
1411     and servers are affected.
1412
1413     This issue was reported to OpenSSL by Joe Orton (Red Hat).
1414     (CVE-2017-3733)
1415     [Matt Caswell]
1416
1417 Changes between 1.1.0c and 1.1.0d [26 Jan 2017]
1418
1419  *) Truncated packet could crash via OOB read
1420
1421     If one side of an SSL/TLS path is running on a 32-bit host and a specific
1422     cipher is being used, then a truncated packet can cause that host to
1423     perform an out-of-bounds read, usually resulting in a crash.
1424
1425     This issue was reported to OpenSSL by Robert Święcki of Google.
1426     (CVE-2017-3731)
1427     [Andy Polyakov]
1428
1429  *) Bad (EC)DHE parameters cause a client crash
1430
1431     If a malicious server supplies bad parameters for a DHE or ECDHE key
1432     exchange then this can result in the client attempting to dereference a
1433     NULL pointer leading to a client crash. This could be exploited in a Denial
1434     of Service attack.
1435
1436     This issue was reported to OpenSSL by Guido Vranken.
1437     (CVE-2017-3730)
1438     [Matt Caswell]
1439
1440  *) BN_mod_exp may produce incorrect results on x86_64
1441
1442     There is a carry propagating bug in the x86_64 Montgomery squaring
1443     procedure. No EC algorithms are affected. Analysis suggests that attacks
1444     against RSA and DSA as a result of this defect would be very difficult to
1445     perform and are not believed likely. Attacks against DH are considered just
1446     feasible (although very difficult) because most of the work necessary to
1447     deduce information about a private key may be performed offline. The amount
1448     of resources required for such an attack would be very significant and
1449     likely only accessible to a limited number of attackers. An attacker would
1450     additionally need online access to an unpatched system using the target
1451     private key in a scenario with persistent DH parameters and a private
1452     key that is shared between multiple clients. For example this can occur by
1453     default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very
1454     similar to CVE-2015-3193 but must be treated as a separate problem.
1455
1456     This issue was reported to OpenSSL by the OSS-Fuzz project.
1457     (CVE-2017-3732)
1458     [Andy Polyakov]
1459
1460 Changes between 1.1.0b and 1.1.0c [10 Nov 2016]
1461
1462  *) ChaCha20/Poly1305 heap-buffer-overflow
1463
1464     TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to
1465     a DoS attack by corrupting larger payloads. This can result in an OpenSSL
1466     crash. This issue is not considered to be exploitable beyond a DoS.
1467
1468     This issue was reported to OpenSSL by Robert Święcki (Google Security Team)
1469     (CVE-2016-7054)
1470     [Richard Levitte]
1471
1472  *) CMS Null dereference
1473
1474     Applications parsing invalid CMS structures can crash with a NULL pointer
1475     dereference. This is caused by a bug in the handling of the ASN.1 CHOICE
1476     type in OpenSSL 1.1.0 which can result in a NULL value being passed to the
1477     structure callback if an attempt is made to free certain invalid encodings.
1478     Only CHOICE structures using a callback which do not handle NULL value are
1479     affected.
1480
1481     This issue was reported to OpenSSL by Tyler Nighswander of ForAllSecure.
1482     (CVE-2016-7053)
1483     [Stephen Henson]
1484
1485  *) Montgomery multiplication may produce incorrect results
1486
1487     There is a carry propagating bug in the Broadwell-specific Montgomery
1488     multiplication procedure that handles input lengths divisible by, but
1489     longer than 256 bits. Analysis suggests that attacks against RSA, DSA
1490     and DH private keys are impossible. This is because the subroutine in
1491     question is not used in operations with the private key itself and an input
1492     of the attacker's direct choice. Otherwise the bug can manifest itself as
1493     transient authentication and key negotiation failures or reproducible
1494     erroneous outcome of public-key operations with specially crafted input.
1495     Among EC algorithms only Brainpool P-512 curves are affected and one
1496     presumably can attack ECDH key negotiation. Impact was not analyzed in
1497     detail, because pre-requisites for attack are considered unlikely. Namely
1498     multiple clients have to choose the curve in question and the server has to
1499     share the private key among them, neither of which is default behaviour.
1500     Even then only clients that chose the curve will be affected.
1501
1502     This issue was publicly reported as transient failures and was not
1503     initially recognized as a security issue. Thanks to Richard Morgan for
1504     providing reproducible case.
1505     (CVE-2016-7055)
1506     [Andy Polyakov]
1507
1508  *) Removed automatic addition of RPATH in shared libraries and executables,
1509     as this was a remainder from OpenSSL 1.0.x and isn't needed any more.
1510     [Richard Levitte]
1511
1512 Changes between 1.1.0a and 1.1.0b [26 Sep 2016]
1513
1514  *) Fix Use After Free for large message sizes
1515
1516     The patch applied to address CVE-2016-6307 resulted in an issue where if a
1517     message larger than approx 16k is received then the underlying buffer to
1518     store the incoming message is reallocated and moved. Unfortunately a
1519     dangling pointer to the old location is left which results in an attempt to
1520     write to the previously freed location. This is likely to result in a
1521     crash, however it could potentially lead to execution of arbitrary code.
1522
1523     This issue only affects OpenSSL 1.1.0a.
1524
1525     This issue was reported to OpenSSL by Robert Święcki.
1526     (CVE-2016-6309)
1527     [Matt Caswell]
1528
1529 Changes between 1.1.0 and 1.1.0a [22 Sep 2016]
1530
1531  *) OCSP Status Request extension unbounded memory growth
1532
1533     A malicious client can send an excessively large OCSP Status Request
1534     extension. If that client continually requests renegotiation, sending a
1535     large OCSP Status Request extension each time, then there will be unbounded
1536     memory growth on the server. This will eventually lead to a Denial Of
1537     Service attack through memory exhaustion. Servers with a default
1538     configuration are vulnerable even if they do not support OCSP. Builds using
1539     the "no-ocsp" build time option are not affected.
1540
1541     This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
1542     (CVE-2016-6304)
1543     [Matt Caswell]
1544
1545  *) SSL_peek() hang on empty record
1546
1547     OpenSSL 1.1.0 SSL/TLS will hang during a call to SSL_peek() if the peer
1548     sends an empty record. This could be exploited by a malicious peer in a
1549     Denial Of Service attack.
1550
1551     This issue was reported to OpenSSL by Alex Gaynor.
1552     (CVE-2016-6305)
1553     [Matt Caswell]
1554
1555  *) Excessive allocation of memory in tls_get_message_header() and
1556     dtls1_preprocess_fragment()
1557
1558     A (D)TLS message includes 3 bytes for its length in the header for the
1559     message. This would allow for messages up to 16Mb in length. Messages of
1560     this length are excessive and OpenSSL includes a check to ensure that a
1561     peer is sending reasonably sized messages in order to avoid too much memory
1562     being consumed to service a connection. A flaw in the logic of version
1563     1.1.0 means that memory for the message is allocated too early, prior to
1564     the excessive message length check. Due to way memory is allocated in
1565     OpenSSL this could mean an attacker could force up to 21Mb to be allocated
1566     to service a connection. This could lead to a Denial of Service through
1567     memory exhaustion. However, the excessive message length check still takes
1568     place, and this would cause the connection to immediately fail. Assuming
1569     that the application calls SSL_free() on the failed connection in a timely
1570     manner then the 21Mb of allocated memory will then be immediately freed
1571     again. Therefore the excessive memory allocation will be transitory in
1572     nature. This then means that there is only a security impact if:
1573
1574     1) The application does not call SSL_free() in a timely manner in the event
1575     that the connection fails
1576     or
1577     2) The application is working in a constrained environment where there is
1578     very little free memory
1579     or
1580     3) The attacker initiates multiple connection attempts such that there are
1581     multiple connections in a state where memory has been allocated for the
1582     connection; SSL_free() has not yet been called; and there is insufficient
1583     memory to service the multiple requests.
1584
1585     Except in the instance of (1) above any Denial Of Service is likely to be
1586     transitory because as soon as the connection fails the memory is
1587     subsequently freed again in the SSL_free() call. However there is an
1588     increased risk during this period of application crashes due to the lack of
1589     memory - which would then mean a more serious Denial of Service.
1590
1591     This issue was reported to OpenSSL by Shi Lei (Gear Team, Qihoo 360 Inc.)
1592     (CVE-2016-6307 and CVE-2016-6308)
1593     [Matt Caswell]
1594
1595  *) solaris-x86-cc, i.e. 32-bit configuration with vendor compiler,
1596     had to be removed. Primary reason is that vendor assembler can't
1597     assemble our modules with -KPIC flag. As result it, assembly
1598     support, was not even available as option. But its lack means
1599     lack of side-channel resistant code, which is incompatible with
1600     security by todays standards. Fortunately gcc is readily available
1601     prepackaged option, which we firmly point at...
1602     [Andy Polyakov]
1603
1604 Changes between 1.0.2h and 1.1.0  [25 Aug 2016]
1605
1606  *) Windows command-line tool supports UTF-8 opt-in option for arguments
1607     and console input. Setting OPENSSL_WIN32_UTF8 environment variable
1608     (to any value) allows Windows user to access PKCS#12 file generated
1609     with Windows CryptoAPI and protected with non-ASCII password, as well
1610     as files generated under UTF-8 locale on Linux also protected with
1611     non-ASCII password.
1612     [Andy Polyakov]
1613
1614  *) To mitigate the SWEET32 attack (CVE-2016-2183), 3DES cipher suites
1615     have been disabled by default and removed from DEFAULT, just like RC4.
1616     See the RC4 item below to re-enable both.
1617     [Rich Salz]
1618
1619  *) The method for finding the storage location for the Windows RAND seed file
1620     has changed. First we check %RANDFILE%. If that is not set then we check
1621     the directories %HOME%, %USERPROFILE% and %SYSTEMROOT% in that order. If
1622     all else fails we fall back to C:\.
1623     [Matt Caswell]
1624
1625  *) The EVP_EncryptUpdate() function has had its return type changed from void
1626     to int. A return of 0 indicates and error while a return of 1 indicates
1627     success.
1628     [Matt Caswell]
1629
1630  *) The flags RSA_FLAG_NO_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME and
1631     DH_FLAG_NO_EXP_CONSTTIME which previously provided the ability to switch
1632     off the constant time implementation for RSA, DSA and DH have been made
1633     no-ops and deprecated.
1634     [Matt Caswell]
1635
1636  *) Windows RAND implementation was simplified to only get entropy by
1637     calling CryptGenRandom(). Various other RAND-related tickets
1638     were also closed.
1639     [Joseph Wylie Yandle, Rich Salz]
1640
1641  *) The stack and lhash API's were renamed to start with OPENSSL_SK_
1642     and OPENSSL_LH_, respectively.  The old names are available
1643     with API compatibility.  They new names are now completely documented.
1644     [Rich Salz]
1645
1646  *) Unify TYPE_up_ref(obj) methods signature.
1647     SSL_CTX_up_ref(), SSL_up_ref(), X509_up_ref(), EVP_PKEY_up_ref(),
1648     X509_CRL_up_ref(), X509_OBJECT_up_ref_count() methods are now returning an
1649     int (instead of void) like all others TYPE_up_ref() methods.
1650     So now these methods also check the return value of CRYPTO_atomic_add(),
1651     and the validity of object reference counter.
1652     [fdasilvayy@gmail.com]
1653
1654  *) With Windows Visual Studio builds, the .pdb files are installed
1655     alongside the installed libraries and executables.  For a static
1656     library installation, ossl_static.pdb is the associate compiler
1657     generated .pdb file to be used when linking programs.
1658     [Richard Levitte]
1659
1660  *) Remove openssl.spec.  Packaging files belong with the packagers.
1661     [Richard Levitte]
1662
1663  *) Automatic Darwin/OSX configuration has had a refresh, it will now
1664     recognise x86_64 architectures automatically.  You can still decide
1665     to build for a different bitness with the environment variable
1666     KERNEL_BITS (can be 32 or 64), for example:
1667
1668         KERNEL_BITS=32 ./config
1669
1670     [Richard Levitte]
1671
1672  *) Change default algorithms in pkcs8 utility to use PKCS#5 v2.0,
1673     256 bit AES and HMAC with SHA256.
1674     [Steve Henson]
1675
1676  *) Remove support for MIPS o32 ABI on IRIX (and IRIX only).
1677     [Andy Polyakov]
1678
1679  *) Triple-DES ciphers have been moved from HIGH to MEDIUM.
1680     [Rich Salz]
1681
1682  *) To enable users to have their own config files and build file templates,
1683     Configure looks in the directory indicated by the environment variable
1684     OPENSSL_LOCAL_CONFIG_DIR as well as the in-source Configurations/
1685     directory.  On VMS, OPENSSL_LOCAL_CONFIG_DIR is expected to be a logical
1686     name and is used as is.
1687     [Richard Levitte]
1688
1689  *) The following datatypes were made opaque: X509_OBJECT, X509_STORE_CTX,
1690     X509_STORE, X509_LOOKUP, and X509_LOOKUP_METHOD.  The unused type
1691     X509_CERT_FILE_CTX was removed.
1692     [Rich Salz]
1693
1694  *) "shared" builds are now the default. To create only static libraries use
1695     the "no-shared" Configure option.
1696     [Matt Caswell]
1697
1698  *) Remove the no-aes, no-hmac, no-rsa, no-sha and no-md5 Configure options.
1699     All of these option have not worked for some while and are fundamental
1700     algorithms.
1701     [Matt Caswell]
1702
1703  *) Make various cleanup routines no-ops and mark them as deprecated. Most
1704     global cleanup functions are no longer required because they are handled
1705     via auto-deinit (see OPENSSL_init_crypto and OPENSSL_init_ssl man pages).
1706     Explicitly de-initing can cause problems (e.g. where a library that uses
1707     OpenSSL de-inits, but an application is still using it). The affected
1708     functions are CONF_modules_free(), ENGINE_cleanup(), OBJ_cleanup(),
1709     EVP_cleanup(), BIO_sock_cleanup(), CRYPTO_cleanup_all_ex_data(),
1710     RAND_cleanup(), SSL_COMP_free_compression_methods(), ERR_free_strings() and
1711     COMP_zlib_cleanup().
1712     [Matt Caswell]
1713
1714  *) --strict-warnings no longer enables runtime debugging options
1715     such as REF_DEBUG. Instead, debug options are automatically
1716     enabled with '--debug' builds.
1717     [Andy Polyakov, Emilia Käsper]
1718
1719  *) Made DH and DH_METHOD opaque. The structures for managing DH objects
1720     have been moved out of the public header files. New functions for managing
1721     these have been added.
1722     [Matt Caswell]
1723
1724  *) Made RSA and RSA_METHOD opaque. The structures for managing RSA
1725     objects have been moved out of the public header files. New
1726     functions for managing these have been added.
1727     [Richard Levitte]
1728
1729  *) Made DSA and DSA_METHOD opaque. The structures for managing DSA objects
1730     have been moved out of the public header files. New functions for managing
1731     these have been added.
1732     [Matt Caswell]
1733
1734  *) Made BIO and BIO_METHOD opaque. The structures for managing BIOs have been
1735     moved out of the public header files. New functions for managing these
1736     have been added.
1737     [Matt Caswell]
1738
1739  *) Removed no-rijndael as a config option. Rijndael is an old name for AES.
1740     [Matt Caswell]
1741
1742  *) Removed the mk1mf build scripts.
1743     [Richard Levitte]
1744
1745  *) Headers are now wrapped, if necessary, with OPENSSL_NO_xxx, so
1746     it is always safe to #include a header now.
1747     [Rich Salz]
1748
1749  *) Removed the aged BC-32 config and all its supporting scripts
1750     [Richard Levitte]
1751
1752  *) Removed support for Ultrix, Netware, and OS/2.
1753     [Rich Salz]
1754
1755  *) Add support for HKDF.
1756     [Alessandro Ghedini]
1757
1758  *) Add support for blake2b and blake2s
1759     [Bill Cox]
1760
1761  *) Added support for "pipelining". Ciphers that have the
1762     EVP_CIPH_FLAG_PIPELINE flag set have a capability to process multiple
1763     encryptions/decryptions simultaneously. There are currently no built-in
1764     ciphers with this property but the expectation is that engines will be able
1765     to offer it to significantly improve throughput. Support has been extended
1766     into libssl so that multiple records for a single connection can be
1767     processed in one go (for >=TLS 1.1).
1768     [Matt Caswell]
1769
1770  *) Added the AFALG engine. This is an async capable engine which is able to
1771     offload work to the Linux kernel. In this initial version it only supports
1772     AES128-CBC. The kernel must be version 4.1.0 or greater.
1773     [Catriona Lucey]
1774
1775  *) OpenSSL now uses a new threading API. It is no longer necessary to
1776     set locking callbacks to use OpenSSL in a multi-threaded environment. There
1777     are two supported threading models: pthreads and windows threads. It is
1778     also possible to configure OpenSSL at compile time for "no-threads". The
1779     old threading API should no longer be used. The functions have been
1780     replaced with "no-op" compatibility macros.
1781     [Alessandro Ghedini, Matt Caswell]
1782
1783  *) Modify behavior of ALPN to invoke callback after SNI/servername
1784     callback, such that updates to the SSL_CTX affect ALPN.
1785     [Todd Short]
1786
1787  *) Add SSL_CIPHER queries for authentication and key-exchange.
1788     [Todd Short]
1789
1790  *) Changes to the DEFAULT cipherlist:
1791       - Prefer (EC)DHE handshakes over plain RSA.
1792       - Prefer AEAD ciphers over legacy ciphers.
1793       - Prefer ECDSA over RSA when both certificates are available.
1794       - Prefer TLSv1.2 ciphers/PRF.
1795       - Remove DSS, SEED, IDEA, CAMELLIA, and AES-CCM from the
1796         default cipherlist.
1797     [Emilia Käsper]
1798
1799  *) Change the ECC default curve list to be this, in order: x25519,
1800     secp256r1, secp521r1, secp384r1.
1801     [Rich Salz]
1802
1803  *) RC4 based libssl ciphersuites are now classed as "weak" ciphers and are
1804     disabled by default. They can be re-enabled using the
1805     enable-weak-ssl-ciphers option to Configure.
1806     [Matt Caswell]
1807
1808  *) If the server has ALPN configured, but supports no protocols that the
1809     client advertises, send a fatal "no_application_protocol" alert.
1810     This behaviour is SHALL in RFC 7301, though it isn't universally
1811     implemented by other servers.
1812     [Emilia Käsper]
1813
1814  *) Add X25519 support.
1815     Add ASN.1 and EVP_PKEY methods for X25519. This includes support
1816     for public and private key encoding using the format documented in
1817     draft-ietf-curdle-pkix-02. The corresponding EVP_PKEY method supports
1818     key generation and key derivation.
1819
1820     TLS support complies with draft-ietf-tls-rfc4492bis-08 and uses
1821     X25519(29).
1822     [Steve Henson]
1823
1824  *) Deprecate SRP_VBASE_get_by_user.
1825     SRP_VBASE_get_by_user had inconsistent memory management behaviour.
1826     In order to fix an unavoidable memory leak (CVE-2016-0798),
1827     SRP_VBASE_get_by_user was changed to ignore the "fake user" SRP
1828     seed, even if the seed is configured.
1829
1830     Users should use SRP_VBASE_get1_by_user instead. Note that in
1831     SRP_VBASE_get1_by_user, caller must free the returned value. Note
1832     also that even though configuring the SRP seed attempts to hide
1833     invalid usernames by continuing the handshake with fake
1834     credentials, this behaviour is not constant time and no strong
1835     guarantees are made that the handshake is indistinguishable from
1836     that of a valid user.
1837     [Emilia Käsper]
1838
1839  *) Configuration change; it's now possible to build dynamic engines
1840     without having to build shared libraries and vice versa.  This
1841     only applies to the engines in engines/, those in crypto/engine/
1842     will always be built into libcrypto (i.e. "static").
1843
1844     Building dynamic engines is enabled by default; to disable, use
1845     the configuration option "disable-dynamic-engine".
1846
1847     The only requirements for building dynamic engines are the
1848     presence of the DSO module and building with position independent
1849     code, so they will also automatically be disabled if configuring
1850     with "disable-dso" or "disable-pic".
1851
1852     The macros OPENSSL_NO_STATIC_ENGINE and OPENSSL_NO_DYNAMIC_ENGINE
1853     are also taken away from openssl/opensslconf.h, as they are
1854     irrelevant.
1855     [Richard Levitte]
1856
1857  *) Configuration change; if there is a known flag to compile
1858     position independent code, it will always be applied on the
1859     libcrypto and libssl object files, and never on the application
1860     object files.  This means other libraries that use routines from
1861     libcrypto / libssl can be made into shared libraries regardless
1862     of how OpenSSL was configured.
1863
1864     If this isn't desirable, the configuration options "disable-pic"
1865     or "no-pic" can be used to disable the use of PIC.  This will
1866     also disable building shared libraries and dynamic engines.
1867     [Richard Levitte]
1868
1869  *) Removed JPAKE code.  It was experimental and has no wide use.
1870     [Rich Salz]
1871
1872  *) The INSTALL_PREFIX Makefile variable has been renamed to
1873     DESTDIR.  That makes for less confusion on what this variable
1874     is for.  Also, the configuration option --install_prefix is
1875     removed.
1876     [Richard Levitte]
1877
1878  *) Heartbeat for TLS has been removed and is disabled by default
1879     for DTLS; configure with enable-heartbeats.  Code that uses the
1880     old #define's might need to be updated.
1881     [Emilia Käsper, Rich Salz]
1882
1883  *) Rename REF_CHECK to REF_DEBUG.
1884     [Rich Salz]
1885
1886  *) New "unified" build system
1887
1888     The "unified" build system is aimed to be a common system for all
1889     platforms we support.  With it comes new support for VMS.
1890
1891     This system builds supports building in a different directory tree
1892     than the source tree.  It produces one Makefile (for unix family
1893     or lookalikes), or one descrip.mms (for VMS).
1894
1895     The source of information to make the Makefile / descrip.mms is
1896     small files called 'build.info', holding the necessary
1897     information for each directory with source to compile, and a
1898     template in Configurations, like unix-Makefile.tmpl or
1899     descrip.mms.tmpl.
1900
1901     With this change, the library names were also renamed on Windows
1902     and on VMS.  They now have names that are closer to the standard
1903     on Unix, and include the major version number, and in certain
1904     cases, the architecture they are built for.  See "Notes on shared
1905     libraries" in INSTALL.
1906
1907     We rely heavily on the perl module Text::Template.
1908     [Richard Levitte]
1909
1910  *) Added support for auto-initialisation and de-initialisation of the library.
1911     OpenSSL no longer requires explicit init or deinit routines to be called,
1912     except in certain circumstances. See the OPENSSL_init_crypto() and
1913     OPENSSL_init_ssl() man pages for further information.
1914     [Matt Caswell]
1915
1916  *) The arguments to the DTLSv1_listen function have changed. Specifically the
1917     "peer" argument is now expected to be a BIO_ADDR object.
1918
1919  *) Rewrite of BIO networking library. The BIO library lacked consistent
1920     support of IPv6, and adding it required some more extensive
1921     modifications.  This introduces the BIO_ADDR and BIO_ADDRINFO types,
1922     which hold all types of addresses and chains of address information.
1923     It also introduces a new API, with functions like BIO_socket,
1924     BIO_connect, BIO_listen, BIO_lookup and a rewrite of BIO_accept.
1925     The source/sink BIOs BIO_s_connect, BIO_s_accept and BIO_s_datagram
1926     have been adapted accordingly.
1927     [Richard Levitte]
1928
1929  *) RSA_padding_check_PKCS1_type_1 now accepts inputs with and without
1930     the leading 0-byte.
1931     [Emilia Käsper]
1932
1933  *) CRIME protection: disable compression by default, even if OpenSSL is
1934     compiled with zlib enabled. Applications can still enable compression
1935     by calling SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION), or by
1936     using the SSL_CONF library to configure compression.
1937     [Emilia Käsper]
1938
1939  *) The signature of the session callback configured with
1940     SSL_CTX_sess_set_get_cb was changed. The read-only input buffer
1941     was explicitly marked as 'const unsigned char*' instead of
1942     'unsigned char*'.
1943     [Emilia Käsper]
1944
1945  *) Always DPURIFY. Remove the use of uninitialized memory in the
1946     RNG, and other conditional uses of DPURIFY. This makes -DPURIFY a no-op.
1947     [Emilia Käsper]
1948
1949  *) Removed many obsolete configuration items, including
1950        DES_PTR, DES_RISC1, DES_RISC2, DES_INT
1951        MD2_CHAR, MD2_INT, MD2_LONG
1952        BF_PTR, BF_PTR2
1953        IDEA_SHORT, IDEA_LONG
1954        RC2_SHORT, RC2_LONG, RC4_LONG, RC4_CHUNK, RC4_INDEX
1955     [Rich Salz, with advice from Andy Polyakov]
1956
1957  *) Many BN internals have been moved to an internal header file.
1958     [Rich Salz with help from Andy Polyakov]
1959
1960  *) Configuration and writing out the results from it has changed.
1961     Files such as Makefile include/openssl/opensslconf.h and are now
1962     produced through general templates, such as Makefile.in and
1963     crypto/opensslconf.h.in and some help from the perl module
1964     Text::Template.
1965
1966     Also, the center of configuration information is no longer
1967     Makefile.  Instead, Configure produces a perl module in
1968     configdata.pm which holds most of the config data (in the hash
1969     table %config), the target data that comes from the target
1970     configuration in one of the Configurations/*.conf files (in
1971     %target).
1972     [Richard Levitte]
1973
1974  *) To clarify their intended purposes, the Configure options
1975     --prefix and --openssldir change their semantics, and become more
1976     straightforward and less interdependent.
1977
1978     --prefix shall be used exclusively to give the location INSTALLTOP
1979     where programs, scripts, libraries, include files and manuals are
1980     going to be installed.  The default is now /usr/local.
1981
1982     --openssldir shall be used exclusively to give the default
1983     location OPENSSLDIR where certificates, private keys, CRLs are
1984     managed.  This is also where the default openssl.cnf gets
1985     installed.
1986     If the directory given with this option is a relative path, the
1987     values of both the --prefix value and the --openssldir value will
1988     be combined to become OPENSSLDIR.
1989     The default for --openssldir is INSTALLTOP/ssl.
1990
1991     Anyone who uses --openssldir to specify where OpenSSL is to be
1992     installed MUST change to use --prefix instead.
1993     [Richard Levitte]
1994
1995  *) The GOST engine was out of date and therefore it has been removed. An up
1996     to date GOST engine is now being maintained in an external repository.
1997     See: https://wiki.openssl.org/index.php/Binaries. Libssl still retains
1998     support for GOST ciphersuites (these are only activated if a GOST engine
1999     is present).
2000     [Matt Caswell]
2001
2002  *) EGD is no longer supported by default; use enable-egd when
2003     configuring.
2004     [Ben Kaduk and Rich Salz]
2005
2006  *) The distribution now has Makefile.in files, which are used to
2007     create Makefile's when Configure is run.  *Configure must be run
2008     before trying to build now.*
2009     [Rich Salz]
2010
2011  *) The return value for SSL_CIPHER_description() for error conditions
2012     has changed.
2013     [Rich Salz]
2014
2015  *) Support for RFC6698/RFC7671 DANE TLSA peer authentication.
2016
2017     Obtaining and performing DNSSEC validation of TLSA records is
2018     the application's responsibility.  The application provides
2019     the TLSA records of its choice to OpenSSL, and these are then
2020     used to authenticate the peer.
2021
2022     The TLSA records need not even come from DNS.  They can, for
2023     example, be used to implement local end-entity certificate or
2024     trust-anchor "pinning", where the "pin" data takes the form
2025     of TLSA records, which can augment or replace verification
2026     based on the usual WebPKI public certification authorities.
2027     [Viktor Dukhovni]
2028
2029  *) Revert default OPENSSL_NO_DEPRECATED setting.  Instead OpenSSL
2030     continues to support deprecated interfaces in default builds.
2031     However, applications are strongly advised to compile their
2032     source files with -DOPENSSL_API_COMPAT=0x10100000L, which hides
2033     the declarations of all interfaces deprecated in 0.9.8, 1.0.0
2034     or the 1.1.0 releases.
2035
2036     In environments in which all applications have been ported to
2037     not use any deprecated interfaces OpenSSL's Configure script
2038     should be used with the --api=1.1.0 option to entirely remove
2039     support for the deprecated features from the library and
2040     unconditionally disable them in the installed headers.
2041     Essentially the same effect can be achieved with the "no-deprecated"
2042     argument to Configure, except that this will always restrict
2043     the build to just the latest API, rather than a fixed API
2044     version.
2045
2046     As applications are ported to future revisions of the API,
2047     they should update their compile-time OPENSSL_API_COMPAT define
2048     accordingly, but in most cases should be able to continue to
2049     compile with later releases.
2050
2051     The OPENSSL_API_COMPAT versions for 1.0.0, and 0.9.8 are
2052     0x10000000L and 0x00908000L, respectively.  However those
2053     versions did not support the OPENSSL_API_COMPAT feature, and
2054     so applications are not typically tested for explicit support
2055     of just the undeprecated features of either release.
2056     [Viktor Dukhovni]
2057
2058  *) Add support for setting the minimum and maximum supported protocol.
2059     It can bet set via the SSL_set_min_proto_version() and
2060     SSL_set_max_proto_version(), or via the SSL_CONF's MinProtocol and
2061     MaxProtocol.  It's recommended to use the new APIs to disable
2062     protocols instead of disabling individual protocols using
2063     SSL_set_options() or SSL_CONF's Protocol.  This change also
2064     removes support for disabling TLS 1.2 in the OpenSSL TLS
2065     client at compile time by defining OPENSSL_NO_TLS1_2_CLIENT.
2066     [Kurt Roeckx]
2067
2068  *) Support for ChaCha20 and Poly1305 added to libcrypto and libssl.
2069     [Andy Polyakov]
2070
2071  *) New EC_KEY_METHOD, this replaces the older ECDSA_METHOD and ECDH_METHOD
2072     and integrates ECDSA and ECDH functionality into EC. Implementations can
2073     now redirect key generation and no longer need to convert to or from
2074     ECDSA_SIG format.
2075
2076     Note: the ecdsa.h and ecdh.h headers are now no longer needed and just
2077     include the ec.h header file instead.
2078     [Steve Henson]
2079
2080  *) Remove support for all 40 and 56 bit ciphers.  This includes all the export
2081     ciphers who are no longer supported and drops support the ephemeral RSA key
2082     exchange. The LOW ciphers currently doesn't have any ciphers in it.
2083     [Kurt Roeckx]
2084
2085  *) Made EVP_MD_CTX, EVP_MD, EVP_CIPHER_CTX, EVP_CIPHER and HMAC_CTX
2086     opaque.  For HMAC_CTX, the following constructors and destructors
2087     were added:
2088
2089        HMAC_CTX *HMAC_CTX_new(void);
2090        void HMAC_CTX_free(HMAC_CTX *ctx);
2091
2092     For EVP_MD and EVP_CIPHER, complete APIs to create, fill and
2093     destroy such methods has been added.  See EVP_MD_meth_new(3) and
2094     EVP_CIPHER_meth_new(3) for documentation.
2095
2096     Additional changes:
2097     1) EVP_MD_CTX_cleanup(), EVP_CIPHER_CTX_cleanup() and
2098        HMAC_CTX_cleanup() were removed.  HMAC_CTX_reset() and
2099        EVP_MD_CTX_reset() should be called instead to reinitialise
2100        an already created structure.
2101     2) For consistency with the majority of our object creators and
2102        destructors, EVP_MD_CTX_(create|destroy) were renamed to
2103        EVP_MD_CTX_(new|free).  The old names are retained as macros
2104        for deprecated builds.
2105     [Richard Levitte]
2106
2107  *) Added ASYNC support. Libcrypto now includes the async sub-library to enable
2108     cryptographic operations to be performed asynchronously as long as an
2109     asynchronous capable engine is used. See the ASYNC_start_job() man page for
2110     further details. Libssl has also had this capability integrated with the
2111     introduction of the new mode SSL_MODE_ASYNC and associated error
2112     SSL_ERROR_WANT_ASYNC. See the SSL_CTX_set_mode() and SSL_get_error() man
2113     pages. This work was developed in partnership with Intel Corp.
2114     [Matt Caswell]
2115
2116  *) SSL_{CTX_}set_ecdh_auto() has been removed and ECDH is support is
2117     always enabled now.  If you want to disable the support you should
2118     exclude it using the list of supported ciphers. This also means that the
2119     "-no_ecdhe" option has been removed from s_server.
2120     [Kurt Roeckx]
2121
2122  *) SSL_{CTX}_set_tmp_ecdh() which can set 1 EC curve now internally calls
2123     SSL_{CTX_}set1_curves() which can set a list.
2124     [Kurt Roeckx]
2125
2126  *) Remove support for SSL_{CTX_}set_tmp_ecdh_callback().  You should set the
2127     curve you want to support using SSL_{CTX_}set1_curves().
2128     [Kurt Roeckx]
2129
2130  *) State machine rewrite. The state machine code has been significantly
2131     refactored in order to remove much duplication of code and solve issues
2132     with the old code (see ssl/statem/README for further details). This change
2133     does have some associated API changes. Notably the SSL_state() function
2134     has been removed and replaced by SSL_get_state which now returns an
2135     "OSSL_HANDSHAKE_STATE" instead of an int. SSL_set_state() has been removed
2136     altogether. The previous handshake states defined in ssl.h and ssl3.h have
2137     also been removed.
2138     [Matt Caswell]
2139
2140  *) All instances of the string "ssleay" in the public API were replaced
2141     with OpenSSL (case-matching; e.g., OPENSSL_VERSION for #define's)
2142     Some error codes related to internal RSA_eay API's were renamed.
2143     [Rich Salz]
2144
2145  *) The demo files in crypto/threads were moved to demo/threads.
2146     [Rich Salz]
2147
2148  *) Removed obsolete engines: 4758cca, aep, atalla, cswift, nuron, gmp,
2149     sureware and ubsec.
2150     [Matt Caswell, Rich Salz]
2151
2152  *) New ASN.1 embed macro.
2153
2154     New ASN.1 macro ASN1_EMBED. This is the same as ASN1_SIMPLE except the
2155     structure is not allocated: it is part of the parent. That is instead of
2156
2157     FOO *x;
2158
2159     it must be:
2160
2161     FOO x;
2162
2163     This reduces memory fragmentation and make it impossible to accidentally
2164     set a mandatory field to NULL.
2165
2166     This currently only works for some fields specifically a SEQUENCE, CHOICE,
2167     or ASN1_STRING type which is part of a parent SEQUENCE. Since it is
2168     equivalent to ASN1_SIMPLE it cannot be tagged, OPTIONAL, SET OF or
2169     SEQUENCE OF.
2170     [Steve Henson]
2171
2172  *) Remove EVP_CHECK_DES_KEY, a compile-time option that never compiled.
2173     [Emilia Käsper]
2174
2175  *) Removed DES and RC4 ciphersuites from DEFAULT. Also removed RC2 although
2176     in 1.0.2 EXPORT was already removed and the only RC2 ciphersuite is also
2177     an EXPORT one. COMPLEMENTOFDEFAULT has been updated accordingly to add
2178     DES and RC4 ciphersuites.
2179     [Matt Caswell]
2180
2181  *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs.
2182     This changes the decoding behaviour for some invalid messages,
2183     though the change is mostly in the more lenient direction, and
2184     legacy behaviour is preserved as much as possible.
2185     [Emilia Käsper]
2186
2187  *) Fix no-stdio build.
2188    [ David Woodhouse <David.Woodhouse@intel.com> and also
2189      Ivan Nestlerode <ivan.nestlerode@sonos.com> ]
2190
2191  *) New testing framework
2192     The testing framework has been largely rewritten and is now using
2193     perl and the perl modules Test::Harness and an extended variant of
2194     Test::More called OpenSSL::Test to do its work.  All test scripts in
2195     test/ have been rewritten into test recipes, and all direct calls to
2196     executables in test/Makefile have become individual recipes using the
2197     simplified testing OpenSSL::Test::Simple.
2198
2199     For documentation on our testing modules, do:
2200
2201        perldoc test/testlib/OpenSSL/Test/Simple.pm
2202        perldoc test/testlib/OpenSSL/Test.pm
2203
2204     [Richard Levitte]
2205
2206  *) Revamped memory debug; only -DCRYPTO_MDEBUG and -DCRYPTO_MDEBUG_ABORT
2207     are used; the latter aborts on memory leaks (usually checked on exit).
2208     Some undocumented "set malloc, etc., hooks" functions were removed
2209     and others were changed.  All are now documented.
2210     [Rich Salz]
2211
2212  *) In DSA_generate_parameters_ex, if the provided seed is too short,
2213     return an error
2214     [Rich Salz and Ismo Puustinen <ismo.puustinen@intel.com>]
2215
2216  *) Rewrite PSK to support ECDHE_PSK, DHE_PSK and RSA_PSK. Add ciphersuites
2217     from RFC4279, RFC4785, RFC5487, RFC5489.
2218
2219     Thanks to Christian J. Dietrich and Giuseppe D'Angelo for the
2220     original RSA_PSK patch.
2221     [Steve Henson]
2222
2223  *) Dropped support for the SSL3_FLAGS_DELAY_CLIENT_FINISHED flag. This SSLeay
2224     era flag was never set throughout the codebase (only read). Also removed
2225     SSL3_FLAGS_POP_BUFFER which was only used if
2226     SSL3_FLAGS_DELAY_CLIENT_FINISHED was also set.
2227     [Matt Caswell]
2228
2229  *) Changed the default name options in the "ca", "crl", "req" and "x509"
2230     to be "oneline" instead of "compat".
2231     [Richard Levitte]
2232
2233  *) Remove SSL_OP_TLS_BLOCK_PADDING_BUG. This is SSLeay legacy, we're
2234     not aware of clients that still exhibit this bug, and the workaround
2235     hasn't been working properly for a while.
2236     [Emilia Käsper]
2237
2238  *) The return type of BIO_number_read() and BIO_number_written() as well as
2239     the corresponding num_read and num_write members in the BIO structure has
2240     changed from unsigned long to uint64_t. On platforms where an unsigned
2241     long is 32 bits (e.g. Windows) these counters could overflow if >4Gb is
2242     transferred.
2243     [Matt Caswell]
2244
2245  *) Given the pervasive nature of TLS extensions it is inadvisable to run
2246     OpenSSL without support for them. It also means that maintaining
2247     the OPENSSL_NO_TLSEXT option within the code is very invasive (and probably
2248     not well tested). Therefore the OPENSSL_NO_TLSEXT option has been removed.
2249     [Matt Caswell]
2250
2251  *) Removed support for the two export grade static DH ciphersuites
2252     EXP-DH-RSA-DES-CBC-SHA and EXP-DH-DSS-DES-CBC-SHA. These two ciphersuites
2253     were newly added (along with a number of other static DH ciphersuites) to
2254     1.0.2. However the two export ones have *never* worked since they were
2255     introduced. It seems strange in any case to be adding new export
2256     ciphersuites, and given "logjam" it also does not seem correct to fix them.
2257     [Matt Caswell]
2258
2259  *) Version negotiation has been rewritten. In particular SSLv23_method(),
2260     SSLv23_client_method() and SSLv23_server_method() have been deprecated,
2261     and turned into macros which simply call the new preferred function names
2262     TLS_method(), TLS_client_method() and TLS_server_method(). All new code
2263     should use the new names instead. Also as part of this change the ssl23.h
2264     header file has been removed.
2265     [Matt Caswell]
2266
2267  *) Support for Kerberos ciphersuites in TLS (RFC2712) has been removed. This
2268     code and the associated standard is no longer considered fit-for-purpose.
2269     [Matt Caswell]
2270
2271  *) RT2547 was closed.  When generating a private key, try to make the
2272     output file readable only by the owner.  This behavior change might
2273     be noticeable when interacting with other software.
2274
2275  *) Documented all exdata functions.  Added CRYPTO_free_ex_index.
2276     Added a test.
2277     [Rich Salz]
2278
2279  *) Added HTTP GET support to the ocsp command.
2280     [Rich Salz]
2281
2282  *) Changed default digest for the dgst and enc commands from MD5 to
2283     sha256
2284     [Rich Salz]
2285
2286  *) RAND_pseudo_bytes has been deprecated. Users should use RAND_bytes instead.
2287     [Matt Caswell]
2288
2289  *) Added support for TLS extended master secret from
2290     draft-ietf-tls-session-hash-03.txt. Thanks for Alfredo Pironti for an
2291     initial patch which was a great help during development.
2292     [Steve Henson]
2293
2294  *) All libssl internal structures have been removed from the public header
2295     files, and the OPENSSL_NO_SSL_INTERN option has been removed (since it is
2296     now redundant). Users should not attempt to access internal structures
2297     directly. Instead they should use the provided API functions.
2298     [Matt Caswell]
2299
2300  *) config has been changed so that by default OPENSSL_NO_DEPRECATED is used.
2301     Access to deprecated functions can be re-enabled by running config with
2302     "enable-deprecated". In addition applications wishing to use deprecated
2303     functions must define OPENSSL_USE_DEPRECATED. Note that this new behaviour
2304     will, by default, disable some transitive includes that previously existed
2305     in the header files (e.g. ec.h will no longer, by default, include bn.h)
2306     [Matt Caswell]
2307
2308  *) Added support for OCB mode. OpenSSL has been granted a patent license
2309     compatible with the OpenSSL license for use of OCB. Details are available
2310     at https://www.openssl.org/source/OCB-patent-grant-OpenSSL.pdf. Support
2311     for OCB can be removed by calling config with no-ocb.
2312     [Matt Caswell]
2313
2314  *) SSLv2 support has been removed.  It still supports receiving a SSLv2
2315     compatible client hello.
2316     [Kurt Roeckx]
2317
2318  *) Increased the minimal RSA keysize from 256 to 512 bits [Rich Salz],
2319     done while fixing the error code for the key-too-small case.
2320     [Annie Yousar <a.yousar@informatik.hu-berlin.de>]
2321
2322  *) CA.sh has been removed; use CA.pl instead.
2323     [Rich Salz]
2324
2325  *) Removed old DES API.
2326     [Rich Salz]
2327
2328  *) Remove various unsupported platforms:
2329        Sony NEWS4
2330        BEOS and BEOS_R5
2331        NeXT
2332        SUNOS
2333        MPE/iX
2334        Sinix/ReliantUNIX RM400
2335        DGUX
2336        NCR
2337        Tandem
2338        Cray
2339        16-bit platforms such as WIN16
2340     [Rich Salz]
2341
2342  *) Clean up OPENSSL_NO_xxx #define's
2343        Use setbuf() and remove OPENSSL_NO_SETVBUF_IONBF
2344        Rename OPENSSL_SYSNAME_xxx to OPENSSL_SYS_xxx
2345        OPENSSL_NO_EC{DH,DSA} merged into OPENSSL_NO_EC
2346        OPENSSL_NO_RIPEMD160, OPENSSL_NO_RIPEMD merged into OPENSSL_NO_RMD160
2347        OPENSSL_NO_FP_API merged into OPENSSL_NO_STDIO
2348        Remove OPENSSL_NO_BIO OPENSSL_NO_BUFFER OPENSSL_NO_CHAIN_VERIFY
2349        OPENSSL_NO_EVP OPENSSL_NO_FIPS_ERR OPENSSL_NO_HASH_COMP
2350        OPENSSL_NO_LHASH OPENSSL_NO_OBJECT OPENSSL_NO_SPEED OPENSSL_NO_STACK
2351        OPENSSL_NO_X509 OPENSSL_NO_X509_VERIFY
2352        Remove MS_STATIC; it's a relic from platforms <32 bits.
2353     [Rich Salz]
2354
2355  *) Cleaned up dead code
2356        Remove all but one '#ifdef undef' which is to be looked at.
2357     [Rich Salz]
2358
2359  *) Clean up calling of xxx_free routines.
2360        Just like free(), fix most of the xxx_free routines to accept
2361        NULL.  Remove the non-null checks from callers.  Save much code.
2362     [Rich Salz]
2363
2364  *) Add secure heap for storage of private keys (when possible).
2365     Add BIO_s_secmem(), CBIGNUM, etc.
2366     Contributed by Akamai Technologies under our Corporate CLA.
2367     [Rich Salz]
2368
2369  *) Experimental support for a new, fast, unbiased prime candidate generator,
2370     bn_probable_prime_dh_coprime(). Not currently used by any prime generator.
2371     [Felix Laurie von Massenbach <felix@erbridge.co.uk>]
2372
2373  *) New output format NSS in the sess_id command line tool. This allows
2374     exporting the session id and the master key in NSS keylog format.
2375     [Martin Kaiser <martin@kaiser.cx>]
2376
2377  *) Harmonize version and its documentation. -f flag is used to display
2378     compilation flags.
2379     [mancha <mancha1@zoho.com>]
2380
2381  *) Fix eckey_priv_encode so it immediately returns an error upon a failure
2382     in i2d_ECPrivateKey.  Thanks to Ted Unangst for feedback on this issue.
2383     [mancha <mancha1@zoho.com>]
2384
2385  *) Fix some double frees. These are not thought to be exploitable.
2386     [mancha <mancha1@zoho.com>]
2387
2388  *) A missing bounds check in the handling of the TLS heartbeat extension
2389     can be used to reveal up to 64k of memory to a connected client or
2390     server.
2391
2392     Thanks for Neel Mehta of Google Security for discovering this bug and to
2393     Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
2394     preparing the fix (CVE-2014-0160)
2395     [Adam Langley, Bodo Moeller]
2396
2397  *) Fix for the attack described in the paper "Recovering OpenSSL
2398     ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
2399     by Yuval Yarom and Naomi Benger. Details can be obtained from:
2400     http://eprint.iacr.org/2014/140
2401
2402     Thanks to Yuval Yarom and Naomi Benger for discovering this
2403     flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
2404     [Yuval Yarom and Naomi Benger]
2405
2406  *) Use algorithm specific chains in SSL_CTX_use_certificate_chain_file():
2407     this fixes a limitation in previous versions of OpenSSL.
2408     [Steve Henson]
2409
2410  *) Experimental encrypt-then-mac support.
2411
2412     Experimental support for encrypt then mac from
2413     draft-gutmann-tls-encrypt-then-mac-02.txt
2414
2415     To enable it set the appropriate extension number (0x42 for the test
2416     server) using e.g. -DTLSEXT_TYPE_encrypt_then_mac=0x42
2417
2418     For non-compliant peers (i.e. just about everything) this should have no
2419     effect.
2420
2421     WARNING: EXPERIMENTAL, SUBJECT TO CHANGE.
2422
2423     [Steve Henson]
2424
2425  *) Add EVP support for key wrapping algorithms, to avoid problems with
2426     existing code the flag EVP_CIPHER_CTX_WRAP_ALLOW has to be set in
2427     the EVP_CIPHER_CTX or an error is returned. Add AES and DES3 wrap
2428     algorithms and include tests cases.
2429     [Steve Henson]
2430
2431  *) Extend CMS code to support RSA-PSS signatures and RSA-OAEP for
2432     enveloped data.
2433     [Steve Henson]
2434
2435  *) Extended RSA OAEP support via EVP_PKEY API. Options to specify digest,
2436     MGF1 digest and OAEP label.
2437     [Steve Henson]
2438
2439  *) Make openssl verify return errors.
2440     [Chris Palmer <palmer@google.com> and Ben Laurie]
2441
2442  *) New function ASN1_TIME_diff to calculate the difference between two
2443     ASN1_TIME structures or one structure and the current time.
2444     [Steve Henson]
2445
2446  *) Update fips_test_suite to support multiple command line options. New
2447     test to induce all self test errors in sequence and check expected
2448     failures.
2449     [Steve Henson]
2450
2451  *) Add FIPS_{rsa,dsa,ecdsa}_{sign,verify} functions which digest and
2452     sign or verify all in one operation.
2453     [Steve Henson]
2454
2455  *) Add fips_algvs: a multicall fips utility incorporating all the algorithm
2456     test programs and fips_test_suite. Includes functionality to parse
2457     the minimal script output of fipsalgest.pl directly.
2458     [Steve Henson]
2459
2460  *) Add authorisation parameter to FIPS_module_mode_set().
2461     [Steve Henson]
2462
2463  *) Add FIPS selftest for ECDH algorithm using P-224 and B-233 curves.
2464     [Steve Henson]
2465
2466  *) Use separate DRBG fields for internal and external flags. New function
2467     FIPS_drbg_health_check() to perform on demand health checking. Add
2468     generation tests to fips_test_suite with reduced health check interval to
2469     demonstrate periodic health checking. Add "nodh" option to
2470     fips_test_suite to skip very slow DH test.
2471     [Steve Henson]
2472
2473  *) New function FIPS_get_cipherbynid() to lookup FIPS supported ciphers
2474     based on NID.
2475     [Steve Henson]
2476
2477  *) More extensive health check for DRBG checking many more failure modes.
2478     New function FIPS_selftest_drbg_all() to handle every possible DRBG
2479     combination: call this in fips_test_suite.
2480     [Steve Henson]
2481
2482  *) Add support for canonical generation of DSA parameter 'g'. See
2483     FIPS 186-3 A.2.3.
2484
2485  *) Add support for HMAC DRBG from SP800-90. Update DRBG algorithm test and
2486     POST to handle HMAC cases.
2487     [Steve Henson]
2488
2489  *) Add functions FIPS_module_version() and FIPS_module_version_text()
2490     to return numerical and string versions of the FIPS module number.
2491     [Steve Henson]
2492
2493  *) Rename FIPS_mode_set and FIPS_mode to FIPS_module_mode_set and
2494     FIPS_module_mode. FIPS_mode and FIPS_mode_set will be implemented
2495     outside the validated module in the FIPS capable OpenSSL.
2496     [Steve Henson]
2497
2498  *) Minor change to DRBG entropy callback semantics. In some cases
2499     there is no multiple of the block length between min_len and
2500     max_len. Allow the callback to return more than max_len bytes
2501     of entropy but discard any extra: it is the callback's responsibility
2502     to ensure that the extra data discarded does not impact the
2503     requested amount of entropy.
2504     [Steve Henson]
2505
2506  *) Add PRNG security strength checks to RSA, DSA and ECDSA using
2507     information in FIPS186-3, SP800-57 and SP800-131A.
2508     [Steve Henson]
2509
2510  *) CCM support via EVP. Interface is very similar to GCM case except we
2511     must supply all data in one chunk (i.e. no update, final) and the
2512     message length must be supplied if AAD is used. Add algorithm test
2513     support.
2514     [Steve Henson]
2515
2516  *) Initial version of POST overhaul. Add POST callback to allow the status
2517     of POST to be monitored and/or failures induced. Modify fips_test_suite
2518     to use callback. Always run all selftests even if one fails.
2519     [Steve Henson]
2520
2521  *) XTS support including algorithm test driver in the fips_gcmtest program.
2522     Note: this does increase the maximum key length from 32 to 64 bytes but
2523     there should be no binary compatibility issues as existing applications
2524     will never use XTS mode.
2525     [Steve Henson]
2526
2527  *) Extensive reorganisation of FIPS PRNG behaviour. Remove all dependencies
2528     to OpenSSL RAND code and replace with a tiny FIPS RAND API which also
2529     performs algorithm blocking for unapproved PRNG types. Also do not
2530     set PRNG type in FIPS_mode_set(): leave this to the application.
2531     Add default OpenSSL DRBG handling: sets up FIPS PRNG and seeds with
2532     the standard OpenSSL PRNG: set additional data to a date time vector.
2533     [Steve Henson]
2534
2535  *) Rename old X9.31 PRNG functions of the form FIPS_rand* to FIPS_x931*.
2536     This shouldn't present any incompatibility problems because applications
2537     shouldn't be using these directly and any that are will need to rethink
2538     anyway as the X9.31 PRNG is now deprecated by FIPS 140-2
2539     [Steve Henson]
2540
2541  *) Extensive self tests and health checking required by SP800-90 DRBG.
2542     Remove strength parameter from FIPS_drbg_instantiate and always
2543     instantiate at maximum supported strength.
2544     [Steve Henson]
2545
2546  *) Add ECDH code to fips module and fips_ecdhvs for primitives only testing.
2547     [Steve Henson]
2548
2549  *) New algorithm test program fips_dhvs to handle DH primitives only testing.
2550     [Steve Henson]
2551
2552  *) New function DH_compute_key_padded() to compute a DH key and pad with
2553     leading zeroes if needed: this complies with SP800-56A et al.
2554     [Steve Henson]
2555
2556  *) Initial implementation of SP800-90 DRBGs for Hash and CTR. Not used by
2557     anything, incomplete, subject to change and largely untested at present.
2558     [Steve Henson]
2559
2560  *) Modify fipscanisteronly build option to only build the necessary object
2561     files by filtering FIPS_EX_OBJ through a perl script in crypto/Makefile.
2562     [Steve Henson]
2563
2564  *) Add experimental option FIPSSYMS to give all symbols in
2565     fipscanister.o and FIPS or fips prefix. This will avoid
2566     conflicts with future versions of OpenSSL. Add perl script
2567     util/fipsas.pl to preprocess assembly language source files
2568     and rename any affected symbols.
2569     [Steve Henson]
2570
2571  *) Add selftest checks and algorithm block of non-fips algorithms in
2572     FIPS mode. Remove DES2 from selftests.
2573     [Steve Henson]
2574
2575  *) Add ECDSA code to fips module. Add tiny fips_ecdsa_check to just
2576     return internal method without any ENGINE dependencies. Add new
2577     tiny fips sign and verify functions.
2578     [Steve Henson]
2579
2580  *) New build option no-ec2m to disable characteristic 2 code.
2581     [Steve Henson]
2582
2583  *) New build option "fipscanisteronly". This only builds fipscanister.o
2584     and (currently) associated fips utilities. Uses the file Makefile.fips
2585     instead of Makefile.org as the prototype.
2586     [Steve Henson]
2587
2588  *) Add some FIPS mode restrictions to GCM. Add internal IV generator.
2589     Update fips_gcmtest to use IV generator.
2590     [Steve Henson]
2591
2592  *) Initial, experimental EVP support for AES-GCM. AAD can be input by
2593     setting output buffer to NULL. The *Final function must be
2594     called although it will not retrieve any additional data. The tag
2595     can be set or retrieved with a ctrl. The IV length is by default 12
2596     bytes (96 bits) but can be set to an alternative value. If the IV
2597     length exceeds the maximum IV length (currently 16 bytes) it cannot be
2598     set before the key.
2599     [Steve Henson]
2600
2601  *) New flag in ciphers: EVP_CIPH_FLAG_CUSTOM_CIPHER. This means the
2602     underlying do_cipher function handles all cipher semantics itself
2603     including padding and finalisation. This is useful if (for example)
2604     an ENGINE cipher handles block padding itself. The behaviour of
2605     do_cipher is subtly changed if this flag is set: the return value
2606     is the number of characters written to the output buffer (zero is
2607     no longer an error code) or a negative error code. Also if the
2608     input buffer is NULL and length 0 finalisation should be performed.
2609     [Steve Henson]
2610
2611  *) If a candidate issuer certificate is already part of the constructed
2612     path ignore it: new debug notification X509_V_ERR_PATH_LOOP for this case.
2613     [Steve Henson]
2614
2615  *) Improve forward-security support: add functions
2616
2617       void SSL_CTX_set_not_resumable_session_callback(SSL_CTX *ctx, int (*cb)(SSL *ssl, int is_forward_secure))
2618       void SSL_set_not_resumable_session_callback(SSL *ssl, int (*cb)(SSL *ssl, int is_forward_secure))
2619
2620     for use by SSL/TLS servers; the callback function will be called whenever a
2621     new session is created, and gets to decide whether the session may be
2622     cached to make it resumable (return 0) or not (return 1).  (As by the
2623     SSL/TLS protocol specifications, the session_id sent by the server will be
2624     empty to indicate that the session is not resumable; also, the server will
2625     not generate RFC 4507 (RFC 5077) session tickets.)
2626
2627     A simple reasonable callback implementation is to return is_forward_secure.
2628     This parameter will be set to 1 or 0 depending on the ciphersuite selected
2629     by the SSL/TLS server library, indicating whether it can provide forward
2630     security.
2631     [Emilia Käsper <emilia.kasper@esat.kuleuven.be> (Google)]
2632
2633  *) New -verify_name option in command line utilities to set verification
2634     parameters by name.
2635     [Steve Henson]
2636
2637  *) Initial CMAC implementation. WARNING: EXPERIMENTAL, API MAY CHANGE.
2638     Add CMAC pkey methods.
2639     [Steve Henson]
2640
2641  *) Experimental renegotiation in s_server -www mode. If the client
2642     browses /reneg connection is renegotiated. If /renegcert it is
2643     renegotiated requesting a certificate.
2644     [Steve Henson]
2645
2646  *) Add an "external" session cache for debugging purposes to s_server. This
2647     should help trace issues which normally are only apparent in deployed
2648     multi-process servers.
2649     [Steve Henson]
2650
2651  *) Extensive audit of libcrypto with DEBUG_UNUSED. Fix many cases where
2652     return value is ignored. NB. The functions RAND_add(), RAND_seed(),
2653     BIO_set_cipher() and some obscure PEM functions were changed so they
2654     can now return an error. The RAND changes required a change to the
2655     RAND_METHOD structure.
2656     [Steve Henson]
2657
2658  *) New macro __owur for "OpenSSL Warn Unused Result". This makes use of
2659     a gcc attribute to warn if the result of a function is ignored. This
2660     is enable if DEBUG_UNUSED is set. Add to several functions in evp.h
2661     whose return value is often ignored.
2662     [Steve Henson]
2663
2664  *) New -noct, -requestct, -requirect and -ctlogfile options for s_client.
2665     These allow SCTs (signed certificate timestamps) to be requested and
2666     validated when establishing a connection.
2667     [Rob Percival <robpercival@google.com>]
2668
2669 Changes between 1.0.2g and 1.0.2h [3 May 2016]
2670
2671  *) Prevent padding oracle in AES-NI CBC MAC check
2672
2673     A MITM attacker can use a padding oracle attack to decrypt traffic
2674     when the connection uses an AES CBC cipher and the server support
2675     AES-NI.
2676
2677     This issue was introduced as part of the fix for Lucky 13 padding
2678     attack (CVE-2013-0169). The padding check was rewritten to be in
2679     constant time by making sure that always the same bytes are read and
2680     compared against either the MAC or padding bytes. But it no longer
2681     checked that there was enough data to have both the MAC and padding
2682     bytes.
2683
2684     This issue was reported by Juraj Somorovsky using TLS-Attacker.
2685     (CVE-2016-2107)
2686     [Kurt Roeckx]
2687
2688  *) Fix EVP_EncodeUpdate overflow
2689
2690     An overflow can occur in the EVP_EncodeUpdate() function which is used for
2691     Base64 encoding of binary data. If an attacker is able to supply very large
2692     amounts of input data then a length check can overflow resulting in a heap
2693     corruption.
2694
2695     Internally to OpenSSL the EVP_EncodeUpdate() function is primarily used by
2696     the PEM_write_bio* family of functions. These are mainly used within the
2697     OpenSSL command line applications, so any application which processes data
2698     from an untrusted source and outputs it as a PEM file should be considered
2699     vulnerable to this issue. User applications that call these APIs directly
2700     with large amounts of untrusted data may also be vulnerable.
2701
2702     This issue was reported by Guido Vranken.
2703     (CVE-2016-2105)
2704     [Matt Caswell]
2705
2706  *) Fix EVP_EncryptUpdate overflow
2707
2708     An overflow can occur in the EVP_EncryptUpdate() function. If an attacker
2709     is able to supply very large amounts of input data after a previous call to
2710     EVP_EncryptUpdate() with a partial block then a length check can overflow
2711     resulting in a heap corruption. Following an analysis of all OpenSSL
2712     internal usage of the EVP_EncryptUpdate() function all usage is one of two
2713     forms. The first form is where the EVP_EncryptUpdate() call is known to be
2714     the first called function after an EVP_EncryptInit(), and therefore that
2715     specific call must be safe. The second form is where the length passed to
2716     EVP_EncryptUpdate() can be seen from the code to be some small value and
2717     therefore there is no possibility of an overflow. Since all instances are
2718     one of these two forms, it is believed that there can be no overflows in
2719     internal code due to this problem. It should be noted that
2720     EVP_DecryptUpdate() can call EVP_EncryptUpdate() in certain code paths.
2721     Also EVP_CipherUpdate() is a synonym for EVP_EncryptUpdate(). All instances
2722     of these calls have also been analysed too and it is believed there are no
2723     instances in internal usage where an overflow could occur.
2724
2725     This issue was reported by Guido Vranken.
2726     (CVE-2016-2106)
2727     [Matt Caswell]
2728
2729  *) Prevent ASN.1 BIO excessive memory allocation
2730
2731     When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
2732     a short invalid encoding can cause allocation of large amounts of memory
2733     potentially consuming excessive resources or exhausting memory.
2734
2735     Any application parsing untrusted data through d2i BIO functions is
2736     affected. The memory based functions such as d2i_X509() are *not* affected.
2737     Since the memory based functions are used by the TLS library, TLS
2738     applications are not affected.
2739
2740     This issue was reported by Brian Carpenter.
2741     (CVE-2016-2109)
2742     [Stephen Henson]
2743
2744  *) EBCDIC overread
2745
2746     ASN1 Strings that are over 1024 bytes can cause an overread in applications
2747     using the X509_NAME_oneline() function on EBCDIC systems. This could result
2748     in arbitrary stack data being returned in the buffer.
2749
2750     This issue was reported by Guido Vranken.
2751     (CVE-2016-2176)
2752     [Matt Caswell]
2753
2754  *) Modify behavior of ALPN to invoke callback after SNI/servername
2755     callback, such that updates to the SSL_CTX affect ALPN.
2756     [Todd Short]
2757
2758  *) Remove LOW from the DEFAULT cipher list.  This removes singles DES from the
2759     default.
2760     [Kurt Roeckx]
2761
2762  *) Only remove the SSLv2 methods with the no-ssl2-method option. When the
2763     methods are enabled and ssl2 is disabled the methods return NULL.
2764     [Kurt Roeckx]
2765
2766 Changes between 1.0.2f and 1.0.2g [1 Mar 2016]
2767
2768  * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
2769    Builds that are not configured with "enable-weak-ssl-ciphers" will not
2770    provide any "EXPORT" or "LOW" strength ciphers.
2771    [Viktor Dukhovni]
2772
2773  * Disable SSLv2 default build, default negotiation and weak ciphers.  SSLv2
2774    is by default disabled at build-time.  Builds that are not configured with
2775    "enable-ssl2" will not support SSLv2.  Even if "enable-ssl2" is used,
2776    users who want to negotiate SSLv2 via the version-flexible SSLv23_method()
2777    will need to explicitly call either of:
2778
2779        SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
2780    or
2781        SSL_clear_options(ssl, SSL_OP_NO_SSLv2);
2782
2783    as appropriate.  Even if either of those is used, or the application
2784    explicitly uses the version-specific SSLv2_method() or its client and
2785    server variants, SSLv2 ciphers vulnerable to exhaustive search key
2786    recovery have been removed.  Specifically, the SSLv2 40-bit EXPORT
2787    ciphers, and SSLv2 56-bit DES are no longer available.
2788    (CVE-2016-0800)
2789    [Viktor Dukhovni]
2790
2791  *) Fix a double-free in DSA code
2792
2793     A double free bug was discovered when OpenSSL parses malformed DSA private
2794     keys and could lead to a DoS attack or memory corruption for applications
2795     that receive DSA private keys from untrusted sources.  This scenario is
2796     considered rare.
2797
2798     This issue was reported to OpenSSL by Adam Langley(Google/BoringSSL) using
2799     libFuzzer.
2800     (CVE-2016-0705)
2801     [Stephen Henson]
2802
2803  *) Disable SRP fake user seed to address a server memory leak.
2804
2805     Add a new method SRP_VBASE_get1_by_user that handles the seed properly.
2806
2807     SRP_VBASE_get_by_user had inconsistent memory management behaviour.
2808     In order to fix an unavoidable memory leak, SRP_VBASE_get_by_user
2809     was changed to ignore the "fake user" SRP seed, even if the seed
2810     is configured.
2811
2812     Users should use SRP_VBASE_get1_by_user instead. Note that in
2813     SRP_VBASE_get1_by_user, caller must free the returned value. Note
2814     also that even though configuring the SRP seed attempts to hide
2815     invalid usernames by continuing the handshake with fake
2816     credentials, this behaviour is not constant time and no strong
2817     guarantees are made that the handshake is indistinguishable from
2818     that of a valid user.
2819     (CVE-2016-0798)
2820     [Emilia Käsper]
2821
2822  *) Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
2823
2824     In the BN_hex2bn function the number of hex digits is calculated using an
2825     int value |i|. Later |bn_expand| is called with a value of |i * 4|. For
2826     large values of |i| this can result in |bn_expand| not allocating any
2827     memory because |i * 4| is negative. This can leave the internal BIGNUM data
2828     field as NULL leading to a subsequent NULL ptr deref. For very large values
2829     of |i|, the calculation |i * 4| could be a positive value smaller than |i|.
2830     In this case memory is allocated to the internal BIGNUM data field, but it
2831     is insufficiently sized leading to heap corruption. A similar issue exists
2832     in BN_dec2bn. This could have security consequences if BN_hex2bn/BN_dec2bn
2833     is ever called by user applications with very large untrusted hex/dec data.
2834     This is anticipated to be a rare occurrence.
2835
2836     All OpenSSL internal usage of these functions use data that is not expected
2837     to be untrusted, e.g. config file data or application command line
2838     arguments. If user developed applications generate config file data based
2839     on untrusted data then it is possible that this could also lead to security
2840     consequences. This is also anticipated to be rare.
2841
2842     This issue was reported to OpenSSL by Guido Vranken.
2843     (CVE-2016-0797)
2844     [Matt Caswell]
2845
2846  *) Fix memory issues in BIO_*printf functions
2847
2848     The internal |fmtstr| function used in processing a "%s" format string in
2849     the BIO_*printf functions could overflow while calculating the length of a
2850     string and cause an OOB read when printing very long strings.
2851
2852     Additionally the internal |doapr_outch| function can attempt to write to an
2853     OOB memory location (at an offset from the NULL pointer) in the event of a
2854     memory allocation failure. In 1.0.2 and below this could be caused where
2855     the size of a buffer to be allocated is greater than INT_MAX. E.g. this
2856     could be in processing a very long "%s" format string. Memory leaks can
2857     also occur.
2858
2859     The first issue may mask the second issue dependent on compiler behaviour.
2860     These problems could enable attacks where large amounts of untrusted data
2861     is passed to the BIO_*printf functions. If applications use these functions
2862     in this way then they could be vulnerable. OpenSSL itself uses these
2863     functions when printing out human-readable dumps of ASN.1 data. Therefore
2864     applications that print this data could be vulnerable if the data is from
2865     untrusted sources. OpenSSL command line applications could also be
2866     vulnerable where they print out ASN.1 data, or if untrusted data is passed
2867     as command line arguments.
2868
2869     Libssl is not considered directly vulnerable. Additionally certificates etc
2870     received via remote connections via libssl are also unlikely to be able to
2871     trigger these issues because of message size limits enforced within libssl.
2872
2873     This issue was reported to OpenSSL Guido Vranken.
2874     (CVE-2016-0799)
2875     [Matt Caswell]
2876
2877  *) Side channel attack on modular exponentiation
2878
2879     A side-channel attack was found which makes use of cache-bank conflicts on
2880     the Intel Sandy-Bridge microarchitecture which could lead to the recovery
2881     of RSA keys.  The ability to exploit this issue is limited as it relies on
2882     an attacker who has control of code in a thread running on the same
2883     hyper-threaded core as the victim thread which is performing decryptions.
2884
2885     This issue was reported to OpenSSL by Yuval Yarom, The University of
2886     Adelaide and NICTA, Daniel Genkin, Technion and Tel Aviv University, and
2887     Nadia Heninger, University of Pennsylvania with more information at
2888     http://cachebleed.info.
2889     (CVE-2016-0702)
2890     [Andy Polyakov]
2891
2892  *) Change the req app to generate a 2048-bit RSA/DSA key by default,
2893     if no keysize is specified with default_bits. This fixes an
2894     omission in an earlier change that changed all RSA/DSA key generation
2895     apps to use 2048 bits by default.
2896     [Emilia Käsper]
2897
2898 Changes between 1.0.2e and 1.0.2f [28 Jan 2016]
2899  *) DH small subgroups
2900
2901     Historically OpenSSL only ever generated DH parameters based on "safe"
2902     primes. More recently (in version 1.0.2) support was provided for
2903     generating X9.42 style parameter files such as those required for RFC 5114
2904     support. The primes used in such files may not be "safe". Where an
2905     application is using DH configured with parameters based on primes that are
2906     not "safe" then an attacker could use this fact to find a peer's private
2907     DH exponent. This attack requires that the attacker complete multiple
2908     handshakes in which the peer uses the same private DH exponent. For example
2909     this could be used to discover a TLS server's private DH exponent if it's
2910     reusing the private DH exponent or it's using a static DH ciphersuite.
2911
2912     OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in
2913     TLS. It is not on by default. If the option is not set then the server
2914     reuses the same private DH exponent for the life of the server process and
2915     would be vulnerable to this attack. It is believed that many popular
2916     applications do set this option and would therefore not be at risk.
2917
2918     The fix for this issue adds an additional check where a "q" parameter is
2919     available (as is the case in X9.42 based parameters). This detects the
2920     only known attack, and is the only possible defense for static DH
2921     ciphersuites. This could have some performance impact.
2922
2923     Additionally the SSL_OP_SINGLE_DH_USE option has been switched on by
2924     default and cannot be disabled. This could have some performance impact.
2925
2926     This issue was reported to OpenSSL by Antonio Sanso (Adobe).
2927     (CVE-2016-0701)
2928     [Matt Caswell]
2929
2930  *) SSLv2 doesn't block disabled ciphers
2931
2932     A malicious client can negotiate SSLv2 ciphers that have been disabled on
2933     the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
2934     been disabled, provided that the SSLv2 protocol was not also disabled via
2935     SSL_OP_NO_SSLv2.
2936
2937     This issue was reported to OpenSSL on 26th December 2015 by Nimrod Aviram
2938     and Sebastian Schinzel.
2939     (CVE-2015-3197)
2940     [Viktor Dukhovni]
2941
2942 Changes between 1.0.2d and 1.0.2e [3 Dec 2015]
2943
2944  *) BN_mod_exp may produce incorrect results on x86_64
2945
2946     There is a carry propagating bug in the x86_64 Montgomery squaring
2947     procedure. No EC algorithms are affected. Analysis suggests that attacks
2948     against RSA and DSA as a result of this defect would be very difficult to
2949     perform and are not believed likely. Attacks against DH are considered just
2950     feasible (although very difficult) because most of the work necessary to
2951     deduce information about a private key may be performed offline. The amount
2952     of resources required for such an attack would be very significant and
2953     likely only accessible to a limited number of attackers. An attacker would
2954     additionally need online access to an unpatched system using the target
2955     private key in a scenario with persistent DH parameters and a private
2956     key that is shared between multiple clients. For example this can occur by
2957     default in OpenSSL DHE based SSL/TLS ciphersuites.
2958
2959     This issue was reported to OpenSSL by Hanno Böck.
2960     (CVE-2015-3193)
2961     [Andy Polyakov]
2962
2963  *) Certificate verify crash with missing PSS parameter
2964
2965     The signature verification routines will crash with a NULL pointer
2966     dereference if presented with an ASN.1 signature using the RSA PSS
2967     algorithm and absent mask generation function parameter. Since these
2968     routines are used to verify certificate signature algorithms this can be
2969     used to crash any certificate verification operation and exploited in a
2970     DoS attack. Any application which performs certificate verification is
2971     vulnerable including OpenSSL clients and servers which enable client
2972     authentication.
2973
2974     This issue was reported to OpenSSL by Loïc Jonas Etienne (Qnective AG).
2975     (CVE-2015-3194)
2976     [Stephen Henson]
2977
2978  *) X509_ATTRIBUTE memory leak
2979
2980     When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak
2981     memory. This structure is used by the PKCS#7 and CMS routines so any
2982     application which reads PKCS#7 or CMS data from untrusted sources is
2983     affected. SSL/TLS is not affected.
2984
2985     This issue was reported to OpenSSL by Adam Langley (Google/BoringSSL) using
2986     libFuzzer.
2987     (CVE-2015-3195)
2988     [Stephen Henson]
2989
2990  *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs.
2991     This changes the decoding behaviour for some invalid messages,
2992     though the change is mostly in the more lenient direction, and
2993     legacy behaviour is preserved as much as possible.
2994     [Emilia Käsper]
2995
2996  *) In DSA_generate_parameters_ex, if the provided seed is too short,
2997     return an error
2998     [Rich Salz and Ismo Puustinen <ismo.puustinen@intel.com>]
2999
3000 Changes between 1.0.2c and 1.0.2d [9 Jul 2015]
3001
3002  *) Alternate chains certificate forgery
3003
3004     During certificate verification, OpenSSL will attempt to find an
3005     alternative certificate chain if the first attempt to build such a chain
3006     fails. An error in the implementation of this logic can mean that an
3007     attacker could cause certain checks on untrusted certificates to be
3008     bypassed, such as the CA flag, enabling them to use a valid leaf
3009     certificate to act as a CA and "issue" an invalid certificate.
3010
3011     This issue was reported to OpenSSL by Adam Langley/David Benjamin
3012     (Google/BoringSSL).
3013     [Matt Caswell]
3014
3015 Changes between 1.0.2b and 1.0.2c [12 Jun 2015]
3016
3017  *) Fix HMAC ABI incompatibility. The previous version introduced an ABI
3018     incompatibility in the handling of HMAC. The previous ABI has now been
3019     restored.
3020     [Matt Caswell]
3021
3022 Changes between 1.0.2a and 1.0.2b [11 Jun 2015]
3023
3024  *) Malformed ECParameters causes infinite loop
3025
3026     When processing an ECParameters structure OpenSSL enters an infinite loop
3027     if the curve specified is over a specially malformed binary polynomial
3028     field.
3029
3030     This can be used to perform denial of service against any
3031     system which processes public keys, certificate requests or
3032     certificates.  This includes TLS clients and TLS servers with
3033     client authentication enabled.
3034
3035     This issue was reported to OpenSSL by Joseph Barr-Pixton.
3036     (CVE-2015-1788)
3037     [Andy Polyakov]
3038
3039  *) Exploitable out-of-bounds read in X509_cmp_time
3040
3041     X509_cmp_time does not properly check the length of the ASN1_TIME
3042     string and can read a few bytes out of bounds. In addition,
3043     X509_cmp_time accepts an arbitrary number of fractional seconds in the
3044     time string.
3045
3046     An attacker can use this to craft malformed certificates and CRLs of
3047     various sizes and potentially cause a segmentation fault, resulting in
3048     a DoS on applications that verify certificates or CRLs. TLS clients
3049     that verify CRLs are affected. TLS clients and servers with client
3050     authentication enabled may be affected if they use custom verification
3051     callbacks.
3052
3053     This issue was reported to OpenSSL by Robert Swiecki (Google), and
3054     independently by Hanno Böck.
3055     (CVE-2015-1789)
3056     [Emilia Käsper]
3057
3058  *) PKCS7 crash with missing EnvelopedContent
3059
3060     The PKCS#7 parsing code does not handle missing inner EncryptedContent
3061     correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs
3062     with missing content and trigger a NULL pointer dereference on parsing.
3063
3064     Applications that decrypt PKCS#7 data or otherwise parse PKCS#7
3065     structures from untrusted sources are affected. OpenSSL clients and
3066     servers are not affected.
3067
3068     This issue was reported to OpenSSL by Michal Zalewski (Google).
3069     (CVE-2015-1790)
3070     [Emilia Käsper]
3071
3072  *) CMS verify infinite loop with unknown hash function
3073
3074     When verifying a signedData message the CMS code can enter an infinite loop
3075     if presented with an unknown hash function OID. This can be used to perform
3076     denial of service against any system which verifies signedData messages using
3077     the CMS code.
3078     This issue was reported to OpenSSL by Johannes Bauer.
3079     (CVE-2015-1792)
3080     [Stephen Henson]
3081
3082  *) Race condition handling NewSessionTicket
3083
3084     If a NewSessionTicket is received by a multi-threaded client when attempting to
3085     reuse a previous ticket then a race condition can occur potentially leading to
3086     a double free of the ticket data.
3087     (CVE-2015-1791)
3088     [Matt Caswell]
3089
3090  *) Only support 256-bit or stronger elliptic curves with the
3091     'ecdh_auto' setting (server) or by default (client). Of supported
3092     curves, prefer P-256 (both).
3093     [Emilia Kasper]
3094
3095 Changes between 1.0.2 and 1.0.2a [19 Mar 2015]
3096
3097  *) ClientHello sigalgs DoS fix
3098
3099     If a client connects to an OpenSSL 1.0.2 server and renegotiates with an
3100     invalid signature algorithms extension a NULL pointer dereference will
3101     occur. This can be exploited in a DoS attack against the server.
3102
3103     This issue was was reported to OpenSSL by David Ramos of Stanford
3104     University.
3105     (CVE-2015-0291)
3106     [Stephen Henson and Matt Caswell]
3107
3108  *) Multiblock corrupted pointer fix
3109
3110     OpenSSL 1.0.2 introduced the "multiblock" performance improvement. This
3111     feature only applies on 64 bit x86 architecture platforms that support AES
3112     NI instructions. A defect in the implementation of "multiblock" can cause
3113     OpenSSL's internal write buffer to become incorrectly set to NULL when
3114     using non-blocking IO. Typically, when the user application is using a
3115     socket BIO for writing, this will only result in a failed connection.
3116     However if some other BIO is used then it is likely that a segmentation
3117     fault will be triggered, thus enabling a potential DoS attack.
3118
3119     This issue was reported to OpenSSL by Daniel Danner and Rainer Mueller.
3120     (CVE-2015-0290)
3121     [Matt Caswell]
3122
3123  *) Segmentation fault in DTLSv1_listen fix
3124
3125     The DTLSv1_listen function is intended to be stateless and processes the
3126     initial ClientHello from many peers. It is common for user code to loop
3127     over the call to DTLSv1_listen until a valid ClientHello is received with
3128     an associated cookie. A defect in the implementation of DTLSv1_listen means
3129     that state is preserved in the SSL object from one invocation to the next
3130     that can lead to a segmentation fault. Errors processing the initial
3131     ClientHello can trigger this scenario. An example of such an error could be
3132     that a DTLS1.0 only client is attempting to connect to a DTLS1.2 only
3133     server.
3134
3135     This issue was reported to OpenSSL by Per Allansson.
3136     (CVE-2015-0207)
3137     [Matt Caswell]
3138
3139  *) Segmentation fault in ASN1_TYPE_cmp fix
3140
3141     The function ASN1_TYPE_cmp will crash with an invalid read if an attempt is
3142     made to compare ASN.1 boolean types. Since ASN1_TYPE_cmp is used to check
3143     certificate signature algorithm consistency this can be used to crash any
3144     certificate verification operation and exploited in a DoS attack. Any
3145     application which performs certificate verification is vulnerable including
3146     OpenSSL clients and servers which enable client authentication.
3147     (CVE-2015-0286)
3148     [Stephen Henson]
3149
3150  *) Segmentation fault for invalid PSS parameters fix
3151
3152     The signature verification routines will crash with a NULL pointer
3153     dereference if presented with an ASN.1 signature using the RSA PSS
3154     algorithm and invalid parameters. Since these routines are used to verify
3155     certificate signature algorithms this can be used to crash any
3156     certificate verification operation and exploited in a DoS attack. Any
3157     application which performs certificate verification is vulnerable including
3158     OpenSSL clients and servers which enable client authentication.
3159
3160     This issue was was reported to OpenSSL by Brian Carpenter.
3161     (CVE-2015-0208)
3162     [Stephen Henson]
3163
3164  *) ASN.1 structure reuse memory corruption fix
3165
3166     Reusing a structure in ASN.1 parsing may allow an attacker to cause
3167     memory corruption via an invalid write. Such reuse is and has been
3168     strongly discouraged and is believed to be rare.
3169
3170     Applications that parse structures containing CHOICE or ANY DEFINED BY
3171     components may be affected. Certificate parsing (d2i_X509 and related
3172     functions) are however not affected. OpenSSL clients and servers are
3173     not affected.
3174     (CVE-2015-0287)
3175     [Stephen Henson]
3176
3177  *) PKCS7 NULL pointer dereferences fix
3178
3179     The PKCS#7 parsing code does not handle missing outer ContentInfo
3180     correctly. An attacker can craft malformed ASN.1-encoded PKCS#7 blobs with
3181     missing content and trigger a NULL pointer dereference on parsing.
3182
3183     Applications that verify PKCS#7 signatures, decrypt PKCS#7 data or
3184     otherwise parse PKCS#7 structures from untrusted sources are
3185     affected. OpenSSL clients and servers are not affected.
3186
3187     This issue was reported to OpenSSL by Michal Zalewski (Google).
3188     (CVE-2015-0289)
3189     [Emilia Käsper]
3190
3191  *) DoS via reachable assert in SSLv2 servers fix
3192
3193     A malicious client can trigger an OPENSSL_assert (i.e., an abort) in
3194     servers that both support SSLv2 and enable export cipher suites by sending
3195     a specially crafted SSLv2 CLIENT-MASTER-KEY message.
3196
3197     This issue was discovered by Sean Burford (Google) and Emilia Käsper
3198     (OpenSSL development team).
3199     (CVE-2015-0293)
3200     [Emilia Käsper]
3201
3202  *) Empty CKE with client auth and DHE fix
3203
3204     If client auth is used then a server can seg fault in the event of a DHE
3205     ciphersuite being selected and a zero length ClientKeyExchange message
3206     being sent by the client. This could be exploited in a DoS attack.
3207     (CVE-2015-1787)
3208     [Matt Caswell]
3209
3210  *) Handshake with unseeded PRNG fix
3211
3212     Under certain conditions an OpenSSL 1.0.2 client can complete a handshake
3213     with an unseeded PRNG. The conditions are:
3214     - The client is on a platform where the PRNG has not been seeded
3215     automatically, and the user has not seeded manually
3216     - A protocol specific client method version has been used (i.e. not
3217     SSL_client_methodv23)
3218     - A ciphersuite is used that does not require additional random data from
3219     the PRNG beyond the initial ClientHello client random (e.g. PSK-RC4-SHA).
3220
3221     If the handshake succeeds then the client random that has been used will
3222     have been generated from a PRNG with insufficient entropy and therefore the
3223     output may be predictable.
3224
3225     For example using the following command with an unseeded openssl will
3226     succeed on an unpatched platform:
3227
3228     openssl s_client -psk 1a2b3c4d -tls1_2 -cipher PSK-RC4-SHA
3229     (CVE-2015-0285)
3230     [Matt Caswell]
3231
3232  *) Use After Free following d2i_ECPrivatekey error fix
3233
3234     A malformed EC private key file consumed via the d2i_ECPrivateKey function
3235     could cause a use after free condition. This, in turn, could cause a double
3236     free in several private key parsing functions (such as d2i_PrivateKey
3237     or EVP_PKCS82PKEY) and could lead to a DoS attack or memory corruption
3238     for applications that receive EC private keys from untrusted
3239     sources. This scenario is considered rare.
3240
3241     This issue was discovered by the BoringSSL project and fixed in their
3242     commit 517073cd4b.
3243     (CVE-2015-0209)
3244     [Matt Caswell]
3245
3246  *) X509_to_X509_REQ NULL pointer deref fix
3247
3248     The function X509_to_X509_REQ will crash with a NULL pointer dereference if
3249     the certificate key is invalid. This function is rarely used in practice.
3250
3251     This issue was discovered by Brian Carpenter.
3252     (CVE-2015-0288)
3253     [Stephen Henson]
3254
3255  *) Removed the export ciphers from the DEFAULT ciphers
3256     [Kurt Roeckx]
3257
3258 Changes between 1.0.1l and 1.0.2 [22 Jan 2015]
3259
3260  *) Facilitate "universal" ARM builds targeting range of ARM ISAs, e.g.
3261     ARMv5 through ARMv8, as opposite to "locking" it to single one.
3262     So far those who have to target multiple platforms would compromise
3263     and argue that binary targeting say ARMv5 would still execute on
3264     ARMv8. "Universal" build resolves this compromise by providing
3265     near-optimal performance even on newer platforms.
3266     [Andy Polyakov]
3267
3268  *) Accelerated NIST P-256 elliptic curve implementation for x86_64
3269     (other platforms pending).
3270     [Shay Gueron & Vlad Krasnov (Intel Corp), Andy Polyakov]
3271
3272  *) Add support for the SignedCertificateTimestampList certificate and
3273     OCSP response extensions from RFC6962.
3274     [Rob Stradling]
3275
3276  *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
3277     for corner cases. (Certain input points at infinity could lead to
3278     bogus results, with non-infinity inputs mapped to infinity too.)
3279     [Bodo Moeller]
3280
3281  *) Initial support for PowerISA 2.0.7, first implemented in POWER8.
3282     This covers AES, SHA256/512 and GHASH. "Initial" means that most
3283     common cases are optimized and there still is room for further
3284     improvements. Vector Permutation AES for Altivec is also added.
3285     [Andy Polyakov]
3286
3287  *) Add support for little-endian ppc64 Linux target.
3288     [Marcelo Cerri (IBM)]
3289
3290  *) Initial support for AMRv8 ISA crypto extensions. This covers AES,
3291     SHA1, SHA256 and GHASH. "Initial" means that most common cases
3292     are optimized and there still is room for further improvements.
3293     Both 32- and 64-bit modes are supported.
3294     [Andy Polyakov, Ard Biesheuvel (Linaro)]
3295
3296  *) Improved ARMv7 NEON support.
3297     [Andy Polyakov]
3298
3299  *) Support for SPARC Architecture 2011 crypto extensions, first
3300     implemented in SPARC T4. This covers AES, DES, Camellia, SHA1,
3301     SHA256/512, MD5, GHASH and modular exponentiation.
3302     [Andy Polyakov, David Miller]
3303
3304  *) Accelerated modular exponentiation for Intel processors, a.k.a.
3305     RSAZ.
3306     [Shay Gueron & Vlad Krasnov (Intel Corp)]
3307
3308  *) Support for new and upcoming Intel processors, including AVX2,
3309     BMI and SHA ISA extensions. This includes additional "stitched"
3310     implementations, AESNI-SHA256 and GCM, and multi-buffer support
3311     for TLS encrypt.
3312
3313     This work was sponsored by Intel Corp.
3314     [Andy Polyakov]
3315
3316  *) Support for DTLS 1.2. This adds two sets of DTLS methods: DTLS_*_method()
3317     supports both DTLS 1.2 and 1.0 and should use whatever version the peer
3318     supports and DTLSv1_2_*_method() which supports DTLS 1.2 only.
3319     [Steve Henson]
3320
3321  *) Use algorithm specific chains in SSL_CTX_use_certificate_chain_file():
3322     this fixes a limitation in previous versions of OpenSSL.
3323     [Steve Henson]
3324
3325  *) Extended RSA OAEP support via EVP_PKEY API. Options to specify digest,
3326     MGF1 digest and OAEP label.
3327     [Steve Henson]
3328
3329  *) Add EVP support for key wrapping algorithms, to avoid problems with
3330     existing code the flag EVP_CIPHER_CTX_WRAP_ALLOW has to be set in
3331     the EVP_CIPHER_CTX or an error is returned. Add AES and DES3 wrap
3332     algorithms and include tests cases.
3333     [Steve Henson]
3334
3335  *) Add functions to allocate and set the fields of an ECDSA_METHOD
3336     structure.
3337     [Douglas E. Engert, Steve Henson]
3338
3339  *) New functions OPENSSL_gmtime_diff and ASN1_TIME_diff to find the
3340     difference in days and seconds between two tm or ASN1_TIME structures.
3341     [Steve Henson]
3342
3343  *) Add -rev test option to s_server to just reverse order of characters
3344     received by client and send back to server. Also prints an abbreviated
3345     summary of the connection parameters.
3346     [Steve Henson]
3347
3348  *) New option -brief for s_client and s_server to print out a brief summary
3349     of connection parameters.
3350     [Steve Henson]
3351
3352  *) Add callbacks for arbitrary TLS extensions.
3353     [Trevor Perrin <trevp@trevp.net> and Ben Laurie]
3354
3355  *) New option -crl_download in several openssl utilities to download CRLs
3356     from CRLDP extension in certificates.
3357     [Steve Henson]
3358
3359  *) New options -CRL and -CRLform for s_client and s_server for CRLs.
3360     [Steve Henson]
3361
3362  *) New function X509_CRL_diff to generate a delta CRL from the difference
3363     of two full CRLs. Add support to "crl" utility.
3364     [Steve Henson]
3365
3366  *) New functions to set lookup_crls function and to retrieve
3367     X509_STORE from X509_STORE_CTX.
3368     [Steve Henson]
3369
3370  *) Print out deprecated issuer and subject unique ID fields in
3371     certificates.
3372     [Steve Henson]
3373
3374  *) Extend OCSP I/O functions so they can be used for simple general purpose
3375     HTTP as well as OCSP. New wrapper function which can be used to download
3376     CRLs using the OCSP API.
3377     [Steve Henson]
3378
3379  *) Delegate command line handling in s_client/s_server to SSL_CONF APIs.
3380     [Steve Henson]
3381
3382  *) SSL_CONF* functions. These provide a common framework for application
3383     configuration using configuration files or command lines.
3384     [Steve Henson]
3385
3386  *) SSL/TLS tracing code. This parses out SSL/TLS records using the
3387     message callback and prints the results. Needs compile time option
3388     "enable-ssl-trace". New options to s_client and s_server to enable
3389     tracing.
3390     [Steve Henson]
3391
3392  *) New ctrl and macro to retrieve supported points extensions.
3393     Print out extension in s_server and s_client.
3394     [Steve Henson]
3395
3396  *) New functions to retrieve certificate signature and signature
3397     OID NID.
3398     [Steve Henson]
3399
3400  *) Add functions to retrieve and manipulate the raw cipherlist sent by a
3401     client to OpenSSL.
3402     [Steve Henson]
3403
3404  *) New Suite B modes for TLS code. These use and enforce the requirements
3405     of RFC6460: restrict ciphersuites, only permit Suite B algorithms and
3406     only use Suite B curves. The Suite B modes can be set by using the
3407     strings "SUITEB128", "SUITEB192" or "SUITEB128ONLY" for the cipherstring.
3408     [Steve Henson]
3409
3410  *) New chain verification flags for Suite B levels of security. Check
3411     algorithms are acceptable when flags are set in X509_verify_cert.
3412     [Steve Henson]
3413
3414  *) Make tls1_check_chain return a set of flags indicating checks passed
3415     by a certificate chain. Add additional tests to handle client
3416     certificates: checks for matching certificate type and issuer name
3417     comparison.
3418     [Steve Henson]
3419
3420  *) If an attempt is made to use a signature algorithm not in the peer
3421     preference list abort the handshake. If client has no suitable
3422     signature algorithms in response to a certificate request do not
3423     use the certificate.
3424     [Steve Henson]
3425
3426  *) If server EC tmp key is not in client preference list abort handshake.
3427     [Steve Henson]
3428
3429  *) Add support for certificate stores in CERT structure. This makes it
3430     possible to have different stores per SSL structure or one store in
3431     the parent SSL_CTX. Include distinct stores for certificate chain
3432     verification and chain building. New ctrl SSL_CTRL_BUILD_CERT_CHAIN
3433     to build and store a certificate chain in CERT structure: returning
3434     an error if the chain cannot be built: this will allow applications
3435     to test if a chain is correctly configured.
3436
3437     Note: if the CERT based stores are not set then the parent SSL_CTX
3438     store is used to retain compatibility with existing behaviour.
3439
3440     [Steve Henson]
3441
3442  *) New function ssl_set_client_disabled to set a ciphersuite disabled
3443     mask based on the current session, check mask when sending client
3444     hello and checking the requested ciphersuite.
3445     [Steve Henson]
3446
3447  *) New ctrls to retrieve and set certificate types in a certificate
3448     request message. Print out received values in s_client. If certificate
3449     types is not set with custom values set sensible values based on
3450     supported signature algorithms.
3451     [Steve Henson]
3452
3453  *) Support for distinct client and server supported signature algorithms.
3454     [Steve Henson]
3455
3456  *) Add certificate callback. If set this is called whenever a certificate
3457     is required by client or server. An application can decide which
3458     certificate chain to present based on arbitrary criteria: for example
3459     supported signature algorithms. Add very simple example to s_server.
3460     This fixes many of the problems and restrictions of the existing client
3461     certificate callback: for example you can now clear an existing
3462     certificate and specify the whole chain.
3463     [Steve Henson]
3464
3465  *) Add new "valid_flags" field to CERT_PKEY structure which determines what
3466     the certificate can be used for (if anything). Set valid_flags field
3467     in new tls1_check_chain function. Simplify ssl_set_cert_masks which used
3468     to have similar checks in it.
3469
3470     Add new "cert_flags" field to CERT structure and include a "strict mode".
3471     This enforces some TLS certificate requirements (such as only permitting
3472     certificate signature algorithms contained in the supported algorithms
3473     extension) which some implementations ignore: this option should be used
3474     with caution as it could cause interoperability issues.
3475     [Steve Henson]
3476
3477  *) Update and tidy signature algorithm extension processing. Work out
3478     shared signature algorithms based on preferences and peer algorithms
3479     and print them out in s_client and s_server. Abort handshake if no
3480     shared signature algorithms.
3481     [Steve Henson]
3482
3483  *) Add new functions to allow customised supported signature algorithms
3484     for SSL and SSL_CTX structures. Add options to s_client and s_server
3485     to support them.
3486     [Steve Henson]
3487
3488  *) New function SSL_certs_clear() to delete all references to certificates
3489     from an SSL structure. Before this once a certificate had been added
3490     it couldn't be removed.
3491     [Steve Henson]
3492
3493  *) Integrate hostname, email address and IP address checking with certificate
3494     verification. New verify options supporting checking in openssl utility.
3495     [Steve Henson]
3496
3497  *) Fixes and wildcard matching support to hostname and email checking
3498     functions. Add manual page.
3499     [Florian Weimer (Red Hat Product Security Team)]
3500
3501  *) New functions to check a hostname email or IP address against a
3502     certificate. Add options x509 utility to print results of checks against
3503     a certificate.
3504     [Steve Henson]
3505
3506  *) Fix OCSP checking.
3507     [Rob Stradling <rob.stradling@comodo.com> and Ben Laurie]
3508
3509  *) Initial experimental support for explicitly trusted non-root CAs.
3510     OpenSSL still tries to build a complete chain to a root but if an
3511     intermediate CA has a trust setting included that is used. The first
3512     setting is used: whether to trust (e.g., -addtrust option to the x509
3513     utility) or reject.
3514     [Steve Henson]
3515
3516  *) Add -trusted_first option which attempts to find certificates in the
3517     trusted store even if an untrusted chain is also supplied.
3518     [Steve Henson]
3519
3520  *) MIPS assembly pack updates: support for MIPS32r2 and SmartMIPS ASE,
3521     platform support for Linux and Android.
3522     [Andy Polyakov]
3523
3524  *) Support for linux-x32, ILP32 environment in x86_64 framework.
3525     [Andy Polyakov]
3526
3527  *) Experimental multi-implementation support for FIPS capable OpenSSL.
3528     When in FIPS mode the approved implementations are used as normal,
3529     when not in FIPS mode the internal unapproved versions are used instead.
3530     This means that the FIPS capable OpenSSL isn't forced to use the
3531     (often lower performance) FIPS implementations outside FIPS mode.
3532     [Steve Henson]
3533
3534  *) Transparently support X9.42 DH parameters when calling
3535     PEM_read_bio_DHparameters. This means existing applications can handle
3536     the new parameter format automatically.
3537     [Steve Henson]
3538
3539  *) Initial experimental support for X9.42 DH parameter format: mainly
3540     to support use of 'q' parameter for RFC5114 parameters.
3541     [Steve Henson]
3542
3543  *) Add DH parameters from RFC5114 including test data to dhtest.
3544     [Steve Henson]
3545
3546  *) Support for automatic EC temporary key parameter selection. If enabled
3547     the most preferred EC parameters are automatically used instead of
3548     hardcoded fixed parameters. Now a server just has to call:
3549     SSL_CTX_set_ecdh_auto(ctx, 1) and the server will automatically
3550     support ECDH and use the most appropriate parameters.
3551     [Steve Henson]
3552
3553  *) Enhance and tidy EC curve and point format TLS extension code. Use
3554     static structures instead of allocation if default values are used.
3555     New ctrls to set curves we wish to support and to retrieve shared curves.
3556     Print out shared curves in s_server. New options to s_server and s_client
3557     to set list of supported curves.
3558     [Steve Henson]
3559
3560  *) New ctrls to retrieve supported signature algorithms and
3561     supported curve values as an array of NIDs. Extend openssl utility
3562     to print out received values.
3563     [Steve Henson]
3564
3565  *) Add new APIs EC_curve_nist2nid and EC_curve_nid2nist which convert
3566     between NIDs and the more common NIST names such as "P-256". Enhance
3567     ecparam utility and ECC method to recognise the NIST names for curves.
3568     [Steve Henson]
3569
3570  *) Enhance SSL/TLS certificate chain handling to support different
3571     chains for each certificate instead of one chain in the parent SSL_CTX.
3572     [Steve Henson]
3573
3574  *) Support for fixed DH ciphersuite client authentication: where both
3575     server and client use DH certificates with common parameters.
3576     [Steve Henson]
3577
3578  *) Support for fixed DH ciphersuites: those requiring DH server
3579     certificates.
3580     [Steve Henson]
3581
3582  *) New function i2d_re_X509_tbs for re-encoding the TBS portion of
3583     the certificate.
3584     Note: Related 1.0.2-beta specific macros X509_get_cert_info,
3585     X509_CINF_set_modified, X509_CINF_get_issuer, X509_CINF_get_extensions and
3586     X509_CINF_get_signature were reverted post internal team review.
3587
3588 Changes between 1.0.1k and 1.0.1l [15 Jan 2015]
3589
3590  *) Build fixes for the Windows and OpenVMS platforms
3591     [Matt Caswell and Richard Levitte]
3592
3593 Changes between 1.0.1j and 1.0.1k [8 Jan 2015]
3594
3595  *) Fix DTLS segmentation fault in dtls1_get_record. A carefully crafted DTLS
3596     message can cause a segmentation fault in OpenSSL due to a NULL pointer
3597     dereference. This could lead to a Denial Of Service attack. Thanks to
3598     Markus Stenberg of Cisco Systems, Inc. for reporting this issue.
3599     (CVE-2014-3571)
3600     [Steve Henson]
3601
3602  *) Fix DTLS memory leak in dtls1_buffer_record. A memory leak can occur in the
3603     dtls1_buffer_record function under certain conditions. In particular this
3604     could occur if an attacker sent repeated DTLS records with the same
3605     sequence number but for the next epoch. The memory leak could be exploited
3606     by an attacker in a Denial of Service attack through memory exhaustion.
3607     Thanks to Chris Mueller for reporting this issue.
3608     (CVE-2015-0206)
3609     [Matt Caswell]
3610
3611  *) Fix issue where no-ssl3 configuration sets method to NULL. When openssl is
3612     built with the no-ssl3 option and a SSL v3 ClientHello is received the ssl
3613     method would be set to NULL which could later result in a NULL pointer
3614     dereference. Thanks to Frank Schmirler for reporting this issue.
3615     (CVE-2014-3569)
3616     [Kurt Roeckx]
3617
3618  *) Abort handshake if server key exchange message is omitted for ephemeral
3619     ECDH ciphersuites.
3620
3621     Thanks to Karthikeyan Bhargavan of the PROSECCO team at INRIA for
3622     reporting this issue.
3623     (CVE-2014-3572)
3624     [Steve Henson]
3625
3626  *) Remove non-export ephemeral RSA code on client and server. This code
3627     violated the TLS standard by allowing the use of temporary RSA keys in
3628     non-export ciphersuites and could be used by a server to effectively
3629     downgrade the RSA key length used to a value smaller than the server
3630     certificate. Thanks for Karthikeyan Bhargavan of the PROSECCO team at
3631     INRIA or reporting this issue.
3632     (CVE-2015-0204)
3633     [Steve Henson]
3634
3635  *) Fixed issue where DH client certificates are accepted without verification.
3636     An OpenSSL server will accept a DH certificate for client authentication
3637     without the certificate verify message. This effectively allows a client to
3638     authenticate without the use of a private key. This only affects servers
3639     which trust a client certificate authority which issues certificates
3640     containing DH keys: these are extremely rare and hardly ever encountered.
3641     Thanks for Karthikeyan Bhargavan of the PROSECCO team at INRIA or reporting
3642     this issue.
3643     (CVE-2015-0205)
3644     [Steve Henson]
3645
3646  *) Ensure that the session ID context of an SSL is updated when its
3647     SSL_CTX is updated via SSL_set_SSL_CTX.
3648
3649     The session ID context is typically set from the parent SSL_CTX,
3650     and can vary with the CTX.
3651     [Adam Langley]
3652
3653  *) Fix various certificate fingerprint issues.
3654
3655     By using non-DER or invalid encodings outside the signed portion of a
3656     certificate the fingerprint can be changed without breaking the signature.
3657     Although no details of the signed portion of the certificate can be changed
3658     this can cause problems with some applications: e.g. those using the
3659     certificate fingerprint for blacklists.
3660
3661     1. Reject signatures with non zero unused bits.
3662
3663     If the BIT STRING containing the signature has non zero unused bits reject
3664     the signature. All current signature algorithms require zero unused bits.
3665
3666     2. Check certificate algorithm consistency.
3667
3668     Check the AlgorithmIdentifier inside TBS matches the one in the
3669     certificate signature. NB: this will result in signature failure
3670     errors for some broken certificates.
3671
3672     Thanks to Konrad Kraszewski from Google for reporting this issue.
3673
3674     3. Check DSA/ECDSA signatures use DER.
3675
3676     Re-encode DSA/ECDSA signatures and compare with the original received
3677     signature. Return an error if there is a mismatch.
3678
3679     This will reject various cases including garbage after signature
3680     (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
3681     program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
3682     (negative or with leading zeroes).
3683
3684     Further analysis was conducted and fixes were developed by Stephen Henson
3685     of the OpenSSL core team.
3686
3687     (CVE-2014-8275)
3688     [Steve Henson]
3689
3690   *) Correct Bignum squaring. Bignum squaring (BN_sqr) may produce incorrect
3691      results on some platforms, including x86_64. This bug occurs at random
3692      with a very low probability, and is not known to be exploitable in any
3693      way, though its exact impact is difficult to determine. Thanks to Pieter
3694      Wuille (Blockstream) who reported this issue and also suggested an initial
3695      fix. Further analysis was conducted by the OpenSSL development team and
3696      Adam Langley of Google. The final fix was developed by Andy Polyakov of
3697      the OpenSSL core team.
3698      (CVE-2014-3570)
3699      [Andy Polyakov]
3700
3701   *) Do not resume sessions on the server if the negotiated protocol
3702      version does not match the session's version. Resuming with a different
3703      version, while not strictly forbidden by the RFC, is of questionable
3704      sanity and breaks all known clients.
3705      [David Benjamin, Emilia Käsper]
3706
3707   *) Tighten handling of the ChangeCipherSpec (CCS) message: reject
3708      early CCS messages during renegotiation. (Note that because
3709      renegotiation is encrypted, this early CCS was not exploitable.)
3710      [Emilia Käsper]
3711
3712   *) Tighten client-side session ticket handling during renegotiation:
3713      ensure that the client only accepts a session ticket if the server sends
3714      the extension anew in the ServerHello. Previously, a TLS client would
3715      reuse the old extension state and thus accept a session ticket if one was
3716      announced in the initial ServerHello.
3717
3718      Similarly, ensure that the client requires a session ticket if one
3719      was advertised in the ServerHello. Previously, a TLS client would
3720      ignore a missing NewSessionTicket message.
3721      [Emilia Käsper]
3722
3723 Changes between 1.0.1i and 1.0.1j [15 Oct 2014]
3724
3725  *) SRTP Memory Leak.
3726
3727     A flaw in the DTLS SRTP extension parsing code allows an attacker, who
3728     sends a carefully crafted handshake message, to cause OpenSSL to fail
3729     to free up to 64k of memory causing a memory leak. This could be
3730     exploited in a Denial Of Service attack. This issue affects OpenSSL
3731     1.0.1 server implementations for both SSL/TLS and DTLS regardless of
3732     whether SRTP is used or configured. Implementations of OpenSSL that
3733     have been compiled with OPENSSL_NO_SRTP defined are not affected.
3734
3735     The fix was developed by the OpenSSL team.
3736     (CVE-2014-3513)
3737     [OpenSSL team]
3738
3739  *) Session Ticket Memory Leak.
3740
3741     When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
3742     integrity of that ticket is first verified. In the event of a session
3743     ticket integrity check failing, OpenSSL will fail to free memory
3744     causing a memory leak. By sending a large number of invalid session
3745     tickets an attacker could exploit this issue in a Denial Of Service
3746     attack.
3747     (CVE-2014-3567)
3748     [Steve Henson]
3749
3750  *) Build option no-ssl3 is incomplete.
3751
3752     When OpenSSL is configured with "no-ssl3" as a build option, servers
3753     could accept and complete a SSL 3.0 handshake, and clients could be
3754     configured to send them.
3755     (CVE-2014-3568)
3756     [Akamai and the OpenSSL team]
3757
3758  *) Add support for TLS_FALLBACK_SCSV.
3759     Client applications doing fallback retries should call
3760     SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV).
3761     (CVE-2014-3566)
3762     [Adam Langley, Bodo Moeller]
3763
3764  *) Add additional DigestInfo checks.
3765
3766     Re-encode DigestInto in DER and check against the original when
3767     verifying RSA signature: this will reject any improperly encoded
3768     DigestInfo structures.
3769
3770     Note: this is a precautionary measure and no attacks are currently known.
3771
3772     [Steve Henson]
3773
3774 Changes between 1.0.1h and 1.0.1i [6 Aug 2014]
3775
3776  *) Fix SRP buffer overrun vulnerability. Invalid parameters passed to the
3777     SRP code can be overrun an internal buffer. Add sanity check that
3778     g, A, B < N to SRP code.
3779
3780     Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC
3781     Group for discovering this issue.
3782     (CVE-2014-3512)
3783     [Steve Henson]
3784
3785  *) A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
3786     TLS 1.0 instead of higher protocol versions when the ClientHello message
3787     is badly fragmented. This allows a man-in-the-middle attacker to force a
3788     downgrade to TLS 1.0 even if both the server and the client support a
3789     higher protocol version, by modifying the client's TLS records.
3790
3791     Thanks to David Benjamin and Adam Langley (Google) for discovering and
3792     researching this issue.
3793     (CVE-2014-3511)
3794     [David Benjamin]
3795
3796  *) OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject
3797     to a denial of service attack. A malicious server can crash the client
3798     with a null pointer dereference (read) by specifying an anonymous (EC)DH
3799     ciphersuite and sending carefully crafted handshake messages.
3800
3801     Thanks to Felix Gröbert (Google) for discovering and researching this
3802     issue.
3803     (CVE-2014-3510)
3804     [Emilia Käsper]
3805
3806  *) By sending carefully crafted DTLS packets an attacker could cause openssl
3807     to leak memory. This can be exploited through a Denial of Service attack.
3808     Thanks to Adam Langley for discovering and researching this issue.
3809     (CVE-2014-3507)
3810     [Adam Langley]
3811
3812  *) An attacker can force openssl to consume large amounts of memory whilst
3813     processing DTLS handshake messages. This can be exploited through a
3814     Denial of Service attack.
3815     Thanks to Adam Langley for discovering and researching this issue.
3816     (CVE-2014-3506)
3817     [Adam Langley]
3818
3819  *) An attacker can force an error condition which causes openssl to crash
3820     whilst processing DTLS packets due to memory being freed twice. This
3821     can be exploited through a Denial of Service attack.
3822     Thanks to Adam Langley and Wan-Teh Chang for discovering and researching
3823     this issue.
3824     (CVE-2014-3505)
3825     [Adam Langley]
3826
3827  *) If a multithreaded client connects to a malicious server using a resumed
3828     session and the server sends an ec point format extension it could write
3829     up to 255 bytes to freed memory.
3830
3831     Thanks to Gabor Tyukasz (LogMeIn Inc) for discovering and researching this
3832     issue.
3833     (CVE-2014-3509)
3834     [Gabor Tyukasz]
3835
3836  *) A malicious server can crash an OpenSSL client with a null pointer
3837     dereference (read) by specifying an SRP ciphersuite even though it was not
3838     properly negotiated with the client. This can be exploited through a
3839     Denial of Service attack.
3840
3841     Thanks to Joonas Kuorilehto and Riku Hietamäki (Codenomicon) for
3842     discovering and researching this issue.
3843     (CVE-2014-5139)
3844     [Steve Henson]
3845
3846  *) A flaw in OBJ_obj2txt may cause pretty printing functions such as
3847     X509_name_oneline, X509_name_print_ex et al. to leak some information
3848     from the stack. Applications may be affected if they echo pretty printing
3849     output to the attacker.
3850
3851     Thanks to Ivan Fratric (Google) for discovering this issue.
3852     (CVE-2014-3508)
3853     [Emilia Käsper, and Steve Henson]
3854
3855  *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
3856     for corner cases. (Certain input points at infinity could lead to
3857     bogus results, with non-infinity inputs mapped to infinity too.)
3858     [Bodo Moeller]
3859
3860 Changes between 1.0.1g and 1.0.1h [5 Jun 2014]
3861
3862  *) Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
3863     handshake can force the use of weak keying material in OpenSSL
3864     SSL/TLS clients and servers.
3865
3866     Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and
3867     researching this issue. (CVE-2014-0224)
3868     [KIKUCHI Masashi, Steve Henson]
3869
3870  *) Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
3871     OpenSSL DTLS client the code can be made to recurse eventually crashing
3872     in a DoS attack.
3873
3874     Thanks to Imre Rad (Search-Lab Ltd.) for discovering this issue.
3875     (CVE-2014-0221)
3876     [Imre Rad, Steve Henson]
3877
3878  *) Fix DTLS invalid fragment vulnerability. A buffer overrun attack can
3879     be triggered by sending invalid DTLS fragments to an OpenSSL DTLS
3880     client or server. This is potentially exploitable to run arbitrary
3881     code on a vulnerable client or server.
3882
3883     Thanks to Jüri Aedla for reporting this issue. (CVE-2014-0195)
3884     [Jüri Aedla, Steve Henson]
3885
3886  *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites
3887     are subject to a denial of service attack.
3888
3889     Thanks to Felix Gröbert and Ivan Fratric at Google for discovering
3890     this issue. (CVE-2014-3470)
3891     [Felix Gröbert, Ivan Fratric, Steve Henson]
3892
3893  *) Harmonize version and its documentation. -f flag is used to display
3894     compilation flags.
3895     [mancha <mancha1@zoho.com>]
3896
3897  *) Fix eckey_priv_encode so it immediately returns an error upon a failure
3898     in i2d_ECPrivateKey.
3899     [mancha <mancha1@zoho.com>]
3900
3901  *) Fix some double frees. These are not thought to be exploitable.
3902     [mancha <mancha1@zoho.com>]
3903
3904 Changes between 1.0.1f and 1.0.1g [7 Apr 2014]
3905
3906  *) A missing bounds check in the handling of the TLS heartbeat extension
3907     can be used to reveal up to 64k of memory to a connected client or
3908     server.
3909
3910     Thanks for Neel Mehta of Google Security for discovering this bug and to
3911     Adam Langley <agl@chromium.org> and Bodo Moeller <bmoeller@acm.org> for
3912     preparing the fix (CVE-2014-0160)
3913     [Adam Langley, Bodo Moeller]
3914
3915  *) Fix for the attack described in the paper "Recovering OpenSSL
3916     ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack"
3917     by Yuval Yarom and Naomi Benger. Details can be obtained from:
3918     http://eprint.iacr.org/2014/140
3919
3920     Thanks to Yuval Yarom and Naomi Benger for discovering this
3921     flaw and to Yuval Yarom for supplying a fix (CVE-2014-0076)
3922     [Yuval Yarom and Naomi Benger]
3923
3924  *) TLS pad extension: draft-agl-tls-padding-03
3925
3926     Workaround for the "TLS hang bug" (see FAQ and PR#2771): if the
3927     TLS client Hello record length value would otherwise be > 255 and
3928     less that 512 pad with a dummy extension containing zeroes so it
3929     is at least 512 bytes long.
3930
3931     [Adam Langley, Steve Henson]
3932
3933 Changes between 1.0.1e and 1.0.1f [6 Jan 2014]
3934
3935  *) Fix for TLS record tampering bug. A carefully crafted invalid
3936     handshake could crash OpenSSL with a NULL pointer exception.
3937     Thanks to Anton Johansson for reporting this issues.
3938     (CVE-2013-4353)
3939
3940  *) Keep original DTLS digest and encryption contexts in retransmission
3941     structures so we can use the previous session parameters if they need
3942     to be resent. (CVE-2013-6450)
3943     [Steve Henson]
3944
3945  *) Add option SSL_OP_SAFARI_ECDHE_ECDSA_BUG (part of SSL_OP_ALL) which
3946     avoids preferring ECDHE-ECDSA ciphers when the client appears to be
3947     Safari on OS X.  Safari on OS X 10.8..10.8.3 advertises support for
3948     several ECDHE-ECDSA ciphers, but fails to negotiate them.  The bug
3949     is fixed in OS X 10.8.4, but Apple have ruled out both hot fixing
3950     10.8..10.8.3 and forcing users to upgrade to 10.8.4 or newer.
3951     [Rob Stradling, Adam Langley]
3952
3953 Changes between 1.0.1d and 1.0.1e [11 Feb 2013]
3954
3955  *) Correct fix for CVE-2013-0169. The original didn't work on AES-NI
3956     supporting platforms or when small records were transferred.
3957     [Andy Polyakov, Steve Henson]
3958
3959 Changes between 1.0.1c and 1.0.1d [5 Feb 2013]
3960
3961  *) Make the decoding of SSLv3, TLS and DTLS CBC records constant time.
3962
3963     This addresses the flaw in CBC record processing discovered by
3964     Nadhem Alfardan and Kenny Paterson. Details of this attack can be found
3965     at: http://www.isg.rhul.ac.uk/tls/
3966
3967     Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
3968     Security Group at Royal Holloway, University of London
3969     (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and
3970     Emilia Käsper for the initial patch.
3971     (CVE-2013-0169)
3972     [Emilia Käsper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson]
3973
3974  *) Fix flaw in AESNI handling of TLS 1.2 and 1.1 records for CBC mode
3975     ciphersuites which can be exploited in a denial of service attack.
3976     Thanks go to and to Adam Langley <agl@chromium.org> for discovering
3977     and detecting this bug and to Wolfgang Ettlinger
3978     <wolfgang.ettlinger@gmail.com> for independently discovering this issue.
3979     (CVE-2012-2686)
3980     [Adam Langley]
3981
3982  *) Return an error when checking OCSP signatures when key is NULL.
3983     This fixes a DoS attack. (CVE-2013-0166)
3984     [Steve Henson]
3985
3986  *) Make openssl verify return errors.
3987     [Chris Palmer <palmer@google.com> and Ben Laurie]
3988
3989  *) Call OCSP Stapling callback after ciphersuite has been chosen, so
3990     the right response is stapled. Also change SSL_get_certificate()
3991     so it returns the certificate actually sent.
3992     See http://rt.openssl.org/Ticket/Display.html?id=2836.
3993     [Rob Stradling <rob.stradling@comodo.com>]
3994
3995  *) Fix possible deadlock when decoding public keys.
3996     [Steve Henson]
3997
3998  *) Don't use TLS 1.0 record version number in initial client hello
3999     if renegotiating.
4000     [Steve Henson]
4001
4002 Changes between 1.0.1b and 1.0.1c [10 May 2012]
4003
4004  *) Sanity check record length before skipping explicit IV in TLS
4005     1.2, 1.1 and DTLS to fix DoS attack.
4006
4007     Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic
4008     fuzzing as a service testing platform.
4009     (CVE-2012-2333)
4010     [Steve Henson]
4011
4012  *) Initialise tkeylen properly when encrypting CMS messages.
4013     Thanks to Solar Designer of Openwall for reporting this issue.
4014     [Steve Henson]
4015
4016  *) In FIPS mode don't try to use composite ciphers as they are not
4017     approved.
4018     [Steve Henson]
4019
4020 Changes between 1.0.1a and 1.0.1b [26 Apr 2012]
4021
4022  *) OpenSSL 1.0.0 sets SSL_OP_ALL to 0x80000FFFL and OpenSSL 1.0.1 and
4023     1.0.1a set SSL_OP_NO_TLSv1_1 to 0x00000400L which would unfortunately
4024     mean any application compiled against OpenSSL 1.0.0 headers setting
4025     SSL_OP_ALL would also set SSL_OP_NO_TLSv1_1, unintentionally disabling
4026     TLS 1.1 also. Fix this by changing the value of SSL_OP_NO_TLSv1_1 to
4027     0x10000000L Any application which was previously compiled against
4028     OpenSSL 1.0.1 or 1.0.1a headers and which cares about SSL_OP_NO_TLSv1_1
4029     will need to be recompiled as a result. Letting be results in
4030     inability to disable specifically TLS 1.1 and in client context,
4031     in unlike event, limit maximum offered version to TLS 1.0 [see below].
4032     [Steve Henson]
4033
4034  *) In order to ensure interoperability SSL_OP_NO_protocolX does not
4035     disable just protocol X, but all protocols above X *if* there are
4036     protocols *below* X still enabled. In more practical terms it means
4037     that if application wants to disable TLS1.0 in favor of TLS1.1 and
4038     above, it's not sufficient to pass SSL_OP_NO_TLSv1, one has to pass
4039     SSL_OP_NO_TLSv1|SSL_OP_NO_SSLv3|SSL_OP_NO_SSLv2. This applies to
4040     client side.
4041     [Andy Polyakov]
4042
4043 Changes between 1.0.1 and 1.0.1a [19 Apr 2012]
4044
4045  *) Check for potentially exploitable overflows in asn1_d2i_read_bio
4046     BUF_mem_grow and BUF_mem_grow_clean. Refuse attempts to shrink buffer
4047     in CRYPTO_realloc_clean.
4048
4049     Thanks to Tavis Ormandy, Google Security Team, for discovering this
4050     issue and to Adam Langley <agl@chromium.org> for fixing it.
4051     (CVE-2012-2110)
4052     [Adam Langley (Google), Tavis Ormandy, Google Security Team]
4053
4054  *) Don't allow TLS 1.2 SHA-256 ciphersuites in TLS 1.0, 1.1 connections.
4055     [Adam Langley]
4056
4057  *) Workarounds for some broken servers that "hang" if a client hello
4058     record length exceeds 255 bytes.
4059
4060     1. Do not use record version number > TLS 1.0 in initial client
4061        hello: some (but not all) hanging servers will now work.
4062     2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate
4063        the number of ciphers sent in the client hello. This should be
4064        set to an even number, such as 50, for example by passing:
4065        -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure.
4066        Most broken servers should now work.
4067     3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable
4068        TLS 1.2 client support entirely.
4069     [Steve Henson]
4070
4071  *) Fix SEGV in Vector Permutation AES module observed in OpenSSH.
4072     [Andy Polyakov]
4073
4074 Changes between 1.0.0h and 1.0.1  [14 Mar 2012]
4075
4076  *) Add compatibility with old MDC2 signatures which use an ASN1 OCTET
4077     STRING form instead of a DigestInfo.
4078     [Steve Henson]
4079
4080  *) The format used for MDC2 RSA signatures is inconsistent between EVP
4081     and the RSA_sign/RSA_verify functions. This was made more apparent when
4082     OpenSSL used RSA_sign/RSA_verify for some RSA signatures in particular
4083     those which went through EVP_PKEY_METHOD in 1.0.0 and later. Detect
4084     the correct format in RSA_verify so both forms transparently work.
4085     [Steve Henson]
4086
4087  *) Some servers which support TLS 1.0 can choke if we initially indicate
4088     support for TLS 1.2 and later renegotiate using TLS 1.0 in the RSA
4089     encrypted premaster secret. As a workaround use the maximum permitted
4090     client version in client hello, this should keep such servers happy
4091     and still work with previous versions of OpenSSL.
4092     [Steve Henson]
4093
4094  *) Add support for TLS/DTLS heartbeats.
4095     [Robin Seggelmann <seggelmann@fh-muenster.de>]
4096
4097  *) Add support for SCTP.
4098     [Robin Seggelmann <seggelmann@fh-muenster.de>]
4099
4100  *) Improved PRNG seeding for VOS.
4101     [Paul Green <Paul.Green@stratus.com>]
4102
4103  *) Extensive assembler packs updates, most notably:
4104
4105        - x86[_64]:     AES-NI, PCLMULQDQ, RDRAND support;
4106        - x86[_64]:     SSSE3 support (SHA1, vector-permutation AES);
4107        - x86_64:       bit-sliced AES implementation;
4108        - ARM:          NEON support, contemporary platforms optimizations;
4109        - s390x:        z196 support;
4110        - *:            GHASH and GF(2^m) multiplication implementations;
4111
4112     [Andy Polyakov]
4113
4114  *) Make TLS-SRP code conformant with RFC 5054 API cleanup
4115     (removal of unnecessary code)
4116     [Peter Sylvester <peter.sylvester@edelweb.fr>]
4117
4118  *) Add TLS key material exporter from RFC 5705.
4119     [Eric Rescorla]
4120
4121  *) Add DTLS-SRTP negotiation from RFC 5764.
4122     [Eric Rescorla]
4123
4124  *) Add Next Protocol Negotiation,
4125     http://tools.ietf.org/html/draft-agl-tls-nextprotoneg-00. Can be
4126     disabled with a no-npn flag to config or Configure. Code donated
4127     by Google.
4128     [Adam Langley <agl@google.com> and Ben Laurie]
4129
4130  *) Add optional 64-bit optimized implementations of elliptic curves NIST-P224,
4131     NIST-P256, NIST-P521, with constant-time single point multiplication on
4132     typical inputs. Compiler support for the nonstandard type __uint128_t is
4133     required to use this (present in gcc 4.4 and later, for 64-bit builds).
4134     Code made available under Apache License version 2.0.
4135
4136     Specify "enable-ec_nistp_64_gcc_128" on the Configure (or config) command
4137     line to include this in your build of OpenSSL, and run "make depend" (or
4138     "make update"). This enables the following EC_METHODs:
4139
4140         EC_GFp_nistp224_method()
4141         EC_GFp_nistp256_method()
4142         EC_GFp_nistp521_method()
4143
4144     EC_GROUP_new_by_curve_name() will automatically use these (while
4145     EC_GROUP_new_curve_GFp() currently prefers the more flexible
4146     implementations).
4147     [Emilia Käsper, Adam Langley, Bodo Moeller (Google)]
4148
4149  *) Use type ossl_ssize_t instead of ssize_t which isn't available on
4150     all platforms. Move ssize_t definition from e_os.h to the public
4151     header file e_os2.h as it now appears in public header file cms.h
4152     [Steve Henson]
4153
4154  *) New -sigopt option to the ca, req and x509 utilities. Additional
4155     signature parameters can be passed using this option and in
4156     particular PSS.
4157     [Steve Henson]
4158
4159  *) Add RSA PSS signing function. This will generate and set the
4160     appropriate AlgorithmIdentifiers for PSS based on those in the
4161     corresponding EVP_MD_CTX structure. No application support yet.
4162     [Steve Henson]
4163
4164  *) Support for companion algorithm specific ASN1 signing routines.
4165     New function ASN1_item_sign_ctx() signs a pre-initialised
4166     EVP_MD_CTX structure and sets AlgorithmIdentifiers based on
4167     the appropriate parameters.
4168     [Steve Henson]
4169
4170  *) Add new algorithm specific ASN1 verification initialisation function
4171     to EVP_PKEY_ASN1_METHOD: this is not in EVP_PKEY_METHOD since the ASN1
4172     handling will be the same no matter what EVP_PKEY_METHOD is used.
4173     Add a PSS handler to support verification of PSS signatures: checked
4174     against a number of sample certificates.
4175     [Steve Henson]
4176
4177  *) Add signature printing for PSS. Add PSS OIDs.
4178     [Steve Henson, Martin Kaiser <lists@kaiser.cx>]
4179
4180  *) Add algorithm specific signature printing. An individual ASN1 method
4181     can now print out signatures instead of the standard hex dump.
4182
4183     More complex signatures (e.g. PSS) can print out more meaningful
4184     information. Include DSA version that prints out the signature
4185     parameters r, s.
4186     [Steve Henson]
4187
4188  *) Password based recipient info support for CMS library: implementing
4189     RFC3211.
4190     [Steve Henson]
4191
4192  *) Split password based encryption into PBES2 and PBKDF2 functions. This
4193     neatly separates the code into cipher and PBE sections and is required
4194     for some algorithms that split PBES2 into separate pieces (such as
4195     password based CMS).
4196     [Steve Henson]
4197
4198  *) Session-handling fixes:
4199     - Fix handling of connections that are resuming with a session ID,
4200       but also support Session Tickets.
4201     - Fix a bug that suppressed issuing of a new ticket if the client
4202       presented a ticket with an expired session.
4203     - Try to set the ticket lifetime hint to something reasonable.
4204     - Make tickets shorter by excluding irrelevant information.
4205     - On the client side, don't ignore renewed tickets.
4206     [Adam Langley, Bodo Moeller (Google)]
4207
4208  *) Fix PSK session representation.
4209     [Bodo Moeller]
4210
4211  *) Add RC4-MD5 and AESNI-SHA1 "stitched" implementations.
4212
4213     This work was sponsored by Intel.
4214     [Andy Polyakov]
4215
4216  *) Add GCM support to TLS library. Some custom code is needed to split
4217     the IV between the fixed (from PRF) and explicit (from TLS record)
4218     portions. This adds all GCM ciphersuites supported by RFC5288 and
4219     RFC5289. Generalise some AES* cipherstrings to include GCM and
4220     add a special AESGCM string for GCM only.
4221     [Steve Henson]
4222
4223  *) Expand range of ctrls for AES GCM. Permit setting invocation
4224     field on decrypt and retrieval of invocation field only on encrypt.
4225     [Steve Henson]
4226
4227  *) Add HMAC ECC ciphersuites from RFC5289. Include SHA384 PRF support.
4228     As required by RFC5289 these ciphersuites cannot be used if for
4229     versions of TLS earlier than 1.2.
4230     [Steve Henson]
4231
4232  *) For FIPS capable OpenSSL interpret a NULL default public key method
4233     as unset and return the appropriate default but do *not* set the default.
4234     This means we can return the appropriate method in applications that
4235     switch between FIPS and non-FIPS modes.
4236     [Steve Henson]
4237
4238  *) Redirect HMAC and CMAC operations to FIPS module in FIPS mode. If an
4239     ENGINE is used then we cannot handle that in the FIPS module so we
4240     keep original code iff non-FIPS operations are allowed.
4241     [Steve Henson]
4242
4243  *) Add -attime option to openssl utilities.
4244     [Peter Eckersley <pde@eff.org>, Ben Laurie and Steve Henson]
4245
4246  *) Redirect DSA and DH operations to FIPS module in FIPS mode.
4247     [Steve Henson]
4248
4249  *) Redirect ECDSA and ECDH operations to FIPS module in FIPS mode. Also use
4250     FIPS EC methods unconditionally for now.
4251     [Steve Henson]
4252
4253  *) New build option no-ec2m to disable characteristic 2 code.
4254     [Steve Henson]
4255
4256  *) Backport libcrypto audit of return value checking from 1.1.0-dev; not
4257     all cases can be covered as some introduce binary incompatibilities.
4258     [Steve Henson]
4259
4260  *) Redirect RSA operations to FIPS module including keygen,
4261     encrypt, decrypt, sign and verify. Block use of non FIPS RSA methods.
4262     [Steve Henson]
4263
4264  *) Add similar low level API blocking to ciphers.
4265     [Steve Henson]
4266
4267  *) Low level digest APIs are not approved in FIPS mode: any attempt
4268     to use these will cause a fatal error. Applications that *really* want
4269     to use them can use the private_* version instead.
4270     [Steve Henson]
4271
4272  *) Redirect cipher operations to FIPS module for FIPS builds.
4273     [Steve Henson]
4274
4275  *) Redirect digest operations to FIPS module for FIPS builds.
4276     [Steve Henson]
4277
4278  *) Update build system to add "fips" flag which will link in fipscanister.o
4279     for static and shared library builds embedding a signature if needed.
4280     [Steve Henson]
4281
4282  *) Output TLS supported curves in preference order instead of numerical
4283     order. This is currently hardcoded for the highest order curves first.
4284     This should be configurable so applications can judge speed vs strength.
4285     [Steve Henson]
4286
4287  *) Add TLS v1.2 server support for client authentication.
4288     [Steve Henson]
4289
4290  *) Add support for FIPS mode in ssl library: disable SSLv3, non-FIPS ciphers
4291     and enable MD5.
4292     [Steve Henson]
4293
4294  *) Functions FIPS_mode_set() and FIPS_mode() which call the underlying
4295     FIPS modules versions.
4296     [Steve Henson]
4297
4298  *) Add TLS v1.2 client side support for client authentication. Keep cache
4299     of handshake records longer as we don't know the hash algorithm to use
4300     until after the certificate request message is received.
4301     [Steve Henson]
4302
4303  *) Initial TLS v1.2 client support. Add a default signature algorithms
4304     extension including all the algorithms we support. Parse new signature
4305     format in client key exchange. Relax some ECC signing restrictions for
4306     TLS v1.2 as indicated in RFC5246.
4307     [Steve Henson]
4308
4309  *) Add server support for TLS v1.2 signature algorithms extension. Switch
4310     to new signature format when needed using client digest preference.
4311     All server ciphersuites should now work correctly in TLS v1.2. No client
4312     support yet and no support for client certificates.
4313     [Steve Henson]
4314
4315  *) Initial TLS v1.2 support. Add new SHA256 digest to ssl code, switch
4316     to SHA256 for PRF when using TLS v1.2 and later. Add new SHA256 based
4317     ciphersuites. At present only RSA key exchange ciphersuites work with
4318     TLS v1.2. Add new option for TLS v1.2 replacing the old and obsolete
4319     SSL_OP_PKCS1_CHECK flags with SSL_OP_NO_TLSv1_2. New TLSv1.2 methods
4320     and version checking.
4321     [Steve Henson]
4322
4323  *) New option OPENSSL_NO_SSL_INTERN. If an application can be compiled
4324     with this defined it will not be affected by any changes to ssl internal
4325     structures. Add several utility functions to allow openssl application
4326     to work with OPENSSL_NO_SSL_INTERN defined.
4327     [Steve Henson]
4328
4329  *) A long standing patch to add support for SRP from EdelWeb (Peter
4330     Sylvester and Christophe Renou) was integrated.
4331     [Christophe Renou <christophe.renou@edelweb.fr>, Peter Sylvester
4332     <peter.sylvester@edelweb.fr>, Tom Wu <tjw@cs.stanford.edu>, and
4333     Ben Laurie]
4334
4335  *) Add functions to copy EVP_PKEY_METHOD and retrieve flags and id.
4336     [Steve Henson]
4337
4338  *) Permit abbreviated handshakes when renegotiating using the function
4339     SSL_renegotiate_abbreviated().
4340     [Robin Seggelmann <seggelmann@fh-muenster.de>]
4341
4342  *) Add call to ENGINE_register_all_complete() to
4343     ENGINE_load_builtin_engines(), so some implementations get used
4344     automatically instead of needing explicit application support.
4345     [Steve Henson]
4346
4347  *) Add support for TLS key exporter as described in RFC5705.
4348     [Robin Seggelmann <seggelmann@fh-muenster.de>, Steve Henson]
4349
4350  *) Initial TLSv1.1 support. Since TLSv1.1 is very similar to TLS v1.0 only
4351     a few changes are required:
4352
4353       Add SSL_OP_NO_TLSv1_1 flag.
4354       Add TLSv1_1 methods.
4355       Update version checking logic to handle version 1.1.
4356       Add explicit IV handling (ported from DTLS code).
4357       Add command line options to s_client/s_server.
4358     [Steve Henson]
4359
4360 Changes between 1.0.0g and 1.0.0h [12 Mar 2012]
4361
4362  *) Fix MMA (Bleichenbacher's attack on PKCS #1 v1.5 RSA padding) weakness
4363     in CMS and PKCS7 code. When RSA decryption fails use a random key for
4364     content decryption and always return the same error. Note: this attack
4365     needs on average 2^20 messages so it only affects automated senders. The
4366     old behaviour can be re-enabled in the CMS code by setting the
4367     CMS_DEBUG_DECRYPT flag: this is useful for debugging and testing where
4368     an MMA defence is not necessary.
4369     Thanks to Ivan Nestlerode <inestlerode@us.ibm.com> for discovering
4370     this issue. (CVE-2012-0884)
4371     [Steve Henson]
4372
4373  *) Fix CVE-2011-4619: make sure we really are receiving a
4374     client hello before rejecting multiple SGC restarts. Thanks to
4375     Ivan Nestlerode <inestlerode@us.ibm.com> for discovering this bug.
4376     [Steve Henson]
4377
4378 Changes between 1.0.0f and 1.0.0g [18 Jan 2012]
4379
4380  *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.
4381     Thanks to Antonio Martin, Enterprise Secure Access Research and
4382     Development, Cisco Systems, Inc. for discovering this bug and
4383     preparing a fix. (CVE-2012-0050)
4384     [Antonio Martin]
4385
4386 Changes between 1.0.0e and 1.0.0f [4 Jan 2012]
4387
4388  *) Nadhem Alfardan and Kenny Paterson have discovered an extension
4389     of the Vaudenay padding oracle attack on CBC mode encryption
4390     which enables an efficient plaintext recovery attack against
4391     the OpenSSL implementation of DTLS. Their attack exploits timing
4392     differences arising during decryption processing. A research
4393     paper describing this attack can be found at:
4394                  http://www.isg.rhul.ac.uk/~kp/dtls.pdf
4395     Thanks go to Nadhem Alfardan and Kenny Paterson of the Information
4396     Security Group at Royal Holloway, University of London
4397     (www.isg.rhul.ac.uk) for discovering this flaw and to Robin Seggelmann
4398     <seggelmann@fh-muenster.de> and Michael Tuexen <tuexen@fh-muenster.de>
4399     for preparing the fix. (CVE-2011-4108)
4400     [Robin Seggelmann, Michael Tuexen]
4401
4402  *) Clear bytes used for block padding of SSL 3.0 records.
4403     (CVE-2011-4576)
4404     [Adam Langley (Google)]
4405
4406  *) Only allow one SGC handshake restart for SSL/TLS. Thanks to George
4407     Kadianakis <desnacked@gmail.com> for discovering this issue and
4408     Adam Langley for preparing the fix. (CVE-2011-4619)
4409     [Adam Langley (Google)]
4410
4411  *) Check parameters are not NULL in GOST ENGINE. (CVE-2012-0027)
4412     [Andrey Kulikov <amdeich@gmail.com>]
4413
4414  *) Prevent malformed RFC3779 data triggering an assertion failure.
4415     Thanks to Andrew Chi, BBN Technologies, for discovering the flaw
4416     and Rob Austein <sra@hactrn.net> for fixing it. (CVE-2011-4577)
4417     [Rob Austein <sra@hactrn.net>]
4418
4419  *) Improved PRNG seeding for VOS.
4420     [Paul Green <Paul.Green@stratus.com>]
4421
4422  *) Fix ssl_ciph.c set-up race.
4423     [Adam Langley (Google)]
4424
4425  *) Fix spurious failures in ecdsatest.c.
4426     [Emilia Käsper (Google)]
4427
4428  *) Fix the BIO_f_buffer() implementation (which was mixing different
4429     interpretations of the '..._len' fields).
4430     [Adam Langley (Google)]
4431
4432  *) Fix handling of BN_BLINDING: now BN_BLINDING_invert_ex (rather than
4433     BN_BLINDING_invert_ex) calls BN_BLINDING_update, ensuring that concurrent
4434     threads won't reuse the same blinding coefficients.
4435
4436     This also avoids the need to obtain the CRYPTO_LOCK_RSA_BLINDING
4437     lock to call BN_BLINDING_invert_ex, and avoids one use of
4438     BN_BLINDING_update for each BN_BLINDING structure (previously,
4439     the last update always remained unused).
4440     [Emilia Käsper (Google)]
4441
4442  *) In ssl3_clear, preserve s3->init_extra along with s3->rbuf.
4443     [Bob Buckholz (Google)]
4444
4445 Changes between 1.0.0d and 1.0.0e [6 Sep 2011]
4446
4447  *) Fix bug where CRLs with nextUpdate in the past are sometimes accepted
4448     by initialising X509_STORE_CTX properly. (CVE-2011-3207)
4449     [Kaspar Brand <ossl@velox.ch>]
4450
4451  *) Fix SSL memory handling for (EC)DH ciphersuites, in particular
4452     for multi-threaded use of ECDH. (CVE-2011-3210)
4453     [Adam Langley (Google)]
4454
4455  *) Fix x509_name_ex_d2i memory leak on bad inputs.
4456     [Bodo Moeller]
4457
4458  *) Remove hard coded ecdsaWithSHA1 signature tests in ssl code and check
4459     signature public key algorithm by using OID xref utilities instead.
4460     Before this you could only use some ECC ciphersuites with SHA1 only.
4461     [Steve Henson]
4462
4463  *) Add protection against ECDSA timing attacks as mentioned in the paper
4464     by Billy Bob Brumley and Nicola Tuveri, see:
4465
4466        http://eprint.iacr.org/2011/232.pdf
4467
4468     [Billy Bob Brumley and Nicola Tuveri]
4469
4470 Changes between 1.0.0c and 1.0.0d [8 Feb 2011]
4471
4472  *) Fix parsing of OCSP stapling ClientHello extension. CVE-2011-0014
4473     [Neel Mehta, Adam Langley, Bodo Moeller (Google)]
4474
4475  *) Fix bug in string printing code: if *any* escaping is enabled we must
4476     escape the escape character (backslash) or the resulting string is
4477     ambiguous.
4478     [Steve Henson]
4479
4480 Changes between 1.0.0b and 1.0.0c  [2 Dec 2010]
4481
4482  *) Disable code workaround for ancient and obsolete Netscape browsers
4483     and servers: an attacker can use it in a ciphersuite downgrade attack.
4484     Thanks to Martin Rex for discovering this bug. CVE-2010-4180
4485     [Steve Henson]
4486
4487  *) Fixed J-PAKE implementation error, originally discovered by
4488     Sebastien Martini, further info and confirmation from Stefan
4489     Arentz and Feng Hao. Note that this fix is a security fix. CVE-2010-4252
4490     [Ben Laurie]
4491
4492 Changes between 1.0.0a and 1.0.0b  [16 Nov 2010]
4493
4494  *) Fix extension code to avoid race conditions which can result in a buffer
4495     overrun vulnerability: resumed sessions must not be modified as they can
4496     be shared by multiple threads. CVE-2010-3864
4497     [Steve Henson]
4498
4499  *) Fix WIN32 build system to correctly link an ENGINE directory into
4500     a DLL.
4501     [Steve Henson]
4502
4503 Changes between 1.0.0 and 1.0.0a  [01 Jun 2010]
4504
4505  *) Check return value of int_rsa_verify in pkey_rsa_verifyrecover
4506     (CVE-2010-1633)
4507     [Steve Henson, Peter-Michael Hager <hager@dortmund.net>]
4508
4509 Changes between 0.9.8n and 1.0.0  [29 Mar 2010]
4510
4511  *) Add "missing" function EVP_CIPHER_CTX_copy(). This copies a cipher
4512     context. The operation can be customised via the ctrl mechanism in
4513     case ENGINEs want to include additional functionality.
4514     [Steve Henson]
4515
4516  *) Tolerate yet another broken PKCS#8 key format: private key value negative.
4517     [Steve Henson]
4518
4519  *) Add new -subject_hash_old and -issuer_hash_old options to x509 utility to
4520     output hashes compatible with older versions of OpenSSL.
4521     [Willy Weisz <weisz@vcpc.univie.ac.at>]
4522
4523  *) Fix compression algorithm handling: if resuming a session use the
4524     compression algorithm of the resumed session instead of determining
4525     it from client hello again. Don't allow server to change algorithm.
4526     [Steve Henson]
4527
4528  *) Add load_crls() function to apps tidying load_certs() too. Add option
4529     to verify utility to allow additional CRLs to be included.
4530     [Steve Henson]
4531
4532  *) Update OCSP request code to permit adding custom headers to the request:
4533     some responders need this.
4534     [Steve Henson]
4535
4536  *) The function EVP_PKEY_sign() returns <=0 on error: check return code
4537     correctly.
4538     [Julia Lawall <julia@diku.dk>]
4539
4540  *) Update verify callback code in apps/s_cb.c and apps/verify.c, it
4541     needlessly dereferenced structures, used obsolete functions and
4542     didn't handle all updated verify codes correctly.
4543     [Steve Henson]
4544
4545  *) Disable MD2 in the default configuration.
4546     [Steve Henson]
4547
4548  *) In BIO_pop() and BIO_push() use the ctrl argument (which was NULL) to
4549     indicate the initial BIO being pushed or popped. This makes it possible
4550     to determine whether the BIO is the one explicitly called or as a result
4551     of the ctrl being passed down the chain. Fix BIO_pop() and SSL BIOs so
4552     it handles reference counts correctly and doesn't zero out the I/O bio
4553     when it is not being explicitly popped. WARNING: applications which
4554     included workarounds for the old buggy behaviour will need to be modified
4555     or they could free up already freed BIOs.
4556     [Steve Henson]
4557
4558  *) Extend the uni2asc/asc2uni => OPENSSL_uni2asc/OPENSSL_asc2uni
4559     renaming to all platforms (within the 0.9.8 branch, this was
4560     done conditionally on Netware platforms to avoid a name clash).
4561     [Guenter <lists@gknw.net>]
4562
4563  *) Add ECDHE and PSK support to DTLS.
4564     [Michael Tuexen <tuexen@fh-muenster.de>]
4565
4566  *) Add CHECKED_STACK_OF macro to safestack.h, otherwise safestack can't
4567     be used on C++.
4568     [Steve Henson]
4569
4570  *) Add "missing" function EVP_MD_flags() (without this the only way to
4571     retrieve a digest flags is by accessing the structure directly. Update
4572     EVP_MD_do_all*() and EVP_CIPHER_do_all*() to include the name a digest
4573     or cipher is registered as in the "from" argument. Print out all
4574     registered digests in the dgst usage message instead of manually
4575     attempting to work them out.
4576     [Steve Henson]
4577
4578  *) If no SSLv2 ciphers are used don't use an SSLv2 compatible client hello:
4579     this allows the use of compression and extensions. Change default cipher
4580     string to remove SSLv2 ciphersuites. This effectively avoids ancient SSLv2
4581     by default unless an application cipher string requests it.
4582     [Steve Henson]
4583
4584  *) Alter match criteria in PKCS12_parse(). It used to try to use local
4585     key ids to find matching certificates and keys but some PKCS#12 files
4586     don't follow the (somewhat unwritten) rules and this strategy fails.
4587     Now just gather all certificates together and the first private key
4588     then look for the first certificate that matches the key.
4589     [Steve Henson]
4590
4591  *) Support use of registered digest and cipher names for dgst and cipher
4592     commands instead of having to add each one as a special case. So now
4593     you can do:
4594
4595        openssl sha256 foo
4596
4597     as well as:
4598
4599        openssl dgst -sha256 foo
4600
4601     and this works for ENGINE based algorithms too.
4602
4603     [Steve Henson]
4604
4605  *) Update Gost ENGINE to support parameter files.
4606     [Victor B. Wagner <vitus@cryptocom.ru>]
4607
4608  *) Support GeneralizedTime in ca utility.
4609     [Oliver Martin <oliver@volatilevoid.net>, Steve Henson]
4610
4611  *) Enhance the hash format used for certificate directory links. The new
4612     form uses the canonical encoding (meaning equivalent names will work
4613     even if they aren't identical) and uses SHA1 instead of MD5. This form
4614     is incompatible with the older format and as a result c_rehash should
4615     be used to rebuild symbolic links.
4616     [Steve Henson]
4617
4618  *) Make PKCS#8 the default write format for private keys, replacing the
4619     traditional format. This form is standardised, more secure and doesn't
4620     include an implicit MD5 dependency.
4621     [Steve Henson]
4622
4623  *) Add a $gcc_devteam_warn option to Configure. The idea is that any code
4624     committed to OpenSSL should pass this lot as a minimum.
4625     [Steve Henson]
4626
4627  *) Add session ticket override functionality for use by EAP-FAST.
4628     [Jouni Malinen <j@w1.fi>]
4629
4630  *) Modify HMAC functions to return a value. Since these can be implemented
4631     in an ENGINE errors can occur.
4632     [Steve Henson]
4633
4634  *) Type-checked OBJ_bsearch_ex.
4635     [Ben Laurie]
4636
4637  *) Type-checked OBJ_bsearch. Also some constification necessitated
4638     by type-checking.  Still to come: TXT_DB, bsearch(?),
4639     OBJ_bsearch_ex, qsort, CRYPTO_EX_DATA, ASN1_VALUE, ASN1_STRING,
4640     CONF_VALUE.
4641     [Ben Laurie]
4642
4643  *) New function OPENSSL_gmtime_adj() to add a specific number of days and
4644     seconds to a tm structure directly, instead of going through OS
4645     specific date routines. This avoids any issues with OS routines such
4646     as the year 2038 bug. New *_adj() functions for ASN1 time structures
4647     and X509_time_adj_ex() to cover the extended range. The existing
4648     X509_time_adj() is still usable and will no longer have any date issues.
4649     [Steve Henson]
4650
4651  *) Delta CRL support. New use deltas option which will attempt to locate
4652     and search any appropriate delta CRLs available.
4653
4654     This work was sponsored by Google.
4655     [Steve Henson]
4656
4657  *) Support for CRLs partitioned by reason code. Reorganise CRL processing
4658     code and add additional score elements. Validate alternate CRL paths
4659     as part of the CRL checking and indicate a new error "CRL path validation
4660     error" in this case. Applications wanting additional details can use
4661     the verify callback and check the new "parent" field. If this is not
4662     NULL CRL path validation is taking place. Existing applications won't
4663     see this because it requires extended CRL support which is off by
4664     default.
4665
4666     This work was sponsored by Google.
4667     [Steve Henson]
4668
4669  *) Support for freshest CRL extension.
4670
4671     This work was sponsored by Google.
4672     [Steve Henson]
4673
4674  *) Initial indirect CRL support. Currently only supported in the CRLs
4675     passed directly and not via lookup. Process certificate issuer
4676     CRL entry extension and lookup CRL entries by bother issuer name
4677     and serial number. Check and process CRL issuer entry in IDP extension.
4678
4679     This work was sponsored by Google.
4680     [Steve Henson]
4681
4682  *) Add support for distinct certificate and CRL paths. The CRL issuer
4683     certificate is validated separately in this case. Only enabled if
4684     an extended CRL support flag is set: this flag will enable additional
4685     CRL functionality in future.
4686
4687     This work was sponsored by Google.
4688     [Steve Henson]
4689
4690  *) Add support for policy mappings extension.
4691
4692     This work was sponsored by Google.
4693     [Steve Henson]
4694
4695  *) Fixes to pathlength constraint, self issued certificate handling,
4696     policy processing to align with RFC3280 and PKITS tests.
4697
4698     This work was sponsored by Google.
4699     [Steve Henson]
4700
4701  *) Support for name constraints certificate extension. DN, email, DNS
4702     and URI types are currently supported.
4703
4704     This work was sponsored by Google.
4705     [Steve Henson]
4706
4707  *) To cater for systems that provide a pointer-based thread ID rather
4708     than numeric, deprecate the current numeric thread ID mechanism and
4709     replace it with a structure and associated callback type. This
4710     mechanism allows a numeric "hash" to be extracted from a thread ID in
4711     either case, and on platforms where pointers are larger than 'long',
4712     mixing is done to help ensure the numeric 'hash' is usable even if it
4713     can't be guaranteed unique. The default mechanism is to use "&errno"
4714     as a pointer-based thread ID to distinguish between threads.
4715
4716     Applications that want to provide their own thread IDs should now use
4717     CRYPTO_THREADID_set_callback() to register a callback that will call
4718     either CRYPTO_THREADID_set_numeric() or CRYPTO_THREADID_set_pointer().
4719
4720     Note that ERR_remove_state() is now deprecated, because it is tied
4721     to the assumption that thread IDs are numeric.  ERR_remove_state(0)
4722     to free the current thread's error state should be replaced by
4723     ERR_remove_thread_state(NULL).
4724
4725     (This new approach replaces the functions CRYPTO_set_idptr_callback(),
4726     CRYPTO_get_idptr_callback(), and CRYPTO_thread_idptr() that existed in
4727     OpenSSL 0.9.9-dev between June 2006 and August 2008. Also, if an
4728     application was previously providing a numeric thread callback that
4729     was inappropriate for distinguishing threads, then uniqueness might
4730     have been obtained with &errno that happened immediately in the
4731     intermediate development versions of OpenSSL; this is no longer the
4732     case, the numeric thread callback will now override the automatic use
4733     of &errno.)
4734     [Geoff Thorpe, with help from Bodo Moeller]
4735
4736  *) Initial support for different CRL issuing certificates. This covers a
4737     simple case where the self issued certificates in the chain exist and
4738     the real CRL issuer is higher in the existing chain.
4739
4740     This work was sponsored by Google.
4741     [Steve Henson]
4742
4743  *) Removed effectively defunct crypto/store from the build.
4744     [Ben Laurie]
4745
4746  *) Revamp of STACK to provide stronger type-checking. Still to come:
4747     TXT_DB, bsearch(?), OBJ_bsearch, qsort, CRYPTO_EX_DATA, ASN1_VALUE,
4748     ASN1_STRING, CONF_VALUE.
4749     [Ben Laurie]
4750
4751  *) Add a new SSL_MODE_RELEASE_BUFFERS mode flag to release unused buffer
4752     RAM on SSL connections.  This option can save about 34k per idle SSL.
4753     [Nick Mathewson]
4754
4755  *) Revamp of LHASH to provide stronger type-checking. Still to come:
4756     STACK, TXT_DB, bsearch, qsort.
4757     [Ben Laurie]
4758
4759  *) Initial support for Cryptographic Message Syntax (aka CMS) based
4760     on RFC3850, RFC3851 and RFC3852. New cms directory and cms utility,
4761     support for data, signedData, compressedData, digestedData and
4762     encryptedData, envelopedData types included. Scripts to check against
4763     RFC4134 examples draft and interop and consistency checks of many
4764     content types and variants.
4765     [Steve Henson]
4766
4767  *) Add options to enc utility to support use of zlib compression BIO.
4768     [Steve Henson]
4769
4770  *) Extend mk1mf to support importing of options and assembly language
4771     files from Configure script, currently only included in VC-WIN32.
4772     The assembly language rules can now optionally generate the source
4773     files from the associated perl scripts.
4774     [Steve Henson]
4775
4776  *) Implement remaining functionality needed to support GOST ciphersuites.
4777     Interop testing has been performed using CryptoPro implementations.
4778     [Victor B. Wagner <vitus@cryptocom.ru>]
4779
4780  *) s390x assembler pack.
4781     [Andy Polyakov]
4782
4783  *) ARMv4 assembler pack. ARMv4 refers to v4 and later ISA, not CPU
4784     "family."
4785     [Andy Polyakov]
4786
4787  *) Implement Opaque PRF Input TLS extension as specified in
4788     draft-rescorla-tls-opaque-prf-input-00.txt.  Since this is not an
4789     official specification yet and no extension type assignment by
4790     IANA exists, this extension (for now) will have to be explicitly
4791     enabled when building OpenSSL by providing the extension number
4792     to use.  For example, specify an option
4793
4794         -DTLSEXT_TYPE_opaque_prf_input=0x9527
4795
4796     to the "config" or "Configure" script to enable the extension,
4797     assuming extension number 0x9527 (which is a completely arbitrary
4798     and unofficial assignment based on the MD5 hash of the Internet
4799     Draft).  Note that by doing so, you potentially lose
4800     interoperability with other TLS implementations since these might
4801     be using the same extension number for other purposes.
4802
4803     SSL_set_tlsext_opaque_prf_input(ssl, src, len) is used to set the
4804     opaque PRF input value to use in the handshake.  This will create
4805     an internal copy of the length-'len' string at 'src', and will
4806     return non-zero for success.
4807
4808     To get more control and flexibility, provide a callback function
4809     by using
4810
4811          SSL_CTX_set_tlsext_opaque_prf_input_callback(ctx, cb)
4812          SSL_CTX_set_tlsext_opaque_prf_input_callback_arg(ctx, arg)
4813
4814     where
4815
4816          int (*cb)(SSL *, void *peerinput, size_t len, void *arg);
4817          void *arg;
4818
4819     Callback function 'cb' will be called in handshakes, and is
4820     expected to use SSL_set_tlsext_opaque_prf_input() as appropriate.
4821     Argument 'arg' is for application purposes (the value as given to
4822     SSL_CTX_set_tlsext_opaque_prf_input_callback_arg() will directly
4823     be provided to the callback function).  The callback function
4824     has to return non-zero to report success: usually 1 to use opaque
4825     PRF input just if possible, or 2 to enforce use of the opaque PRF
4826     input.  In the latter case, the library will abort the handshake
4827     if opaque PRF input is not successfully negotiated.
4828
4829     Arguments 'peerinput' and 'len' given to the callback function
4830     will always be NULL and 0 in the case of a client.  A server will
4831     see the client's opaque PRF input through these variables if
4832     available (NULL and 0 otherwise).  Note that if the server
4833     provides an opaque PRF input, the length must be the same as the
4834     length of the client's opaque PRF input.
4835
4836     Note that the callback function will only be called when creating
4837     a new session (session resumption can resume whatever was
4838     previously negotiated), and will not be called in SSL 2.0
4839     handshakes; thus, SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) or
4840     SSL_set_options(ssl, SSL_OP_NO_SSLv2) is especially recommended
4841     for applications that need to enforce opaque PRF input.
4842
4843     [Bodo Moeller]
4844
4845  *) Update ssl code to support digests other than SHA1+MD5 for handshake
4846     MAC.
4847
4848     [Victor B. Wagner <vitus@cryptocom.ru>]
4849
4850  *) Add RFC4507 support to OpenSSL. This includes the corrections in
4851     RFC4507bis. The encrypted ticket format is an encrypted encoded
4852     SSL_SESSION structure, that way new session features are automatically
4853     supported.
4854
4855     If a client application caches session in an SSL_SESSION structure
4856     support is transparent because tickets are now stored in the encoded
4857     SSL_SESSION.
4858
4859     The SSL_CTX structure automatically generates keys for ticket
4860     protection in servers so again support should be possible
4861     with no application modification.
4862
4863     If a client or server wishes to disable RFC4507 support then the option
4864     SSL_OP_NO_TICKET can be set.
4865
4866     Add a TLS extension debugging callback to allow the contents of any client
4867     or server extensions to be examined.
4868
4869     This work was sponsored by Google.
4870     [Steve Henson]
4871
4872  *) Final changes to avoid use of pointer pointer casts in OpenSSL.
4873     OpenSSL should now compile cleanly on gcc 4.2
4874     [Peter Hartley <pdh@utter.chaos.org.uk>, Steve Henson]
4875
4876  *) Update SSL library to use new EVP_PKEY MAC API. Include generic MAC
4877     support including streaming MAC support: this is required for GOST
4878     ciphersuite support.
4879     [Victor B. Wagner <vitus@cryptocom.ru>, Steve Henson]
4880
4881  *) Add option -stream to use PKCS#7 streaming in smime utility. New
4882     function i2d_PKCS7_bio_stream() and PEM_write_PKCS7_bio_stream()
4883     to output in BER and PEM format.
4884     [Steve Henson]
4885
4886  *) Experimental support for use of HMAC via EVP_PKEY interface. This
4887     allows HMAC to be handled via the EVP_DigestSign*() interface. The
4888     EVP_PKEY "key" in this case is the HMAC key, potentially allowing
4889     ENGINE support for HMAC keys which are unextractable. New -mac and
4890     -macopt options to dgst utility.
4891     [Steve Henson]
4892
4893  *) New option -sigopt to dgst utility. Update dgst to use
4894     EVP_Digest{Sign,Verify}*. These two changes make it possible to use
4895     alternative signing parameters such as X9.31 or PSS in the dgst
4896     utility.
4897     [Steve Henson]
4898
4899  *) Change ssl_cipher_apply_rule(), the internal function that does
4900     the work each time a ciphersuite string requests enabling
4901     ("foo+bar"), moving ("+foo+bar"), disabling ("-foo+bar", or
4902     removing ("!foo+bar") a class of ciphersuites: Now it maintains
4903     the order of disabled ciphersuites such that those ciphersuites
4904     that most recently went from enabled to disabled not only stay
4905     in order with respect to each other, but also have higher priority
4906     than other disabled ciphersuites the next time ciphersuites are
4907     enabled again.
4908
4909     This means that you can now say, e.g., "PSK:-PSK:HIGH" to enable
4910     the same ciphersuites as with "HIGH" alone, but in a specific
4911     order where the PSK ciphersuites come first (since they are the
4912     most recently disabled ciphersuites when "HIGH" is parsed).
4913
4914     Also, change ssl_create_cipher_list() (using this new
4915     functionality) such that between otherwise identical
4916     ciphersuites, ephemeral ECDH is preferred over ephemeral DH in
4917     the default order.
4918     [Bodo Moeller]
4919
4920  *) Change ssl_create_cipher_list() so that it automatically
4921     arranges the ciphersuites in reasonable order before starting
4922     to process the rule string.  Thus, the definition for "DEFAULT"
4923     (SSL_DEFAULT_CIPHER_LIST) now is just "ALL:!aNULL:!eNULL", but
4924     remains equivalent to "AES:ALL:!aNULL:!eNULL:+aECDH:+kRSA:+RC4:@STRENGTH".
4925     This makes it much easier to arrive at a reasonable default order
4926     in applications for which anonymous ciphers are OK (meaning
4927     that you can't actually use DEFAULT).
4928     [Bodo Moeller; suggested by Victor Duchovni]
4929
4930  *) Split the SSL/TLS algorithm mask (as used for ciphersuite string
4931     processing) into multiple integers instead of setting
4932     "SSL_MKEY_MASK" bits, "SSL_AUTH_MASK" bits, "SSL_ENC_MASK",
4933     "SSL_MAC_MASK", and "SSL_SSL_MASK" bits all in a single integer.
4934     (These masks as well as the individual bit definitions are hidden
4935     away into the non-exported interface ssl/ssl_locl.h, so this
4936     change to the definition of the SSL_CIPHER structure shouldn't
4937     affect applications.)  This give us more bits for each of these
4938     categories, so there is no longer a need to coagulate AES128 and
4939     AES256 into a single algorithm bit, and to coagulate Camellia128
4940     and Camellia256 into a single algorithm bit, which has led to all
4941     kinds of kludges.
4942
4943     Thus, among other things, the kludge introduced in 0.9.7m and
4944     0.9.8e for masking out AES256 independently of AES128 or masking
4945     out Camellia256 independently of AES256 is not needed here in 0.9.9.
4946
4947     With the change, we also introduce new ciphersuite aliases that
4948     so far were missing: "AES128", "AES256", "CAMELLIA128", and
4949     "CAMELLIA256".
4950     [Bodo Moeller]
4951
4952  *) Add support for dsa-with-SHA224 and dsa-with-SHA256.
4953     Use the leftmost N bytes of the signature input if the input is
4954     larger than the prime q (with N being the size in bytes of q).
4955     [Nils Larsch]
4956
4957  *) Very *very* experimental PKCS#7 streaming encoder support. Nothing uses
4958     it yet and it is largely untested.
4959     [Steve Henson]
4960
4961  *) Add support for the ecdsa-with-SHA224/256/384/512 signature types.
4962     [Nils Larsch]
4963
4964  *) Initial incomplete changes to avoid need for function casts in OpenSSL
4965     some compilers (gcc 4.2 and later) reject their use. Safestack is
4966     reimplemented.  Update ASN1 to avoid use of legacy functions.
4967     [Steve Henson]
4968
4969  *) Win32/64 targets are linked with Winsock2.
4970     [Andy Polyakov]
4971
4972  *) Add an X509_CRL_METHOD structure to allow CRL processing to be redirected
4973     to external functions. This can be used to increase CRL handling
4974     efficiency especially when CRLs are very large by (for example) storing
4975     the CRL revoked certificates in a database.
4976     [Steve Henson]
4977
4978  *) Overhaul of by_dir code. Add support for dynamic loading of CRLs so
4979     new CRLs added to a directory can be used. New command line option
4980     -verify_return_error to s_client and s_server. This causes real errors
4981     to be returned by the verify callback instead of carrying on no matter
4982     what. This reflects the way a "real world" verify callback would behave.
4983     [Steve Henson]
4984
4985  *) GOST engine, supporting several GOST algorithms and public key formats.
4986     Kindly donated by Cryptocom.
4987     [Cryptocom]
4988
4989  *) Partial support for Issuing Distribution Point CRL extension. CRLs
4990     partitioned by DP are handled but no indirect CRL or reason partitioning
4991     (yet). Complete overhaul of CRL handling: now the most suitable CRL is
4992     selected via a scoring technique which handles IDP and AKID in CRLs.
4993     [Steve Henson]
4994
4995  *) New X509_STORE_CTX callbacks lookup_crls() and lookup_certs() which
4996     will ultimately be used for all verify operations: this will remove the
4997     X509_STORE dependency on certificate verification and allow alternative
4998     lookup methods.  X509_STORE based implementations of these two callbacks.
4999     [Steve Henson]
5000
5001  *) Allow multiple CRLs to exist in an X509_STORE with matching issuer names.
5002     Modify get_crl() to find a valid (unexpired) CRL if possible.
5003     [Steve Henson]
5004
5005  *) New function X509_CRL_match() to check if two CRLs are identical. Normally
5006     this would be called X509_CRL_cmp() but that name is already used by
5007     a function that just compares CRL issuer names. Cache several CRL
5008     extensions in X509_CRL structure and cache CRLDP in X509.
5009     [Steve Henson]
5010
5011  *) Store a "canonical" representation of X509_NAME structure (ASN1 Name)
5012     this maps equivalent X509_NAME structures into a consistent structure.
5013     Name comparison can then be performed rapidly using memcmp().
5014     [Steve Henson]
5015
5016  *) Non-blocking OCSP request processing. Add -timeout option to ocsp
5017     utility.
5018     [Steve Henson]
5019
5020  *) Allow digests to supply their own micalg string for S/MIME type using
5021     the ctrl EVP_MD_CTRL_MICALG.
5022     [Steve Henson]
5023
5024  *) During PKCS7 signing pass the PKCS7 SignerInfo structure to the
5025     EVP_PKEY_METHOD before and after signing via the EVP_PKEY_CTRL_PKCS7_SIGN
5026     ctrl. It can then customise the structure before and/or after signing
5027     if necessary.
5028     [Steve Henson]
5029
5030  *) New function OBJ_add_sigid() to allow application defined signature OIDs
5031     to be added to OpenSSLs internal tables. New function OBJ_sigid_free()
5032     to free up any added signature OIDs.
5033     [Steve Henson]
5034
5035  *) New functions EVP_CIPHER_do_all(), EVP_CIPHER_do_all_sorted(),
5036     EVP_MD_do_all() and EVP_MD_do_all_sorted() to enumerate internal
5037     digest and cipher tables. New options added to openssl utility:
5038     list-message-digest-algorithms and list-cipher-algorithms.
5039     [Steve Henson]
5040
5041  *) Change the array representation of binary polynomials: the list
5042     of degrees of non-zero coefficients is now terminated with -1.
5043     Previously it was terminated with 0, which was also part of the
5044     value; thus, the array representation was not applicable to
5045     polynomials where t^0 has coefficient zero.  This change makes
5046     the array representation useful in a more general context.
5047     [Douglas Stebila]
5048
5049  *) Various modifications and fixes to SSL/TLS cipher string
5050     handling.  For ECC, the code now distinguishes between fixed ECDH
5051     with RSA certificates on the one hand and with ECDSA certificates
5052     on the other hand, since these are separate ciphersuites.  The
5053     unused code for Fortezza ciphersuites has been removed.
5054
5055     For consistency with EDH, ephemeral ECDH is now called "EECDH"
5056     (not "ECDHE").  For consistency with the code for DH
5057     certificates, use of ECDH certificates is now considered ECDH
5058     authentication, not RSA or ECDSA authentication (the latter is
5059     merely the CA's signing algorithm and not actively used in the
5060     protocol).
5061
5062     The temporary ciphersuite alias "ECCdraft" is no longer
5063     available, and ECC ciphersuites are no longer excluded from "ALL"
5064     and "DEFAULT".  The following aliases now exist for RFC 4492
5065     ciphersuites, most of these by analogy with the DH case:
5066
5067         kECDHr   - ECDH cert, signed with RSA
5068         kECDHe   - ECDH cert, signed with ECDSA
5069         kECDH    - ECDH cert (signed with either RSA or ECDSA)
5070         kEECDH   - ephemeral ECDH
5071         ECDH     - ECDH cert or ephemeral ECDH
5072
5073         aECDH    - ECDH cert
5074         aECDSA   - ECDSA cert
5075         ECDSA    - ECDSA cert
5076
5077         AECDH    - anonymous ECDH
5078         EECDH    - non-anonymous ephemeral ECDH (equivalent to "kEECDH:-AECDH")
5079
5080     [Bodo Moeller]
5081
5082  *) Add additional S/MIME capabilities for AES and GOST ciphers if supported.
5083     Use correct micalg parameters depending on digest(s) in signed message.
5084     [Steve Henson]
5085
5086  *) Add engine support for EVP_PKEY_ASN1_METHOD. Add functions to process
5087     an ENGINE asn1 method. Support ENGINE lookups in the ASN1 code.
5088     [Steve Henson]
5089
5090  *) Initial engine support for EVP_PKEY_METHOD. New functions to permit
5091     an engine to register a method. Add ENGINE lookups for methods and
5092     functional reference processing.
5093     [Steve Henson]
5094
5095  *) New functions EVP_Digest{Sign,Verify)*. These are enhanced versions of
5096     EVP_{Sign,Verify}* which allow an application to customise the signature
5097     process.
5098     [Steve Henson]
5099
5100  *) New -resign option to smime utility. This adds one or more signers
5101     to an existing PKCS#7 signedData structure. Also -md option to use an
5102     alternative message digest algorithm for signing.
5103     [Steve Henson]
5104
5105  *) Tidy up PKCS#7 routines and add new functions to make it easier to
5106     create PKCS7 structures containing multiple signers. Update smime
5107     application to support multiple signers.
5108     [Steve Henson]
5109
5110  *) New -macalg option to pkcs12 utility to allow setting of an alternative
5111     digest MAC.
5112     [Steve Henson]
5113
5114  *) Initial support for PKCS#5 v2.0 PRFs other than default SHA1 HMAC.
5115     Reorganize PBE internals to lookup from a static table using NIDs,
5116     add support for HMAC PBE OID translation. Add a EVP_CIPHER ctrl:
5117     EVP_CTRL_PBE_PRF_NID this allows a cipher to specify an alternative
5118     PRF which will be automatically used with PBES2.
5119     [Steve Henson]
5120
5121  *) Replace the algorithm specific calls to generate keys in "req" with the
5122     new API.
5123     [Steve Henson]
5124
5125  *) Update PKCS#7 enveloped data routines to use new API. This is now
5126     supported by any public key method supporting the encrypt operation. A
5127     ctrl is added to allow the public key algorithm to examine or modify
5128     the PKCS#7 RecipientInfo structure if it needs to: for RSA this is
5129     a no op.
5130     [Steve Henson]
5131
5132  *) Add a ctrl to asn1 method to allow a public key algorithm to express
5133     a default digest type to use. In most cases this will be SHA1 but some
5134     algorithms (such as GOST) need to specify an alternative digest. The
5135     return value indicates how strong the preference is 1 means optional and
5136     2 is mandatory (that is it is the only supported type). Modify
5137     ASN1_item_sign() to accept a NULL digest argument to indicate it should
5138     use the default md. Update openssl utilities to use the default digest
5139     type for signing if it is not explicitly indicated.
5140     [Steve Henson]
5141
5142  *) Use OID cross reference table in ASN1_sign() and ASN1_verify(). New
5143     EVP_MD flag EVP_MD_FLAG_PKEY_METHOD_SIGNATURE. This uses the relevant
5144     signing method from the key type. This effectively removes the link
5145     between digests and public key types.
5146     [Steve Henson]
5147
5148  *) Add an OID cross reference table and utility functions. Its purpose is to
5149     translate between signature OIDs such as SHA1WithrsaEncryption and SHA1,
5150     rsaEncryption. This will allow some of the algorithm specific hackery
5151     needed to use the correct OID to be removed.
5152     [Steve Henson]
5153
5154  *) Remove algorithm specific dependencies when setting PKCS7_SIGNER_INFO
5155     structures for PKCS7_sign(). They are now set up by the relevant public
5156     key ASN1 method.
5157     [Steve Henson]
5158
5159  *) Add provisional EC pkey method with support for ECDSA and ECDH.
5160     [Steve Henson]
5161
5162  *) Add support for key derivation (agreement) in the API, DH method and
5163     pkeyutl.
5164     [Steve Henson]
5165
5166  *) Add DSA pkey method and DH pkey methods, extend DH ASN1 method to support
5167     public and private key formats. As a side effect these add additional
5168     command line functionality not previously available: DSA signatures can be
5169     generated and verified using pkeyutl and DH key support and generation in
5170     pkey, genpkey.
5171     [Steve Henson]
5172
5173  *) BeOS support.
5174     [Oliver Tappe <zooey@hirschkaefer.de>]
5175
5176  *) New make target "install_html_docs" installs HTML renditions of the
5177     manual pages.
5178     [Oliver Tappe <zooey@hirschkaefer.de>]
5179
5180  *) New utility "genpkey" this is analogous to "genrsa" etc except it can
5181     generate keys for any algorithm. Extend and update EVP_PKEY_METHOD to
5182     support key and parameter generation and add initial key generation
5183     functionality for RSA.
5184     [Steve Henson]
5185
5186  *) Add functions for main EVP_PKEY_method operations. The undocumented
5187     functions EVP_PKEY_{encrypt,decrypt} have been renamed to
5188     EVP_PKEY_{encrypt,decrypt}_old.
5189     [Steve Henson]
5190
5191  *) Initial definitions for EVP_PKEY_METHOD. This will be a high level public
5192     key API, doesn't do much yet.
5193     [Steve Henson]
5194
5195  *) New function EVP_PKEY_asn1_get0_info() to retrieve information about
5196     public key algorithms. New option to openssl utility:
5197     "list-public-key-algorithms" to print out info.
5198     [Steve Henson]
5199
5200  *) Implement the Supported Elliptic Curves Extension for
5201     ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
5202     [Douglas Stebila]
5203
5204  *) Don't free up OIDs in OBJ_cleanup() if they are in use by EVP_MD or
5205     EVP_CIPHER structures to avoid later problems in EVP_cleanup().
5206     [Steve Henson]
5207
5208  *) New utilities pkey and pkeyparam. These are similar to algorithm specific
5209     utilities such as rsa, dsa, dsaparam etc except they process any key
5210     type.
5211     [Steve Henson]
5212
5213  *) Transfer public key printing routines to EVP_PKEY_ASN1_METHOD. New
5214     functions EVP_PKEY_print_public(), EVP_PKEY_print_private(),
5215     EVP_PKEY_print_param() to print public key data from an EVP_PKEY
5216     structure.
5217     [Steve Henson]
5218
5219  *) Initial support for pluggable public key ASN1.
5220     De-spaghettify the public key ASN1 handling. Move public and private
5221     key ASN1 handling to a new EVP_PKEY_ASN1_METHOD structure. Relocate
5222     algorithm specific handling to a single module within the relevant
5223     algorithm directory. Add functions to allow (near) opaque processing
5224     of public and private key structures.
5225     [Steve Henson]
5226
5227  *) Implement the Supported Point Formats Extension for
5228     ECC ciphersuites from draft-ietf-tls-ecc-12.txt.
5229     [Douglas Stebila]
5230
5231  *) Add initial support for RFC 4279 PSK TLS ciphersuites. Add members
5232     for the psk identity [hint] and the psk callback functions to the
5233     SSL_SESSION, SSL and SSL_CTX structure.
5234
5235     New ciphersuites:
5236         PSK-RC4-SHA, PSK-3DES-EDE-CBC-SHA, PSK-AES128-CBC-SHA,
5237         PSK-AES256-CBC-SHA
5238
5239     New functions:
5240         SSL_CTX_use_psk_identity_hint
5241         SSL_get_psk_identity_hint
5242         SSL_get_psk_identity
5243         SSL_use_psk_identity_hint
5244
5245     [Mika Kousa and Pasi Eronen of Nokia Corporation]
5246
5247  *) Add RFC 3161 compliant time stamp request creation, response generation
5248     and response verification functionality.
5249     [Zoltán Glózik <zglozik@opentsa.org>, The OpenTSA Project]
5250
5251  *) Add initial support for TLS extensions, specifically for the server_name
5252     extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
5253     have new members for a host name.  The SSL data structure has an
5254     additional member SSL_CTX *initial_ctx so that new sessions can be
5255     stored in that context to allow for session resumption, even after the
5256     SSL has been switched to a new SSL_CTX in reaction to a client's
5257     server_name extension.
5258
5259     New functions (subject to change):
5260
5261         SSL_get_servername()
5262         SSL_get_servername_type()
5263         SSL_set_SSL_CTX()
5264
5265     New CTRL codes and macros (subject to change):
5266
5267         SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
5268                                 - SSL_CTX_set_tlsext_servername_callback()
5269         SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
5270                                      - SSL_CTX_set_tlsext_servername_arg()
5271         SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
5272
5273     openssl s_client has a new '-servername ...' option.
5274
5275     openssl s_server has new options '-servername_host ...', '-cert2 ...',
5276     '-key2 ...', '-servername_fatal' (subject to change).  This allows
5277     testing the HostName extension for a specific single host name ('-cert'
5278     and '-key' remain fallbacks for handshakes without HostName
5279     negotiation).  If the unrecognized_name alert has to be sent, this by
5280     default is a warning; it becomes fatal with the '-servername_fatal'
5281     option.
5282
5283     [Peter Sylvester,  Remy Allais, Christophe Renou]
5284
5285  *) Whirlpool hash implementation is added.
5286     [Andy Polyakov]
5287
5288  *) BIGNUM code on 64-bit SPARCv9 targets is switched from bn(64,64) to
5289     bn(64,32). Because of instruction set limitations it doesn't have
5290     any negative impact on performance. This was done mostly in order
5291     to make it possible to share assembler modules, such as bn_mul_mont
5292     implementations, between 32- and 64-bit builds without hassle.
5293     [Andy Polyakov]
5294
5295  *) Move code previously exiled into file crypto/ec/ec2_smpt.c
5296     to ec2_smpl.c, and no longer require the OPENSSL_EC_BIN_PT_COMP
5297     macro.
5298     [Bodo Moeller]
5299
5300  *) New candidate for BIGNUM assembler implementation, bn_mul_mont,
5301     dedicated Montgomery multiplication procedure, is introduced.
5302     BN_MONT_CTX is modified to allow bn_mul_mont to reach for higher
5303     "64-bit" performance on certain 32-bit targets.
5304     [Andy Polyakov]
5305
5306  *) New option SSL_OP_NO_COMP to disable use of compression selectively
5307     in SSL structures. New SSL ctrl to set maximum send fragment size.
5308     Save memory by setting the I/O buffer sizes dynamically instead of
5309     using the maximum available value.
5310     [Steve Henson]
5311
5312  *) New option -V for 'openssl ciphers'. This prints the ciphersuite code
5313     in addition to the text details.
5314     [Bodo Moeller]
5315
5316  *) Very, very preliminary EXPERIMENTAL support for printing of general
5317     ASN1 structures. This currently produces rather ugly output and doesn't
5318     handle several customised structures at all.
5319     [Steve Henson]
5320
5321  *) Integrated support for PVK file format and some related formats such
5322     as MS PUBLICKEYBLOB and PRIVATEKEYBLOB. Command line switches to support
5323     these in the 'rsa' and 'dsa' utilities.
5324     [Steve Henson]
5325
5326  *) Support for PKCS#1 RSAPublicKey format on rsa utility command line.
5327     [Steve Henson]
5328
5329  *) Remove the ancient ASN1_METHOD code. This was only ever used in one
5330     place for the (very old) "NETSCAPE" format certificates which are now
5331     handled using new ASN1 code equivalents.
5332     [Steve Henson]
5333
5334  *) Let the TLSv1_method() etc. functions return a 'const' SSL_METHOD
5335     pointer and make the SSL_METHOD parameter in SSL_CTX_new,
5336     SSL_CTX_set_ssl_version and SSL_set_ssl_method 'const'.
5337     [Nils Larsch]
5338
5339  *) Modify CRL distribution points extension code to print out previously
5340     unsupported fields. Enhance extension setting code to allow setting of
5341     all fields.
5342     [Steve Henson]
5343
5344  *) Add print and set support for Issuing Distribution Point CRL extension.
5345     [Steve Henson]
5346
5347  *) Change 'Configure' script to enable Camellia by default.
5348     [NTT]
5349
5350 Changes between 0.9.8m and 0.9.8n [24 Mar 2010]
5351
5352  *) When rejecting SSL/TLS records due to an incorrect version number, never
5353     update s->server with a new major version number.  As of
5354     - OpenSSL 0.9.8m if 'short' is a 16-bit type,
5355     - OpenSSL 0.9.8f if 'short' is longer than 16 bits,
5356     the previous behavior could result in a read attempt at NULL when
5357     receiving specific incorrect SSL/TLS records once record payload
5358     protection is active.  (CVE-2010-0740)
5359     [Bodo Moeller, Adam Langley <agl@chromium.org>]
5360
5361  *) Fix for CVE-2010-0433 where some kerberos enabled versions of OpenSSL
5362     could be crashed if the relevant tables were not present (e.g. chrooted).
5363     [Tomas Hoger <thoger@redhat.com>]
5364
5365 Changes between 0.9.8l and 0.9.8m [25 Feb 2010]
5366
5367  *) Always check bn_wexpand() return values for failure.  (CVE-2009-3245)
5368     [Martin Olsson, Neel Mehta]
5369
5370  *) Fix X509_STORE locking: Every 'objs' access requires a lock (to
5371     accommodate for stack sorting, always a write lock!).
5372     [Bodo Moeller]
5373
5374  *) On some versions of WIN32 Heap32Next is very slow. This can cause
5375     excessive delays in the RAND_poll(): over a minute. As a workaround
5376     include a time check in the inner Heap32Next loop too.
5377     [Steve Henson]
5378
5379  *) The code that handled flushing of data in SSL/TLS originally used the
5380     BIO_CTRL_INFO ctrl to see if any data was pending first. This caused
5381     the problem outlined in PR#1949. The fix suggested there however can
5382     trigger problems with buggy BIO_CTRL_WPENDING (e.g. some versions
5383     of Apache). So instead simplify the code to flush unconditionally.
5384     This should be fine since flushing with no data to flush is a no op.
5385     [Steve Henson]
5386
5387  *) Handle TLS versions 2.0 and later properly and correctly use the
5388     highest version of TLS/SSL supported. Although TLS >= 2.0 is some way
5389     off ancient servers have a habit of sticking around for a while...
5390     [Steve Henson]
5391
5392  *) Modify compression code so it frees up structures without using the
5393     ex_data callbacks. This works around a problem where some applications
5394     call CRYPTO_cleanup_all_ex_data() before application exit (e.g. when
5395     restarting) then use compression (e.g. SSL with compression) later.
5396     This results in significant per-connection memory leaks and
5397     has caused some security issues including CVE-2008-1678 and
5398     CVE-2009-4355.
5399     [Steve Henson]
5400
5401  *) Constify crypto/cast (i.e., <openssl/cast.h>): a CAST_KEY doesn't
5402     change when encrypting or decrypting.
5403     [Bodo Moeller]
5404
5405  *) Add option SSL_OP_LEGACY_SERVER_CONNECT which will allow clients to
5406     connect and renegotiate with servers which do not support RI.
5407     Until RI is more widely deployed this option is enabled by default.
5408     [Steve Henson]
5409
5410  *) Add "missing" ssl ctrls to clear options and mode.
5411     [Steve Henson]
5412
5413  *) If client attempts to renegotiate and doesn't support RI respond with
5414     a no_renegotiation alert as required by RFC5746.  Some renegotiating
5415     TLS clients will continue a connection gracefully when they receive
5416     the alert. Unfortunately OpenSSL mishandled this alert and would hang
5417     waiting for a server hello which it will never receive. Now we treat a
5418     received no_renegotiation alert as a fatal error. This is because
5419     applications requesting a renegotiation might well expect it to succeed
5420     and would have no code in place to handle the server denying it so the
5421     only safe thing to do is to terminate the connection.
5422     [Steve Henson]
5423
5424  *) Add ctrl macro SSL_get_secure_renegotiation_support() which returns 1 if
5425     peer supports secure renegotiation and 0 otherwise. Print out peer
5426     renegotiation support in s_client/s_server.
5427     [Steve Henson]
5428
5429  *) Replace the highly broken and deprecated SPKAC certification method with
5430     the updated NID creation version. This should correctly handle UTF8.
5431     [Steve Henson]
5432
5433  *) Implement RFC5746. Re-enable renegotiation but require the extension
5434     as needed. Unfortunately, SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
5435     turns out to be a bad idea. It has been replaced by
5436     SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION which can be set with
5437     SSL_CTX_set_options(). This is really not recommended unless you
5438     know what you are doing.
5439     [Eric Rescorla <ekr@networkresonance.com>, Ben Laurie, Steve Henson]
5440
5441  *) Fixes to stateless session resumption handling. Use initial_ctx when
5442     issuing and attempting to decrypt tickets in case it has changed during
5443     servername handling. Use a non-zero length session ID when attempting
5444     stateless session resumption: this makes it possible to determine if
5445     a resumption has occurred immediately after receiving server hello
5446     (several places in OpenSSL subtly assume this) instead of later in
5447     the handshake.
5448     [Steve Henson]
5449
5450  *) The functions ENGINE_ctrl(), OPENSSL_isservice(),
5451     CMS_get1_RecipientRequest() and RAND_bytes() can return <=0 on error
5452     fixes for a few places where the return code is not checked
5453     correctly.
5454     [Julia Lawall <julia@diku.dk>]
5455
5456  *) Add --strict-warnings option to Configure script to include devteam
5457     warnings in other configurations.
5458     [Steve Henson]
5459
5460  *) Add support for --libdir option and LIBDIR variable in makefiles. This
5461     makes it possible to install openssl libraries in locations which
5462     have names other than "lib", for example "/usr/lib64" which some
5463     systems need.
5464     [Steve Henson, based on patch from Jeremy Utley]
5465
5466  *) Don't allow the use of leading 0x80 in OIDs. This is a violation of
5467     X690 8.9.12 and can produce some misleading textual output of OIDs.
5468     [Steve Henson, reported by Dan Kaminsky]
5469
5470  *) Delete MD2 from algorithm tables. This follows the recommendation in
5471     several standards that it is not used in new applications due to
5472     several cryptographic weaknesses. For binary compatibility reasons
5473     the MD2 API is still compiled in by default.
5474     [Steve Henson]
5475
5476  *) Add compression id to {d2i,i2d}_SSL_SESSION so it is correctly saved
5477     and restored.
5478     [Steve Henson]
5479
5480  *) Rename uni2asc and asc2uni functions to OPENSSL_uni2asc and
5481     OPENSSL_asc2uni conditionally on Netware platforms to avoid a name
5482     clash.
5483     [Guenter <lists@gknw.net>]
5484
5485  *) Fix the server certificate chain building code to use X509_verify_cert(),
5486     it used to have an ad-hoc builder which was unable to cope with anything
5487     other than a simple chain.
5488     [David Woodhouse <dwmw2@infradead.org>, Steve Henson]
5489
5490  *) Don't check self signed certificate signatures in X509_verify_cert()
5491     by default (a flag can override this): it just wastes time without
5492     adding any security. As a useful side effect self signed root CAs
5493     with non-FIPS digests are now usable in FIPS mode.
5494     [Steve Henson]
5495
5496  *) In dtls1_process_out_of_seq_message() the check if the current message
5497     is already buffered was missing. For every new message was memory
5498     allocated, allowing an attacker to perform an denial of service attack
5499     with sending out of seq handshake messages until there is no memory
5500     left. Additionally every future message was buffered, even if the
5501     sequence number made no sense and would be part of another handshake.
5502     So only messages with sequence numbers less than 10 in advance will be
5503     buffered.  (CVE-2009-1378)
5504     [Robin Seggelmann, discovered by Daniel Mentz]
5505
5506  *) Records are buffered if they arrive with a future epoch to be
5507     processed after finishing the corresponding handshake. There is
5508     currently no limitation to this buffer allowing an attacker to perform
5509     a DOS attack with sending records with future epochs until there is no
5510     memory left. This patch adds the pqueue_size() function to determine
5511     the size of a buffer and limits the record buffer to 100 entries.
5512     (CVE-2009-1377)
5513     [Robin Seggelmann, discovered by Daniel Mentz]
5514
5515  *) Keep a copy of frag->msg_header.frag_len so it can be used after the
5516     parent structure is freed.  (CVE-2009-1379)
5517     [Daniel Mentz]
5518
5519  *) Handle non-blocking I/O properly in SSL_shutdown() call.
5520     [Darryl Miles <darryl-mailinglists@netbauds.net>]
5521
5522  *) Add 2.5.4.* OIDs
5523     [Ilya O. <vrghost@gmail.com>]
5524
5525 Changes between 0.9.8k and 0.9.8l  [5 Nov 2009]
5526
5527  *) Disable renegotiation completely - this fixes a severe security
5528     problem (CVE-2009-3555) at the cost of breaking all
5529     renegotiation. Renegotiation can be re-enabled by setting
5530     SSL3_FLAGS_ALLOW_UNSAFE_LEGACY_RENEGOTIATION in s3->flags at
5531     run-time. This is really not recommended unless you know what
5532     you're doing.
5533     [Ben Laurie]
5534
5535 Changes between 0.9.8j and 0.9.8k  [25 Mar 2009]
5536
5537  *) Don't set val to NULL when freeing up structures, it is freed up by
5538     underlying code. If sizeof(void *) > sizeof(long) this can result in
5539     zeroing past the valid field. (CVE-2009-0789)
5540     [Paolo Ganci <Paolo.Ganci@AdNovum.CH>]
5541
5542  *) Fix bug where return value of CMS_SignerInfo_verify_content() was not
5543     checked correctly. This would allow some invalid signed attributes to
5544     appear to verify correctly. (CVE-2009-0591)
5545     [Ivan Nestlerode <inestlerode@us.ibm.com>]
5546
5547  *) Reject UniversalString and BMPString types with invalid lengths. This
5548     prevents a crash in ASN1_STRING_print_ex() which assumes the strings have
5549     a legal length. (CVE-2009-0590)
5550     [Steve Henson]
5551
5552  *) Set S/MIME signing as the default purpose rather than setting it
5553     unconditionally. This allows applications to override it at the store
5554     level.
5555     [Steve Henson]
5556
5557  *) Permit restricted recursion of ASN1 strings. This is needed in practice
5558     to handle some structures.
5559     [Steve Henson]
5560
5561  *) Improve efficiency of mem_gets: don't search whole buffer each time
5562     for a '\n'
5563     [Jeremy Shapiro <jnshapir@us.ibm.com>]
5564
5565  *) New -hex option for openssl rand.
5566     [Matthieu Herrb]
5567
5568  *) Print out UTF8String and NumericString when parsing ASN1.
5569     [Steve Henson]
5570
5571  *) Support NumericString type for name components.
5572     [Steve Henson]
5573
5574  *) Allow CC in the environment to override the automatically chosen
5575     compiler. Note that nothing is done to ensure flags work with the
5576     chosen compiler.
5577     [Ben Laurie]
5578
5579 Changes between 0.9.8i and 0.9.8j  [07 Jan 2009]
5580
5581  *) Properly check EVP_VerifyFinal() and similar return values
5582     (CVE-2008-5077).
5583     [Ben Laurie, Bodo Moeller, Google Security Team]
5584
5585  *) Enable TLS extensions by default.
5586     [Ben Laurie]
5587
5588  *) Allow the CHIL engine to be loaded, whether the application is
5589     multithreaded or not. (This does not release the developer from the
5590     obligation to set up the dynamic locking callbacks.)
5591     [Sander Temme <sander@temme.net>]
5592
5593  *) Use correct exit code if there is an error in dgst command.
5594     [Steve Henson; problem pointed out by Roland Dirlewanger]
5595
5596  *) Tweak Configure so that you need to say "experimental-jpake" to enable
5597     JPAKE, and need to use -DOPENSSL_EXPERIMENTAL_JPAKE in applications.
5598     [Bodo Moeller]
5599
5600  *) Add experimental JPAKE support, including demo authentication in
5601     s_client and s_server.
5602     [Ben Laurie]
5603
5604  *) Set the comparison function in v3_addr_canonize().
5605     [Rob Austein <sra@hactrn.net>]
5606
5607  *) Add support for XMPP STARTTLS in s_client.
5608     [Philip Paeps <philip@freebsd.org>]
5609
5610  *) Change the server-side SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG behavior
5611     to ensure that even with this option, only ciphersuites in the
5612     server's preference list will be accepted.  (Note that the option
5613     applies only when resuming a session, so the earlier behavior was
5614     just about the algorithm choice for symmetric cryptography.)
5615     [Bodo Moeller]
5616
5617 Changes between 0.9.8h and 0.9.8i  [15 Sep 2008]
5618
5619  *) Fix NULL pointer dereference if a DTLS server received
5620     ChangeCipherSpec as first record (CVE-2009-1386).
5621     [PR #1679]
5622
5623  *) Fix a state transition in s3_srvr.c and d1_srvr.c
5624     (was using SSL3_ST_CW_CLNT_HELLO_B, should be ..._ST_SW_SRVR_...).
5625     [Nagendra Modadugu]
5626
5627  *) The fix in 0.9.8c that supposedly got rid of unsafe
5628     double-checked locking was incomplete for RSA blinding,
5629     addressing just one layer of what turns out to have been
5630     doubly unsafe triple-checked locking.
5631
5632     So now fix this for real by retiring the MONT_HELPER macro
5633     in crypto/rsa/rsa_eay.c.
5634
5635     [Bodo Moeller; problem pointed out by Marius Schilder]
5636
5637  *) Various precautionary measures:
5638
5639     - Avoid size_t integer overflow in HASH_UPDATE (md32_common.h).
5640
5641     - Avoid a buffer overflow in d2i_SSL_SESSION() (ssl_asn1.c).
5642       (NB: This would require knowledge of the secret session ticket key
5643       to exploit, in which case you'd be SOL either way.)
5644
5645     - Change bn_nist.c so that it will properly handle input BIGNUMs
5646       outside the expected range.
5647
5648     - Enforce the 'num' check in BN_div() (bn_div.c) for non-BN_DEBUG
5649       builds.
5650
5651     [Neel Mehta, Bodo Moeller]
5652
5653  *) Allow engines to be "soft loaded" - i.e. optionally don't die if
5654     the load fails. Useful for distros.
5655     [Ben Laurie and the FreeBSD team]
5656
5657  *) Add support for Local Machine Keyset attribute in PKCS#12 files.
5658     [Steve Henson]
5659
5660  *) Fix BN_GF2m_mod_arr() top-bit cleanup code.
5661     [Huang Ying]
5662
5663  *) Expand ENGINE to support engine supplied SSL client certificate functions.
5664
5665     This work was sponsored by Logica.
5666     [Steve Henson]
5667
5668  *) Add CryptoAPI ENGINE to support use of RSA and DSA keys held in Windows
5669     keystores. Support for SSL/TLS client authentication too.
5670     Not compiled unless enable-capieng specified to Configure.
5671
5672     This work was sponsored by Logica.
5673     [Steve Henson]
5674
5675  *) Fix bug in X509_ATTRIBUTE creation: don't set attribute using
5676     ASN1_TYPE_set1 if MBSTRING flag set. This bug would crash certain
5677     attribute creation routines such as certificate requests and PKCS#12
5678     files.
5679     [Steve Henson]
5680
5681 Changes between 0.9.8g and 0.9.8h  [28 May 2008]
5682
5683  *) Fix flaw if 'Server Key exchange message' is omitted from a TLS
5684     handshake which could lead to a client crash as found using the
5685     Codenomicon TLS test suite (CVE-2008-1672)
5686     [Steve Henson, Mark Cox]
5687
5688  *) Fix double free in TLS server name extensions which could lead to
5689     a remote crash found by Codenomicon TLS test suite (CVE-2008-0891)
5690     [Joe Orton]
5691
5692  *) Clear error queue in SSL_CTX_use_certificate_chain_file()
5693
5694     Clear the error queue to ensure that error entries left from
5695     older function calls do not interfere with the correct operation.
5696     [Lutz Jaenicke, Erik de Castro Lopo]
5697
5698  *) Remove root CA certificates of commercial CAs:
5699
5700     The OpenSSL project does not recommend any specific CA and does not
5701     have any policy with respect to including or excluding any CA.
5702     Therefore it does not make any sense to ship an arbitrary selection
5703     of root CA certificates with the OpenSSL software.
5704     [Lutz Jaenicke]
5705
5706  *) RSA OAEP patches to fix two separate invalid memory reads.
5707     The first one involves inputs when 'lzero' is greater than
5708     'SHA_DIGEST_LENGTH' (it would read about SHA_DIGEST_LENGTH bytes
5709     before the beginning of from). The second one involves inputs where
5710     the 'db' section contains nothing but zeroes (there is a one-byte
5711     invalid read after the end of 'db').
5712     [Ivan Nestlerode <inestlerode@us.ibm.com>]
5713
5714  *) Partial backport from 0.9.9-dev:
5715
5716     Introduce bn_mul_mont (dedicated Montgomery multiplication
5717     procedure) as a candidate for BIGNUM assembler implementation.
5718     While 0.9.9-dev uses assembler for various architectures, only
5719     x86_64 is available by default here in the 0.9.8 branch, and
5720     32-bit x86 is available through a compile-time setting.
5721
5722     To try the 32-bit x86 assembler implementation, use Configure
5723     option "enable-montasm" (which exists only for this backport).
5724
5725     As "enable-montasm" for 32-bit x86 disclaims code stability
5726     anyway, in this constellation we activate additional code
5727     backported from 0.9.9-dev for further performance improvements,
5728     namely BN_from_montgomery_word.  (To enable this otherwise,
5729     e.g. x86_64, try "-DMONT_FROM_WORD___NON_DEFAULT_0_9_8_BUILD".)
5730
5731     [Andy Polyakov (backport partially by Bodo Moeller)]
5732
5733  *) Add TLS session ticket callback. This allows an application to set
5734     TLS ticket cipher and HMAC keys rather than relying on hardcoded fixed
5735     values. This is useful for key rollover for example where several key
5736     sets may exist with different names.
5737     [Steve Henson]
5738
5739  *) Reverse ENGINE-internal logic for caching default ENGINE handles.
5740     This was broken until now in 0.9.8 releases, such that the only way
5741     a registered ENGINE could be used (assuming it initialises
5742     successfully on the host) was to explicitly set it as the default
5743     for the relevant algorithms. This is in contradiction with 0.9.7
5744     behaviour and the documentation. With this fix, when an ENGINE is
5745     registered into a given algorithm's table of implementations, the
5746     'uptodate' flag is reset so that auto-discovery will be used next
5747     time a new context for that algorithm attempts to select an
5748     implementation.
5749     [Ian Lister (tweaked by Geoff Thorpe)]
5750
5751  *) Backport of CMS code to OpenSSL 0.9.8. This differs from the 0.9.9
5752     implementation in the following ways:
5753
5754     Lack of EVP_PKEY_ASN1_METHOD means algorithm parameters have to be
5755     hard coded.
5756
5757     Lack of BER streaming support means one pass streaming processing is
5758     only supported if data is detached: setting the streaming flag is
5759     ignored for embedded content.
5760
5761     CMS support is disabled by default and must be explicitly enabled
5762     with the enable-cms configuration option.
5763     [Steve Henson]
5764
5765  *) Update the GMP engine glue to do direct copies between BIGNUM and
5766     mpz_t when openssl and GMP use the same limb size. Otherwise the
5767     existing "conversion via a text string export" trick is still used.
5768     [Paul Sheer <paulsheer@gmail.com>]
5769
5770  *) Zlib compression BIO. This is a filter BIO which compressed and
5771     uncompresses any data passed through it.
5772     [Steve Henson]
5773
5774  *) Add AES_wrap_key() and AES_unwrap_key() functions to implement
5775     RFC3394 compatible AES key wrapping.
5776     [Steve Henson]
5777
5778  *) Add utility functions to handle ASN1 structures. ASN1_STRING_set0():
5779     sets string data without copying. X509_ALGOR_set0() and
5780     X509_ALGOR_get0(): set and retrieve X509_ALGOR (AlgorithmIdentifier)
5781     data. Attribute function X509at_get0_data_by_OBJ(): retrieves data
5782     from an X509_ATTRIBUTE structure optionally checking it occurs only
5783     once. ASN1_TYPE_set1(): set and ASN1_TYPE structure copying supplied
5784     data.
5785     [Steve Henson]
5786
5787  *) Fix BN flag handling in RSA_eay_mod_exp() and BN_MONT_CTX_set()
5788     to get the expected BN_FLG_CONSTTIME behavior.
5789     [Bodo Moeller (Google)]
5790
5791  *) Netware support:
5792
5793     - fixed wrong usage of ioctlsocket() when build for LIBC BSD sockets
5794     - fixed do_tests.pl to run the test suite with CLIB builds too (CLIB_OPT)
5795     - added some more tests to do_tests.pl
5796     - fixed RunningProcess usage so that it works with newer LIBC NDKs too
5797     - removed usage of BN_LLONG for CLIB builds to avoid runtime dependency
5798     - added new Configure targets netware-clib-bsdsock, netware-clib-gcc,
5799       netware-clib-bsdsock-gcc, netware-libc-bsdsock-gcc
5800     - various changes to netware.pl to enable gcc-cross builds on Win32
5801       platform
5802     - changed crypto/bio/b_sock.c to work with macro functions (CLIB BSD)
5803     - various changes to fix missing prototype warnings
5804     - fixed x86nasm.pl to create correct asm files for NASM COFF output
5805     - added AES, WHIRLPOOL and CPUID assembler code to build files
5806     - added missing AES assembler make rules to mk1mf.pl
5807     - fixed order of includes in apps/ocsp.c so that e_os.h settings apply
5808     [Guenter Knauf <eflash@gmx.net>]
5809
5810  *) Implement certificate status request TLS extension defined in RFC3546.
5811     A client can set the appropriate parameters and receive the encoded
5812     OCSP response via a callback. A server can query the supplied parameters
5813     and set the encoded OCSP response in the callback. Add simplified examples
5814     to s_client and s_server.
5815     [Steve Henson]
5816
5817 Changes between 0.9.8f and 0.9.8g  [19 Oct 2007]
5818
5819  *) Fix various bugs:
5820     + Binary incompatibility of ssl_ctx_st structure
5821     + DTLS interoperation with non-compliant servers
5822     + Don't call get_session_cb() without proposed session
5823     + Fix ia64 assembler code
5824     [Andy Polyakov, Steve Henson]
5825
5826 Changes between 0.9.8e and 0.9.8f  [11 Oct 2007]
5827
5828  *) DTLS Handshake overhaul. There were longstanding issues with
5829     OpenSSL DTLS implementation, which were making it impossible for
5830     RFC 4347 compliant client to communicate with OpenSSL server.
5831     Unfortunately just fixing these incompatibilities would "cut off"
5832     pre-0.9.8f clients. To allow for hassle free upgrade post-0.9.8e
5833     server keeps tolerating non RFC compliant syntax. The opposite is
5834     not true, 0.9.8f client can not communicate with earlier server.
5835     This update even addresses CVE-2007-4995.
5836     [Andy Polyakov]
5837
5838  *) Changes to avoid need for function casts in OpenSSL: some compilers
5839     (gcc 4.2 and later) reject their use.
5840     [Kurt Roeckx <kurt@roeckx.be>, Peter Hartley <pdh@utter.chaos.org.uk>,
5841      Steve Henson]
5842
5843  *) Add RFC4507 support to OpenSSL. This includes the corrections in
5844     RFC4507bis. The encrypted ticket format is an encrypted encoded
5845     SSL_SESSION structure, that way new session features are automatically
5846     supported.
5847
5848     If a client application caches session in an SSL_SESSION structure
5849     support is transparent because tickets are now stored in the encoded
5850     SSL_SESSION.
5851
5852     The SSL_CTX structure automatically generates keys for ticket
5853     protection in servers so again support should be possible
5854     with no application modification.
5855
5856     If a client or server wishes to disable RFC4507 support then the option
5857     SSL_OP_NO_TICKET can be set.
5858
5859     Add a TLS extension debugging callback to allow the contents of any client
5860     or server extensions to be examined.
5861
5862     This work was sponsored by Google.
5863     [Steve Henson]
5864
5865  *) Add initial support for TLS extensions, specifically for the server_name
5866     extension so far.  The SSL_SESSION, SSL_CTX, and SSL data structures now
5867     have new members for a host name.  The SSL data structure has an
5868     additional member SSL_CTX *initial_ctx so that new sessions can be
5869     stored in that context to allow for session resumption, even after the
5870     SSL has been switched to a new SSL_CTX in reaction to a client's
5871     server_name extension.
5872
5873     New functions (subject to change):
5874
5875         SSL_get_servername()
5876         SSL_get_servername_type()
5877         SSL_set_SSL_CTX()
5878
5879     New CTRL codes and macros (subject to change):
5880
5881         SSL_CTRL_SET_TLSEXT_SERVERNAME_CB
5882                                 - SSL_CTX_set_tlsext_servername_callback()
5883         SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG
5884                                      - SSL_CTX_set_tlsext_servername_arg()
5885         SSL_CTRL_SET_TLSEXT_HOSTNAME           - SSL_set_tlsext_host_name()
5886
5887     openssl s_client has a new '-servername ...' option.
5888
5889     openssl s_server has new options '-servername_host ...', '-cert2 ...',
5890     '-key2 ...', '-servername_fatal' (subject to change).  This allows
5891     testing the HostName extension for a specific single host name ('-cert'
5892     and '-key' remain fallbacks for handshakes without HostName
5893     negotiation).  If the unrecognized_name alert has to be sent, this by
5894     default is a warning; it becomes fatal with the '-servername_fatal'
5895     option.
5896
5897     [Peter Sylvester,  Remy Allais, Christophe Renou, Steve Henson]
5898
5899  *) Add AES and SSE2 assembly language support to VC++ build.
5900     [Steve Henson]
5901
5902  *) Mitigate attack on final subtraction in Montgomery reduction.
5903     [Andy Polyakov]
5904
5905  *) Fix crypto/ec/ec_mult.c to work properly with scalars of value 0
5906     (which previously caused an internal error).
5907     [Bodo Moeller]
5908
5909  *) Squeeze another 10% out of IGE mode when in != out.
5910     [Ben Laurie]
5911
5912  *) AES IGE mode speedup.
5913     [Dean Gaudet (Google)]
5914
5915  *) Add the Korean symmetric 128-bit cipher SEED (see
5916     http://www.kisa.or.kr/kisa/seed/jsp/seed_eng.jsp) and
5917     add SEED ciphersuites from RFC 4162:
5918
5919        TLS_RSA_WITH_SEED_CBC_SHA      =  "SEED-SHA"
5920        TLS_DHE_DSS_WITH_SEED_CBC_SHA  =  "DHE-DSS-SEED-SHA"
5921        TLS_DHE_RSA_WITH_SEED_CBC_SHA  =  "DHE-RSA-SEED-SHA"
5922        TLS_DH_anon_WITH_SEED_CBC_SHA  =  "ADH-SEED-SHA"
5923
5924     To minimize changes between patchlevels in the OpenSSL 0.9.8
5925     series, SEED remains excluded from compilation unless OpenSSL
5926     is configured with 'enable-seed'.
5927     [KISA, Bodo Moeller]
5928
5929  *) Mitigate branch prediction attacks, which can be practical if a
5930     single processor is shared, allowing a spy process to extract
5931     information.  For detailed background information, see
5932     http://eprint.iacr.org/2007/039 (O. Aciicmez, S. Gueron,
5933     J.-P. Seifert, "New Branch Prediction Vulnerabilities in OpenSSL
5934     and Necessary Software Countermeasures").  The core of the change
5935     are new versions BN_div_no_branch() and
5936     BN_mod_inverse_no_branch() of BN_div() and BN_mod_inverse(),
5937     respectively, which are slower, but avoid the security-relevant
5938     conditional branches.  These are automatically called by BN_div()
5939     and BN_mod_inverse() if the flag BN_FLG_CONSTTIME is set for one
5940     of the input BIGNUMs.  Also, BN_is_bit_set() has been changed to
5941     remove a conditional branch.
5942
5943     BN_FLG_CONSTTIME is the new name for the previous
5944     BN_FLG_EXP_CONSTTIME flag, since it now affects more than just
5945     modular exponentiation.  (Since OpenSSL 0.9.7h, setting this flag
5946     in the exponent causes BN_mod_exp_mont() to use the alternative
5947     implementation in BN_mod_exp_mont_consttime().)  The old name
5948     remains as a deprecated alias.
5949
5950     Similarly, RSA_FLAG_NO_EXP_CONSTTIME is replaced by a more general
5951     RSA_FLAG_NO_CONSTTIME flag since the RSA implementation now uses
5952     constant-time implementations for more than just exponentiation.
5953     Here too the old name is kept as a deprecated alias.
5954
5955     BN_BLINDING_new() will now use BN_dup() for the modulus so that
5956     the BN_BLINDING structure gets an independent copy of the
5957     modulus.  This means that the previous "BIGNUM *m" argument to
5958     BN_BLINDING_new() and to BN_BLINDING_create_param() now
5959     essentially becomes "const BIGNUM *m", although we can't actually
5960     change this in the header file before 0.9.9.  It allows
5961     RSA_setup_blinding() to use BN_with_flags() on the modulus to
5962     enable BN_FLG_CONSTTIME.
5963
5964     [Matthew D Wood (Intel Corp)]
5965
5966  *) In the SSL/TLS server implementation, be strict about session ID
5967     context matching (which matters if an application uses a single
5968     external cache for different purposes).  Previously,
5969     out-of-context reuse was forbidden only if SSL_VERIFY_PEER was
5970     set.  This did ensure strict client verification, but meant that,
5971     with applications using a single external cache for quite
5972     different requirements, clients could circumvent ciphersuite
5973     restrictions for a given session ID context by starting a session
5974     in a different context.
5975     [Bodo Moeller]
5976
5977  *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
5978     a ciphersuite string such as "DEFAULT:RSA" cannot enable
5979     authentication-only ciphersuites.
5980     [Bodo Moeller]
5981
5982  *) Update the SSL_get_shared_ciphers() fix CVE-2006-3738 which was
5983     not complete and could lead to a possible single byte overflow
5984     (CVE-2007-5135) [Ben Laurie]
5985
5986 Changes between 0.9.8d and 0.9.8e  [23 Feb 2007]
5987
5988  *) Since AES128 and AES256 (and similarly Camellia128 and
5989     Camellia256) share a single mask bit in the logic of
5990     ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
5991     kludge to work properly if AES128 is available and AES256 isn't
5992     (or if Camellia128 is available and Camellia256 isn't).
5993     [Victor Duchovni]
5994
5995  *) Fix the BIT STRING encoding generated by crypto/ec/ec_asn1.c
5996     (within i2d_ECPrivateKey, i2d_ECPKParameters, i2d_ECParameters):
5997     When a point or a seed is encoded in a BIT STRING, we need to
5998     prevent the removal of trailing zero bits to get the proper DER
5999     encoding.  (By default, crypto/asn1/a_bitstr.c assumes the case
6000     of a NamedBitList, for which trailing 0 bits need to be removed.)
6001     [Bodo Moeller]
6002
6003  *) Have SSL/TLS server implementation tolerate "mismatched" record
6004     protocol version while receiving ClientHello even if the
6005     ClientHello is fragmented.  (The server can't insist on the
6006     particular protocol version it has chosen before the ServerHello
6007     message has informed the client about his choice.)
6008     [Bodo Moeller]
6009
6010  *) Add RFC 3779 support.
6011     [Rob Austein for ARIN, Ben Laurie]
6012
6013  *) Load error codes if they are not already present instead of using a
6014     static variable. This allows them to be cleanly unloaded and reloaded.
6015     Improve header file function name parsing.
6016     [Steve Henson]
6017
6018  *) extend SMTP and IMAP protocol emulation in s_client to use EHLO
6019     or CAPABILITY handshake as required by RFCs.
6020     [Goetz Babin-Ebell]
6021
6022 Changes between 0.9.8c and 0.9.8d  [28 Sep 2006]
6023
6024  *) Introduce limits to prevent malicious keys being able to
6025     cause a denial of service.  (CVE-2006-2940)
6026     [Steve Henson, Bodo Moeller]
6027
6028  *) Fix ASN.1 parsing of certain invalid structures that can result
6029     in a denial of service.  (CVE-2006-2937)  [Steve Henson]
6030
6031  *) Fix buffer overflow in SSL_get_shared_ciphers() function.
6032     (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
6033
6034  *) Fix SSL client code which could crash if connecting to a
6035     malicious SSLv2 server.  (CVE-2006-4343)
6036     [Tavis Ormandy and Will Drewry, Google Security Team]
6037
6038  *) Since 0.9.8b, ciphersuite strings naming explicit ciphersuites
6039     match only those.  Before that, "AES256-SHA" would be interpreted
6040     as a pattern and match "AES128-SHA" too (since AES128-SHA got
6041     the same strength classification in 0.9.7h) as we currently only
6042     have a single AES bit in the ciphersuite description bitmap.
6043     That change, however, also applied to ciphersuite strings such as
6044     "RC4-MD5" that intentionally matched multiple ciphersuites --
6045     namely, SSL 2.0 ciphersuites in addition to the more common ones
6046     from SSL 3.0/TLS 1.0.
6047
6048     So we change the selection algorithm again: Naming an explicit
6049     ciphersuite selects this one ciphersuite, and any other similar
6050     ciphersuite (same bitmap) from *other* protocol versions.
6051     Thus, "RC4-MD5" again will properly select both the SSL 2.0
6052     ciphersuite and the SSL 3.0/TLS 1.0 ciphersuite.
6053
6054     Since SSL 2.0 does not have any ciphersuites for which the
6055     128/256 bit distinction would be relevant, this works for now.
6056     The proper fix will be to use different bits for AES128 and
6057     AES256, which would have avoided the problems from the beginning;
6058     however, bits are scarce, so we can only do this in a new release
6059     (not just a patchlevel) when we can change the SSL_CIPHER
6060     definition to split the single 'unsigned long mask' bitmap into
6061     multiple values to extend the available space.
6062
6063     [Bodo Moeller]
6064
6065 Changes between 0.9.8b and 0.9.8c  [05 Sep 2006]
6066
6067  *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
6068     (CVE-2006-4339)  [Ben Laurie and Google Security Team]
6069
6070  *) Add AES IGE and biIGE modes.
6071     [Ben Laurie]
6072
6073  *) Change the Unix randomness entropy gathering to use poll() when
6074     possible instead of select(), since the latter has some
6075     undesirable limitations.
6076     [Darryl Miles via Richard Levitte and Bodo Moeller]
6077
6078  *) Disable "ECCdraft" ciphersuites more thoroughly.  Now special
6079     treatment in ssl/ssl_ciph.s makes sure that these ciphersuites
6080     cannot be implicitly activated as part of, e.g., the "AES" alias.
6081     However, please upgrade to OpenSSL 0.9.9[-dev] for
6082     non-experimental use of the ECC ciphersuites to get TLS extension
6083     support, which is required for curve and point format negotiation
6084     to avoid potential handshake problems.
6085     [Bodo Moeller]
6086
6087  *) Disable rogue ciphersuites:
6088
6089      - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
6090      - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
6091      - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
6092
6093     The latter two were purportedly from
6094     draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
6095     appear there.
6096
6097     Also deactivate the remaining ciphersuites from
6098     draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
6099     unofficial, and the ID has long expired.
6100     [Bodo Moeller]
6101
6102  *) Fix RSA blinding Heisenbug (problems sometimes occurred on
6103     dual-core machines) and other potential thread-safety issues.
6104     [Bodo Moeller]
6105
6106  *) Add the symmetric cipher Camellia (128-bit, 192-bit, 256-bit key
6107     versions), which is now available for royalty-free use
6108     (see http://info.isl.ntt.co.jp/crypt/eng/info/chiteki.html).
6109     Also, add Camellia TLS ciphersuites from RFC 4132.
6110
6111     To minimize changes between patchlevels in the OpenSSL 0.9.8
6112     series, Camellia remains excluded from compilation unless OpenSSL
6113     is configured with 'enable-camellia'.
6114     [NTT]
6115
6116  *) Disable the padding bug check when compression is in use. The padding
6117     bug check assumes the first packet is of even length, this is not
6118     necessarily true if compression is enabled and can result in false
6119     positives causing handshake failure. The actual bug test is ancient
6120     code so it is hoped that implementations will either have fixed it by
6121     now or any which still have the bug do not support compression.
6122     [Steve Henson]
6123
6124 Changes between 0.9.8a and 0.9.8b  [04 May 2006]
6125
6126  *) When applying a cipher rule check to see if string match is an explicit
6127     cipher suite and only match that one cipher suite if it is.
6128     [Steve Henson]
6129
6130  *) Link in manifests for VC++ if needed.
6131     [Austin Ziegler <halostatue@gmail.com>]
6132
6133  *) Update support for ECC-based TLS ciphersuites according to
6134     draft-ietf-tls-ecc-12.txt with proposed changes (but without
6135     TLS extensions, which are supported starting with the 0.9.9
6136     branch, not in the OpenSSL 0.9.8 branch).
6137     [Douglas Stebila]
6138
6139  *) New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free() to support
6140     opaque EVP_CIPHER_CTX handling.
6141     [Steve Henson]
6142
6143  *) Fixes and enhancements to zlib compression code. We now only use
6144     "zlib1.dll" and use the default __cdecl calling convention on Win32
6145     to conform with the standards mentioned here:
6146           http://www.zlib.net/DLL_FAQ.txt
6147     Static zlib linking now works on Windows and the new --with-zlib-include
6148     --with-zlib-lib options to Configure can be used to supply the location
6149     of the headers and library. Gracefully handle case where zlib library
6150     can't be loaded.
6151     [Steve Henson]
6152
6153  *) Several fixes and enhancements to the OID generation code. The old code
6154     sometimes allowed invalid OIDs (1.X for X >= 40 for example), couldn't
6155     handle numbers larger than ULONG_MAX, truncated printing and had a
6156     non standard OBJ_obj2txt() behaviour.
6157     [Steve Henson]
6158
6159  *) Add support for building of engines under engine/ as shared libraries
6160     under VC++ build system.
6161     [Steve Henson]
6162
6163  *) Corrected the numerous bugs in the Win32 path splitter in DSO.
6164     Hopefully, we will not see any false combination of paths any more.
6165     [Richard Levitte]
6166
6167 Changes between 0.9.8 and 0.9.8a  [11 Oct 2005]
6168
6169  *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
6170     (part of SSL_OP_ALL).  This option used to disable the
6171     countermeasure against man-in-the-middle protocol-version
6172     rollback in the SSL 2.0 server implementation, which is a bad
6173     idea.  (CVE-2005-2969)
6174
6175     [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
6176     for Information Security, National Institute of Advanced Industrial
6177     Science and Technology [AIST], Japan)]
6178
6179  *) Add two function to clear and return the verify parameter flags.
6180     [Steve Henson]
6181
6182  *) Keep cipherlists sorted in the source instead of sorting them at
6183     runtime, thus removing the need for a lock.
6184     [Nils Larsch]
6185
6186  *) Avoid some small subgroup attacks in Diffie-Hellman.
6187     [Nick Mathewson and Ben Laurie]
6188
6189  *) Add functions for well-known primes.
6190     [Nick Mathewson]
6191
6192  *) Extended Windows CE support.
6193     [Satoshi Nakamura and Andy Polyakov]
6194
6195  *) Initialize SSL_METHOD structures at compile time instead of during
6196     runtime, thus removing the need for a lock.
6197     [Steve Henson]
6198
6199  *) Make PKCS7_decrypt() work even if no certificate is supplied by
6200     attempting to decrypt each encrypted key in turn. Add support to
6201     smime utility.
6202     [Steve Henson]
6203
6204 Changes between 0.9.7h and 0.9.8  [05 Jul 2005]
6205
6206  [NB: OpenSSL 0.9.7i and later 0.9.7 patch levels were released after
6207  OpenSSL 0.9.8.]
6208
6209  *) Add libcrypto.pc and libssl.pc for those who feel they need them.
6210     [Richard Levitte]
6211
6212  *) Change CA.sh and CA.pl so they don't bundle the CSR and the private
6213     key into the same file any more.
6214     [Richard Levitte]
6215
6216  *) Add initial support for Win64, both IA64 and AMD64/x64 flavors.
6217     [Andy Polyakov]
6218
6219  *) Add -utf8 command line and config file option to 'ca'.
6220     [Stefan <stf@udoma.org]
6221
6222  *) Removed the macro des_crypt(), as it seems to conflict with some
6223     libraries.  Use DES_crypt().
6224     [Richard Levitte]
6225
6226  *) Correct naming of the 'chil' and '4758cca' ENGINEs. This
6227     involves renaming the source and generated shared-libs for
6228     both. The engines will accept the corrected or legacy ids
6229     ('ncipher' and '4758_cca' respectively) when binding. NB,
6230     this only applies when building 'shared'.
6231     [Corinna Vinschen <vinschen@redhat.com> and Geoff Thorpe]
6232
6233  *) Add attribute functions to EVP_PKEY structure. Modify
6234     PKCS12_create() to recognize a CSP name attribute and
6235     use it. Make -CSP option work again in pkcs12 utility.
6236     [Steve Henson]
6237
6238  *) Add new functionality to the bn blinding code:
6239     - automatic re-creation of the BN_BLINDING parameters after
6240       a fixed number of uses (currently 32)
6241     - add new function for parameter creation
6242     - introduce flags to control the update behaviour of the
6243       BN_BLINDING parameters
6244     - hide BN_BLINDING structure
6245     Add a second BN_BLINDING slot to the RSA structure to improve
6246     performance when a single RSA object is shared among several
6247     threads.
6248     [Nils Larsch]
6249
6250  *) Add support for DTLS.
6251     [Nagendra Modadugu <nagendra@cs.stanford.edu> and Ben Laurie]
6252
6253  *) Add support for DER encoded private keys (SSL_FILETYPE_ASN1)
6254     to SSL_CTX_use_PrivateKey_file() and SSL_use_PrivateKey_file()
6255     [Walter Goulet]
6256
6257  *) Remove buggy and incomplete DH cert support from
6258     ssl/ssl_rsa.c and ssl/s3_both.c
6259     [Nils Larsch]
6260
6261  *) Use SHA-1 instead of MD5 as the default digest algorithm for
6262     the apps/openssl applications.
6263     [Nils Larsch]
6264
6265  *) Compile clean with "-Wall -Wmissing-prototypes
6266     -Wstrict-prototypes -Wmissing-declarations -Werror". Currently
6267     DEBUG_SAFESTACK must also be set.
6268     [Ben Laurie]
6269
6270  *) Change ./Configure so that certain algorithms can be disabled by default.
6271     The new counterpiece to "no-xxx" is "enable-xxx".
6272
6273     The patented RC5 and MDC2 algorithms will now be disabled unless
6274     "enable-rc5" and "enable-mdc2", respectively, are specified.
6275
6276     (IDEA remains enabled despite being patented.  This is because IDEA
6277     is frequently required for interoperability, and there is no license
6278     fee for non-commercial use.  As before, "no-idea" can be used to
6279     avoid this algorithm.)
6280
6281     [Bodo Moeller]
6282
6283  *) Add processing of proxy certificates (see RFC 3820).  This work was
6284     sponsored by KTH (The Royal Institute of Technology in Stockholm) and
6285     EGEE (Enabling Grids for E-science in Europe).
6286     [Richard Levitte]
6287
6288  *) RC4 performance overhaul on modern architectures/implementations, such
6289     as Intel P4, IA-64 and AMD64.
6290     [Andy Polyakov]
6291
6292  *) New utility extract-section.pl. This can be used specify an alternative
6293     section number in a pod file instead of having to treat each file as
6294     a separate case in Makefile. This can be done by adding two lines to the
6295     pod file:
6296
6297     =for comment openssl_section:XXX
6298
6299     The blank line is mandatory.
6300
6301     [Steve Henson]
6302
6303  *) New arguments -certform, -keyform and -pass for s_client and s_server
6304     to allow alternative format key and certificate files and passphrase
6305     sources.
6306     [Steve Henson]
6307
6308  *) New structure X509_VERIFY_PARAM which combines current verify parameters,
6309     update associated structures and add various utility functions.
6310
6311     Add new policy related verify parameters, include policy checking in
6312     standard verify code. Enhance 'smime' application with extra parameters
6313     to support policy checking and print out.
6314     [Steve Henson]
6315
6316  *) Add a new engine to support VIA PadLock ACE extensions in the VIA C3
6317     Nehemiah processors. These extensions support AES encryption in hardware
6318     as well as RNG (though RNG support is currently disabled).
6319     [Michal Ludvig <michal@logix.cz>, with help from Andy Polyakov]
6320
6321  *) Deprecate BN_[get|set]_params() functions (they were ignored internally).
6322     [Geoff Thorpe]
6323
6324  *) New FIPS 180-2 algorithms, SHA-224/-256/-384/-512 are implemented.
6325     [Andy Polyakov and a number of other people]
6326
6327  *) Improved PowerPC platform support. Most notably BIGNUM assembler
6328     implementation contributed by IBM.
6329     [Suresh Chari, Peter Waltenberg, Andy Polyakov]
6330
6331  *) The new 'RSA_generate_key_ex' function now takes a BIGNUM for the public
6332     exponent rather than 'unsigned long'. There is a corresponding change to
6333     the new 'rsa_keygen' element of the RSA_METHOD structure.
6334     [Jelte Jansen, Geoff Thorpe]
6335
6336  *) Functionality for creating the initial serial number file is now
6337     moved from CA.pl to the 'ca' utility with a new option -create_serial.
6338
6339     (Before OpenSSL 0.9.7e, CA.pl used to initialize the serial
6340     number file to 1, which is bound to cause problems.  To avoid
6341     the problems while respecting compatibility between different 0.9.7
6342     patchlevels, 0.9.7e  employed 'openssl x509 -next_serial' in
6343     CA.pl for serial number initialization.  With the new release 0.9.8,
6344     we can fix the problem directly in the 'ca' utility.)
6345     [Steve Henson]
6346
6347  *) Reduced header interdependencies by declaring more opaque objects in
6348     ossl_typ.h. As a consequence, including some headers (eg. engine.h) will
6349     give fewer recursive includes, which could break lazy source code - so
6350     this change is covered by the OPENSSL_NO_DEPRECATED symbol. As always,
6351     developers should define this symbol when building and using openssl to
6352     ensure they track the recommended behaviour, interfaces, [etc], but
6353     backwards-compatible behaviour prevails when this isn't defined.
6354     [Geoff Thorpe]
6355
6356  *) New function X509_POLICY_NODE_print() which prints out policy nodes.
6357     [Steve Henson]
6358
6359  *) Add new EVP function EVP_CIPHER_CTX_rand_key and associated functionality.
6360     This will generate a random key of the appropriate length based on the
6361     cipher context. The EVP_CIPHER can provide its own random key generation
6362     routine to support keys of a specific form. This is used in the des and
6363     3des routines to generate a key of the correct parity. Update S/MIME
6364     code to use new functions and hence generate correct parity DES keys.
6365     Add EVP_CHECK_DES_KEY #define to return an error if the key is not
6366     valid (weak or incorrect parity).
6367     [Steve Henson]
6368
6369  *) Add a local set of CRLs that can be used by X509_verify_cert() as well
6370     as looking them up. This is useful when the verified structure may contain
6371     CRLs, for example PKCS#7 signedData. Modify PKCS7_verify() to use any CRLs
6372     present unless the new PKCS7_NO_CRL flag is asserted.
6373     [Steve Henson]
6374
6375  *) Extend ASN1 oid configuration module. It now additionally accepts the
6376     syntax:
6377
6378     shortName = some long name, 1.2.3.4
6379     [Steve Henson]
6380
6381  *) Reimplemented the BN_CTX implementation. There is now no more static
6382     limitation on the number of variables it can handle nor the depth of the
6383     "stack" handling for BN_CTX_start()/BN_CTX_end() pairs. The stack
6384     information can now expand as required, and rather than having a single
6385     static array of bignums, BN_CTX now uses a linked-list of such arrays
6386     allowing it to expand on demand whilst maintaining the usefulness of
6387     BN_CTX's "bundling".
6388     [Geoff Thorpe]
6389
6390  *) Add a missing BN_CTX parameter to the 'rsa_mod_exp' callback in RSA_METHOD
6391     to allow all RSA operations to function using a single BN_CTX.
6392     [Geoff Thorpe]
6393
6394  *) Preliminary support for certificate policy evaluation and checking. This
6395     is initially intended to pass the tests outlined in "Conformance Testing
6396     of Relying Party Client Certificate Path Processing Logic" v1.07.
6397     [Steve Henson]
6398
6399  *) bn_dup_expand() has been deprecated, it was introduced in 0.9.7 and
6400     remained unused and not that useful. A variety of other little bignum
6401     tweaks and fixes have also been made continuing on from the audit (see
6402     below).
6403     [Geoff Thorpe]
6404
6405  *) Constify all or almost all d2i, c2i, s2i and r2i functions, along with
6406     associated ASN1, EVP and SSL functions and old ASN1 macros.
6407     [Richard Levitte]
6408
6409  *) BN_zero() only needs to set 'top' and 'neg' to zero for correct results,
6410     and this should never fail. So the return value from the use of
6411     BN_set_word() (which can fail due to needless expansion) is now deprecated;
6412     if OPENSSL_NO_DEPRECATED is defined, BN_zero() is a void macro.
6413     [Geoff Thorpe]
6414
6415  *) BN_CTX_get() should return zero-valued bignums, providing the same
6416     initialised value as BN_new().
6417     [Geoff Thorpe, suggested by Ulf Möller]
6418
6419  *) Support for inhibitAnyPolicy certificate extension.
6420     [Steve Henson]
6421
6422  *) An audit of the BIGNUM code is underway, for which debugging code is
6423     enabled when BN_DEBUG is defined. This makes stricter enforcements on what
6424     is considered valid when processing BIGNUMs, and causes execution to
6425     assert() when a problem is discovered. If BN_DEBUG_RAND is defined,
6426     further steps are taken to deliberately pollute unused data in BIGNUM
6427     structures to try and expose faulty code further on. For now, openssl will
6428     (in its default mode of operation) continue to tolerate the inconsistent
6429     forms that it has tolerated in the past, but authors and packagers should
6430     consider trying openssl and their own applications when compiled with
6431     these debugging symbols defined. It will help highlight potential bugs in
6432     their own code, and will improve the test coverage for OpenSSL itself. At
6433     some point, these tighter rules will become openssl's default to improve
6434     maintainability, though the assert()s and other overheads will remain only
6435     in debugging configurations. See bn.h for more details.
6436     [Geoff Thorpe, Nils Larsch, Ulf Möller]
6437
6438  *) BN_CTX_init() has been deprecated, as BN_CTX is an opaque structure
6439     that can only be obtained through BN_CTX_new() (which implicitly
6440     initialises it). The presence of this function only made it possible
6441     to overwrite an existing structure (and cause memory leaks).
6442     [Geoff Thorpe]
6443
6444  *) Because of the callback-based approach for implementing LHASH as a
6445     template type, lh_insert() adds opaque objects to hash-tables and
6446     lh_doall() or lh_doall_arg() are typically used with a destructor callback
6447     to clean up those corresponding objects before destroying the hash table
6448     (and losing the object pointers). So some over-zealous constifications in
6449     LHASH have been relaxed so that lh_insert() does not take (nor store) the
6450     objects as "const" and the lh_doall[_arg] callback wrappers are not
6451     prototyped to have "const" restrictions on the object pointers they are
6452     given (and so aren't required to cast them away any more).
6453     [Geoff Thorpe]
6454
6455  *) The tmdiff.h API was so ugly and minimal that our own timing utility
6456     (speed) prefers to use its own implementation. The two implementations
6457     haven't been consolidated as yet (volunteers?) but the tmdiff API has had
6458     its object type properly exposed (MS_TM) instead of casting to/from "char
6459     *". This may still change yet if someone realises MS_TM and "ms_time_***"
6460     aren't necessarily the greatest nomenclatures - but this is what was used
6461     internally to the implementation so I've used that for now.
6462     [Geoff Thorpe]
6463
6464  *) Ensure that deprecated functions do not get compiled when
6465     OPENSSL_NO_DEPRECATED is defined. Some "openssl" subcommands and a few of
6466     the self-tests were still using deprecated key-generation functions so
6467     these have been updated also.
6468     [Geoff Thorpe]
6469
6470  *) Reorganise PKCS#7 code to separate the digest location functionality
6471     into PKCS7_find_digest(), digest addition into PKCS7_bio_add_digest().
6472     New function PKCS7_set_digest() to set the digest type for PKCS#7
6473     digestedData type. Add additional code to correctly generate the
6474     digestedData type and add support for this type in PKCS7 initialization
6475     functions.
6476     [Steve Henson]
6477
6478  *) New function PKCS7_set0_type_other() this initializes a PKCS7
6479     structure of type "other".
6480     [Steve Henson]
6481
6482  *) Fix prime generation loop in crypto/bn/bn_prime.pl by making
6483     sure the loop does correctly stop and breaking ("division by zero")
6484     modulus operations are not performed. The (pre-generated) prime
6485     table crypto/bn/bn_prime.h was already correct, but it could not be
6486     re-generated on some platforms because of the "division by zero"
6487     situation in the script.
6488     [Ralf S. Engelschall]
6489
6490  *) Update support for ECC-based TLS ciphersuites according to
6491     draft-ietf-tls-ecc-03.txt: the KDF1 key derivation function with
6492     SHA-1 now is only used for "small" curves (where the
6493     representation of a field element takes up to 24 bytes); for
6494     larger curves, the field element resulting from ECDH is directly
6495     used as premaster secret.
6496     [Douglas Stebila (Sun Microsystems Laboratories)]
6497
6498  *) Add code for kP+lQ timings to crypto/ec/ectest.c, and add SEC2
6499     curve secp160r1 to the tests.
6500     [Douglas Stebila (Sun Microsystems Laboratories)]
6501
6502  *) Add the possibility to load symbols globally with DSO.
6503     [Götz Babin-Ebell <babin-ebell@trustcenter.de> via Richard Levitte]
6504
6505  *) Add the functions ERR_set_mark() and ERR_pop_to_mark() for better
6506     control of the error stack.
6507     [Richard Levitte]
6508
6509  *) Add support for STORE in ENGINE.
6510     [Richard Levitte]
6511
6512  *) Add the STORE type.  The intention is to provide a common interface
6513     to certificate and key stores, be they simple file-based stores, or
6514     HSM-type store, or LDAP stores, or...
6515     NOTE: The code is currently UNTESTED and isn't really used anywhere.
6516     [Richard Levitte]
6517
6518  *) Add a generic structure called OPENSSL_ITEM.  This can be used to
6519     pass a list of arguments to any function as well as provide a way
6520     for a function to pass data back to the caller.
6521     [Richard Levitte]
6522
6523  *) Add the functions BUF_strndup() and BUF_memdup().  BUF_strndup()
6524     works like BUF_strdup() but can be used to duplicate a portion of
6525     a string.  The copy gets NUL-terminated.  BUF_memdup() duplicates
6526     a memory area.
6527     [Richard Levitte]
6528
6529  *) Add the function sk_find_ex() which works like sk_find(), but will
6530     return an index to an element even if an exact match couldn't be
6531     found.  The index is guaranteed to point at the element where the
6532     searched-for key would be inserted to preserve sorting order.
6533     [Richard Levitte]
6534
6535  *) Add the function OBJ_bsearch_ex() which works like OBJ_bsearch() but
6536     takes an extra flags argument for optional functionality.  Currently,
6537     the following flags are defined:
6538
6539        OBJ_BSEARCH_VALUE_ON_NOMATCH
6540        This one gets OBJ_bsearch_ex() to return a pointer to the first
6541        element where the comparing function returns a negative or zero
6542        number.
6543
6544        OBJ_BSEARCH_FIRST_VALUE_ON_MATCH
6545        This one gets OBJ_bsearch_ex() to return a pointer to the first
6546        element where the comparing function returns zero.  This is useful
6547        if there are more than one element where the comparing function
6548        returns zero.
6549     [Richard Levitte]
6550
6551  *) Make it possible to create self-signed certificates with 'openssl ca'
6552     in such a way that the self-signed certificate becomes part of the
6553     CA database and uses the same mechanisms for serial number generation
6554     as all other certificate signing.  The new flag '-selfsign' enables
6555     this functionality.  Adapt CA.sh and CA.pl.in.
6556     [Richard Levitte]
6557
6558  *) Add functionality to check the public key of a certificate request
6559     against a given private.  This is useful to check that a certificate
6560     request can be signed by that key (self-signing).
6561     [Richard Levitte]
6562
6563  *) Make it possible to have multiple active certificates with the same
6564     subject in the CA index file.  This is done only if the keyword
6565     'unique_subject' is set to 'no' in the main CA section (default
6566     if 'CA_default') of the configuration file.  The value is saved
6567     with the database itself in a separate index attribute file,
6568     named like the index file with '.attr' appended to the name.
6569     [Richard Levitte]
6570
6571  *) Generate multi-valued AVAs using '+' notation in config files for
6572     req and dirName.
6573     [Steve Henson]
6574
6575  *) Support for nameConstraints certificate extension.
6576     [Steve Henson]
6577
6578  *) Support for policyConstraints certificate extension.
6579     [Steve Henson]
6580
6581  *) Support for policyMappings certificate extension.
6582     [Steve Henson]
6583
6584  *) Make sure the default DSA_METHOD implementation only uses its
6585     dsa_mod_exp() and/or bn_mod_exp() handlers if they are non-NULL,
6586     and change its own handlers to be NULL so as to remove unnecessary
6587     indirection. This lets alternative implementations fallback to the
6588     default implementation more easily.
6589     [Geoff Thorpe]
6590
6591  *) Support for directoryName in GeneralName related extensions
6592     in config files.
6593     [Steve Henson]
6594
6595  *) Make it possible to link applications using Makefile.shared.
6596     Make that possible even when linking against static libraries!
6597     [Richard Levitte]
6598
6599  *) Support for single pass processing for S/MIME signing. This now
6600     means that S/MIME signing can be done from a pipe, in addition
6601     cleartext signing (multipart/signed type) is effectively streaming
6602     and the signed data does not need to be all held in memory.
6603
6604     This is done with a new flag PKCS7_STREAM. When this flag is set
6605     PKCS7_sign() only initializes the PKCS7 structure and the actual signing
6606     is done after the data is output (and digests calculated) in
6607     SMIME_write_PKCS7().
6608     [Steve Henson]
6609
6610  *) Add full support for -rpath/-R, both in shared libraries and
6611     applications, at least on the platforms where it's known how
6612     to do it.
6613     [Richard Levitte]
6614
6615  *) In crypto/ec/ec_mult.c, implement fast point multiplication with
6616     precomputation, based on wNAF splitting: EC_GROUP_precompute_mult()
6617     will now compute a table of multiples of the generator that
6618     makes subsequent invocations of EC_POINTs_mul() or EC_POINT_mul()
6619     faster (notably in the case of a single point multiplication,
6620     scalar * generator).
6621     [Nils Larsch, Bodo Moeller]
6622
6623  *) IPv6 support for certificate extensions. The various extensions
6624     which use the IP:a.b.c.d can now take IPv6 addresses using the
6625     formats of RFC1884 2.2 . IPv6 addresses are now also displayed
6626     correctly.
6627     [Steve Henson]
6628
6629  *) Added an ENGINE that implements RSA by performing private key
6630     exponentiations with the GMP library. The conversions to and from
6631     GMP's mpz_t format aren't optimised nor are any montgomery forms
6632     cached, and on x86 it appears OpenSSL's own performance has caught up.
6633     However there are likely to be other architectures where GMP could
6634     provide a boost. This ENGINE is not built in by default, but it can be
6635     specified at Configure time and should be accompanied by the necessary
6636     linker additions, eg;
6637         ./config -DOPENSSL_USE_GMP -lgmp
6638     [Geoff Thorpe]
6639
6640  *) "openssl engine" will not display ENGINE/DSO load failure errors when
6641     testing availability of engines with "-t" - the old behaviour is
6642     produced by increasing the feature's verbosity with "-tt".
6643     [Geoff Thorpe]
6644
6645  *) ECDSA routines: under certain error conditions uninitialized BN objects
6646     could be freed. Solution: make sure initialization is performed early
6647     enough. (Reported and fix supplied by Nils Larsch <nla@trustcenter.de>
6648     via PR#459)
6649     [Lutz Jaenicke]
6650
6651  *) Key-generation can now be implemented in RSA_METHOD, DSA_METHOD
6652     and DH_METHOD (eg. by ENGINE implementations) to override the normal
6653     software implementations. For DSA and DH, parameter generation can
6654     also be overridden by providing the appropriate method callbacks.
6655     [Geoff Thorpe]
6656
6657  *) Change the "progress" mechanism used in key-generation and
6658     primality testing to functions that take a new BN_GENCB pointer in
6659     place of callback/argument pairs. The new API functions have "_ex"
6660     postfixes and the older functions are reimplemented as wrappers for
6661     the new ones. The OPENSSL_NO_DEPRECATED symbol can be used to hide
6662     declarations of the old functions to help (graceful) attempts to
6663     migrate to the new functions. Also, the new key-generation API
6664     functions operate on a caller-supplied key-structure and return
6665     success/failure rather than returning a key or NULL - this is to
6666     help make "keygen" another member function of RSA_METHOD etc.
6667
6668     Example for using the new callback interface:
6669
6670          int (*my_callback)(int a, int b, BN_GENCB *cb) = ...;
6671          void *my_arg = ...;
6672          BN_GENCB my_cb;
6673
6674          BN_GENCB_set(&my_cb, my_callback, my_arg);
6675
6676          return BN_is_prime_ex(some_bignum, BN_prime_checks, NULL, &cb);
6677          /* For the meaning of a, b in calls to my_callback(), see the
6678           * documentation of the function that calls the callback.
6679           * cb will point to my_cb; my_arg can be retrieved as cb->arg.
6680           * my_callback should return 1 if it wants BN_is_prime_ex()
6681           * to continue, or 0 to stop.
6682           */
6683
6684     [Geoff Thorpe]
6685
6686  *) Change the ZLIB compression method to be stateful, and make it
6687     available to TLS with the number defined in
6688     draft-ietf-tls-compression-04.txt.
6689     [Richard Levitte]
6690
6691  *) Add the ASN.1 structures and functions for CertificatePair, which
6692     is defined as follows (according to X.509_4thEditionDraftV6.pdf):
6693
6694     CertificatePair ::= SEQUENCE {
6695        forward         [0]     Certificate OPTIONAL,
6696        reverse         [1]     Certificate OPTIONAL,
6697        -- at least one of the pair shall be present -- }
6698
6699     Also implement the PEM functions to read and write certificate
6700     pairs, and defined the PEM tag as "CERTIFICATE PAIR".
6701
6702     This needed to be defined, mostly for the sake of the LDAP
6703     attribute crossCertificatePair, but may prove useful elsewhere as
6704     well.
6705     [Richard Levitte]
6706
6707  *) Make it possible to inhibit symlinking of shared libraries in
6708     Makefile.shared, for Cygwin's sake.
6709     [Richard Levitte]
6710
6711  *) Extend the BIGNUM API by creating a function
6712          void BN_set_negative(BIGNUM *a, int neg);
6713     and a macro that behave like
6714          int  BN_is_negative(const BIGNUM *a);
6715
6716     to avoid the need to access 'a->neg' directly in applications.
6717     [Nils Larsch]
6718
6719  *) Implement fast modular reduction for pseudo-Mersenne primes
6720     used in NIST curves (crypto/bn/bn_nist.c, crypto/ec/ecp_nist.c).
6721     EC_GROUP_new_curve_GFp() will now automatically use this
6722     if applicable.
6723     [Nils Larsch <nla@trustcenter.de>]
6724
6725  *) Add new lock type (CRYPTO_LOCK_BN).
6726     [Bodo Moeller]
6727
6728  *) Change the ENGINE framework to automatically load engines
6729     dynamically from specific directories unless they could be
6730     found to already be built in or loaded.  Move all the
6731     current engines except for the cryptodev one to a new
6732     directory engines/.
6733     The engines in engines/ are built as shared libraries if
6734     the "shared" options was given to ./Configure or ./config.
6735     Otherwise, they are inserted in libcrypto.a.
6736     /usr/local/ssl/engines is the default directory for dynamic
6737     engines, but that can be overridden at configure time through
6738     the usual use of --prefix and/or --openssldir, and at run
6739     time with the environment variable OPENSSL_ENGINES.
6740     [Geoff Thorpe and Richard Levitte]
6741
6742  *) Add Makefile.shared, a helper makefile to build shared
6743     libraries.  Adapt Makefile.org.
6744     [Richard Levitte]
6745
6746  *) Add version info to Win32 DLLs.
6747     [Peter 'Luna' Runestig" <peter@runestig.com>]
6748
6749  *) Add new 'medium level' PKCS#12 API. Certificates and keys
6750     can be added using this API to created arbitrary PKCS#12
6751     files while avoiding the low level API.
6752
6753     New options to PKCS12_create(), key or cert can be NULL and
6754     will then be omitted from the output file. The encryption
6755     algorithm NIDs can be set to -1 for no encryption, the mac
6756     iteration count can be set to 0 to omit the mac.
6757
6758     Enhance pkcs12 utility by making the -nokeys and -nocerts
6759     options work when creating a PKCS#12 file. New option -nomac
6760     to omit the mac, NONE can be set for an encryption algorithm.
6761     New code is modified to use the enhanced PKCS12_create()
6762     instead of the low level API.
6763     [Steve Henson]
6764
6765  *) Extend ASN1 encoder to support indefinite length constructed
6766     encoding. This can output sequences tags and octet strings in
6767     this form. Modify pk7_asn1.c to support indefinite length
6768     encoding. This is experimental and needs additional code to
6769     be useful, such as an ASN1 bio and some enhanced streaming
6770     PKCS#7 code.
6771
6772     Extend template encode functionality so that tagging is passed
6773     down to the template encoder.
6774     [Steve Henson]
6775
6776  *) Let 'openssl req' fail if an argument to '-newkey' is not
6777     recognized instead of using RSA as a default.
6778     [Bodo Moeller]
6779
6780  *) Add support for ECC-based ciphersuites from draft-ietf-tls-ecc-01.txt.
6781     As these are not official, they are not included in "ALL";
6782     the "ECCdraft" ciphersuite group alias can be used to select them.
6783     [Vipul Gupta and Sumit Gupta (Sun Microsystems Laboratories)]
6784
6785  *) Add ECDH engine support.
6786     [Nils Gura and Douglas Stebila (Sun Microsystems Laboratories)]
6787
6788  *) Add ECDH in new directory crypto/ecdh/.
6789     [Douglas Stebila (Sun Microsystems Laboratories)]
6790
6791  *) Let BN_rand_range() abort with an error after 100 iterations
6792     without success (which indicates a broken PRNG).
6793     [Bodo Moeller]
6794
6795  *) Change BN_mod_sqrt() so that it verifies that the input value
6796     is really the square of the return value.  (Previously,
6797     BN_mod_sqrt would show GIGO behaviour.)
6798     [Bodo Moeller]
6799
6800  *) Add named elliptic curves over binary fields from X9.62, SECG,
6801     and WAP/WTLS; add OIDs that were still missing.
6802
6803     [Sheueling Chang Shantz and Douglas Stebila
6804     (Sun Microsystems Laboratories)]
6805
6806  *) Extend the EC library for elliptic curves over binary fields
6807     (new files ec2_smpl.c, ec2_smpt.c, ec2_mult.c in crypto/ec/).
6808     New EC_METHOD:
6809
6810          EC_GF2m_simple_method
6811
6812     New API functions:
6813
6814          EC_GROUP_new_curve_GF2m
6815          EC_GROUP_set_curve_GF2m
6816          EC_GROUP_get_curve_GF2m
6817          EC_POINT_set_affine_coordinates_GF2m
6818          EC_POINT_get_affine_coordinates_GF2m
6819          EC_POINT_set_compressed_coordinates_GF2m
6820
6821     Point compression for binary fields is disabled by default for
6822     patent reasons (compile with OPENSSL_EC_BIN_PT_COMP defined to
6823     enable it).
6824
6825     As binary polynomials are represented as BIGNUMs, various members
6826     of the EC_GROUP and EC_POINT data structures can be shared
6827     between the implementations for prime fields and binary fields;
6828     the above ..._GF2m functions (except for EX_GROUP_new_curve_GF2m)
6829     are essentially identical to their ..._GFp counterparts.
6830     (For simplicity, the '..._GFp' prefix has been dropped from
6831     various internal method names.)
6832
6833     An internal 'field_div' method (similar to 'field_mul' and
6834     'field_sqr') has been added; this is used only for binary fields.
6835
6836     [Sheueling Chang Shantz and Douglas Stebila
6837     (Sun Microsystems Laboratories)]
6838
6839  *) Optionally dispatch EC_POINT_mul(), EC_POINT_precompute_mult()
6840     through methods ('mul', 'precompute_mult').
6841
6842     The generic implementations (now internally called 'ec_wNAF_mul'
6843     and 'ec_wNAF_precomputed_mult') remain the default if these
6844     methods are undefined.
6845
6846     [Sheueling Chang Shantz and Douglas Stebila
6847     (Sun Microsystems Laboratories)]
6848
6849  *) New function EC_GROUP_get_degree, which is defined through
6850     EC_METHOD.  For curves over prime fields, this returns the bit
6851     length of the modulus.
6852
6853     [Sheueling Chang Shantz and Douglas Stebila
6854     (Sun Microsystems Laboratories)]
6855
6856  *) New functions EC_GROUP_dup, EC_POINT_dup.
6857     (These simply call ..._new  and ..._copy).
6858
6859     [Sheueling Chang Shantz and Douglas Stebila
6860     (Sun Microsystems Laboratories)]
6861
6862  *) Add binary polynomial arithmetic software in crypto/bn/bn_gf2m.c.
6863     Polynomials are represented as BIGNUMs (where the sign bit is not
6864     used) in the following functions [macros]:
6865
6866          BN_GF2m_add
6867          BN_GF2m_sub             [= BN_GF2m_add]
6868          BN_GF2m_mod             [wrapper for BN_GF2m_mod_arr]
6869          BN_GF2m_mod_mul         [wrapper for BN_GF2m_mod_mul_arr]
6870          BN_GF2m_mod_sqr         [wrapper for BN_GF2m_mod_sqr_arr]
6871          BN_GF2m_mod_inv
6872          BN_GF2m_mod_exp         [wrapper for BN_GF2m_mod_exp_arr]
6873          BN_GF2m_mod_sqrt        [wrapper for BN_GF2m_mod_sqrt_arr]
6874          BN_GF2m_mod_solve_quad  [wrapper for BN_GF2m_mod_solve_quad_arr]
6875          BN_GF2m_cmp             [= BN_ucmp]
6876
6877     (Note that only the 'mod' functions are actually for fields GF(2^m).
6878     BN_GF2m_add() is misnomer, but this is for the sake of consistency.)
6879
6880     For some functions, an the irreducible polynomial defining a
6881     field can be given as an 'unsigned int[]' with strictly
6882     decreasing elements giving the indices of those bits that are set;
6883     i.e., p[] represents the polynomial
6884          f(t) = t^p[0] + t^p[1] + ... + t^p[k]
6885     where
6886          p[0] > p[1] > ... > p[k] = 0.
6887     This applies to the following functions:
6888
6889          BN_GF2m_mod_arr
6890          BN_GF2m_mod_mul_arr
6891          BN_GF2m_mod_sqr_arr
6892          BN_GF2m_mod_inv_arr        [wrapper for BN_GF2m_mod_inv]
6893          BN_GF2m_mod_div_arr        [wrapper for BN_GF2m_mod_div]
6894          BN_GF2m_mod_exp_arr
6895          BN_GF2m_mod_sqrt_arr
6896          BN_GF2m_mod_solve_quad_arr
6897          BN_GF2m_poly2arr
6898          BN_GF2m_arr2poly
6899
6900     Conversion can be performed by the following functions:
6901
6902          BN_GF2m_poly2arr
6903          BN_GF2m_arr2poly
6904
6905     bntest.c has additional tests for binary polynomial arithmetic.
6906
6907     Two implementations for BN_GF2m_mod_div() are available.
6908     The default algorithm simply uses BN_GF2m_mod_inv() and
6909     BN_GF2m_mod_mul().  The alternative algorithm is compiled in only
6910     if OPENSSL_SUN_GF2M_DIV is defined (patent pending; read the
6911     copyright notice in crypto/bn/bn_gf2m.c before enabling it).
6912
6913     [Sheueling Chang Shantz and Douglas Stebila
6914     (Sun Microsystems Laboratories)]
6915
6916  *) Add new error code 'ERR_R_DISABLED' that can be used when some
6917     functionality is disabled at compile-time.
6918     [Douglas Stebila <douglas.stebila@sun.com>]
6919
6920  *) Change default behaviour of 'openssl asn1parse' so that more
6921     information is visible when viewing, e.g., a certificate:
6922
6923     Modify asn1_parse2 (crypto/asn1/asn1_par.c) so that in non-'dump'
6924     mode the content of non-printable OCTET STRINGs is output in a
6925     style similar to INTEGERs, but with '[HEX DUMP]' prepended to
6926     avoid the appearance of a printable string.
6927     [Nils Larsch <nla@trustcenter.de>]
6928
6929  *) Add 'asn1_flag' and 'asn1_form' member to EC_GROUP with access
6930     functions
6931          EC_GROUP_set_asn1_flag()
6932          EC_GROUP_get_asn1_flag()
6933          EC_GROUP_set_point_conversion_form()
6934          EC_GROUP_get_point_conversion_form()
6935     These control ASN1 encoding details:
6936     - Curves (i.e., groups) are encoded explicitly unless asn1_flag
6937       has been set to OPENSSL_EC_NAMED_CURVE.
6938     - Points are encoded in uncompressed form by default; options for
6939       asn1_for are as for point2oct, namely
6940          POINT_CONVERSION_COMPRESSED
6941          POINT_CONVERSION_UNCOMPRESSED
6942          POINT_CONVERSION_HYBRID
6943
6944     Also add 'seed' and 'seed_len' members to EC_GROUP with access
6945     functions
6946          EC_GROUP_set_seed()
6947          EC_GROUP_get0_seed()
6948          EC_GROUP_get_seed_len()
6949     This is used only for ASN1 purposes (so far).
6950     [Nils Larsch <nla@trustcenter.de>]
6951
6952  *) Add 'field_type' member to EC_METHOD, which holds the NID
6953     of the appropriate field type OID.  The new function
6954     EC_METHOD_get_field_type() returns this value.
6955     [Nils Larsch <nla@trustcenter.de>]
6956
6957  *) Add functions
6958          EC_POINT_point2bn()
6959          EC_POINT_bn2point()
6960          EC_POINT_point2hex()
6961          EC_POINT_hex2point()
6962     providing useful interfaces to EC_POINT_point2oct() and
6963     EC_POINT_oct2point().
6964     [Nils Larsch <nla@trustcenter.de>]
6965
6966  *) Change internals of the EC library so that the functions
6967          EC_GROUP_set_generator()
6968          EC_GROUP_get_generator()
6969          EC_GROUP_get_order()
6970          EC_GROUP_get_cofactor()
6971     are implemented directly in crypto/ec/ec_lib.c and not dispatched
6972     to methods, which would lead to unnecessary code duplication when
6973     adding different types of curves.
6974     [Nils Larsch <nla@trustcenter.de> with input by Bodo Moeller]
6975
6976  *) Implement compute_wNAF (crypto/ec/ec_mult.c) without BIGNUM
6977     arithmetic, and such that modified wNAFs are generated
6978     (which avoid length expansion in many cases).
6979     [Bodo Moeller]
6980
6981  *) Add a function EC_GROUP_check_discriminant() (defined via
6982     EC_METHOD) that verifies that the curve discriminant is non-zero.
6983
6984     Add a function EC_GROUP_check() that makes some sanity tests
6985     on a EC_GROUP, its generator and order.  This includes
6986     EC_GROUP_check_discriminant().
6987     [Nils Larsch <nla@trustcenter.de>]
6988
6989  *) Add ECDSA in new directory crypto/ecdsa/.
6990
6991     Add applications 'openssl ecparam' and 'openssl ecdsa'
6992     (these are based on 'openssl dsaparam' and 'openssl dsa').
6993
6994     ECDSA support is also included in various other files across the
6995     library.  Most notably,
6996     - 'openssl req' now has a '-newkey ecdsa:file' option;
6997     - EVP_PKCS82PKEY (crypto/evp/evp_pkey.c) now can handle ECDSA;
6998     - X509_PUBKEY_get (crypto/asn1/x_pubkey.c) and
6999       d2i_PublicKey (crypto/asn1/d2i_pu.c) have been modified to make
7000       them suitable for ECDSA where domain parameters must be
7001       extracted before the specific public key;
7002     - ECDSA engine support has been added.
7003     [Nils Larsch <nla@trustcenter.de>]
7004
7005  *) Include some named elliptic curves, and add OIDs from X9.62,
7006     SECG, and WAP/WTLS.  Each curve can be obtained from the new
7007     function
7008          EC_GROUP_new_by_curve_name(),
7009     and the list of available named curves can be obtained with
7010          EC_get_builtin_curves().
7011     Also add a 'curve_name' member to EC_GROUP objects, which can be
7012     accessed via
7013         EC_GROUP_set_curve_name()
7014         EC_GROUP_get_curve_name()
7015     [Nils Larsch <larsch@trustcenter.de, Bodo Moeller]
7016
7017  *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
7018     was actually never needed) and in BN_mul().  The removal in BN_mul()
7019     required a small change in bn_mul_part_recursive() and the addition
7020     of the functions bn_cmp_part_words(), bn_sub_part_words() and
7021     bn_add_part_words(), which do the same thing as bn_cmp_words(),
7022     bn_sub_words() and bn_add_words() except they take arrays with
7023     differing sizes.
7024     [Richard Levitte]
7025
7026 Changes between 0.9.7l and 0.9.7m  [23 Feb 2007]
7027
7028  *) Cleanse PEM buffers before freeing them since they may contain
7029     sensitive data.
7030     [Benjamin Bennett <ben@psc.edu>]
7031
7032  *) Include "!eNULL" in SSL_DEFAULT_CIPHER_LIST to make sure that
7033     a ciphersuite string such as "DEFAULT:RSA" cannot enable
7034     authentication-only ciphersuites.
7035     [Bodo Moeller]
7036
7037  *) Since AES128 and AES256 share a single mask bit in the logic of
7038     ssl/ssl_ciph.c, the code for masking out disabled ciphers needs a
7039     kludge to work properly if AES128 is available and AES256 isn't.
7040     [Victor Duchovni]
7041
7042  *) Expand security boundary to match 1.1.1 module.
7043     [Steve Henson]
7044
7045  *) Remove redundant features: hash file source, editing of test vectors
7046     modify fipsld to use external fips_premain.c signature.
7047     [Steve Henson]
7048
7049  *) New perl script mkfipsscr.pl to create shell scripts or batch files to
7050     run algorithm test programs.
7051     [Steve Henson]
7052
7053  *) Make algorithm test programs more tolerant of whitespace.
7054     [Steve Henson]
7055
7056  *) Have SSL/TLS server implementation tolerate "mismatched" record
7057     protocol version while receiving ClientHello even if the
7058     ClientHello is fragmented.  (The server can't insist on the
7059     particular protocol version it has chosen before the ServerHello
7060     message has informed the client about his choice.)
7061     [Bodo Moeller]
7062
7063  *) Load error codes if they are not already present instead of using a
7064     static variable. This allows them to be cleanly unloaded and reloaded.
7065     [Steve Henson]
7066
7067 Changes between 0.9.7k and 0.9.7l  [28 Sep 2006]
7068
7069  *) Introduce limits to prevent malicious keys being able to
7070     cause a denial of service.  (CVE-2006-2940)
7071     [Steve Henson, Bodo Moeller]
7072
7073  *) Fix ASN.1 parsing of certain invalid structures that can result
7074     in a denial of service.  (CVE-2006-2937)  [Steve Henson]
7075
7076  *) Fix buffer overflow in SSL_get_shared_ciphers() function.
7077     (CVE-2006-3738) [Tavis Ormandy and Will Drewry, Google Security Team]
7078
7079  *) Fix SSL client code which could crash if connecting to a
7080     malicious SSLv2 server.  (CVE-2006-4343)
7081     [Tavis Ormandy and Will Drewry, Google Security Team]
7082
7083  *) Change ciphersuite string processing so that an explicit
7084     ciphersuite selects this one ciphersuite (so that "AES256-SHA"
7085     will no longer include "AES128-SHA"), and any other similar
7086     ciphersuite (same bitmap) from *other* protocol versions (so that
7087     "RC4-MD5" will still include both the SSL 2.0 ciphersuite and the
7088     SSL 3.0/TLS 1.0 ciphersuite).  This is a backport combining
7089     changes from 0.9.8b and 0.9.8d.
7090     [Bodo Moeller]
7091
7092 Changes between 0.9.7j and 0.9.7k  [05 Sep 2006]
7093
7094  *) Avoid PKCS #1 v1.5 signature attack discovered by Daniel Bleichenbacher
7095     (CVE-2006-4339)  [Ben Laurie and Google Security Team]
7096
7097  *) Change the Unix randomness entropy gathering to use poll() when
7098     possible instead of select(), since the latter has some
7099     undesirable limitations.
7100     [Darryl Miles via Richard Levitte and Bodo Moeller]
7101
7102  *) Disable rogue ciphersuites:
7103
7104      - SSLv2 0x08 0x00 0x80 ("RC4-64-MD5")
7105      - SSLv3/TLSv1 0x00 0x61 ("EXP1024-RC2-CBC-MD5")
7106      - SSLv3/TLSv1 0x00 0x60 ("EXP1024-RC4-MD5")
7107
7108     The latter two were purportedly from
7109     draft-ietf-tls-56-bit-ciphersuites-0[01].txt, but do not really
7110     appear there.
7111
7112     Also deactivate the remaining ciphersuites from
7113     draft-ietf-tls-56-bit-ciphersuites-01.txt.  These are just as
7114     unofficial, and the ID has long expired.
7115     [Bodo Moeller]
7116
7117  *) Fix RSA blinding Heisenbug (problems sometimes occurred on
7118     dual-core machines) and other potential thread-safety issues.
7119     [Bodo Moeller]
7120
7121 Changes between 0.9.7i and 0.9.7j  [04 May 2006]
7122
7123  *) Adapt fipsld and the build system to link against the validated FIPS
7124     module in FIPS mode.
7125     [Steve Henson]
7126
7127  *) Fixes for VC++ 2005 build under Windows.
7128     [Steve Henson]
7129
7130  *) Add new Windows build target VC-32-GMAKE for VC++. This uses GNU make
7131     from a Windows bash shell such as MSYS. It is autodetected from the
7132     "config" script when run from a VC++ environment. Modify standard VC++
7133     build to use fipscanister.o from the GNU make build.
7134     [Steve Henson]
7135
7136 Changes between 0.9.7h and 0.9.7i  [14 Oct 2005]
7137
7138  *) Wrapped the definition of EVP_MAX_MD_SIZE in a #ifdef OPENSSL_FIPS.
7139     The value now differs depending on if you build for FIPS or not.
7140     BEWARE!  A program linked with a shared FIPSed libcrypto can't be
7141     safely run with a non-FIPSed libcrypto, as it may crash because of
7142     the difference induced by this change.
7143     [Andy Polyakov]
7144
7145 Changes between 0.9.7g and 0.9.7h  [11 Oct 2005]
7146
7147  *) Remove the functionality of SSL_OP_MSIE_SSLV2_RSA_PADDING
7148     (part of SSL_OP_ALL).  This option used to disable the
7149     countermeasure against man-in-the-middle protocol-version
7150     rollback in the SSL 2.0 server implementation, which is a bad
7151     idea.  (CVE-2005-2969)
7152
7153     [Bodo Moeller; problem pointed out by Yutaka Oiwa (Research Center
7154     for Information Security, National Institute of Advanced Industrial
7155     Science and Technology [AIST], Japan)]
7156
7157  *) Minimal support for X9.31 signatures and PSS padding modes. This is
7158     mainly for FIPS compliance and not fully integrated at this stage.
7159     [Steve Henson]
7160
7161  *) For DSA signing, unless DSA_FLAG_NO_EXP_CONSTTIME is set, perform
7162     the exponentiation using a fixed-length exponent.  (Otherwise,
7163     the information leaked through timing could expose the secret key
7164     after many signatures; cf. Bleichenbacher's attack on DSA with
7165     biased k.)
7166     [Bodo Moeller]
7167
7168  *) Make a new fixed-window mod_exp implementation the default for
7169     RSA, DSA, and DH private-key operations so that the sequence of
7170     squares and multiplies and the memory access pattern are
7171     independent of the particular secret key.  This will mitigate
7172     cache-timing and potential related attacks.
7173
7174     BN_mod_exp_mont_consttime() is the new exponentiation implementation,
7175     and this is automatically used by BN_mod_exp_mont() if the new flag
7176     BN_FLG_EXP_CONSTTIME is set for the exponent.  RSA, DSA, and DH
7177     will use this BN flag for private exponents unless the flag
7178     RSA_FLAG_NO_EXP_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME, or
7179     DH_FLAG_NO_EXP_CONSTTIME, respectively, is set.
7180
7181     [Matthew D Wood (Intel Corp), with some changes by Bodo Moeller]
7182
7183  *) Change the client implementation for SSLv23_method() and
7184     SSLv23_client_method() so that is uses the SSL 3.0/TLS 1.0
7185     Client Hello message format if the SSL_OP_NO_SSLv2 option is set.
7186     (Previously, the SSL 2.0 backwards compatible Client Hello
7187     message format would be used even with SSL_OP_NO_SSLv2.)
7188     [Bodo Moeller]
7189
7190  *) Add support for smime-type MIME parameter in S/MIME messages which some
7191     clients need.
7192     [Steve Henson]
7193
7194  *) New function BN_MONT_CTX_set_locked() to set montgomery parameters in
7195     a threadsafe manner. Modify rsa code to use new function and add calls
7196     to dsa and dh code (which had race conditions before).
7197     [Steve Henson]
7198
7199  *) Include the fixed error library code in the C error file definitions
7200     instead of fixing them up at runtime. This keeps the error code
7201     structures constant.
7202     [Steve Henson]
7203
7204 Changes between 0.9.7f and 0.9.7g  [11 Apr 2005]
7205
7206  [NB: OpenSSL 0.9.7h and later 0.9.7 patch levels were released after
7207  OpenSSL 0.9.8.]
7208
7209  *) Fixes for newer kerberos headers. NB: the casts are needed because
7210     the 'length' field is signed on one version and unsigned on another
7211     with no (?) obvious way to tell the difference, without these VC++
7212     complains. Also the "definition" of FAR (blank) is no longer included
7213     nor is the error ENOMEM. KRB5_PRIVATE has to be set to 1 to pick up
7214     some needed definitions.
7215     [Steve Henson]
7216
7217  *) Undo Cygwin change.
7218     [Ulf Möller]
7219
7220  *) Added support for proxy certificates according to RFC 3820.
7221     Because they may be a security thread to unaware applications,
7222     they must be explicitly allowed in run-time.  See
7223     docs/HOWTO/proxy_certificates.txt for further information.
7224     [Richard Levitte]
7225
7226 Changes between 0.9.7e and 0.9.7f  [22 Mar 2005]
7227
7228  *) Use (SSL_RANDOM_VALUE - 4) bytes of pseudo random data when generating
7229     server and client random values. Previously
7230     (SSL_RANDOM_VALUE - sizeof(time_t)) would be used which would result in
7231     less random data when sizeof(time_t) > 4 (some 64 bit platforms).
7232
7233     This change has negligible security impact because:
7234
7235     1. Server and client random values still have 24 bytes of pseudo random
7236        data.
7237
7238     2. Server and client random values are sent in the clear in the initial
7239        handshake.
7240
7241     3. The master secret is derived using the premaster secret (48 bytes in
7242        size for static RSA ciphersuites) as well as client server and random
7243        values.
7244
7245     The OpenSSL team would like to thank the UK NISCC for bringing this issue
7246     to our attention.
7247
7248     [Stephen Henson, reported by UK NISCC]
7249
7250  *) Use Windows randomness collection on Cygwin.
7251     [Ulf Möller]
7252
7253  *) Fix hang in EGD/PRNGD query when communication socket is closed
7254     prematurely by EGD/PRNGD.
7255     [Darren Tucker <dtucker@zip.com.au> via Lutz Jänicke, resolves #1014]
7256
7257  *) Prompt for pass phrases when appropriate for PKCS12 input format.
7258     [Steve Henson]
7259
7260  *) Back-port of selected performance improvements from development
7261     branch, as well as improved support for PowerPC platforms.
7262     [Andy Polyakov]
7263
7264  *) Add lots of checks for memory allocation failure, error codes to indicate
7265     failure and freeing up memory if a failure occurs.
7266     [Nauticus Networks SSL Team <openssl@nauticusnet.com>, Steve Henson]
7267
7268  *) Add new -passin argument to dgst.
7269     [Steve Henson]
7270
7271  *) Perform some character comparisons of different types in X509_NAME_cmp:
7272     this is needed for some certificates that re-encode DNs into UTF8Strings
7273     (in violation of RFC3280) and can't or won't issue name rollover
7274     certificates.
7275     [Steve Henson]
7276
7277  *) Make an explicit check during certificate validation to see that
7278     the CA setting in each certificate on the chain is correct.  As a
7279     side effect always do the following basic checks on extensions,
7280     not just when there's an associated purpose to the check:
7281
7282      - if there is an unhandled critical extension (unless the user
7283        has chosen to ignore this fault)
7284      - if the path length has been exceeded (if one is set at all)
7285      - that certain extensions fit the associated purpose (if one has
7286        been given)
7287     [Richard Levitte]
7288
7289 Changes between 0.9.7d and 0.9.7e  [25 Oct 2004]
7290
7291  *) Avoid a race condition when CRLs are checked in a multi threaded
7292     environment. This would happen due to the reordering of the revoked
7293     entries during signature checking and serial number lookup. Now the
7294     encoding is cached and the serial number sort performed under a lock.
7295     Add new STACK function sk_is_sorted().
7296     [Steve Henson]
7297
7298  *) Add Delta CRL to the extension code.
7299     [Steve Henson]
7300
7301  *) Various fixes to s3_pkt.c so alerts are sent properly.
7302     [David Holmes <d.holmes@f5.com>]
7303
7304  *) Reduce the chances of duplicate issuer name and serial numbers (in
7305     violation of RFC3280) using the OpenSSL certificate creation utilities.
7306     This is done by creating a random 64 bit value for the initial serial
7307     number when a serial number file is created or when a self signed
7308     certificate is created using 'openssl req -x509'. The initial serial
7309     number file is created using 'openssl x509 -next_serial' in CA.pl
7310     rather than being initialized to 1.
7311     [Steve Henson]
7312
7313 Changes between 0.9.7c and 0.9.7d  [17 Mar 2004]
7314
7315  *) Fix null-pointer assignment in do_change_cipher_spec() revealed
7316     by using the Codenomicon TLS Test Tool (CVE-2004-0079)
7317     [Joe Orton, Steve Henson]
7318
7319  *) Fix flaw in SSL/TLS handshaking when using Kerberos ciphersuites
7320     (CVE-2004-0112)
7321     [Joe Orton, Steve Henson]
7322
7323  *) Make it possible to have multiple active certificates with the same
7324     subject in the CA index file.  This is done only if the keyword
7325     'unique_subject' is set to 'no' in the main CA section (default
7326     if 'CA_default') of the configuration file.  The value is saved
7327     with the database itself in a separate index attribute file,
7328     named like the index file with '.attr' appended to the name.
7329     [Richard Levitte]
7330
7331  *) X509 verify fixes. Disable broken certificate workarounds when
7332     X509_V_FLAGS_X509_STRICT is set. Check CRL issuer has cRLSign set if
7333     keyUsage extension present. Don't accept CRLs with unhandled critical
7334     extensions: since verify currently doesn't process CRL extensions this
7335     rejects a CRL with *any* critical extensions. Add new verify error codes
7336     for these cases.
7337     [Steve Henson]
7338
7339  *) When creating an OCSP nonce use an OCTET STRING inside the extnValue.
7340     A clarification of RFC2560 will require the use of OCTET STRINGs and
7341     some implementations cannot handle the current raw format. Since OpenSSL
7342     copies and compares OCSP nonces as opaque blobs without any attempt at
7343     parsing them this should not create any compatibility issues.
7344     [Steve Henson]
7345
7346  *) New md flag EVP_MD_CTX_FLAG_REUSE this allows md_data to be reused when
7347     calling EVP_MD_CTX_copy_ex() to avoid calling OPENSSL_malloc(). Without
7348     this HMAC (and other) operations are several times slower than OpenSSL
7349     < 0.9.7.
7350     [Steve Henson]
7351
7352  *) Print out GeneralizedTime and UTCTime in ASN1_STRING_print_ex().
7353     [Peter Sylvester <Peter.Sylvester@EdelWeb.fr>]
7354
7355  *) Use the correct content when signing type "other".
7356     [Steve Henson]
7357
7358 Changes between 0.9.7b and 0.9.7c  [30 Sep 2003]
7359
7360  *) Fix various bugs revealed by running the NISCC test suite:
7361
7362     Stop out of bounds reads in the ASN1 code when presented with
7363     invalid tags (CVE-2003-0543 and CVE-2003-0544).
7364
7365     Free up ASN1_TYPE correctly if ANY type is invalid (CVE-2003-0545).
7366
7367     If verify callback ignores invalid public key errors don't try to check
7368     certificate signature with the NULL public key.
7369
7370     [Steve Henson]
7371
7372  *) New -ignore_err option in ocsp application to stop the server
7373     exiting on the first error in a request.
7374     [Steve Henson]
7375
7376  *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
7377     if the server requested one: as stated in TLS 1.0 and SSL 3.0
7378     specifications.
7379     [Steve Henson]
7380
7381  *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
7382     extra data after the compression methods not only for TLS 1.0
7383     but also for SSL 3.0 (as required by the specification).
7384     [Bodo Moeller; problem pointed out by Matthias Loepfe]
7385
7386  *) Change X509_certificate_type() to mark the key as exported/exportable
7387     when it's 512 *bits* long, not 512 bytes.
7388     [Richard Levitte]
7389
7390  *) Change AES_cbc_encrypt() so it outputs exact multiple of
7391     blocks during encryption.
7392     [Richard Levitte]
7393
7394  *) Various fixes to base64 BIO and non blocking I/O. On write
7395     flushes were not handled properly if the BIO retried. On read
7396     data was not being buffered properly and had various logic bugs.
7397     This also affects blocking I/O when the data being decoded is a
7398     certain size.
7399     [Steve Henson]
7400
7401  *) Various S/MIME bugfixes and compatibility changes:
7402     output correct application/pkcs7 MIME type if
7403     PKCS7_NOOLDMIMETYPE is set. Tolerate some broken signatures.
7404     Output CR+LF for EOL if PKCS7_CRLFEOL is set (this makes opening
7405     of files as .eml work). Correctly handle very long lines in MIME
7406     parser.
7407     [Steve Henson]
7408
7409 Changes between 0.9.7a and 0.9.7b  [10 Apr 2003]
7410
7411  *) Countermeasure against the Klima-Pokorny-Rosa extension of
7412     Bleichbacher's attack on PKCS #1 v1.5 padding: treat
7413     a protocol version number mismatch like a decryption error
7414     in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
7415     [Bodo Moeller]
7416
7417  *) Turn on RSA blinding by default in the default implementation
7418     to avoid a timing attack. Applications that don't want it can call
7419     RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
7420     They would be ill-advised to do so in most cases.
7421     [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
7422
7423  *) Change RSA blinding code so that it works when the PRNG is not
7424     seeded (in this case, the secret RSA exponent is abused as
7425     an unpredictable seed -- if it is not unpredictable, there
7426     is no point in blinding anyway).  Make RSA blinding thread-safe
7427     by remembering the creator's thread ID in rsa->blinding and
7428     having all other threads use local one-time blinding factors
7429     (this requires more computation than sharing rsa->blinding, but
7430     avoids excessive locking; and if an RSA object is not shared
7431     between threads, blinding will still be very fast).
7432     [Bodo Moeller]
7433
7434  *) Fixed a typo bug that would cause ENGINE_set_default() to set an
7435     ENGINE as defaults for all supported algorithms irrespective of
7436     the 'flags' parameter. 'flags' is now honoured, so applications
7437     should make sure they are passing it correctly.
7438     [Geoff Thorpe]
7439
7440  *) Target "mingw" now allows native Windows code to be generated in
7441     the Cygwin environment as well as with the MinGW compiler.
7442     [Ulf Moeller]
7443
7444 Changes between 0.9.7 and 0.9.7a  [19 Feb 2003]
7445
7446  *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
7447     via timing by performing a MAC computation even if incorrect
7448     block cipher padding has been found.  This is a countermeasure
7449     against active attacks where the attacker has to distinguish
7450     between bad padding and a MAC verification error. (CVE-2003-0078)
7451
7452     [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
7453     Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
7454     Martin Vuagnoux (EPFL, Ilion)]
7455
7456  *) Make the no-err option work as intended.  The intention with no-err
7457     is not to have the whole error stack handling routines removed from
7458     libcrypto, it's only intended to remove all the function name and
7459     reason texts, thereby removing some of the footprint that may not
7460     be interesting if those errors aren't displayed anyway.
7461
7462     NOTE: it's still possible for any application or module to have its
7463     own set of error texts inserted.  The routines are there, just not
7464     used by default when no-err is given.
7465     [Richard Levitte]
7466
7467  *) Add support for FreeBSD on IA64.
7468     [dirk.meyer@dinoex.sub.org via Richard Levitte, resolves #454]
7469
7470  *) Adjust DES_cbc_cksum() so it returns the same value as the MIT
7471     Kerberos function mit_des_cbc_cksum().  Before this change,
7472     the value returned by DES_cbc_cksum() was like the one from
7473     mit_des_cbc_cksum(), except the bytes were swapped.
7474     [Kevin Greaney <Kevin.Greaney@hp.com> and Richard Levitte]
7475
7476  *) Allow an application to disable the automatic SSL chain building.
7477     Before this a rather primitive chain build was always performed in
7478     ssl3_output_cert_chain(): an application had no way to send the
7479     correct chain if the automatic operation produced an incorrect result.
7480
7481     Now the chain builder is disabled if either:
7482
7483     1. Extra certificates are added via SSL_CTX_add_extra_chain_cert().
7484
7485     2. The mode flag SSL_MODE_NO_AUTO_CHAIN is set.
7486
7487     The reasoning behind this is that an application would not want the
7488     auto chain building to take place if extra chain certificates are
7489     present and it might also want a means of sending no additional
7490     certificates (for example the chain has two certificates and the
7491     root is omitted).
7492     [Steve Henson]
7493
7494  *) Add the possibility to build without the ENGINE framework.
7495     [Steven Reddie <smr@essemer.com.au> via Richard Levitte]
7496
7497  *) Under Win32 gmtime() can return NULL: check return value in
7498     OPENSSL_gmtime(). Add error code for case where gmtime() fails.
7499     [Steve Henson]
7500
7501  *) DSA routines: under certain error conditions uninitialized BN objects
7502     could be freed. Solution: make sure initialization is performed early
7503     enough. (Reported and fix supplied by Ivan D Nestlerode <nestler@MIT.EDU>,
7504     Nils Larsch <nla@trustcenter.de> via PR#459)
7505     [Lutz Jaenicke]
7506
7507  *) Another fix for SSLv2 session ID handling: the session ID was incorrectly
7508     checked on reconnect on the client side, therefore session resumption
7509     could still fail with a "ssl session id is different" error. This
7510     behaviour is masked when SSL_OP_ALL is used due to
7511     SSL_OP_MICROSOFT_SESS_ID_BUG being set.
7512     Behaviour observed by Crispin Flowerday <crispin@flowerday.cx> as
7513     followup to PR #377.
7514     [Lutz Jaenicke]
7515
7516  *) IA-32 assembler support enhancements: unified ELF targets, support
7517     for SCO/Caldera platforms, fix for Cygwin shared build.
7518     [Andy Polyakov]
7519
7520  *) Add support for FreeBSD on sparc64.  As a consequence, support for
7521     FreeBSD on non-x86 processors is separate from x86 processors on
7522     the config script, much like the NetBSD support.
7523     [Richard Levitte & Kris Kennaway <kris@obsecurity.org>]
7524
7525 Changes between 0.9.6h and 0.9.7  [31 Dec 2002]
7526
7527  [NB: OpenSSL 0.9.6i and later 0.9.6 patch levels were released after
7528  OpenSSL 0.9.7.]
7529
7530  *) Fix session ID handling in SSLv2 client code: the SERVER FINISHED
7531     code (06) was taken as the first octet of the session ID and the last
7532     octet was ignored consequently. As a result SSLv2 client side session
7533     caching could not have worked due to the session ID mismatch between
7534     client and server.
7535     Behaviour observed by Crispin Flowerday <crispin@flowerday.cx> as
7536     PR #377.
7537     [Lutz Jaenicke]
7538
7539  *) Change the declaration of needed Kerberos libraries to use EX_LIBS
7540     instead of the special (and badly supported) LIBKRB5.  LIBKRB5 is
7541     removed entirely.
7542     [Richard Levitte]
7543
7544  *) The hw_ncipher.c engine requires dynamic locks.  Unfortunately, it
7545     seems that in spite of existing for more than a year, many application
7546     author have done nothing to provide the necessary callbacks, which
7547     means that this particular engine will not work properly anywhere.
7548     This is a very unfortunate situation which forces us, in the name
7549     of usability, to give the hw_ncipher.c a static lock, which is part
7550     of libcrypto.
7551     NOTE: This is for the 0.9.7 series ONLY.  This hack will never
7552     appear in 0.9.8 or later.  We EXPECT application authors to have
7553     dealt properly with this when 0.9.8 is released (unless we actually
7554     make such changes in the libcrypto locking code that changes will
7555     have to be made anyway).
7556     [Richard Levitte]
7557
7558  *) In asn1_d2i_read_bio() repeatedly call BIO_read() until all content
7559     octets have been read, EOF or an error occurs. Without this change
7560     some truncated ASN1 structures will not produce an error.
7561     [Steve Henson]
7562
7563  *) Disable Heimdal support, since it hasn't been fully implemented.
7564     Still give the possibility to force the use of Heimdal, but with
7565     warnings and a request that patches get sent to openssl-dev.
7566     [Richard Levitte]
7567
7568  *) Add the VC-CE target, introduce the WINCE sysname, and add
7569     INSTALL.WCE and appropriate conditionals to make it build.
7570     [Steven Reddie <smr@essemer.com.au> via Richard Levitte]
7571
7572  *) Change the DLL names for Cygwin to cygcrypto-x.y.z.dll and
7573     cygssl-x.y.z.dll, where x, y and z are the major, minor and
7574     edit numbers of the version.
7575     [Corinna Vinschen <vinschen@redhat.com> and Richard Levitte]
7576
7577  *) Introduce safe string copy and catenation functions
7578     (BUF_strlcpy() and BUF_strlcat()).
7579     [Ben Laurie (CHATS) and Richard Levitte]
7580
7581  *) Avoid using fixed-size buffers for one-line DNs.
7582     [Ben Laurie (CHATS)]
7583
7584  *) Add BUF_MEM_grow_clean() to avoid information leakage when
7585     resizing buffers containing secrets, and use where appropriate.
7586     [Ben Laurie (CHATS)]
7587
7588  *) Avoid using fixed size buffers for configuration file location.
7589     [Ben Laurie (CHATS)]
7590
7591  *) Avoid filename truncation for various CA files.
7592     [Ben Laurie (CHATS)]
7593
7594  *) Use sizeof in preference to magic numbers.
7595     [Ben Laurie (CHATS)]
7596
7597  *) Avoid filename truncation in cert requests.
7598     [Ben Laurie (CHATS)]
7599
7600  *) Add assertions to check for (supposedly impossible) buffer
7601     overflows.
7602     [Ben Laurie (CHATS)]
7603
7604  *) Don't cache truncated DNS entries in the local cache (this could
7605     potentially lead to a spoofing attack).
7606     [Ben Laurie (CHATS)]
7607
7608  *) Fix various buffers to be large enough for hex/decimal
7609     representations in a platform independent manner.
7610     [Ben Laurie (CHATS)]
7611
7612  *) Add CRYPTO_realloc_clean() to avoid information leakage when
7613     resizing buffers containing secrets, and use where appropriate.
7614     [Ben Laurie (CHATS)]
7615
7616  *) Add BIO_indent() to avoid much slightly worrying code to do
7617     indents.
7618     [Ben Laurie (CHATS)]
7619
7620  *) Convert sprintf()/BIO_puts() to BIO_printf().
7621     [Ben Laurie (CHATS)]
7622
7623  *) buffer_gets() could terminate with the buffer only half
7624     full. Fixed.
7625     [Ben Laurie (CHATS)]
7626
7627  *) Add assertions to prevent user-supplied crypto functions from
7628     overflowing internal buffers by having large block sizes, etc.
7629     [Ben Laurie (CHATS)]
7630
7631  *) New OPENSSL_assert() macro (similar to assert(), but enabled
7632     unconditionally).
7633     [Ben Laurie (CHATS)]
7634
7635  *) Eliminate unused copy of key in RC4.
7636     [Ben Laurie (CHATS)]
7637
7638  *) Eliminate unused and incorrectly sized buffers for IV in pem.h.
7639     [Ben Laurie (CHATS)]
7640
7641  *) Fix off-by-one error in EGD path.
7642     [Ben Laurie (CHATS)]
7643
7644  *) If RANDFILE path is too long, ignore instead of truncating.
7645     [Ben Laurie (CHATS)]
7646
7647  *) Eliminate unused and incorrectly sized X.509 structure
7648     CBCParameter.
7649     [Ben Laurie (CHATS)]
7650
7651  *) Eliminate unused and dangerous function knumber().
7652     [Ben Laurie (CHATS)]
7653
7654  *) Eliminate unused and dangerous structure, KSSL_ERR.
7655     [Ben Laurie (CHATS)]
7656
7657  *) Protect against overlong session ID context length in an encoded
7658     session object. Since these are local, this does not appear to be
7659     exploitable.
7660     [Ben Laurie (CHATS)]
7661
7662  *) Change from security patch (see 0.9.6e below) that did not affect
7663     the 0.9.6 release series:
7664
7665     Remote buffer overflow in SSL3 protocol - an attacker could
7666     supply an oversized master key in Kerberos-enabled versions.
7667     (CVE-2002-0657)
7668     [Ben Laurie (CHATS)]
7669
7670  *) Change the SSL kerb5 codes to match RFC 2712.
7671     [Richard Levitte]
7672
7673  *) Make -nameopt work fully for req and add -reqopt switch.
7674     [Michael Bell <michael.bell@rz.hu-berlin.de>, Steve Henson]
7675
7676  *) The "block size" for block ciphers in CFB and OFB mode should be 1.
7677     [Steve Henson, reported by Yngve Nysaeter Pettersen <yngve@opera.com>]
7678
7679  *) Make sure tests can be performed even if the corresponding algorithms
7680     have been removed entirely.  This was also the last step to make
7681     OpenSSL compilable with DJGPP under all reasonable conditions.
7682     [Richard Levitte, Doug Kaufman <dkaufman@rahul.net>]
7683
7684  *) Add cipher selection rules COMPLEMENTOFALL and COMPLEMENTOFDEFAULT
7685     to allow version independent disabling of normally unselected ciphers,
7686     which may be activated as a side-effect of selecting a single cipher.
7687
7688     (E.g., cipher list string "RSA" enables ciphersuites that are left
7689     out of "ALL" because they do not provide symmetric encryption.
7690     "RSA:!COMPLEMEMENTOFALL" avoids these unsafe ciphersuites.)
7691     [Lutz Jaenicke, Bodo Moeller]
7692
7693  *) Add appropriate support for separate platform-dependent build
7694     directories.  The recommended way to make a platform-dependent
7695     build directory is the following (tested on Linux), maybe with
7696     some local tweaks:
7697
7698        # Place yourself outside of the OpenSSL source tree.  In
7699        # this example, the environment variable OPENSSL_SOURCE
7700        # is assumed to contain the absolute OpenSSL source directory.
7701        mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
7702        cd objtree/"`uname -s`-`uname -r`-`uname -m`"
7703        (cd $OPENSSL_SOURCE; find . -type f) | while read F; do
7704                mkdir -p `dirname $F`
7705                ln -s $OPENSSL_SOURCE/$F $F
7706        done
7707
7708     To be absolutely sure not to disturb the source tree, a "make clean"
7709     is a good thing.  If it isn't successful, don't worry about it,
7710     it probably means the source directory is very clean.
7711     [Richard Levitte]
7712
7713  *) Make sure any ENGINE control commands make local copies of string
7714     pointers passed to them whenever necessary. Otherwise it is possible
7715     the caller may have overwritten (or deallocated) the original string
7716     data when a later ENGINE operation tries to use the stored values.
7717     [Götz Babin-Ebell <babinebell@trustcenter.de>]
7718
7719  *) Improve diagnostics in file reading and command-line digests.
7720     [Ben Laurie aided and abetted by Solar Designer <solar@openwall.com>]
7721
7722  *) Add AES modes CFB and OFB to the object database.  Correct an
7723     error in AES-CFB decryption.
7724     [Richard Levitte]
7725
7726  *) Remove most calls to EVP_CIPHER_CTX_cleanup() in evp_enc.c, this
7727     allows existing EVP_CIPHER_CTX structures to be reused after
7728     calling EVP_*Final(). This behaviour is used by encryption
7729     BIOs and some applications. This has the side effect that
7730     applications must explicitly clean up cipher contexts with
7731     EVP_CIPHER_CTX_cleanup() or they will leak memory.
7732     [Steve Henson]
7733
7734  *) Check the values of dna and dnb in bn_mul_recursive before calling
7735     bn_mul_comba (a non zero value means the a or b arrays do not contain
7736     n2 elements) and fallback to bn_mul_normal if either is not zero.
7737     [Steve Henson]
7738
7739  *) Fix escaping of non-ASCII characters when using the -subj option
7740     of the "openssl req" command line tool. (Robert Joop <joop@fokus.gmd.de>)
7741     [Lutz Jaenicke]
7742
7743  *) Make object definitions compliant to LDAP (RFC2256): SN is the short
7744     form for "surname", serialNumber has no short form.
7745     Use "mail" as the short name for "rfc822Mailbox" according to RFC2798;
7746     therefore remove "mail" short name for "internet 7".
7747     The OID for unique identifiers in X509 certificates is
7748     x500UniqueIdentifier, not uniqueIdentifier.
7749     Some more OID additions. (Michael Bell <michael.bell@rz.hu-berlin.de>)
7750     [Lutz Jaenicke]
7751
7752  *) Add an "init" command to the ENGINE config module and auto initialize
7753     ENGINEs. Without any "init" command the ENGINE will be initialized
7754     after all ctrl commands have been executed on it. If init=1 the
7755     ENGINE is initialized at that point (ctrls before that point are run
7756     on the uninitialized ENGINE and after on the initialized one). If
7757     init=0 then the ENGINE will not be initialized at all.
7758     [Steve Henson]
7759
7760  *) Fix the 'app_verify_callback' interface so that the user-defined
7761     argument is actually passed to the callback: In the
7762     SSL_CTX_set_cert_verify_callback() prototype, the callback
7763     declaration has been changed from
7764          int (*cb)()
7765     into
7766          int (*cb)(X509_STORE_CTX *,void *);
7767     in ssl_verify_cert_chain (ssl/ssl_cert.c), the call
7768          i=s->ctx->app_verify_callback(&ctx)
7769     has been changed into
7770          i=s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg).
7771
7772     To update applications using SSL_CTX_set_cert_verify_callback(),
7773     a dummy argument can be added to their callback functions.
7774     [D. K. Smetters <smetters@parc.xerox.com>]
7775
7776  *) Added the '4758cca' ENGINE to support IBM 4758 cards.
7777     [Maurice Gittens <maurice@gittens.nl>, touchups by Geoff Thorpe]
7778
7779  *) Add and OPENSSL_LOAD_CONF define which will cause
7780     OpenSSL_add_all_algorithms() to load the openssl.cnf config file.
7781     This allows older applications to transparently support certain
7782     OpenSSL features: such as crypto acceleration and dynamic ENGINE loading.
7783     Two new functions OPENSSL_add_all_algorithms_noconf() which will never
7784     load the config file and OPENSSL_add_all_algorithms_conf() which will
7785     always load it have also been added.
7786     [Steve Henson]
7787
7788  *) Add the OFB, CFB and CTR (all with 128 bit feedback) to AES.
7789     Adjust NIDs and EVP layer.
7790     [Stephen Sprunk <stephen@sprunk.org> and Richard Levitte]
7791
7792  *) Config modules support in openssl utility.
7793
7794     Most commands now load modules from the config file,
7795     though in a few (such as version) this isn't done
7796     because it couldn't be used for anything.
7797
7798     In the case of ca and req the config file used is
7799     the same as the utility itself: that is the -config
7800     command line option can be used to specify an
7801     alternative file.
7802     [Steve Henson]
7803
7804  *) Move default behaviour from OPENSSL_config(). If appname is NULL
7805     use "openssl_conf" if filename is NULL use default openssl config file.
7806     [Steve Henson]
7807
7808  *) Add an argument to OPENSSL_config() to allow the use of an alternative
7809     config section name. Add a new flag to tolerate a missing config file
7810     and move code to CONF_modules_load_file().
7811     [Steve Henson]
7812
7813  *) Support for crypto accelerator cards from Accelerated Encryption
7814     Processing, www.aep.ie.  (Use engine 'aep')
7815     The support was copied from 0.9.6c [engine] and adapted/corrected
7816     to work with the new engine framework.
7817     [AEP Inc. and Richard Levitte]
7818
7819  *) Support for SureWare crypto accelerator cards from Baltimore
7820     Technologies.  (Use engine 'sureware')
7821     The support was copied from 0.9.6c [engine] and adapted
7822     to work with the new engine framework.
7823     [Richard Levitte]
7824
7825  *) Have the CHIL engine fork-safe (as defined by nCipher) and actually
7826     make the newer ENGINE framework commands for the CHIL engine work.
7827     [Toomas Kiisk <vix@cyber.ee> and Richard Levitte]
7828
7829  *) Make it possible to produce shared libraries on ReliantUNIX.
7830     [Robert Dahlem <Robert.Dahlem@ffm2.siemens.de> via Richard Levitte]
7831
7832  *) Add the configuration target debug-linux-ppro.
7833     Make 'openssl rsa' use the general key loading routines
7834     implemented in apps.c, and make those routines able to
7835     handle the key format FORMAT_NETSCAPE and the variant
7836     FORMAT_IISSGC.
7837     [Toomas Kiisk <vix@cyber.ee> via Richard Levitte]
7838
7839 *) Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
7840     [Toomas Kiisk <vix@cyber.ee> via Richard Levitte]
7841
7842  *) Add -keyform to rsautl, and document -engine.
7843     [Richard Levitte, inspired by Toomas Kiisk <vix@cyber.ee>]
7844
7845  *) Change BIO_new_file (crypto/bio/bss_file.c) to use new
7846     BIO_R_NO_SUCH_FILE error code rather than the generic
7847     ERR_R_SYS_LIB error code if fopen() fails with ENOENT.
7848     [Ben Laurie]
7849
7850  *) Add new functions
7851          ERR_peek_last_error
7852          ERR_peek_last_error_line
7853          ERR_peek_last_error_line_data.
7854     These are similar to
7855          ERR_peek_error
7856          ERR_peek_error_line
7857          ERR_peek_error_line_data,
7858     but report on the latest error recorded rather than the first one
7859     still in the error queue.
7860     [Ben Laurie, Bodo Moeller]
7861
7862  *) default_algorithms option in ENGINE config module. This allows things
7863     like:
7864     default_algorithms = ALL
7865     default_algorithms = RSA, DSA, RAND, CIPHERS, DIGESTS
7866     [Steve Henson]
7867
7868  *) Preliminary ENGINE config module.
7869     [Steve Henson]
7870
7871  *) New experimental application configuration code.
7872     [Steve Henson]
7873
7874  *) Change the AES code to follow the same name structure as all other
7875     symmetric ciphers, and behave the same way.  Move everything to
7876     the directory crypto/aes, thereby obsoleting crypto/rijndael.
7877     [Stephen Sprunk <stephen@sprunk.org> and Richard Levitte]
7878
7879  *) SECURITY: remove unsafe setjmp/signal interaction from ui_openssl.c.
7880     [Ben Laurie and Theo de Raadt]
7881
7882  *) Add option to output public keys in req command.
7883     [Massimiliano Pala madwolf@openca.org]
7884
7885  *) Use wNAFs in EC_POINTs_mul() for improved efficiency
7886     (up to about 10% better than before for P-192 and P-224).
7887     [Bodo Moeller]
7888
7889  *) New functions/macros
7890
7891          SSL_CTX_set_msg_callback(ctx, cb)
7892          SSL_CTX_set_msg_callback_arg(ctx, arg)
7893          SSL_set_msg_callback(ssl, cb)
7894          SSL_set_msg_callback_arg(ssl, arg)
7895
7896     to request calling a callback function
7897
7898          void cb(int write_p, int version, int content_type,
7899                  const void *buf, size_t len, SSL *ssl, void *arg)
7900
7901     whenever a protocol message has been completely received
7902     (write_p == 0) or sent (write_p == 1).  Here 'version' is the
7903     protocol version  according to which the SSL library interprets
7904     the current protocol message (SSL2_VERSION, SSL3_VERSION, or
7905     TLS1_VERSION).  'content_type' is 0 in the case of SSL 2.0, or
7906     the content type as defined in the SSL 3.0/TLS 1.0 protocol
7907     specification (change_cipher_spec(20), alert(21), handshake(22)).
7908     'buf' and 'len' point to the actual message, 'ssl' to the
7909     SSL object, and 'arg' is the application-defined value set by
7910     SSL[_CTX]_set_msg_callback_arg().
7911
7912     'openssl s_client' and 'openssl s_server' have new '-msg' options
7913     to enable a callback that displays all protocol messages.
7914     [Bodo Moeller]
7915
7916  *) Change the shared library support so shared libraries are built as
7917     soon as the corresponding static library is finished, and thereby get
7918     openssl and the test programs linked against the shared library.
7919     This still only happens when the keyword "shard" has been given to
7920     the configuration scripts.
7921
7922     NOTE: shared library support is still an experimental thing, and
7923     backward binary compatibility is still not guaranteed.
7924     ["Maciej W. Rozycki" <macro@ds2.pg.gda.pl> and Richard Levitte]
7925
7926  *) Add support for Subject Information Access extension.
7927     [Peter Sylvester <Peter.Sylvester@EdelWeb.fr>]
7928
7929  *) Make BUF_MEM_grow() behaviour more consistent: Initialise to zero
7930     additional bytes when new memory had to be allocated, not just
7931     when reusing an existing buffer.
7932     [Bodo Moeller]
7933
7934  *) New command line and configuration option 'utf8' for the req command.
7935     This allows field values to be specified as UTF8 strings.
7936     [Steve Henson]
7937
7938  *) Add -multi and -mr options to "openssl speed" - giving multiple parallel
7939     runs for the former and machine-readable output for the latter.
7940     [Ben Laurie]
7941
7942  *) Add '-noemailDN' option to 'openssl ca'.  This prevents inclusion
7943     of the e-mail address in the DN (i.e., it will go into a certificate
7944     extension only).  The new configuration file option 'email_in_dn = no'
7945     has the same effect.
7946     [Massimiliano Pala madwolf@openca.org]
7947
7948  *) Change all functions with names starting with des_ to be starting
7949     with DES_ instead.  Add wrappers that are compatible with libdes,
7950     but are named _ossl_old_des_*.  Finally, add macros that map the
7951     des_* symbols to the corresponding _ossl_old_des_* if libdes
7952     compatibility is desired.  If OpenSSL 0.9.6c compatibility is
7953     desired, the des_* symbols will be mapped to DES_*, with one
7954     exception.
7955
7956     Since we provide two compatibility mappings, the user needs to
7957     define the macro OPENSSL_DES_LIBDES_COMPATIBILITY if libdes
7958     compatibility is desired.  The default (i.e., when that macro
7959     isn't defined) is OpenSSL 0.9.6c compatibility.
7960
7961     There are also macros that enable and disable the support of old
7962     des functions altogether.  Those are OPENSSL_ENABLE_OLD_DES_SUPPORT
7963     and OPENSSL_DISABLE_OLD_DES_SUPPORT.  If none or both of those
7964     are defined, the default will apply: to support the old des routines.
7965
7966     In either case, one must include openssl/des.h to get the correct
7967     definitions.  Do not try to just include openssl/des_old.h, that
7968     won't work.
7969
7970     NOTE: This is a major break of an old API into a new one.  Software
7971     authors are encouraged to switch to the DES_ style functions.  Some
7972     time in the future, des_old.h and the libdes compatibility functions
7973     will be disable (i.e. OPENSSL_DISABLE_OLD_DES_SUPPORT will be the
7974     default), and then completely removed.
7975     [Richard Levitte]
7976
7977  *) Test for certificates which contain unsupported critical extensions.
7978     If such a certificate is found during a verify operation it is
7979     rejected by default: this behaviour can be overridden by either
7980     handling the new error X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION or
7981     by setting the verify flag X509_V_FLAG_IGNORE_CRITICAL. A new function
7982     X509_supported_extension() has also been added which returns 1 if a
7983     particular extension is supported.
7984     [Steve Henson]
7985
7986  *) Modify the behaviour of EVP cipher functions in similar way to digests
7987     to retain compatibility with existing code.
7988     [Steve Henson]
7989
7990  *) Modify the behaviour of EVP_DigestInit() and EVP_DigestFinal() to retain
7991     compatibility with existing code. In particular the 'ctx' parameter does
7992     not have to be to be initialized before the call to EVP_DigestInit() and
7993     it is tidied up after a call to EVP_DigestFinal(). New function
7994     EVP_DigestFinal_ex() which does not tidy up the ctx. Similarly function
7995     EVP_MD_CTX_copy() changed to not require the destination to be
7996     initialized valid and new function EVP_MD_CTX_copy_ex() added which
7997     requires the destination to be valid.
7998
7999     Modify all the OpenSSL digest calls to use EVP_DigestInit_ex(),
8000     EVP_DigestFinal_ex() and EVP_MD_CTX_copy_ex().
8001     [Steve Henson]
8002
8003  *) Change ssl3_get_message (ssl/s3_both.c) and the functions using it
8004     so that complete 'Handshake' protocol structures are kept in memory
8005     instead of overwriting 'msg_type' and 'length' with 'body' data.
8006     [Bodo Moeller]
8007
8008  *) Add an implementation of SSL_add_dir_cert_subjects_to_stack for Win32.
8009     [Massimo Santin via Richard Levitte]
8010
8011  *) Major restructuring to the underlying ENGINE code. This includes
8012     reduction of linker bloat, separation of pure "ENGINE" manipulation
8013     (initialisation, etc) from functionality dealing with implementations
8014     of specific crypto interfaces. This change also introduces integrated
8015     support for symmetric ciphers and digest implementations - so ENGINEs
8016     can now accelerate these by providing EVP_CIPHER and EVP_MD
8017     implementations of their own. This is detailed in crypto/engine/README
8018     as it couldn't be adequately described here. However, there are a few
8019     API changes worth noting - some RSA, DSA, DH, and RAND functions that
8020     were changed in the original introduction of ENGINE code have now
8021     reverted back - the hooking from this code to ENGINE is now a good
8022     deal more passive and at run-time, operations deal directly with
8023     RSA_METHODs, DSA_METHODs (etc) as they did before, rather than
8024     dereferencing through an ENGINE pointer any more. Also, the ENGINE
8025     functions dealing with BN_MOD_EXP[_CRT] handlers have been removed -
8026     they were not being used by the framework as there is no concept of a
8027     BIGNUM_METHOD and they could not be generalised to the new
8028     'ENGINE_TABLE' mechanism that underlies the new code. Similarly,
8029     ENGINE_cpy() has been removed as it cannot be consistently defined in
8030     the new code.
8031     [Geoff Thorpe]
8032
8033  *) Change ASN1_GENERALIZEDTIME_check() to allow fractional seconds.
8034     [Steve Henson]
8035
8036  *) Change mkdef.pl to sort symbols that get the same entry number,
8037     and make sure the automatically generated functions ERR_load_*
8038     become part of libeay.num as well.
8039     [Richard Levitte]
8040
8041  *) New function SSL_renegotiate_pending().  This returns true once
8042     renegotiation has been requested (either SSL_renegotiate() call
8043     or HelloRequest/ClientHello received from the peer) and becomes
8044     false once a handshake has been completed.
8045     (For servers, SSL_renegotiate() followed by SSL_do_handshake()
8046     sends a HelloRequest, but does not ensure that a handshake takes
8047     place.  SSL_renegotiate_pending() is useful for checking if the
8048     client has followed the request.)
8049     [Bodo Moeller]
8050
8051  *) New SSL option SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION.
8052     By default, clients may request session resumption even during
8053     renegotiation (if session ID contexts permit); with this option,
8054     session resumption is possible only in the first handshake.
8055
8056     SSL_OP_ALL is now 0x00000FFFL instead of 0x000FFFFFL.  This makes
8057     more bits available for options that should not be part of
8058     SSL_OP_ALL (such as SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION).
8059     [Bodo Moeller]
8060
8061  *) Add some demos for certificate and certificate request creation.
8062     [Steve Henson]
8063
8064  *) Make maximum certificate chain size accepted from the peer application
8065     settable (SSL*_get/set_max_cert_list()), as proposed by
8066     "Douglas E. Engert" <deengert@anl.gov>.
8067     [Lutz Jaenicke]
8068
8069  *) Add support for shared libraries for Unixware-7
8070     (Boyd Lynn Gerber <gerberb@zenez.com>).
8071     [Lutz Jaenicke]
8072
8073  *) Add a "destroy" handler to ENGINEs that allows structural cleanup to
8074     be done prior to destruction. Use this to unload error strings from
8075     ENGINEs that load their own error strings. NB: This adds two new API
8076     functions to "get" and "set" this destroy handler in an ENGINE.
8077     [Geoff Thorpe]
8078
8079  *) Alter all existing ENGINE implementations (except "openssl" and
8080     "openbsd") to dynamically instantiate their own error strings. This
8081     makes them more flexible to be built both as statically-linked ENGINEs
8082     and self-contained shared-libraries loadable via the "dynamic" ENGINE.
8083     Also, add stub code to each that makes building them as self-contained
8084     shared-libraries easier (see README.ENGINE).
8085     [Geoff Thorpe]
8086
8087  *) Add a "dynamic" ENGINE that provides a mechanism for binding ENGINE
8088     implementations into applications that are completely implemented in
8089     self-contained shared-libraries. The "dynamic" ENGINE exposes control
8090     commands that can be used to configure what shared-library to load and
8091     to control aspects of the way it is handled. Also, made an update to
8092     the README.ENGINE file that brings its information up-to-date and
8093     provides some information and instructions on the "dynamic" ENGINE
8094     (ie. how to use it, how to build "dynamic"-loadable ENGINEs, etc).
8095     [Geoff Thorpe]
8096
8097  *) Make it possible to unload ranges of ERR strings with a new
8098     "ERR_unload_strings" function.
8099     [Geoff Thorpe]
8100
8101  *) Add a copy() function to EVP_MD.
8102     [Ben Laurie]
8103
8104  *) Make EVP_MD routines take a context pointer instead of just the
8105     md_data void pointer.
8106     [Ben Laurie]
8107
8108  *) Add flags to EVP_MD and EVP_MD_CTX. EVP_MD_FLAG_ONESHOT indicates
8109     that the digest can only process a single chunk of data
8110     (typically because it is provided by a piece of
8111     hardware). EVP_MD_CTX_FLAG_ONESHOT indicates that the application
8112     is only going to provide a single chunk of data, and hence the
8113     framework needn't accumulate the data for oneshot drivers.
8114     [Ben Laurie]
8115
8116  *) As with "ERR", make it possible to replace the underlying "ex_data"
8117     functions. This change also alters the storage and management of global
8118     ex_data state - it's now all inside ex_data.c and all "class" code (eg.
8119     RSA, BIO, SSL_CTX, etc) no longer stores its own STACKS and per-class
8120     index counters. The API functions that use this state have been changed
8121     to take a "class_index" rather than pointers to the class's local STACK
8122     and counter, and there is now an API function to dynamically create new
8123     classes. This centralisation allows us to (a) plug a lot of the
8124     thread-safety problems that existed, and (b) makes it possible to clean
8125     up all allocated state using "CRYPTO_cleanup_all_ex_data()". W.r.t. (b)
8126     such data would previously have always leaked in application code and
8127     workarounds were in place to make the memory debugging turn a blind eye
8128     to it. Application code that doesn't use this new function will still
8129     leak as before, but their memory debugging output will announce it now
8130     rather than letting it slide.
8131
8132     Besides the addition of CRYPTO_cleanup_all_ex_data(), another API change
8133     induced by the "ex_data" overhaul is that X509_STORE_CTX_init() now
8134     has a return value to indicate success or failure.
8135     [Geoff Thorpe]
8136
8137  *) Make it possible to replace the underlying "ERR" functions such that the
8138     global state (2 LHASH tables and 2 locks) is only used by the "default"
8139     implementation. This change also adds two functions to "get" and "set"
8140     the implementation prior to it being automatically set the first time
8141     any other ERR function takes place. Ie. an application can call "get",
8142     pass the return value to a module it has just loaded, and that module
8143     can call its own "set" function using that value. This means the
8144     module's "ERR" operations will use (and modify) the error state in the
8145     application and not in its own statically linked copy of OpenSSL code.
8146     [Geoff Thorpe]
8147
8148  *) Give DH, DSA, and RSA types their own "**_up_ref()" function to increment
8149     reference counts. This performs normal REF_PRINT/REF_CHECK macros on
8150     the operation, and provides a more encapsulated way for external code
8151     (crypto/evp/ and ssl/) to do this. Also changed the evp and ssl code
8152     to use these functions rather than manually incrementing the counts.
8153
8154     Also rename "DSO_up()" function to more descriptive "DSO_up_ref()".
8155     [Geoff Thorpe]
8156
8157  *) Add EVP test program.
8158     [Ben Laurie]
8159
8160  *) Add symmetric cipher support to ENGINE. Expect the API to change!
8161     [Ben Laurie]
8162
8163  *) New CRL functions: X509_CRL_set_version(), X509_CRL_set_issuer_name()
8164     X509_CRL_set_lastUpdate(), X509_CRL_set_nextUpdate(), X509_CRL_sort(),
8165     X509_REVOKED_set_serialNumber(), and X509_REVOKED_set_revocationDate().
8166     These allow a CRL to be built without having to access X509_CRL fields
8167     directly. Modify 'ca' application to use new functions.
8168     [Steve Henson]
8169
8170  *) Move SSL_OP_TLS_ROLLBACK_BUG out of the SSL_OP_ALL list of recommended
8171     bug workarounds. Rollback attack detection is a security feature.
8172     The problem will only arise on OpenSSL servers when TLSv1 is not
8173     available (sslv3_server_method() or SSL_OP_NO_TLSv1).
8174     Software authors not wanting to support TLSv1 will have special reasons
8175     for their choice and can explicitly enable this option.
8176     [Bodo Moeller, Lutz Jaenicke]
8177
8178  *) Rationalise EVP so it can be extended: don't include a union of
8179     cipher/digest structures, add init/cleanup functions for EVP_MD_CTX
8180     (similar to those existing for EVP_CIPHER_CTX).
8181     Usage example:
8182
8183         EVP_MD_CTX md;
8184
8185         EVP_MD_CTX_init(&md);             /* new function call */
8186         EVP_DigestInit(&md, EVP_sha1());
8187         EVP_DigestUpdate(&md, in, len);
8188         EVP_DigestFinal(&md, out, NULL);
8189         EVP_MD_CTX_cleanup(&md);          /* new function call */
8190
8191     [Ben Laurie]
8192
8193  *) Make DES key schedule conform to the usual scheme, as well as
8194     correcting its structure. This means that calls to DES functions
8195     now have to pass a pointer to a des_key_schedule instead of a
8196     plain des_key_schedule (which was actually always a pointer
8197     anyway): E.g.,
8198
8199         des_key_schedule ks;
8200
8201         des_set_key_checked(..., &ks);
8202         des_ncbc_encrypt(..., &ks, ...);
8203
8204     (Note that a later change renames 'des_...' into 'DES_...'.)
8205     [Ben Laurie]
8206
8207  *) Initial reduction of linker bloat: the use of some functions, such as
8208     PEM causes large amounts of unused functions to be linked in due to
8209     poor organisation. For example pem_all.c contains every PEM function
8210     which has a knock on effect of linking in large amounts of (unused)
8211     ASN1 code. Grouping together similar functions and splitting unrelated
8212     functions prevents this.
8213     [Steve Henson]
8214
8215  *) Cleanup of EVP macros.
8216     [Ben Laurie]
8217
8218  *) Change historical references to {NID,SN,LN}_des_ede and ede3 to add the
8219     correct _ecb suffix.
8220     [Ben Laurie]
8221
8222  *) Add initial OCSP responder support to ocsp application. The
8223     revocation information is handled using the text based index
8224     use by the ca application. The responder can either handle
8225     requests generated internally, supplied in files (for example
8226     via a CGI script) or using an internal minimal server.
8227     [Steve Henson]
8228
8229  *) Add configuration choices to get zlib compression for TLS.
8230     [Richard Levitte]
8231
8232  *) Changes to Kerberos SSL for RFC 2712 compliance:
8233     1.  Implemented real KerberosWrapper, instead of just using
8234         KRB5 AP_REQ message.  [Thanks to Simon Wilkinson <sxw@sxw.org.uk>]
8235     2.  Implemented optional authenticator field of KerberosWrapper.
8236
8237     Added openssl-style ASN.1 macros for Kerberos ticket, ap_req,
8238     and authenticator structs; see crypto/krb5/.
8239
8240     Generalized Kerberos calls to support multiple Kerberos libraries.
8241     [Vern Staats <staatsvr@asc.hpc.mil>,
8242      Jeffrey Altman <jaltman@columbia.edu>
8243      via Richard Levitte]
8244
8245  *) Cause 'openssl speed' to use fully hard-coded DSA keys as it
8246     already does with RSA. testdsa.h now has 'priv_key/pub_key'
8247     values for each of the key sizes rather than having just
8248     parameters (and 'speed' generating keys each time).
8249     [Geoff Thorpe]
8250
8251  *) Speed up EVP routines.
8252     Before:
8253encrypt
8254type              8 bytes     64 bytes    256 bytes   1024 bytes   8192 bytes
8255des-cbc           4408.85k     5560.51k     5778.46k     5862.20k     5825.16k
8256des-cbc           4389.55k     5571.17k     5792.23k     5846.91k     5832.11k
8257des-cbc           4394.32k     5575.92k     5807.44k     5848.37k     5841.30k
8258decrypt
8259des-cbc           3482.66k     5069.49k     5496.39k     5614.16k     5639.28k
8260des-cbc           3480.74k     5068.76k     5510.34k     5609.87k     5635.52k
8261des-cbc           3483.72k     5067.62k     5504.60k     5708.01k     5724.80k
8262     After:
8263encrypt
8264des-cbc           4660.16k     5650.19k     5807.19k     5827.13k     5783.32k
8265decrypt
8266des-cbc           3624.96k     5258.21k     5530.91k     5624.30k     5628.26k
8267     [Ben Laurie]
8268
8269  *) Added the OS2-EMX target.
8270     ["Brian Havard" <brianh@kheldar.apana.org.au> and Richard Levitte]
8271
8272  *) Rewrite apps to use NCONF routines instead of the old CONF. New functions
8273     to support NCONF routines in extension code. New function CONF_set_nconf()
8274     to allow functions which take an NCONF to also handle the old LHASH
8275     structure: this means that the old CONF compatible routines can be
8276     retained (in particular wrt extensions) without having to duplicate the
8277     code. New function X509V3_add_ext_nconf_sk to add extensions to a stack.
8278     [Steve Henson]
8279
8280  *) Enhance the general user interface with mechanisms for inner control
8281     and with possibilities to have yes/no kind of prompts.
8282     [Richard Levitte]
8283
8284  *) Change all calls to low level digest routines in the library and
8285     applications to use EVP. Add missing calls to HMAC_cleanup() and
8286     don't assume HMAC_CTX can be copied using memcpy().
8287     [Verdon Walker <VWalker@novell.com>, Steve Henson]
8288
8289  *) Add the possibility to control engines through control names but with
8290     arbitrary arguments instead of just a string.
8291     Change the key loaders to take a UI_METHOD instead of a callback
8292     function pointer.  NOTE: this breaks binary compatibility with earlier
8293     versions of OpenSSL [engine].
8294     Adapt the nCipher code for these new conditions and add a card insertion
8295     callback.
8296     [Richard Levitte]
8297
8298  *) Enhance the general user interface with mechanisms to better support
8299     dialog box interfaces, application-defined prompts, the possibility
8300     to use defaults (for example default passwords from somewhere else)
8301     and interrupts/cancellations.
8302     [Richard Levitte]
8303
8304  *) Tidy up PKCS#12 attribute handling. Add support for the CSP name
8305     attribute in PKCS#12 files, add new -CSP option to pkcs12 utility.
8306     [Steve Henson]
8307
8308  *) Fix a memory leak in 'sk_dup()' in the case reallocation fails. (Also
8309     tidy up some unnecessarily weird code in 'sk_new()').
8310     [Geoff, reported by Diego Tartara <dtartara@novamens.com>]
8311
8312  *) Change the key loading routines for ENGINEs to use the same kind
8313     callback (pem_password_cb) as all other routines that need this
8314     kind of callback.
8315     [Richard Levitte]
8316
8317  *) Increase ENTROPY_NEEDED to 32 bytes, as Rijndael can operate with
8318     256 bit (=32 byte) keys. Of course seeding with more entropy bytes
8319     than this minimum value is recommended.
8320     [Lutz Jaenicke]
8321
8322  *) New random seeder for OpenVMS, using the system process statistics
8323     that are easily reachable.
8324     [Richard Levitte]
8325
8326  *) Windows apparently can't transparently handle global
8327     variables defined in DLLs. Initialisations such as:
8328
8329        const ASN1_ITEM *it = &ASN1_INTEGER_it;
8330
8331     won't compile. This is used by the any applications that need to
8332     declare their own ASN1 modules. This was fixed by adding the option
8333     EXPORT_VAR_AS_FN to all Win32 platforms, although this isn't strictly
8334     needed for static libraries under Win32.
8335     [Steve Henson]
8336
8337  *) New functions X509_PURPOSE_set() and X509_TRUST_set() to handle
8338     setting of purpose and trust fields. New X509_STORE trust and
8339     purpose functions and tidy up setting in other SSL functions.
8340     [Steve Henson]
8341
8342  *) Add copies of X509_STORE_CTX fields and callbacks to X509_STORE
8343     structure. These are inherited by X509_STORE_CTX when it is
8344     initialised. This allows various defaults to be set in the
8345     X509_STORE structure (such as flags for CRL checking and custom
8346     purpose or trust settings) for functions which only use X509_STORE_CTX
8347     internally such as S/MIME.
8348
8349     Modify X509_STORE_CTX_purpose_inherit() so it only sets purposes and
8350     trust settings if they are not set in X509_STORE. This allows X509_STORE
8351     purposes and trust (in S/MIME for example) to override any set by default.
8352
8353     Add command line options for CRL checking to smime, s_client and s_server
8354     applications.
8355     [Steve Henson]
8356
8357  *) Initial CRL based revocation checking. If the CRL checking flag(s)
8358     are set then the CRL is looked up in the X509_STORE structure and
8359     its validity and signature checked, then if the certificate is found
8360     in the CRL the verify fails with a revoked error.
8361
8362     Various new CRL related callbacks added to X509_STORE_CTX structure.
8363
8364     Command line options added to 'verify' application to support this.
8365
8366     This needs some additional work, such as being able to handle multiple
8367     CRLs with different times, extension based lookup (rather than just
8368     by subject name) and ultimately more complete V2 CRL extension
8369     handling.
8370     [Steve Henson]
8371
8372  *) Add a general user interface API (crypto/ui/).  This is designed
8373     to replace things like des_read_password and friends (backward
8374     compatibility functions using this new API are provided).
8375     The purpose is to remove prompting functions from the DES code
8376     section as well as provide for prompting through dialog boxes in
8377     a window system and the like.
8378     [Richard Levitte]
8379
8380  *) Add "ex_data" support to ENGINE so implementations can add state at a
8381     per-structure level rather than having to store it globally.
8382     [Geoff]
8383
8384  *) Make it possible for ENGINE structures to be copied when retrieved by
8385     ENGINE_by_id() if the ENGINE specifies a new flag: ENGINE_FLAGS_BY_ID_COPY.
8386     This causes the "original" ENGINE structure to act like a template,
8387     analogous to the RSA vs. RSA_METHOD type of separation. Because of this
8388     operational state can be localised to each ENGINE structure, despite the
8389     fact they all share the same "methods". New ENGINE structures returned in
8390     this case have no functional references and the return value is the single
8391     structural reference. This matches the single structural reference returned
8392     by ENGINE_by_id() normally, when it is incremented on the pre-existing
8393     ENGINE structure.
8394     [Geoff]
8395
8396  *) Fix ASN1 decoder when decoding type ANY and V_ASN1_OTHER: since this
8397     needs to match any other type at all we need to manually clear the
8398     tag cache.
8399     [Steve Henson]
8400
8401  *) Changes to the "openssl engine" utility to include;
8402     - verbosity levels ('-v', '-vv', and '-vvv') that provide information
8403       about an ENGINE's available control commands.
8404     - executing control commands from command line arguments using the
8405       '-pre' and '-post' switches. '-post' is only used if '-t' is
8406       specified and the ENGINE is successfully initialised. The syntax for
8407       the individual commands are colon-separated, for example;
8408         openssl engine chil -pre FORK_CHECK:0 -pre SO_PATH:/lib/test.so
8409     [Geoff]
8410
8411  *) New dynamic control command support for ENGINEs. ENGINEs can now
8412     declare their own commands (numbers), names (strings), descriptions,
8413     and input types for run-time discovery by calling applications. A
8414     subset of these commands are implicitly classed as "executable"
8415     depending on their input type, and only these can be invoked through
8416     the new string-based API function ENGINE_ctrl_cmd_string(). (Eg. this
8417     can be based on user input, config files, etc). The distinction is
8418     that "executable" commands cannot return anything other than a boolean
8419     result and can only support numeric or string input, whereas some
8420     discoverable commands may only be for direct use through
8421     ENGINE_ctrl(), eg. supporting the exchange of binary data, function
8422     pointers, or other custom uses. The "executable" commands are to
8423     support parameterisations of ENGINE behaviour that can be
8424     unambiguously defined by ENGINEs and used consistently across any
8425     OpenSSL-based application. Commands have been added to all the
8426     existing hardware-supporting ENGINEs, noticeably "SO_PATH" to allow
8427     control over shared-library paths without source code alterations.
8428     [Geoff]
8429
8430  *) Changed all ENGINE implementations to dynamically allocate their
8431     ENGINEs rather than declaring them statically. Apart from this being
8432     necessary with the removal of the ENGINE_FLAGS_MALLOCED distinction,
8433     this also allows the implementations to compile without using the
8434     internal engine_int.h header.
8435     [Geoff]
8436
8437  *) Minor adjustment to "rand" code. RAND_get_rand_method() now returns a
8438     'const' value. Any code that should be able to modify a RAND_METHOD
8439     should already have non-const pointers to it (ie. they should only
8440     modify their own ones).
8441     [Geoff]
8442
8443  *) Made a variety of little tweaks to the ENGINE code.
8444     - "atalla" and "ubsec" string definitions were moved from header files
8445       to C code. "nuron" string definitions were placed in variables
8446       rather than hard-coded - allowing parameterisation of these values
8447       later on via ctrl() commands.
8448     - Removed unused "#if 0"'d code.
8449     - Fixed engine list iteration code so it uses ENGINE_free() to release
8450       structural references.
8451     - Constified the RAND_METHOD element of ENGINE structures.
8452     - Constified various get/set functions as appropriate and added
8453       missing functions (including a catch-all ENGINE_cpy that duplicates
8454       all ENGINE values onto a new ENGINE except reference counts/state).
8455     - Removed NULL parameter checks in get/set functions. Setting a method
8456       or function to NULL is a way of cancelling out a previously set
8457       value.  Passing a NULL ENGINE parameter is just plain stupid anyway
8458       and doesn't justify the extra error symbols and code.
8459     - Deprecate the ENGINE_FLAGS_MALLOCED define and move the area for
8460       flags from engine_int.h to engine.h.
8461     - Changed prototypes for ENGINE handler functions (init(), finish(),
8462       ctrl(), key-load functions, etc) to take an (ENGINE*) parameter.
8463     [Geoff]
8464
8465  *) Implement binary inversion algorithm for BN_mod_inverse in addition
8466     to the algorithm using long division.  The binary algorithm can be
8467     used only if the modulus is odd.  On 32-bit systems, it is faster
8468     only for relatively small moduli (roughly 20-30% for 128-bit moduli,
8469     roughly 5-15% for 256-bit moduli), so we use it only for moduli
8470     up to 450 bits.  In 64-bit environments, the binary algorithm
8471     appears to be advantageous for much longer moduli; here we use it
8472     for moduli up to 2048 bits.
8473     [Bodo Moeller]
8474
8475  *) Rewrite CHOICE field setting in ASN1_item_ex_d2i(). The old code
8476     could not support the combine flag in choice fields.
8477     [Steve Henson]
8478
8479  *) Add a 'copy_extensions' option to the 'ca' utility. This copies
8480     extensions from a certificate request to the certificate.
8481     [Steve Henson]
8482
8483  *) Allow multiple 'certopt' and 'nameopt' options to be separated
8484     by commas. Add 'namopt' and 'certopt' options to the 'ca' config
8485     file: this allows the display of the certificate about to be
8486     signed to be customised, to allow certain fields to be included
8487     or excluded and extension details. The old system didn't display
8488     multicharacter strings properly, omitted fields not in the policy
8489     and couldn't display additional details such as extensions.
8490     [Steve Henson]
8491
8492  *) Function EC_POINTs_mul for multiple scalar multiplication
8493     of an arbitrary number of elliptic curve points
8494          \sum scalars[i]*points[i],
8495     optionally including the generator defined for the EC_GROUP:
8496          scalar*generator +  \sum scalars[i]*points[i].
8497
8498     EC_POINT_mul is a simple wrapper function for the typical case
8499     that the point list has just one item (besides the optional
8500     generator).
8501     [Bodo Moeller]
8502
8503  *) First EC_METHODs for curves over GF(p):
8504
8505     EC_GFp_simple_method() uses the basic BN_mod_mul and BN_mod_sqr
8506     operations and provides various method functions that can also
8507     operate with faster implementations of modular arithmetic.
8508
8509     EC_GFp_mont_method() reuses most functions that are part of
8510     EC_GFp_simple_method, but uses Montgomery arithmetic.
8511
8512     [Bodo Moeller; point addition and point doubling
8513     implementation directly derived from source code provided by
8514     Lenka Fibikova <fibikova@exp-math.uni-essen.de>]
8515
8516  *) Framework for elliptic curves (crypto/ec/ec.h, crypto/ec/ec_lcl.h,
8517     crypto/ec/ec_lib.c):
8518
8519     Curves are EC_GROUP objects (with an optional group generator)
8520     based on EC_METHODs that are built into the library.
8521
8522     Points are EC_POINT objects based on EC_GROUP objects.
8523
8524     Most of the framework would be able to handle curves over arbitrary
8525     finite fields, but as there are no obvious types for fields other
8526     than GF(p), some functions are limited to that for now.
8527     [Bodo Moeller]
8528
8529  *) Add the -HTTP option to s_server.  It is similar to -WWW, but requires
8530     that the file contains a complete HTTP response.
8531     [Richard Levitte]
8532
8533  *) Add the ec directory to mkdef.pl and mkfiles.pl. In mkdef.pl
8534     change the def and num file printf format specifier from "%-40sXXX"
8535     to "%-39s XXX". The latter will always guarantee a space after the
8536     field while the former will cause them to run together if the field
8537     is 40 of more characters long.
8538     [Steve Henson]
8539
8540  *) Constify the cipher and digest 'method' functions and structures
8541     and modify related functions to take constant EVP_MD and EVP_CIPHER
8542     pointers.
8543     [Steve Henson]
8544
8545  *) Hide BN_CTX structure details in bn_lcl.h instead of publishing them
8546     in <openssl/bn.h>.  Also further increase BN_CTX_NUM to 32.
8547     [Bodo Moeller]
8548
8549  *) Modify EVP_Digest*() routines so they now return values. Although the
8550     internal software routines can never fail additional hardware versions
8551     might.
8552     [Steve Henson]
8553
8554  *) Clean up crypto/err/err.h and change some error codes to avoid conflicts:
8555
8556     Previously ERR_R_FATAL was too small and coincided with ERR_LIB_PKCS7
8557     (= ERR_R_PKCS7_LIB); it is now 64 instead of 32.
8558
8559     ASN1 error codes
8560          ERR_R_NESTED_ASN1_ERROR
8561          ...
8562          ERR_R_MISSING_ASN1_EOS
8563     were 4 .. 9, conflicting with
8564          ERR_LIB_RSA (= ERR_R_RSA_LIB)
8565          ...
8566          ERR_LIB_PEM (= ERR_R_PEM_LIB).
8567     They are now 58 .. 63 (i.e., just below ERR_R_FATAL).
8568
8569     Add new error code 'ERR_R_INTERNAL_ERROR'.
8570     [Bodo Moeller]
8571
8572  *) Don't overuse locks in crypto/err/err.c: For data retrieval, CRYPTO_r_lock
8573     suffices.
8574     [Bodo Moeller]
8575
8576  *) New option '-subj arg' for 'openssl req' and 'openssl ca'.  This
8577     sets the subject name for a new request or supersedes the
8578     subject name in a given request. Formats that can be parsed are
8579          'CN=Some Name, OU=myOU, C=IT'
8580     and
8581          'CN=Some Name/OU=myOU/C=IT'.
8582
8583     Add options '-batch' and '-verbose' to 'openssl req'.
8584     [Massimiliano Pala <madwolf@hackmasters.net>]
8585
8586  *) Introduce the possibility to access global variables through
8587     functions on platform were that's the best way to handle exporting
8588     global variables in shared libraries.  To enable this functionality,
8589     one must configure with "EXPORT_VAR_AS_FN" or defined the C macro
8590     "OPENSSL_EXPORT_VAR_AS_FUNCTION" in crypto/opensslconf.h (the latter
8591     is normally done by Configure or something similar).
8592
8593     To implement a global variable, use the macro OPENSSL_IMPLEMENT_GLOBAL
8594     in the source file (foo.c) like this:
8595
8596        OPENSSL_IMPLEMENT_GLOBAL(int,foo)=1;
8597        OPENSSL_IMPLEMENT_GLOBAL(double,bar);
8598
8599     To declare a global variable, use the macros OPENSSL_DECLARE_GLOBAL
8600     and OPENSSL_GLOBAL_REF in the header file (foo.h) like this:
8601
8602        OPENSSL_DECLARE_GLOBAL(int,foo);
8603        #define foo OPENSSL_GLOBAL_REF(foo)
8604        OPENSSL_DECLARE_GLOBAL(double,bar);
8605        #define bar OPENSSL_GLOBAL_REF(bar)
8606
8607     The #defines are very important, and therefore so is including the
8608     header file everywhere where the defined globals are used.
8609
8610     The macro OPENSSL_EXPORT_VAR_AS_FUNCTION also affects the definition
8611     of ASN.1 items, but that structure is a bit different.
8612
8613     The largest change is in util/mkdef.pl which has been enhanced with
8614     better and easier to understand logic to choose which symbols should
8615     go into the Windows .def files as well as a number of fixes and code
8616     cleanup (among others, algorithm keywords are now sorted
8617     lexicographically to avoid constant rewrites).
8618     [Richard Levitte]
8619
8620  *) In BN_div() keep a copy of the sign of 'num' before writing the
8621     result to 'rm' because if rm==num the value will be overwritten
8622     and produce the wrong result if 'num' is negative: this caused
8623     problems with BN_mod() and BN_nnmod().
8624     [Steve Henson]
8625
8626  *) Function OCSP_request_verify(). This checks the signature on an
8627     OCSP request and verifies the signer certificate. The signer
8628     certificate is just checked for a generic purpose and OCSP request
8629     trust settings.
8630     [Steve Henson]
8631
8632  *) Add OCSP_check_validity() function to check the validity of OCSP
8633     responses. OCSP responses are prepared in real time and may only
8634     be a few seconds old. Simply checking that the current time lies
8635     between thisUpdate and nextUpdate max reject otherwise valid responses
8636     caused by either OCSP responder or client clock inaccuracy. Instead
8637     we allow thisUpdate and nextUpdate to fall within a certain period of
8638     the current time. The age of the response can also optionally be
8639     checked. Two new options -validity_period and -status_age added to
8640     ocsp utility.
8641     [Steve Henson]
8642
8643  *) If signature or public key algorithm is unrecognized print out its
8644     OID rather that just UNKNOWN.
8645     [Steve Henson]
8646
8647  *) Change OCSP_cert_to_id() to tolerate a NULL subject certificate and
8648     OCSP_cert_id_new() a NULL serialNumber. This allows a partial certificate
8649     ID to be generated from the issuer certificate alone which can then be
8650     passed to OCSP_id_issuer_cmp().
8651     [Steve Henson]
8652
8653  *) New compilation option ASN1_ITEM_FUNCTIONS. This causes the new
8654     ASN1 modules to export functions returning ASN1_ITEM pointers
8655     instead of the ASN1_ITEM structures themselves. This adds several
8656     new macros which allow the underlying ASN1 function/structure to
8657     be accessed transparently. As a result code should not use ASN1_ITEM
8658     references directly (such as &X509_it) but instead use the relevant
8659     macros (such as ASN1_ITEM_rptr(X509)). This option is to allow
8660     use of the new ASN1 code on platforms where exporting structures
8661     is problematical (for example in shared libraries) but exporting
8662     functions returning pointers to structures is not.
8663     [Steve Henson]
8664
8665  *) Add support for overriding the generation of SSL/TLS session IDs.
8666     These callbacks can be registered either in an SSL_CTX or per SSL.
8667     The purpose of this is to allow applications to control, if they wish,
8668     the arbitrary values chosen for use as session IDs, particularly as it
8669     can be useful for session caching in multiple-server environments. A
8670     command-line switch for testing this (and any client code that wishes
8671     to use such a feature) has been added to "s_server".
8672     [Geoff Thorpe, Lutz Jaenicke]
8673
8674  *) Modify mkdef.pl to recognise and parse preprocessor conditionals
8675     of the form '#if defined(...) || defined(...) || ...' and
8676     '#if !defined(...) && !defined(...) && ...'.  This also avoids
8677     the growing number of special cases it was previously handling.
8678     [Richard Levitte]
8679
8680  *) Make all configuration macros available for application by making
8681     sure they are available in opensslconf.h, by giving them names starting
8682     with "OPENSSL_" to avoid conflicts with other packages and by making
8683     sure e_os2.h will cover all platform-specific cases together with
8684     opensslconf.h.
8685     Additionally, it is now possible to define configuration/platform-
8686     specific names (called "system identities").  In the C code, these
8687     are prefixed with "OPENSSL_SYSNAME_".  e_os2.h will create another
8688     macro with the name beginning with "OPENSSL_SYS_", which is determined
8689     from "OPENSSL_SYSNAME_*" or compiler-specific macros depending on
8690     what is available.
8691     [Richard Levitte]
8692
8693  *) New option -set_serial to 'req' and 'x509' this allows the serial
8694     number to use to be specified on the command line. Previously self
8695     signed certificates were hard coded with serial number 0 and the
8696     CA options of 'x509' had to use a serial number in a file which was
8697     auto incremented.
8698     [Steve Henson]
8699
8700  *) New options to 'ca' utility to support V2 CRL entry extensions.
8701     Currently CRL reason, invalidity date and hold instruction are
8702     supported. Add new CRL extensions to V3 code and some new objects.
8703     [Steve Henson]
8704
8705  *) New function EVP_CIPHER_CTX_set_padding() this is used to
8706     disable standard block padding (aka PKCS#5 padding) in the EVP
8707     API, which was previously mandatory. This means that the data is
8708     not padded in any way and so the total length much be a multiple
8709     of the block size, otherwise an error occurs.
8710     [Steve Henson]
8711
8712  *) Initial (incomplete) OCSP SSL support.
8713     [Steve Henson]
8714
8715  *) New function OCSP_parse_url(). This splits up a URL into its host,
8716     port and path components: primarily to parse OCSP URLs. New -url
8717     option to ocsp utility.
8718     [Steve Henson]
8719
8720  *) New nonce behavior. The return value of OCSP_check_nonce() now
8721     reflects the various checks performed. Applications can decide
8722     whether to tolerate certain situations such as an absent nonce
8723     in a response when one was present in a request: the ocsp application
8724     just prints out a warning. New function OCSP_add1_basic_nonce()
8725     this is to allow responders to include a nonce in a response even if
8726     the request is nonce-less.
8727     [Steve Henson]
8728
8729  *) Disable stdin buffering in load_cert (apps/apps.c) so that no certs are
8730     skipped when using openssl x509 multiple times on a single input file,
8731     e.g. "(openssl x509 -out cert1; openssl x509 -out cert2) <certs".
8732     [Bodo Moeller]
8733
8734  *) Make ASN1_UTCTIME_set_string() and ASN1_GENERALIZEDTIME_set_string()
8735     set string type: to handle setting ASN1_TIME structures. Fix ca
8736     utility to correctly initialize revocation date of CRLs.
8737     [Steve Henson]
8738
8739  *) New option SSL_OP_CIPHER_SERVER_PREFERENCE allows the server to override
8740     the clients preferred ciphersuites and rather use its own preferences.
8741     Should help to work around M$ SGC (Server Gated Cryptography) bug in
8742     Internet Explorer by ensuring unchanged hash method during stepup.
8743     (Also replaces the broken/deactivated SSL_OP_NON_EXPORT_FIRST option.)
8744     [Lutz Jaenicke]
8745
8746  *) Make mkdef.pl recognise all DECLARE_ASN1 macros, change rijndael
8747     to aes and add a new 'exist' option to print out symbols that don't
8748     appear to exist.
8749     [Steve Henson]
8750
8751  *) Additional options to ocsp utility to allow flags to be set and
8752     additional certificates supplied.
8753     [Steve Henson]
8754
8755  *) Add the option -VAfile to 'openssl ocsp', so the user can give the
8756     OCSP client a number of certificate to only verify the response
8757     signature against.
8758     [Richard Levitte]
8759
8760  *) Update Rijndael code to version 3.0 and change EVP AES ciphers to
8761     handle the new API. Currently only ECB, CBC modes supported. Add new
8762     AES OIDs.
8763
8764     Add TLS AES ciphersuites as described in RFC3268, "Advanced
8765     Encryption Standard (AES) Ciphersuites for Transport Layer
8766     Security (TLS)".  (In beta versions of OpenSSL 0.9.7, these were
8767     not enabled by default and were not part of the "ALL" ciphersuite
8768     alias because they were not yet official; they could be
8769     explicitly requested by specifying the "AESdraft" ciphersuite
8770     group alias.  In the final release of OpenSSL 0.9.7, the group
8771     alias is called "AES" and is part of "ALL".)
8772     [Ben Laurie, Steve  Henson, Bodo Moeller]
8773
8774  *) New function OCSP_copy_nonce() to copy nonce value (if present) from
8775     request to response.
8776     [Steve Henson]
8777
8778  *) Functions for OCSP responders. OCSP_request_onereq_count(),
8779     OCSP_request_onereq_get0(), OCSP_onereq_get0_id() and OCSP_id_get0_info()
8780     extract information from a certificate request. OCSP_response_create()
8781     creates a response and optionally adds a basic response structure.
8782     OCSP_basic_add1_status() adds a complete single response to a basic
8783     response and returns the OCSP_SINGLERESP structure just added (to allow
8784     extensions to be included for example). OCSP_basic_add1_cert() adds a
8785     certificate to a basic response and OCSP_basic_sign() signs a basic
8786     response with various flags. New helper functions ASN1_TIME_check()
8787     (checks validity of ASN1_TIME structure) and ASN1_TIME_to_generalizedtime()
8788     (converts ASN1_TIME to GeneralizedTime).
8789     [Steve Henson]
8790
8791  *) Various new functions. EVP_Digest() combines EVP_Digest{Init,Update,Final}()
8792     in a single operation. X509_get0_pubkey_bitstr() extracts the public_key
8793     structure from a certificate. X509_pubkey_digest() digests the public_key
8794     contents: this is used in various key identifiers.
8795     [Steve Henson]
8796
8797  *) Make sk_sort() tolerate a NULL argument.
8798     [Steve Henson reported by Massimiliano Pala <madwolf@comune.modena.it>]
8799
8800  *) New OCSP verify flag OCSP_TRUSTOTHER. When set the "other" certificates
8801     passed by the function are trusted implicitly. If any of them signed the
8802     response then it is assumed to be valid and is not verified.
8803     [Steve Henson]
8804
8805  *) In PKCS7_set_type() initialise content_type in PKCS7_ENC_CONTENT
8806     to data. This was previously part of the PKCS7 ASN1 code. This
8807     was causing problems with OpenSSL created PKCS#12 and PKCS#7 structures.
8808     [Steve Henson, reported by Kenneth R. Robinette
8809                                <support@securenetterm.com>]
8810
8811  *) Add CRYPTO_push_info() and CRYPTO_pop_info() calls to new ASN1
8812     routines: without these tracing memory leaks is very painful.
8813     Fix leaks in PKCS12 and PKCS7 routines.
8814     [Steve Henson]
8815
8816  *) Make X509_time_adj() cope with the new behaviour of ASN1_TIME_new().
8817     Previously it initialised the 'type' argument to V_ASN1_UTCTIME which
8818     effectively meant GeneralizedTime would never be used. Now it
8819     is initialised to -1 but X509_time_adj() now has to check the value
8820     and use ASN1_TIME_set() if the value is not V_ASN1_UTCTIME or
8821     V_ASN1_GENERALIZEDTIME, without this it always uses GeneralizedTime.
8822     [Steve Henson, reported by Kenneth R. Robinette
8823                                <support@securenetterm.com>]
8824
8825  *) Fixes to BN_to_ASN1_INTEGER when bn is zero. This would previously
8826     result in a zero length in the ASN1_INTEGER structure which was
8827     not consistent with the structure when d2i_ASN1_INTEGER() was used
8828     and would cause ASN1_INTEGER_cmp() to fail. Enhance s2i_ASN1_INTEGER()
8829     to cope with hex and negative integers. Fix bug in i2a_ASN1_INTEGER()
8830     where it did not print out a minus for negative ASN1_INTEGER.
8831     [Steve Henson]
8832
8833  *) Add summary printout to ocsp utility. The various functions which
8834     convert status values to strings have been renamed to:
8835     OCSP_response_status_str(), OCSP_cert_status_str() and
8836     OCSP_crl_reason_str() and are no longer static. New options
8837     to verify nonce values and to disable verification. OCSP response
8838     printout format cleaned up.
8839     [Steve Henson]
8840
8841  *) Add additional OCSP certificate checks. These are those specified
8842     in RFC2560. This consists of two separate checks: the CA of the
8843     certificate being checked must either be the OCSP signer certificate
8844     or the issuer of the OCSP signer certificate. In the latter case the
8845     OCSP signer certificate must contain the OCSP signing extended key
8846     usage. This check is performed by attempting to match the OCSP
8847     signer or the OCSP signer CA to the issuerNameHash and issuerKeyHash
8848     in the OCSP_CERTID structures of the response.
8849     [Steve Henson]
8850
8851  *) Initial OCSP certificate verification added to OCSP_basic_verify()
8852     and related routines. This uses the standard OpenSSL certificate
8853     verify routines to perform initial checks (just CA validity) and
8854     to obtain the certificate chain. Then additional checks will be
8855     performed on the chain. Currently the root CA is checked to see
8856     if it is explicitly trusted for OCSP signing. This is used to set
8857     a root CA as a global signing root: that is any certificate that
8858     chains to that CA is an acceptable OCSP signing certificate.
8859     [Steve Henson]
8860
8861  *) New '-extfile ...' option to 'openssl ca' for reading X.509v3
8862     extensions from a separate configuration file.
8863     As when reading extensions from the main configuration file,
8864     the '-extensions ...' option may be used for specifying the
8865     section to use.
8866     [Massimiliano Pala <madwolf@comune.modena.it>]
8867
8868  *) New OCSP utility. Allows OCSP requests to be generated or
8869     read. The request can be sent to a responder and the output
8870     parsed, outputted or printed in text form. Not complete yet:
8871     still needs to check the OCSP response validity.
8872     [Steve Henson]
8873
8874  *) New subcommands for 'openssl ca':
8875     'openssl ca -status <serial>' prints the status of the cert with
8876     the given serial number (according to the index file).
8877     'openssl ca -updatedb' updates the expiry status of certificates
8878     in the index file.
8879     [Massimiliano Pala <madwolf@comune.modena.it>]
8880
8881  *) New '-newreq-nodes' command option to CA.pl.  This is like
8882     '-newreq', but calls 'openssl req' with the '-nodes' option
8883     so that the resulting key is not encrypted.
8884     [Damien Miller <djm@mindrot.org>]
8885
8886  *) New configuration for the GNU Hurd.
8887     [Jonathan Bartlett <johnnyb@wolfram.com> via Richard Levitte]
8888
8889  *) Initial code to implement OCSP basic response verify. This
8890     is currently incomplete. Currently just finds the signer's
8891     certificate and verifies the signature on the response.
8892     [Steve Henson]
8893
8894  *) New SSLeay_version code SSLEAY_DIR to determine the compiled-in
8895     value of OPENSSLDIR.  This is available via the new '-d' option
8896     to 'openssl version', and is also included in 'openssl version -a'.
8897     [Bodo Moeller]
8898
8899  *) Allowing defining memory allocation callbacks that will be given
8900     file name and line number information in additional arguments
8901     (a const char* and an int).  The basic functionality remains, as
8902     well as the original possibility to just replace malloc(),
8903     realloc() and free() by functions that do not know about these
8904     additional arguments.  To register and find out the current
8905     settings for extended allocation functions, the following
8906     functions are provided:
8907
8908        CRYPTO_set_mem_ex_functions
8909        CRYPTO_set_locked_mem_ex_functions
8910        CRYPTO_get_mem_ex_functions
8911        CRYPTO_get_locked_mem_ex_functions
8912
8913     These work the same way as CRYPTO_set_mem_functions and friends.
8914     CRYPTO_get_[locked_]mem_functions now writes 0 where such an
8915     extended allocation function is enabled.
8916     Similarly, CRYPTO_get_[locked_]mem_ex_functions writes 0 where
8917     a conventional allocation function is enabled.
8918     [Richard Levitte, Bodo Moeller]
8919
8920  *) Finish off removing the remaining LHASH function pointer casts.
8921     There should no longer be any prototype-casting required when using
8922     the LHASH abstraction, and any casts that remain are "bugs". See
8923     the callback types and macros at the head of lhash.h for details
8924     (and "OBJ_cleanup" in crypto/objects/obj_dat.c as an example).
8925     [Geoff Thorpe]
8926
8927  *) Add automatic query of EGD sockets in RAND_poll() for the unix variant.
8928     If /dev/[u]random devices are not available or do not return enough
8929     entropy, EGD style sockets (served by EGD or PRNGD) will automatically
8930     be queried.
8931     The locations /var/run/egd-pool, /dev/egd-pool, /etc/egd-pool, and
8932     /etc/entropy will be queried once each in this sequence, querying stops
8933     when enough entropy was collected without querying more sockets.
8934     [Lutz Jaenicke]
8935
8936  *) Change the Unix RAND_poll() variant to be able to poll several
8937     random devices, as specified by DEVRANDOM, until a sufficient amount
8938     of data has been collected.   We spend at most 10 ms on each file
8939     (select timeout) and read in non-blocking mode.  DEVRANDOM now
8940     defaults to the list "/dev/urandom", "/dev/random", "/dev/srandom"
8941     (previously it was just the string "/dev/urandom"), so on typical
8942     platforms the 10 ms delay will never occur.
8943     Also separate out the Unix variant to its own file, rand_unix.c.
8944     For VMS, there's a currently-empty rand_vms.c.
8945     [Richard Levitte]
8946
8947  *) Move OCSP client related routines to ocsp_cl.c. These
8948     provide utility functions which an application needing
8949     to issue a request to an OCSP responder and analyse the
8950     response will typically need: as opposed to those which an
8951     OCSP responder itself would need which will be added later.
8952
8953     OCSP_request_sign() signs an OCSP request with an API similar
8954     to PKCS7_sign(). OCSP_response_status() returns status of OCSP
8955     response. OCSP_response_get1_basic() extracts basic response
8956     from response. OCSP_resp_find_status(): finds and extracts status
8957     information from an OCSP_CERTID structure (which will be created
8958     when the request structure is built). These are built from lower
8959     level functions which work on OCSP_SINGLERESP structures but
8960     won't normally be used unless the application wishes to examine
8961     extensions in the OCSP response for example.
8962
8963     Replace nonce routines with a pair of functions.
8964     OCSP_request_add1_nonce() adds a nonce value and optionally
8965     generates a random value. OCSP_check_nonce() checks the
8966     validity of the nonce in an OCSP response.
8967     [Steve Henson]
8968
8969  *) Change function OCSP_request_add() to OCSP_request_add0_id().
8970     This doesn't copy the supplied OCSP_CERTID and avoids the
8971     need to free up the newly created id. Change return type
8972     to OCSP_ONEREQ to return the internal OCSP_ONEREQ structure.
8973     This can then be used to add extensions to the request.
8974     Deleted OCSP_request_new(), since most of its functionality
8975     is now in OCSP_REQUEST_new() (and the case insensitive name
8976     clash) apart from the ability to set the request name which
8977     will be added elsewhere.
8978     [Steve Henson]
8979
8980  *) Update OCSP API. Remove obsolete extensions argument from
8981     various functions. Extensions are now handled using the new
8982     OCSP extension code. New simple OCSP HTTP function which
8983     can be used to send requests and parse the response.
8984     [Steve Henson]
8985
8986  *) Fix the PKCS#7 (S/MIME) code to work with new ASN1. Two new
8987     ASN1_ITEM structures help with sign and verify. PKCS7_ATTR_SIGN
8988     uses the special reorder version of SET OF to sort the attributes
8989     and reorder them to match the encoded order. This resolves a long
8990     standing problem: a verify on a PKCS7 structure just after signing
8991     it used to fail because the attribute order did not match the
8992     encoded order. PKCS7_ATTR_VERIFY does not reorder the attributes:
8993     it uses the received order. This is necessary to tolerate some broken
8994     software that does not order SET OF. This is handled by encoding
8995     as a SEQUENCE OF but using implicit tagging (with UNIVERSAL class)
8996     to produce the required SET OF.
8997     [Steve Henson]
8998
8999  *) Have mk1mf.pl generate the macros OPENSSL_BUILD_SHLIBCRYPTO and
9000     OPENSSL_BUILD_SHLIBSSL and use them appropriately in the header
9001     files to get correct declarations of the ASN.1 item variables.
9002     [Richard Levitte]
9003
9004  *) Rewrite of PKCS#12 code to use new ASN1 functionality. Replace many
9005     PKCS#12 macros with real functions. Fix two unrelated ASN1 bugs:
9006     asn1_check_tlen() would sometimes attempt to use 'ctx' when it was
9007     NULL and ASN1_TYPE was not dereferenced properly in asn1_ex_c2i().
9008     New ASN1 macro: DECLARE_ASN1_ITEM() which just declares the relevant
9009     ASN1_ITEM and no wrapper functions.
9010     [Steve Henson]
9011
9012  *) New functions or ASN1_item_d2i_fp() and ASN1_item_d2i_bio(). These
9013     replace the old function pointer based I/O routines. Change most of
9014     the *_d2i_bio() and *_d2i_fp() functions to use these.
9015     [Steve Henson]
9016
9017  *) Enhance mkdef.pl to be more accepting about spacing in C preprocessor
9018     lines, recognize more "algorithms" that can be deselected, and make
9019     it complain about algorithm deselection that isn't recognised.
9020     [Richard Levitte]
9021
9022  *) New ASN1 functions to handle dup, sign, verify, digest, pack and
9023     unpack operations in terms of ASN1_ITEM. Modify existing wrappers
9024     to use new functions. Add NO_ASN1_OLD which can be set to remove
9025     some old style ASN1 functions: this can be used to determine if old
9026     code will still work when these eventually go away.
9027     [Steve Henson]
9028
9029  *) New extension functions for OCSP structures, these follow the
9030     same conventions as certificates and CRLs.
9031     [Steve Henson]
9032
9033  *) New function X509V3_add1_i2d(). This automatically encodes and
9034     adds an extension. Its behaviour can be customised with various
9035     flags to append, replace or delete. Various wrappers added for
9036     certificates and CRLs.
9037     [Steve Henson]
9038
9039  *) Fix to avoid calling the underlying ASN1 print routine when
9040     an extension cannot be parsed. Correct a typo in the
9041     OCSP_SERVICELOC extension. Tidy up print OCSP format.
9042     [Steve Henson]
9043
9044  *) Make mkdef.pl parse some of the ASN1 macros and add appropriate
9045     entries for variables.
9046     [Steve Henson]
9047
9048  *) Add functionality to apps/openssl.c for detecting locking
9049     problems: As the program is single-threaded, all we have
9050     to do is register a locking callback using an array for
9051     storing which locks are currently held by the program.
9052     [Bodo Moeller]
9053
9054  *) Use a lock around the call to CRYPTO_get_ex_new_index() in
9055     SSL_get_ex_data_X509_STORE_idx(), which is used in
9056     ssl_verify_cert_chain() and thus can be called at any time
9057     during TLS/SSL handshakes so that thread-safety is essential.
9058     Unfortunately, the ex_data design is not at all suited
9059     for multi-threaded use, so it probably should be abolished.
9060     [Bodo Moeller]
9061
9062  *) Added Broadcom "ubsec" ENGINE to OpenSSL.
9063     [Broadcom, tweaked and integrated by Geoff Thorpe]
9064
9065  *) Move common extension printing code to new function
9066     X509V3_print_extensions(). Reorganise OCSP print routines and
9067     implement some needed OCSP ASN1 functions. Add OCSP extensions.
9068     [Steve Henson]
9069
9070  *) New function X509_signature_print() to remove duplication in some
9071     print routines.
9072     [Steve Henson]
9073
9074  *) Add a special meaning when SET OF and SEQUENCE OF flags are both
9075     set (this was treated exactly the same as SET OF previously). This
9076     is used to reorder the STACK representing the structure to match the
9077     encoding. This will be used to get round a problem where a PKCS7
9078     structure which was signed could not be verified because the STACK
9079     order did not reflect the encoded order.
9080     [Steve Henson]
9081
9082  *) Reimplement the OCSP ASN1 module using the new code.
9083     [Steve Henson]
9084
9085  *) Update the X509V3 code to permit the use of an ASN1_ITEM structure
9086     for its ASN1 operations. The old style function pointers still exist
9087     for now but they will eventually go away.
9088     [Steve Henson]
9089
9090  *) Merge in replacement ASN1 code from the ASN1 branch. This almost
9091     completely replaces the old ASN1 functionality with a table driven
9092     encoder and decoder which interprets an ASN1_ITEM structure describing
9093     the ASN1 module. Compatibility with the existing ASN1 API (i2d,d2i) is
9094     largely maintained. Almost all of the old asn1_mac.h macro based ASN1
9095     has also been converted to the new form.
9096     [Steve Henson]
9097
9098  *) Change BN_mod_exp_recp so that negative moduli are tolerated
9099     (the sign is ignored).  Similarly, ignore the sign in BN_MONT_CTX_set
9100     so that BN_mod_exp_mont and BN_mod_exp_mont_word work
9101     for negative moduli.
9102     [Bodo Moeller]
9103
9104  *) Fix BN_uadd and BN_usub: Always return non-negative results instead
9105     of not touching the result's sign bit.
9106     [Bodo Moeller]
9107
9108  *) BN_div bugfix: If the result is 0, the sign (res->neg) must not be
9109     set.
9110     [Bodo Moeller]
9111
9112  *) Changed the LHASH code to use prototypes for callbacks, and created
9113     macros to declare and implement thin (optionally static) functions
9114     that provide type-safety and avoid function pointer casting for the
9115     type-specific callbacks.
9116     [Geoff Thorpe]
9117
9118  *) Added Kerberos Cipher Suites to be used with TLS, as written in
9119     RFC 2712.
9120     [Veers Staats <staatsvr@asc.hpc.mil>,
9121      Jeffrey Altman <jaltman@columbia.edu>, via Richard Levitte]
9122
9123  *) Reformat the FAQ so the different questions and answers can be divided
9124     in sections depending on the subject.
9125     [Richard Levitte]
9126
9127  *) Have the zlib compression code load ZLIB.DLL dynamically under
9128     Windows.
9129     [Richard Levitte]
9130
9131  *) New function BN_mod_sqrt for computing square roots modulo a prime
9132     (using the probabilistic Tonelli-Shanks algorithm unless
9133     p == 3 (mod 4)  or  p == 5 (mod 8),  which are cases that can
9134     be handled deterministically).
9135     [Lenka Fibikova <fibikova@exp-math.uni-essen.de>, Bodo Moeller]
9136
9137  *) Make BN_mod_inverse faster by explicitly handling small quotients
9138     in the Euclid loop. (Speed gain about 20% for small moduli [256 or
9139     512 bits], about 30% for larger ones [1024 or 2048 bits].)
9140     [Bodo Moeller]
9141
9142  *) New function BN_kronecker.
9143     [Bodo Moeller]
9144
9145  *) Fix BN_gcd so that it works on negative inputs; the result is
9146     positive unless both parameters are zero.
9147     Previously something reasonably close to an infinite loop was
9148     possible because numbers could be growing instead of shrinking
9149     in the implementation of Euclid's algorithm.
9150     [Bodo Moeller]
9151
9152  *) Fix BN_is_word() and BN_is_one() macros to take into account the
9153     sign of the number in question.
9154
9155     Fix BN_is_word(a,w) to work correctly for w == 0.
9156
9157     The old BN_is_word(a,w) macro is now called BN_abs_is_word(a,w)
9158     because its test if the absolute value of 'a' equals 'w'.
9159     Note that BN_abs_is_word does *not* handle w == 0 reliably;
9160     it exists mostly for use in the implementations of BN_is_zero(),
9161     BN_is_one(), and BN_is_word().
9162     [Bodo Moeller]
9163
9164  *) New function BN_swap.
9165     [Bodo Moeller]
9166
9167  *) Use BN_nnmod instead of BN_mod in crypto/bn/bn_exp.c so that
9168     the exponentiation functions are more likely to produce reasonable
9169     results on negative inputs.
9170     [Bodo Moeller]
9171
9172  *) Change BN_mod_mul so that the result is always non-negative.
9173     Previously, it could be negative if one of the factors was negative;
9174     I don't think anyone really wanted that behaviour.
9175     [Bodo Moeller]
9176
9177  *) Move BN_mod_... functions into new file crypto/bn/bn_mod.c
9178     (except for exponentiation, which stays in crypto/bn/bn_exp.c,
9179     and BN_mod_mul_reciprocal, which stays in crypto/bn/bn_recp.c)
9180     and add new functions:
9181
9182          BN_nnmod
9183          BN_mod_sqr
9184          BN_mod_add
9185          BN_mod_add_quick
9186          BN_mod_sub
9187          BN_mod_sub_quick
9188          BN_mod_lshift1
9189          BN_mod_lshift1_quick
9190          BN_mod_lshift
9191          BN_mod_lshift_quick
9192
9193     These functions always generate non-negative results.
9194
9195     BN_nnmod otherwise is like BN_mod (if BN_mod computes a remainder  r
9196     such that  |m| < r < 0,  BN_nnmod will output  rem + |m|  instead).
9197
9198     BN_mod_XXX_quick(r, a, [b,] m) generates the same result as
9199     BN_mod_XXX(r, a, [b,] m, ctx), but requires that  a  [and  b]
9200     be reduced modulo  m.
9201     [Lenka Fibikova <fibikova@exp-math.uni-essen.de>, Bodo Moeller]
9202
9203#if 0
9204     The following entry accidentally appeared in the CHANGES file
9205     distributed with OpenSSL 0.9.7.  The modifications described in
9206     it do *not* apply to OpenSSL 0.9.7.
9207
9208  *) Remove a few calls to bn_wexpand() in BN_sqr() (the one in there
9209     was actually never needed) and in BN_mul().  The removal in BN_mul()
9210     required a small change in bn_mul_part_recursive() and the addition
9211     of the functions bn_cmp_part_words(), bn_sub_part_words() and
9212     bn_add_part_words(), which do the same thing as bn_cmp_words(),
9213     bn_sub_words() and bn_add_words() except they take arrays with
9214     differing sizes.
9215     [Richard Levitte]
9216#endif
9217
9218  *) In 'openssl passwd', verify passwords read from the terminal
9219     unless the '-salt' option is used (which usually means that
9220     verification would just waste user's time since the resulting
9221     hash is going to be compared with some given password hash)
9222     or the new '-noverify' option is used.
9223
9224     This is an incompatible change, but it does not affect
9225     non-interactive use of 'openssl passwd' (passwords on the command
9226     line, '-stdin' option, '-in ...' option) and thus should not
9227     cause any problems.
9228     [Bodo Moeller]
9229
9230  *) Remove all references to RSAref, since there's no more need for it.
9231     [Richard Levitte]
9232
9233  *) Make DSO load along a path given through an environment variable
9234     (SHLIB_PATH) with shl_load().
9235     [Richard Levitte]
9236
9237  *) Constify the ENGINE code as a result of BIGNUM constification.
9238     Also constify the RSA code and most things related to it.  In a
9239     few places, most notable in the depth of the ASN.1 code, ugly
9240     casts back to non-const were required (to be solved at a later
9241     time)
9242     [Richard Levitte]
9243
9244  *) Make it so the openssl application has all engines loaded by default.
9245     [Richard Levitte]
9246
9247  *) Constify the BIGNUM routines a little more.
9248     [Richard Levitte]
9249
9250  *) Add the following functions:
9251
9252        ENGINE_load_cswift()
9253        ENGINE_load_chil()
9254        ENGINE_load_atalla()
9255        ENGINE_load_nuron()
9256        ENGINE_load_builtin_engines()
9257
9258     That way, an application can itself choose if external engines that
9259     are built-in in OpenSSL shall ever be used or not.  The benefit is
9260     that applications won't have to be linked with libdl or other dso
9261     libraries unless it's really needed.
9262
9263     Changed 'openssl engine' to load all engines on demand.
9264     Changed the engine header files to avoid the duplication of some
9265     declarations (they differed!).
9266     [Richard Levitte]
9267
9268  *) 'openssl engine' can now list capabilities.
9269     [Richard Levitte]
9270
9271  *) Better error reporting in 'openssl engine'.
9272     [Richard Levitte]
9273
9274  *) Never call load_dh_param(NULL) in s_server.
9275     [Bodo Moeller]
9276
9277  *) Add engine application.  It can currently list engines by name and
9278     identity, and test if they are actually available.
9279     [Richard Levitte]
9280
9281  *) Improve RPM specification file by forcing symbolic linking and making
9282     sure the installed documentation is also owned by root.root.
9283     [Damien Miller <djm@mindrot.org>]
9284
9285  *) Give the OpenSSL applications more possibilities to make use of
9286     keys (public as well as private) handled by engines.
9287     [Richard Levitte]
9288
9289  *) Add OCSP code that comes from CertCo.
9290     [Richard Levitte]
9291
9292  *) Add VMS support for the Rijndael code.
9293     [Richard Levitte]
9294
9295  *) Added untested support for Nuron crypto accelerator.
9296     [Ben Laurie]
9297
9298  *) Add support for external cryptographic devices.  This code was
9299     previously distributed separately as the "engine" branch.
9300     [Geoff Thorpe, Richard Levitte]
9301
9302  *) Rework the filename-translation in the DSO code. It is now possible to
9303     have far greater control over how a "name" is turned into a filename
9304     depending on the operating environment and any oddities about the
9305     different shared library filenames on each system.
9306     [Geoff Thorpe]
9307
9308  *) Support threads on FreeBSD-elf in Configure.
9309     [Richard Levitte]
9310
9311  *) Fix for SHA1 assembly problem with MASM: it produces
9312     warnings about corrupt line number information when assembling
9313     with debugging information. This is caused by the overlapping
9314     of two sections.
9315     [Bernd Matthes <mainbug@celocom.de>, Steve Henson]
9316
9317  *) NCONF changes.
9318     NCONF_get_number() has no error checking at all.  As a replacement,
9319     NCONF_get_number_e() is defined (_e for "error checking") and is
9320     promoted strongly.  The old NCONF_get_number is kept around for
9321     binary backward compatibility.
9322     Make it possible for methods to load from something other than a BIO,
9323     by providing a function pointer that is given a name instead of a BIO.
9324     For example, this could be used to load configuration data from an
9325     LDAP server.
9326     [Richard Levitte]
9327
9328  *) Fix for non blocking accept BIOs. Added new I/O special reason
9329     BIO_RR_ACCEPT to cover this case. Previously use of accept BIOs
9330     with non blocking I/O was not possible because no retry code was
9331     implemented. Also added new SSL code SSL_WANT_ACCEPT to cover
9332     this case.
9333     [Steve Henson]
9334
9335  *) Added the beginnings of Rijndael support.
9336     [Ben Laurie]
9337
9338  *) Fix for bug in DirectoryString mask setting. Add support for
9339     X509_NAME_print_ex() in 'req' and X509_print_ex() function
9340     to allow certificate printing to more controllable, additional
9341     'certopt' option to 'x509' to allow new printing options to be
9342     set.
9343     [Steve Henson]
9344
9345  *) Clean old EAY MD5 hack from e_os.h.
9346     [Richard Levitte]
9347
9348 Changes between 0.9.6l and 0.9.6m  [17 Mar 2004]
9349
9350  *) Fix null-pointer assignment in do_change_cipher_spec() revealed
9351     by using the Codenomicon TLS Test Tool (CVE-2004-0079)
9352     [Joe Orton, Steve Henson]
9353
9354 Changes between 0.9.6k and 0.9.6l  [04 Nov 2003]
9355
9356  *) Fix additional bug revealed by the NISCC test suite:
9357
9358     Stop bug triggering large recursion when presented with
9359     certain ASN.1 tags (CVE-2003-0851)
9360     [Steve Henson]
9361
9362 Changes between 0.9.6j and 0.9.6k  [30 Sep 2003]
9363
9364  *) Fix various bugs revealed by running the NISCC test suite:
9365
9366     Stop out of bounds reads in the ASN1 code when presented with
9367     invalid tags (CVE-2003-0543 and CVE-2003-0544).
9368
9369     If verify callback ignores invalid public key errors don't try to check
9370     certificate signature with the NULL public key.
9371
9372     [Steve Henson]
9373
9374  *) In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
9375     if the server requested one: as stated in TLS 1.0 and SSL 3.0
9376     specifications.
9377     [Steve Henson]
9378
9379  *) In ssl3_get_client_hello() (ssl/s3_srvr.c), tolerate additional
9380     extra data after the compression methods not only for TLS 1.0
9381     but also for SSL 3.0 (as required by the specification).
9382     [Bodo Moeller; problem pointed out by Matthias Loepfe]
9383
9384  *) Change X509_certificate_type() to mark the key as exported/exportable
9385     when it's 512 *bits* long, not 512 bytes.
9386     [Richard Levitte]
9387
9388 Changes between 0.9.6i and 0.9.6j  [10 Apr 2003]
9389
9390  *) Countermeasure against the Klima-Pokorny-Rosa extension of
9391     Bleichbacher's attack on PKCS #1 v1.5 padding: treat
9392     a protocol version number mismatch like a decryption error
9393     in ssl3_get_client_key_exchange (ssl/s3_srvr.c).
9394     [Bodo Moeller]
9395
9396  *) Turn on RSA blinding by default in the default implementation
9397     to avoid a timing attack. Applications that don't want it can call
9398     RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
9399     They would be ill-advised to do so in most cases.
9400     [Ben Laurie, Steve Henson, Geoff Thorpe, Bodo Moeller]
9401
9402  *) Change RSA blinding code so that it works when the PRNG is not
9403     seeded (in this case, the secret RSA exponent is abused as
9404     an unpredictable seed -- if it is not unpredictable, there
9405     is no point in blinding anyway).  Make RSA blinding thread-safe
9406     by remembering the creator's thread ID in rsa->blinding and
9407     having all other threads use local one-time blinding factors
9408     (this requires more computation than sharing rsa->blinding, but
9409     avoids excessive locking; and if an RSA object is not shared
9410     between threads, blinding will still be very fast).
9411     [Bodo Moeller]
9412
9413 Changes between 0.9.6h and 0.9.6i  [19 Feb 2003]
9414
9415  *) In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
9416     via timing by performing a MAC computation even if incorrect
9417     block cipher padding has been found.  This is a countermeasure
9418     against active attacks where the attacker has to distinguish
9419     between bad padding and a MAC verification error. (CVE-2003-0078)
9420
9421     [Bodo Moeller; problem pointed out by Brice Canvel (EPFL),
9422     Alain Hiltgen (UBS), Serge Vaudenay (EPFL), and
9423     Martin Vuagnoux (EPFL, Ilion)]
9424
9425 Changes between 0.9.6g and 0.9.6h  [5 Dec 2002]
9426
9427  *) New function OPENSSL_cleanse(), which is used to cleanse a section of
9428     memory from its contents.  This is done with a counter that will
9429     place alternating values in each byte.  This can be used to solve
9430     two issues: 1) the removal of calls to memset() by highly optimizing
9431     compilers, and 2) cleansing with other values than 0, since those can
9432     be read through on certain media, for example a swap space on disk.
9433     [Geoff Thorpe]
9434
9435  *) Bugfix: client side session caching did not work with external caching,
9436     because the session->cipher setting was not restored when reloading
9437     from the external cache. This problem was masked, when
9438     SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (part of SSL_OP_ALL) was set.
9439     (Found by Steve Haslam <steve@araqnid.ddts.net>.)
9440     [Lutz Jaenicke]
9441
9442  *) Fix client_certificate (ssl/s2_clnt.c): The permissible total
9443     length of the REQUEST-CERTIFICATE message is 18 .. 34, not 17 .. 33.
9444     [Zeev Lieber <zeev-l@yahoo.com>]
9445
9446  *) Undo an undocumented change introduced in 0.9.6e which caused
9447     repeated calls to OpenSSL_add_all_ciphers() and
9448     OpenSSL_add_all_digests() to be ignored, even after calling
9449     EVP_cleanup().
9450     [Richard Levitte]
9451
9452  *) Change the default configuration reader to deal with last line not
9453     being properly terminated.
9454     [Richard Levitte]
9455
9456  *) Change X509_NAME_cmp() so it applies the special rules on handling
9457     DN values that are of type PrintableString, as well as RDNs of type
9458     emailAddress where the value has the type ia5String.
9459     [stefank@valicert.com via Richard Levitte]
9460
9461  *) Add a SSL_SESS_CACHE_NO_INTERNAL_STORE flag to take over half
9462     the job SSL_SESS_CACHE_NO_INTERNAL_LOOKUP was inconsistently
9463     doing, define a new flag (SSL_SESS_CACHE_NO_INTERNAL) to be
9464     the bitwise-OR of the two for use by the majority of applications
9465     wanting this behaviour, and update the docs. The documented
9466     behaviour and actual behaviour were inconsistent and had been
9467     changing anyway, so this is more a bug-fix than a behavioural
9468     change.
9469     [Geoff Thorpe, diagnosed by Nadav Har'El]
9470
9471  *) Don't impose a 16-byte length minimum on session IDs in ssl/s3_clnt.c
9472     (the SSL 3.0 and TLS 1.0 specifications allow any length up to 32 bytes).
9473     [Bodo Moeller]
9474
9475  *) Fix initialization code race conditions in
9476        SSLv23_method(),  SSLv23_client_method(),   SSLv23_server_method(),
9477        SSLv2_method(),   SSLv2_client_method(),    SSLv2_server_method(),
9478        SSLv3_method(),   SSLv3_client_method(),    SSLv3_server_method(),
9479        TLSv1_method(),   TLSv1_client_method(),    TLSv1_server_method(),
9480        ssl2_get_cipher_by_char(),
9481        ssl3_get_cipher_by_char().
9482     [Patrick McCormick <patrick@tellme.com>, Bodo Moeller]
9483
9484  *) Reorder cleanup sequence in SSL_CTX_free(): only remove the ex_data after
9485     the cached sessions are flushed, as the remove_cb() might use ex_data
9486     contents. Bug found by Sam Varshavchik <mrsam@courier-mta.com>
9487     (see [openssl.org #212]).
9488     [Geoff Thorpe, Lutz Jaenicke]
9489
9490  *) Fix typo in OBJ_txt2obj which incorrectly passed the content
9491     length, instead of the encoding length to d2i_ASN1_OBJECT.
9492     [Steve Henson]
9493
9494 Changes between 0.9.6f and 0.9.6g  [9 Aug 2002]
9495
9496  *) [In 0.9.6g-engine release:]
9497     Fix crypto/engine/vendor_defns/cswift.h for WIN32 (use '_stdcall').
9498     [Lynn Gazis <lgazis@rainbow.com>]
9499
9500 Changes between 0.9.6e and 0.9.6f  [8 Aug 2002]
9501
9502  *) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
9503     and get fix the header length calculation.
9504     [Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>,
9505        Alon Kantor <alonk@checkpoint.com> (and others),
9506        Steve Henson]
9507
9508  *) Use proper error handling instead of 'assertions' in buffer
9509     overflow checks added in 0.9.6e.  This prevents DoS (the
9510     assertions could call abort()).
9511     [Arne Ansper <arne@ats.cyber.ee>, Bodo Moeller]
9512
9513 Changes between 0.9.6d and 0.9.6e  [30 Jul 2002]
9514
9515  *) Add various sanity checks to asn1_get_length() to reject
9516     the ASN1 length bytes if they exceed sizeof(long), will appear
9517     negative or the content length exceeds the length of the
9518     supplied buffer.
9519     [Steve Henson, Adi Stav <stav@mercury.co.il>, James Yonan <jim@ntlp.com>]
9520
9521  *) Fix cipher selection routines: ciphers without encryption had no flags
9522     for the cipher strength set and where therefore not handled correctly
9523     by the selection routines (PR #130).
9524     [Lutz Jaenicke]
9525
9526  *) Fix EVP_dsa_sha macro.
9527     [Nils Larsch]
9528
9529  *) New option
9530          SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
9531     for disabling the SSL 3.0/TLS 1.0 CBC vulnerability countermeasure
9532     that was added in OpenSSL 0.9.6d.
9533
9534     As the countermeasure turned out to be incompatible with some
9535     broken SSL implementations, the new option is part of SSL_OP_ALL.
9536     SSL_OP_ALL is usually employed when compatibility with weird SSL
9537     implementations is desired (e.g. '-bugs' option to 's_client' and
9538     's_server'), so the new option is automatically set in many
9539     applications.
9540     [Bodo Moeller]
9541
9542  *) Changes in security patch:
9543
9544     Changes marked "(CHATS)" were sponsored by the Defense Advanced
9545     Research Projects Agency (DARPA) and Air Force Research Laboratory,
9546     Air Force Materiel Command, USAF, under agreement number
9547     F30602-01-2-0537.
9548
9549  *) Add various sanity checks to asn1_get_length() to reject
9550     the ASN1 length bytes if they exceed sizeof(long), will appear
9551     negative or the content length exceeds the length of the
9552     supplied buffer. (CVE-2002-0659)
9553     [Steve Henson, Adi Stav <stav@mercury.co.il>, James Yonan <jim@ntlp.com>]
9554
9555  *) Assertions for various potential buffer overflows, not known to
9556     happen in practice.
9557     [Ben Laurie (CHATS)]
9558
9559  *) Various temporary buffers to hold ASCII versions of integers were
9560     too small for 64 bit platforms. (CVE-2002-0655)
9561     [Matthew Byng-Maddick <mbm@aldigital.co.uk> and Ben Laurie (CHATS)>
9562
9563  *) Remote buffer overflow in SSL3 protocol - an attacker could
9564     supply an oversized session ID to a client. (CVE-2002-0656)
9565     [Ben Laurie (CHATS)]
9566
9567  *) Remote buffer overflow in SSL2 protocol - an attacker could
9568     supply an oversized client master key. (CVE-2002-0656)
9569     [Ben Laurie (CHATS)]
9570
9571 Changes between 0.9.6c and 0.9.6d  [9 May 2002]
9572
9573  *) Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not
9574     encoded as NULL) with id-dsa-with-sha1.
9575     [Nils Larsch <nla@trustcenter.de>; problem pointed out by Bodo Moeller]
9576
9577  *) Check various X509_...() return values in apps/req.c.
9578     [Nils Larsch <nla@trustcenter.de>]
9579
9580  *) Fix BASE64 decode (EVP_DecodeUpdate) for data with CR/LF ended lines:
9581     an end-of-file condition would erroneously be flagged, when the CRLF
9582     was just at the end of a processed block. The bug was discovered when
9583     processing data through a buffering memory BIO handing the data to a
9584     BASE64-decoding BIO. Bug fund and patch submitted by Pavel Tsekov
9585     <ptsekov@syntrex.com> and Nedelcho Stanev.
9586     [Lutz Jaenicke]
9587
9588  *) Implement a countermeasure against a vulnerability recently found
9589     in CBC ciphersuites in SSL 3.0/TLS 1.0: Send an empty fragment
9590     before application data chunks to avoid the use of known IVs
9591     with data potentially chosen by the attacker.
9592     [Bodo Moeller]
9593
9594  *) Fix length checks in ssl3_get_client_hello().
9595     [Bodo Moeller]
9596
9597  *) TLS/SSL library bugfix: use s->s3->in_read_app_data differently
9598     to prevent ssl3_read_internal() from incorrectly assuming that
9599     ssl3_read_bytes() found application data while handshake
9600     processing was enabled when in fact s->s3->in_read_app_data was
9601     merely automatically cleared during the initial handshake.
9602     [Bodo Moeller; problem pointed out by Arne Ansper <arne@ats.cyber.ee>]
9603
9604  *) Fix object definitions for Private and Enterprise: they were not
9605     recognized in their shortname (=lowercase) representation. Extend
9606     obj_dat.pl to issue an error when using undefined keywords instead
9607     of silently ignoring the problem (Svenning Sorensen
9608     <sss@sss.dnsalias.net>).
9609     [Lutz Jaenicke]
9610
9611  *) Fix DH_generate_parameters() so that it works for 'non-standard'
9612     generators, i.e. generators other than 2 and 5.  (Previously, the
9613     code did not properly initialise the 'add' and 'rem' values to
9614     BN_generate_prime().)
9615
9616     In the new general case, we do not insist that 'generator' is
9617     actually a primitive root: This requirement is rather pointless;
9618     a generator of the order-q subgroup is just as good, if not
9619     better.
9620     [Bodo Moeller]
9621
9622  *) Map new X509 verification errors to alerts. Discovered and submitted by
9623     Tom Wu <tom@arcot.com>.
9624     [Lutz Jaenicke]
9625
9626  *) Fix ssl3_pending() (ssl/s3_lib.c) to prevent SSL_pending() from
9627     returning non-zero before the data has been completely received
9628     when using non-blocking I/O.
9629     [Bodo Moeller; problem pointed out by John Hughes]
9630
9631  *) Some of the ciphers missed the strength entry (SSL_LOW etc).
9632     [Ben Laurie, Lutz Jaenicke]
9633
9634  *) Fix bug in SSL_clear(): bad sessions were not removed (found by
9635     Yoram Zahavi <YoramZ@gilian.com>).
9636     [Lutz Jaenicke]
9637
9638  *) Add information about CygWin 1.3 and on, and preserve proper
9639     configuration for the versions before that.
9640     [Corinna Vinschen <vinschen@redhat.com> and Richard Levitte]
9641
9642  *) Make removal from session cache (SSL_CTX_remove_session()) more robust:
9643     check whether we deal with a copy of a session and do not delete from
9644     the cache in this case. Problem reported by "Izhar Shoshani Levi"
9645     <izhar@checkpoint.com>.
9646     [Lutz Jaenicke]
9647
9648  *) Do not store session data into the internal session cache, if it
9649     is never intended to be looked up (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP
9650     flag is set). Proposed by Aslam <aslam@funk.com>.
9651     [Lutz Jaenicke]
9652
9653  *) Have ASN1_BIT_STRING_set_bit() really clear a bit when the requested
9654     value is 0.
9655     [Richard Levitte]
9656
9657  *) [In 0.9.6d-engine release:]
9658     Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
9659     [Toomas Kiisk <vix@cyber.ee> via Richard Levitte]
9660
9661  *) Add the configuration target linux-s390x.
9662     [Neale Ferguson <Neale.Ferguson@SoftwareAG-USA.com> via Richard Levitte]
9663
9664  *) The earlier bugfix for the SSL3_ST_SW_HELLO_REQ_C case of
9665     ssl3_accept (ssl/s3_srvr.c) incorrectly used a local flag
9666     variable as an indication that a ClientHello message has been
9667     received.  As the flag value will be lost between multiple
9668     invocations of ssl3_accept when using non-blocking I/O, the
9669     function may not be aware that a handshake has actually taken
9670     place, thus preventing a new session from being added to the
9671     session cache.
9672
9673     To avoid this problem, we now set s->new_session to 2 instead of
9674     using a local variable.
9675     [Lutz Jaenicke, Bodo Moeller]
9676
9677  *) Bugfix: Return -1 from ssl3_get_server_done (ssl3/s3_clnt.c)
9678     if the SSL_R_LENGTH_MISMATCH error is detected.
9679     [Geoff Thorpe, Bodo Moeller]
9680
9681  *) New 'shared_ldflag' column in Configure platform table.
9682     [Richard Levitte]
9683
9684  *) Fix EVP_CIPHER_mode macro.
9685     ["Dan S. Camper" <dan@bti.net>]
9686
9687  *) Fix ssl3_read_bytes (ssl/s3_pkt.c): To ignore messages of unknown
9688     type, we must throw them away by setting rr->length to 0.
9689     [D P Chang <dpc@qualys.com>]
9690
9691 Changes between 0.9.6b and 0.9.6c  [21 dec 2001]
9692
9693  *) Fix BN_rand_range bug pointed out by Dominikus Scherkl
9694     <Dominikus.Scherkl@biodata.com>.  (The previous implementation
9695     worked incorrectly for those cases where  range = 10..._2  and
9696     3*range  is two bits longer than  range.)
9697     [Bodo Moeller]
9698
9699  *) Only add signing time to PKCS7 structures if it is not already
9700     present.
9701     [Steve Henson]
9702
9703  *) Fix crypto/objects/objects.h: "ld-ce" should be "id-ce",
9704     OBJ_ld_ce should be OBJ_id_ce.
9705     Also some ip-pda OIDs in crypto/objects/objects.txt were
9706     incorrect (cf. RFC 3039).
9707     [Matt Cooper, Frederic Giudicelli, Bodo Moeller]
9708
9709  *) Release CRYPTO_LOCK_DYNLOCK when CRYPTO_destroy_dynlockid()
9710     returns early because it has nothing to do.
9711     [Andy Schneider <andy.schneider@bjss.co.uk>]
9712
9713  *) [In 0.9.6c-engine release:]
9714     Fix mutex callback return values in crypto/engine/hw_ncipher.c.
9715     [Andy Schneider <andy.schneider@bjss.co.uk>]
9716
9717  *) [In 0.9.6c-engine release:]
9718     Add support for Cryptographic Appliance's keyserver technology.
9719     (Use engine 'keyclient')
9720     [Cryptographic Appliances and Geoff Thorpe]
9721
9722  *) Add a configuration entry for OS/390 Unix.  The C compiler 'c89'
9723     is called via tools/c89.sh because arguments have to be
9724     rearranged (all '-L' options must appear before the first object
9725     modules).
9726     [Richard Shapiro <rshapiro@abinitio.com>]
9727
9728  *) [In 0.9.6c-engine release:]
9729     Add support for Broadcom crypto accelerator cards, backported
9730     from 0.9.7.
9731     [Broadcom, Nalin Dahyabhai <nalin@redhat.com>, Mark Cox]
9732
9733  *) [In 0.9.6c-engine release:]
9734     Add support for SureWare crypto accelerator cards from
9735     Baltimore Technologies.  (Use engine 'sureware')
9736     [Baltimore Technologies and Mark Cox]
9737
9738  *) [In 0.9.6c-engine release:]
9739     Add support for crypto accelerator cards from Accelerated
9740     Encryption Processing, www.aep.ie.  (Use engine 'aep')
9741     [AEP Inc. and Mark Cox]
9742
9743  *) Add a configuration entry for gcc on UnixWare.
9744     [Gary Benson <gbenson@redhat.com>]
9745
9746  *) Change ssl/s2_clnt.c and ssl/s2_srvr.c so that received handshake
9747     messages are stored in a single piece (fixed-length part and
9748     variable-length part combined) and fix various bugs found on the way.
9749     [Bodo Moeller]
9750
9751  *) Disable caching in BIO_gethostbyname(), directly use gethostbyname()
9752     instead.  BIO_gethostbyname() does not know what timeouts are
9753     appropriate, so entries would stay in cache even when they have
9754     become invalid.
9755     [Bodo Moeller; problem pointed out by Rich Salz <rsalz@zolera.com>
9756
9757  *) Change ssl23_get_client_hello (ssl/s23_srvr.c) behaviour when
9758     faced with a pathologically small ClientHello fragment that does
9759     not contain client_version: Instead of aborting with an error,
9760     simply choose the highest available protocol version (i.e.,
9761     TLS 1.0 unless it is disabled).  In practice, ClientHello
9762     messages are never sent like this, but this change gives us
9763     strictly correct behaviour at least for TLS.
9764     [Bodo Moeller]
9765
9766  *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()
9767     never resets s->method to s->ctx->method when called from within
9768     one of the SSL handshake functions.
9769     [Bodo Moeller; problem pointed out by Niko Baric]
9770
9771  *) In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert
9772     (sent using the client's version number) if client_version is
9773     smaller than the protocol version in use.  Also change
9774     ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0 if
9775     the client demanded SSL 3.0 but only TLS 1.0 is enabled; then
9776     the client will at least see that alert.
9777     [Bodo Moeller]
9778
9779  *) Fix ssl3_get_message (ssl/s3_both.c) to handle message fragmentation
9780     correctly.
9781     [Bodo Moeller]
9782
9783  *) Avoid infinite loop in ssl3_get_message (ssl/s3_both.c) if a
9784     client receives HelloRequest while in a handshake.
9785     [Bodo Moeller; bug noticed by Andy Schneider <andy.schneider@bjss.co.uk>]
9786
9787  *) Bugfix in ssl3_accept (ssl/s3_srvr.c): Case SSL3_ST_SW_HELLO_REQ_C
9788     should end in 'break', not 'goto end' which circumvents various
9789     cleanups done in state SSL_ST_OK.   But session related stuff
9790     must be disabled for SSL_ST_OK in the case that we just sent a
9791     HelloRequest.
9792
9793     Also avoid some overhead by not calling ssl_init_wbio_buffer()
9794     before just sending a HelloRequest.
9795     [Bodo Moeller, Eric Rescorla <ekr@rtfm.com>]
9796
9797  *) Fix ssl/s3_enc.c, ssl/t1_enc.c and ssl/s3_pkt.c so that we don't
9798     reveal whether illegal block cipher padding was found or a MAC
9799     verification error occurred.  (Neither SSLerr() codes nor alerts
9800     are directly visible to potential attackers, but the information
9801     may leak via logfiles.)
9802
9803     Similar changes are not required for the SSL 2.0 implementation
9804     because the number of padding bytes is sent in clear for SSL 2.0,
9805     and the extra bytes are just ignored.  However ssl/s2_pkt.c
9806     failed to verify that the purported number of padding bytes is in
9807     the legal range.
9808     [Bodo Moeller]
9809
9810  *) Add OpenUNIX-8 support including shared libraries
9811     (Boyd Lynn Gerber <gerberb@zenez.com>).
9812     [Lutz Jaenicke]
9813
9814  *) Improve RSA_padding_check_PKCS1_OAEP() check again to avoid
9815     'wristwatch attack' using huge encoding parameters (cf.
9816     James H. Manger's CRYPTO 2001 paper).  Note that the
9817     RSA_PKCS1_OAEP_PADDING case of RSA_private_decrypt() does not use
9818     encoding parameters and hence was not vulnerable.
9819     [Bodo Moeller]
9820
9821  *) BN_sqr() bug fix.
9822     [Ulf Möller, reported by Jim Ellis <jim.ellis@cavium.com>]
9823
9824  *) Rabin-Miller test analyses assume uniformly distributed witnesses,
9825     so use BN_pseudo_rand_range() instead of using BN_pseudo_rand()
9826     followed by modular reduction.
9827     [Bodo Moeller; pointed out by Adam Young <AYoung1@NCSUS.JNJ.COM>]
9828
9829  *) Add BN_pseudo_rand_range() with obvious functionality: BN_rand_range()
9830     equivalent based on BN_pseudo_rand() instead of BN_rand().
9831     [Bodo Moeller]
9832
9833  *) s3_srvr.c: allow sending of large client certificate lists (> 16 kB).
9834     This function was broken, as the check for a new client hello message
9835     to handle SGC did not allow these large messages.
9836     (Tracked down by "Douglas E. Engert" <deengert@anl.gov>.)
9837     [Lutz Jaenicke]
9838
9839  *) Add alert descriptions for TLSv1 to SSL_alert_desc_string[_long]().
9840     [Lutz Jaenicke]
9841
9842  *) Fix buggy behaviour of BIO_get_num_renegotiates() and BIO_ctrl()
9843     for BIO_C_GET_WRITE_BUF_SIZE ("Stephen Hinton" <shinton@netopia.com>).
9844     [Lutz Jaenicke]
9845
9846  *) Rework the configuration and shared library support for Tru64 Unix.
9847     The configuration part makes use of modern compiler features and
9848     still retains old compiler behavior for those that run older versions
9849     of the OS.  The shared library support part includes a variant that
9850     uses the RPATH feature, and is available through the special
9851     configuration target "alpha-cc-rpath", which will never be selected
9852     automatically.
9853     [Tim Mooney <mooney@dogbert.cc.ndsu.NoDak.edu> via Richard Levitte]
9854
9855  *) In ssl3_get_key_exchange (ssl/s3_clnt.c), call ssl3_get_message()
9856     with the same message size as in ssl3_get_certificate_request().
9857     Otherwise, if no ServerKeyExchange message occurs, CertificateRequest
9858     messages might inadvertently be reject as too long.
9859     [Petr Lampa <lampa@fee.vutbr.cz>]
9860
9861  *) Enhanced support for IA-64 Unix platforms (well, Linux and HP-UX).
9862     [Andy Polyakov]
9863
9864  *) Modified SSL library such that the verify_callback that has been set
9865     specifically for an SSL object with SSL_set_verify() is actually being
9866     used. Before the change, a verify_callback set with this function was
9867     ignored and the verify_callback() set in the SSL_CTX at the time of
9868     the call was used. New function X509_STORE_CTX_set_verify_cb() introduced
9869     to allow the necessary settings.
9870     [Lutz Jaenicke]
9871
9872  *) Initialize static variable in crypto/dsa/dsa_lib.c and crypto/dh/dh_lib.c
9873     explicitly to NULL, as at least on Solaris 8 this seems not always to be
9874     done automatically (in contradiction to the requirements of the C
9875     standard). This made problems when used from OpenSSH.
9876     [Lutz Jaenicke]
9877
9878  *) In OpenSSL 0.9.6a and 0.9.6b, crypto/dh/dh_key.c ignored
9879     dh->length and always used
9880
9881          BN_rand_range(priv_key, dh->p).
9882
9883     BN_rand_range() is not necessary for Diffie-Hellman, and this
9884     specific range makes Diffie-Hellman unnecessarily inefficient if
9885     dh->length (recommended exponent length) is much smaller than the
9886     length of dh->p.  We could use BN_rand_range() if the order of
9887     the subgroup was stored in the DH structure, but we only have
9888     dh->length.
9889
9890     So switch back to
9891
9892          BN_rand(priv_key, l, ...)
9893
9894     where 'l' is dh->length if this is defined, or BN_num_bits(dh->p)-1
9895     otherwise.
9896     [Bodo Moeller]
9897
9898  *) In
9899
9900          RSA_eay_public_encrypt
9901          RSA_eay_private_decrypt
9902          RSA_eay_private_encrypt (signing)
9903          RSA_eay_public_decrypt (signature verification)
9904
9905     (default implementations for RSA_public_encrypt,
9906     RSA_private_decrypt, RSA_private_encrypt, RSA_public_decrypt),
9907     always reject numbers >= n.
9908     [Bodo Moeller]
9909
9910  *) In crypto/rand/md_rand.c, use a new short-time lock CRYPTO_LOCK_RAND2
9911     to synchronize access to 'locking_thread'.  This is necessary on
9912     systems where access to 'locking_thread' (an 'unsigned long'
9913     variable) is not atomic.
9914     [Bodo Moeller]
9915
9916  *) In crypto/rand/md_rand.c, set 'locking_thread' to current thread's ID
9917     *before* setting the 'crypto_lock_rand' flag.  The previous code had
9918     a race condition if 0 is a valid thread ID.
9919     [Travis Vitek <vitek@roguewave.com>]
9920
9921  *) Add support for shared libraries under Irix.
9922     [Albert Chin-A-Young <china@thewrittenword.com>]
9923
9924  *) Add configuration option to build on Linux on both big-endian and
9925     little-endian MIPS.
9926     [Ralf Baechle <ralf@uni-koblenz.de>]
9927
9928  *) Add the possibility to create shared libraries on HP-UX.
9929     [Richard Levitte]
9930
9931 Changes between 0.9.6a and 0.9.6b  [9 Jul 2001]
9932
9933  *) Change ssleay_rand_bytes (crypto/rand/md_rand.c)
9934     to avoid a SSLeay/OpenSSL PRNG weakness pointed out by
9935     Markku-Juhani O. Saarinen <markku-juhani.saarinen@nokia.com>:
9936     PRNG state recovery was possible based on the output of
9937     one PRNG request appropriately sized to gain knowledge on
9938     'md' followed by enough consecutive 1-byte PRNG requests
9939     to traverse all of 'state'.
9940
9941     1. When updating 'md_local' (the current thread's copy of 'md')
9942        during PRNG output generation, hash all of the previous
9943        'md_local' value, not just the half used for PRNG output.
9944
9945     2. Make the number of bytes from 'state' included into the hash
9946        independent from the number of PRNG bytes requested.
9947
9948     The first measure alone would be sufficient to avoid
9949     Markku-Juhani's attack.  (Actually it had never occurred
9950     to me that the half of 'md_local' used for chaining was the
9951     half from which PRNG output bytes were taken -- I had always
9952     assumed that the secret half would be used.)  The second
9953     measure makes sure that additional data from 'state' is never
9954     mixed into 'md_local' in small portions; this heuristically
9955     further strengthens the PRNG.
9956     [Bodo Moeller]
9957
9958  *) Fix crypto/bn/asm/mips3.s.
9959     [Andy Polyakov]
9960
9961  *) When only the key is given to "enc", the IV is undefined. Print out
9962     an error message in this case.
9963     [Lutz Jaenicke]
9964
9965  *) Handle special case when X509_NAME is empty in X509 printing routines.
9966     [Steve Henson]
9967
9968  *) In dsa_do_verify (crypto/dsa/dsa_ossl.c), verify that r and s are
9969     positive and less than q.
9970     [Bodo Moeller]
9971
9972  *) Don't change *pointer in CRYPTO_add_lock() is add_lock_callback is
9973     used: it isn't thread safe and the add_lock_callback should handle
9974     that itself.
9975     [Paul Rose <Paul.Rose@bridge.com>]
9976
9977  *) Verify that incoming data obeys the block size in
9978     ssl3_enc (ssl/s3_enc.c) and tls1_enc (ssl/t1_enc.c).
9979     [Bodo Moeller]
9980
9981  *) Fix OAEP check.
9982     [Ulf Möller, Bodo Möller]
9983
9984  *) The countermeasure against Bleichbacher's attack on PKCS #1 v1.5
9985     RSA encryption was accidentally removed in s3_srvr.c in OpenSSL 0.9.5
9986     when fixing the server behaviour for backwards-compatible 'client
9987     hello' messages.  (Note that the attack is impractical against
9988     SSL 3.0 and TLS 1.0 anyway because length and version checking
9989     means that the probability of guessing a valid ciphertext is
9990     around 2^-40; see section 5 in Bleichenbacher's CRYPTO '98
9991     paper.)
9992
9993     Before 0.9.5, the countermeasure (hide the error by generating a
9994     random 'decryption result') did not work properly because
9995     ERR_clear_error() was missing, meaning that SSL_get_error() would
9996     detect the supposedly ignored error.
9997
9998     Both problems are now fixed.
9999     [Bodo Moeller]
10000
10001  *) In crypto/bio/bf_buff.c, increase DEFAULT_BUFFER_SIZE to 4096
10002     (previously it was 1024).
10003     [Bodo Moeller]
10004
10005  *) Fix for compatibility mode trust settings: ignore trust settings
10006     unless some valid trust or reject settings are present.
10007     [Steve Henson]
10008
10009  *) Fix for blowfish EVP: its a variable length cipher.
10010     [Steve Henson]
10011
10012  *) Fix various bugs related to DSA S/MIME verification. Handle missing
10013     parameters in DSA public key structures and return an error in the
10014     DSA routines if parameters are absent.
10015     [Steve Henson]
10016
10017  *) In versions up to 0.9.6, RAND_file_name() resorted to file ".rnd"
10018     in the current directory if neither $RANDFILE nor $HOME was set.
10019     RAND_file_name() in 0.9.6a returned NULL in this case.  This has
10020     caused some confusion to Windows users who haven't defined $HOME.
10021     Thus RAND_file_name() is changed again: e_os.h can define a
10022     DEFAULT_HOME, which will be used if $HOME is not set.
10023     For Windows, we use "C:"; on other platforms, we still require
10024     environment variables.
10025
10026  *) Move 'if (!initialized) RAND_poll()' into regions protected by
10027     CRYPTO_LOCK_RAND.  This is not strictly necessary, but avoids
10028     having multiple threads call RAND_poll() concurrently.
10029     [Bodo Moeller]
10030
10031  *) In crypto/rand/md_rand.c, replace 'add_do_not_lock' flag by a
10032     combination of a flag and a thread ID variable.
10033     Otherwise while one thread is in ssleay_rand_bytes (which sets the
10034     flag), *other* threads can enter ssleay_add_bytes without obeying
10035     the CRYPTO_LOCK_RAND lock (and may even illegally release the lock
10036     that they do not hold after the first thread unsets add_do_not_lock).
10037     [Bodo Moeller]
10038
10039  *) Change bctest again: '-x' expressions are not available in all
10040     versions of 'test'.
10041     [Bodo Moeller]
10042
10043 Changes between 0.9.6 and 0.9.6a  [5 Apr 2001]
10044
10045  *) Fix a couple of memory leaks in PKCS7_dataDecode()
10046     [Steve Henson, reported by Heyun Zheng <hzheng@atdsprint.com>]
10047
10048  *) Change Configure and Makefiles to provide EXE_EXT, which will contain
10049     the default extension for executables, if any.  Also, make the perl
10050     scripts that use symlink() to test if it really exists and use "cp"
10051     if it doesn't.  All this made OpenSSL compilable and installable in
10052     CygWin.
10053     [Richard Levitte]
10054
10055  *) Fix for asn1_GetSequence() for indefinite length constructed data.
10056     If SEQUENCE is length is indefinite just set c->slen to the total
10057     amount of data available.
10058     [Steve Henson, reported by shige@FreeBSD.org]
10059     [This change does not apply to 0.9.7.]
10060
10061  *) Change bctest to avoid here-documents inside command substitution
10062     (workaround for FreeBSD /bin/sh bug).
10063     For compatibility with Ultrix, avoid shell functions (introduced
10064     in the bctest version that searches along $PATH).
10065     [Bodo Moeller]
10066
10067  *) Rename 'des_encrypt' to 'des_encrypt1'.  This avoids the clashes
10068     with des_encrypt() defined on some operating systems, like Solaris
10069     and UnixWare.
10070     [Richard Levitte]
10071
10072  *) Check the result of RSA-CRT (see D. Boneh, R. DeMillo, R. Lipton:
10073     On the Importance of Eliminating Errors in Cryptographic
10074     Computations, J. Cryptology 14 (2001) 2, 101-119,
10075     http://theory.stanford.edu/~dabo/papers/faults.ps.gz).
10076     [Ulf Moeller]
10077
10078  *) MIPS assembler BIGNUM division bug fix.
10079     [Andy Polyakov]
10080
10081  *) Disabled incorrect Alpha assembler code.
10082     [Richard Levitte]
10083
10084  *) Fix PKCS#7 decode routines so they correctly update the length
10085     after reading an EOC for the EXPLICIT tag.
10086     [Steve Henson]
10087     [This change does not apply to 0.9.7.]
10088
10089  *) Fix bug in PKCS#12 key generation routines. This was triggered
10090     if a 3DES key was generated with a 0 initial byte. Include
10091     PKCS12_BROKEN_KEYGEN compilation option to retain the old
10092     (but broken) behaviour.
10093     [Steve Henson]
10094
10095  *) Enhance bctest to search for a working bc along $PATH and print
10096     it when found.
10097     [Tim Rice <tim@multitalents.net> via Richard Levitte]
10098
10099  *) Fix memory leaks in err.c: free err_data string if necessary;
10100     don't write to the wrong index in ERR_set_error_data.
10101     [Bodo Moeller]
10102
10103  *) Implement ssl23_peek (analogous to ssl23_read), which previously
10104     did not exist.
10105     [Bodo Moeller]
10106
10107  *) Replace rdtsc with _emit statements for VC++ version 5.
10108     [Jeremy Cooper <jeremy@baymoo.org>]
10109
10110  *) Make it possible to reuse SSLv2 sessions.
10111     [Richard Levitte]
10112
10113  *) In copy_email() check for >= 0 as a return value for
10114     X509_NAME_get_index_by_NID() since 0 is a valid index.
10115     [Steve Henson reported by Massimiliano Pala <madwolf@opensca.org>]
10116
10117  *) Avoid coredump with unsupported or invalid public keys by checking if
10118     X509_get_pubkey() fails in PKCS7_verify(). Fix memory leak when
10119     PKCS7_verify() fails with non detached data.
10120     [Steve Henson]
10121
10122  *) Don't use getenv in library functions when run as setuid/setgid.
10123     New function OPENSSL_issetugid().
10124     [Ulf Moeller]
10125
10126  *) Avoid false positives in memory leak detection code (crypto/mem_dbg.c)
10127     due to incorrect handling of multi-threading:
10128
10129     1. Fix timing glitch in the MemCheck_off() portion of CRYPTO_mem_ctrl().
10130
10131     2. Fix logical glitch in is_MemCheck_on() aka CRYPTO_is_mem_check_on().
10132
10133     3. Count how many times MemCheck_off() has been called so that
10134        nested use can be treated correctly.  This also avoids
10135        inband-signalling in the previous code (which relied on the
10136        assumption that thread ID 0 is impossible).
10137     [Bodo Moeller]
10138
10139  *) Add "-rand" option also to s_client and s_server.
10140     [Lutz Jaenicke]
10141
10142  *) Fix CPU detection on Irix 6.x.
10143     [Kurt Hockenbury <khockenb@stevens-tech.edu> and
10144      "Bruce W. Forsberg" <bruce.forsberg@baesystems.com>]
10145
10146  *) Fix X509_NAME bug which produced incorrect encoding if X509_NAME
10147     was empty.
10148     [Steve Henson]
10149     [This change does not apply to 0.9.7.]
10150
10151  *) Use the cached encoding of an X509_NAME structure rather than
10152     copying it. This is apparently the reason for the libsafe "errors"
10153     but the code is actually correct.
10154     [Steve Henson]
10155
10156  *) Add new function BN_rand_range(), and fix DSA_sign_setup() to prevent
10157     Bleichenbacher's DSA attack.
10158     Extend BN_[pseudo_]rand: As before, top=1 forces the highest two bits
10159     to be set and top=0 forces the highest bit to be set; top=-1 is new
10160     and leaves the highest bit random.
10161     [Ulf Moeller, Bodo Moeller]
10162
10163  *) In the NCONF_...-based implementations for CONF_... queries
10164     (crypto/conf/conf_lib.c), if the input LHASH is NULL, avoid using
10165     a temporary CONF structure with the data component set to NULL
10166     (which gives segmentation faults in lh_retrieve).
10167     Instead, use NULL for the CONF pointer in CONF_get_string and
10168     CONF_get_number (which may use environment variables) and directly
10169     return NULL from CONF_get_section.
10170     [Bodo Moeller]
10171
10172  *) Fix potential buffer overrun for EBCDIC.
10173     [Ulf Moeller]
10174
10175  *) Tolerate nonRepudiation as being valid for S/MIME signing and certSign
10176     keyUsage if basicConstraints absent for a CA.
10177     [Steve Henson]
10178
10179  *) Make SMIME_write_PKCS7() write mail header values with a format that
10180     is more generally accepted (no spaces before the semicolon), since
10181     some programs can't parse those values properly otherwise.  Also make
10182     sure BIO's that break lines after each write do not create invalid
10183     headers.
10184     [Richard Levitte]
10185
10186  *) Make the CRL encoding routines work with empty SEQUENCE OF. The
10187     macros previously used would not encode an empty SEQUENCE OF
10188     and break the signature.
10189     [Steve Henson]
10190     [This change does not apply to 0.9.7.]
10191
10192  *) Zero the premaster secret after deriving the master secret in
10193     DH ciphersuites.
10194     [Steve Henson]
10195
10196  *) Add some EVP_add_digest_alias registrations (as found in
10197     OpenSSL_add_all_digests()) to SSL_library_init()
10198     aka OpenSSL_add_ssl_algorithms().  This provides improved
10199     compatibility with peers using X.509 certificates
10200     with unconventional AlgorithmIdentifier OIDs.
10201     [Bodo Moeller]
10202
10203  *) Fix for Irix with NO_ASM.
10204     ["Bruce W. Forsberg" <bruce.forsberg@baesystems.com>]
10205
10206  *) ./config script fixes.
10207     [Ulf Moeller, Richard Levitte]
10208
10209  *) Fix 'openssl passwd -1'.
10210     [Bodo Moeller]
10211
10212  *) Change PKCS12_key_gen_asc() so it can cope with non null
10213     terminated strings whose length is passed in the passlen
10214     parameter, for example from PEM callbacks. This was done
10215     by adding an extra length parameter to asc2uni().
10216     [Steve Henson, reported by <oddissey@samsung.co.kr>]
10217
10218  *) Fix C code generated by 'openssl dsaparam -C': If a BN_bin2bn
10219     call failed, free the DSA structure.
10220     [Bodo Moeller]
10221
10222  *) Fix to uni2asc() to cope with zero length Unicode strings.
10223     These are present in some PKCS#12 files.
10224     [Steve Henson]
10225
10226  *) Increase s2->wbuf allocation by one byte in ssl2_new (ssl/s2_lib.c).
10227     Otherwise do_ssl_write (ssl/s2_pkt.c) will write beyond buffer limits
10228     when writing a 32767 byte record.
10229     [Bodo Moeller; problem reported by Eric Day <eday@concentric.net>]
10230
10231  *) In RSA_eay_public_{en,ed}crypt and RSA_eay_mod_exp (rsa_eay.c),
10232     obtain lock CRYPTO_LOCK_RSA before setting rsa->_method_mod_{n,p,q}.
10233
10234     (RSA objects have a reference count access to which is protected
10235     by CRYPTO_LOCK_RSA [see rsa_lib.c, s3_srvr.c, ssl_cert.c, ssl_rsa.c],
10236     so they are meant to be shared between threads.)
10237     [Bodo Moeller, Geoff Thorpe; original patch submitted by
10238     "Reddie, Steven" <Steven.Reddie@ca.com>]
10239
10240  *) Fix a deadlock in CRYPTO_mem_leaks().
10241     [Bodo Moeller]
10242
10243  *) Use better test patterns in bntest.
10244     [Ulf Möller]
10245
10246  *) rand_win.c fix for Borland C.
10247     [Ulf Möller]
10248
10249  *) BN_rshift bugfix for n == 0.
10250     [Bodo Moeller]
10251
10252  *) Add a 'bctest' script that checks for some known 'bc' bugs
10253     so that 'make test' does not abort just because 'bc' is broken.
10254     [Bodo Moeller]
10255
10256  *) Store verify_result within SSL_SESSION also for client side to
10257     avoid potential security hole. (Re-used sessions on the client side
10258     always resulted in verify_result==X509_V_OK, not using the original
10259     result of the server certificate verification.)
10260     [Lutz Jaenicke]
10261
10262  *) Fix ssl3_pending: If the record in s->s3->rrec is not of type
10263     SSL3_RT_APPLICATION_DATA, return 0.
10264     Similarly, change ssl2_pending to return 0 if SSL_in_init(s) is true.
10265     [Bodo Moeller]
10266
10267  *) Fix SSL_peek:
10268     Both ssl2_peek and ssl3_peek, which were totally broken in earlier
10269     releases, have been re-implemented by renaming the previous
10270     implementations of ssl2_read and ssl3_read to ssl2_read_internal
10271     and ssl3_read_internal, respectively, and adding 'peek' parameters
10272     to them.  The new ssl[23]_{read,peek} functions are calls to
10273     ssl[23]_read_internal with the 'peek' flag set appropriately.
10274     A 'peek' parameter has also been added to ssl3_read_bytes, which
10275     does the actual work for ssl3_read_internal.
10276     [Bodo Moeller]
10277
10278  *) Initialise "ex_data" member of RSA/DSA/DH structures prior to calling
10279     the method-specific "init()" handler. Also clean up ex_data after
10280     calling the method-specific "finish()" handler. Previously, this was
10281     happening the other way round.
10282     [Geoff Thorpe]
10283
10284  *) Increase BN_CTX_NUM (the number of BIGNUMs in a BN_CTX) to 16.
10285     The previous value, 12, was not always sufficient for BN_mod_exp().
10286     [Bodo Moeller]
10287
10288  *) Make sure that shared libraries get the internal name engine with
10289     the full version number and not just 0.  This should mark the
10290     shared libraries as not backward compatible.  Of course, this should
10291     be changed again when we can guarantee backward binary compatibility.
10292     [Richard Levitte]
10293
10294  *) Fix typo in get_cert_by_subject() in by_dir.c
10295     [Jean-Marc Desperrier <jean-marc.desperrier@certplus.com>]
10296
10297  *) Rework the system to generate shared libraries:
10298
10299     - Make note of the expected extension for the shared libraries and
10300       if there is a need for symbolic links from for example libcrypto.so.0
10301       to libcrypto.so.0.9.7.  There is extended info in Configure for
10302       that.
10303
10304     - Make as few rebuilds of the shared libraries as possible.
10305
10306     - Still avoid linking the OpenSSL programs with the shared libraries.
10307
10308     - When installing, install the shared libraries separately from the
10309       static ones.
10310     [Richard Levitte]
10311
10312  *) Fix SSL_CTX_set_read_ahead macro to actually use its argument.
10313
10314     Copy SSL_CTX's read_ahead flag to SSL object directly in SSL_new
10315     and not in SSL_clear because the latter is also used by the
10316     accept/connect functions; previously, the settings made by
10317     SSL_set_read_ahead would be lost during the handshake.
10318     [Bodo Moeller; problems reported by Anders Gertz <gertz@epact.se>]
10319
10320  *) Correct util/mkdef.pl to be selective about disabled algorithms.
10321     Previously, it would create entries for disabled algorithms no
10322     matter what.
10323     [Richard Levitte]
10324
10325  *) Added several new manual pages for SSL_* function.
10326     [Lutz Jaenicke]
10327
10328 Changes between 0.9.5a and 0.9.6  [24 Sep 2000]
10329
10330  *) In ssl23_get_client_hello, generate an error message when faced
10331     with an initial SSL 3.0/TLS record that is too small to contain the
10332     first two bytes of the ClientHello message, i.e. client_version.
10333     (Note that this is a pathologic case that probably has never happened
10334     in real life.)  The previous approach was to use the version number
10335     from the record header as a substitute; but our protocol choice
10336     should not depend on that one because it is not authenticated
10337     by the Finished messages.
10338     [Bodo Moeller]
10339
10340  *) More robust randomness gathering functions for Windows.
10341     [Jeffrey Altman <jaltman@columbia.edu>]
10342
10343  *) For compatibility reasons if the flag X509_V_FLAG_ISSUER_CHECK is
10344     not set then we don't setup the error code for issuer check errors
10345     to avoid possibly overwriting other errors which the callback does
10346     handle. If an application does set the flag then we assume it knows
10347     what it is doing and can handle the new informational codes
10348     appropriately.
10349     [Steve Henson]
10350
10351  *) Fix for a nasty bug in ASN1_TYPE handling. ASN1_TYPE is used for
10352     a general "ANY" type, as such it should be able to decode anything
10353     including tagged types. However it didn't check the class so it would
10354     wrongly interpret tagged types in the same way as their universal
10355     counterpart and unknown types were just rejected. Changed so that the
10356     tagged and unknown types are handled in the same way as a SEQUENCE:
10357     that is the encoding is stored intact. There is also a new type
10358     "V_ASN1_OTHER" which is used when the class is not universal, in this
10359     case we have no idea what the actual type is so we just lump them all
10360     together.
10361     [Steve Henson]
10362
10363  *) On VMS, stdout may very well lead to a file that is written to
10364     in a record-oriented fashion.  That means that every write() will
10365     write a separate record, which will be read separately by the
10366     programs trying to read from it.  This can be very confusing.
10367
10368     The solution is to put a BIO filter in the way that will buffer
10369     text until a linefeed is reached, and then write everything a
10370     line at a time, so every record written will be an actual line,
10371     not chunks of lines and not (usually doesn't happen, but I've
10372     seen it once) several lines in one record.  BIO_f_linebuffer() is
10373     the answer.
10374
10375     Currently, it's a VMS-only method, because that's where it has
10376     been tested well enough.
10377     [Richard Levitte]
10378
10379  *) Remove 'optimized' squaring variant in BN_mod_mul_montgomery,
10380     it can return incorrect results.
10381     (Note: The buggy variant was not enabled in OpenSSL 0.9.5a,
10382     but it was in 0.9.6-beta[12].)
10383     [Bodo Moeller]
10384
10385  *) Disable the check for content being present when verifying detached
10386     signatures in pk7_smime.c. Some versions of Netscape (wrongly)
10387     include zero length content when signing messages.
10388     [Steve Henson]
10389
10390  *) New BIO_shutdown_wr macro, which invokes the BIO_C_SHUTDOWN_WR
10391     BIO_ctrl (for BIO pairs).
10392     [Bodo Möller]
10393
10394  *) Add DSO method for VMS.
10395     [Richard Levitte]
10396
10397  *) Bug fix: Montgomery multiplication could produce results with the
10398     wrong sign.
10399     [Ulf Möller]
10400
10401  *) Add RPM specification openssl.spec and modify it to build three
10402     packages.  The default package contains applications, application
10403     documentation and run-time libraries.  The devel package contains
10404     include files, static libraries and function documentation.  The
10405     doc package contains the contents of the doc directory.  The original
10406     openssl.spec was provided by Damien Miller <djm@mindrot.org>.
10407     [Richard Levitte]
10408
10409  *) Add a large number of documentation files for many SSL routines.
10410     [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE>]
10411
10412  *) Add a configuration entry for Sony News 4.
10413     [NAKAJI Hiroyuki <nakaji@tutrp.tut.ac.jp>]
10414
10415  *) Don't set the two most significant bits to one when generating a
10416     random number < q in the DSA library.
10417     [Ulf Möller]
10418
10419  *) New SSL API mode 'SSL_MODE_AUTO_RETRY'.  This disables the default
10420     behaviour that SSL_read may result in SSL_ERROR_WANT_READ (even if
10421     the underlying transport is blocking) if a handshake took place.
10422     (The default behaviour is needed by applications such as s_client
10423     and s_server that use select() to determine when to use SSL_read;
10424     but for applications that know in advance when to expect data, it
10425     just makes things more complicated.)
10426     [Bodo Moeller]
10427
10428  *) Add RAND_egd_bytes(), which gives control over the number of bytes read
10429     from EGD.
10430     [Ben Laurie]
10431
10432  *) Add a few more EBCDIC conditionals that make `req' and `x509'
10433     work better on such systems.
10434     [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>]
10435
10436  *) Add two demo programs for PKCS12_parse() and PKCS12_create().
10437     Update PKCS12_parse() so it copies the friendlyName and the
10438     keyid to the certificates aux info.
10439     [Steve Henson]
10440
10441  *) Fix bug in PKCS7_verify() which caused an infinite loop
10442     if there was more than one signature.
10443     [Sven Uszpelkat <su@celocom.de>]
10444
10445  *) Major change in util/mkdef.pl to include extra information
10446     about each symbol, as well as presenting variables as well
10447     as functions.  This change means that there's n more need
10448     to rebuild the .num files when some algorithms are excluded.
10449     [Richard Levitte]
10450
10451  *) Allow the verify time to be set by an application,
10452     rather than always using the current time.
10453     [Steve Henson]
10454
10455  *) Phase 2 verify code reorganisation. The certificate
10456     verify code now looks up an issuer certificate by a
10457     number of criteria: subject name, authority key id
10458     and key usage. It also verifies self signed certificates
10459     by the same criteria. The main comparison function is
10460     X509_check_issued() which performs these checks.
10461
10462     Lot of changes were necessary in order to support this
10463     without completely rewriting the lookup code.
10464
10465     Authority and subject key identifier are now cached.
10466
10467     The LHASH 'certs' is X509_STORE has now been replaced
10468     by a STACK_OF(X509_OBJECT). This is mainly because an
10469     LHASH can't store or retrieve multiple objects with
10470     the same hash value.
10471
10472     As a result various functions (which were all internal
10473     use only) have changed to handle the new X509_STORE
10474     structure. This will break anything that messed round
10475     with X509_STORE internally.
10476
10477     The functions X509_STORE_add_cert() now checks for an
10478     exact match, rather than just subject name.
10479
10480     The X509_STORE API doesn't directly support the retrieval
10481     of multiple certificates matching a given criteria, however
10482     this can be worked round by performing a lookup first
10483     (which will fill the cache with candidate certificates)
10484     and then examining the cache for matches. This is probably
10485     the best we can do without throwing out X509_LOOKUP
10486     entirely (maybe later...).
10487
10488     The X509_VERIFY_CTX structure has been enhanced considerably.
10489
10490     All certificate lookup operations now go via a get_issuer()
10491     callback. Although this currently uses an X509_STORE it
10492     can be replaced by custom lookups. This is a simple way
10493     to bypass the X509_STORE hackery necessary to make this
10494     work and makes it possible to use more efficient techniques
10495     in future. A very simple version which uses a simple
10496     STACK for its trusted certificate store is also provided
10497     using X509_STORE_CTX_trusted_stack().
10498
10499     The verify_cb() and verify() callbacks now have equivalents
10500     in the X509_STORE_CTX structure.
10501
10502     X509_STORE_CTX also has a 'flags' field which can be used
10503     to customise the verify behaviour.
10504     [Steve Henson]
10505
10506  *) Add new PKCS#7 signing option PKCS7_NOSMIMECAP which
10507     excludes S/MIME capabilities.
10508     [Steve Henson]
10509
10510  *) When a certificate request is read in keep a copy of the
10511     original encoding of the signed data and use it when outputting
10512     again. Signatures then use the original encoding rather than
10513     a decoded, encoded version which may cause problems if the
10514     request is improperly encoded.
10515     [Steve Henson]
10516
10517  *) For consistency with other BIO_puts implementations, call
10518     buffer_write(b, ...) directly in buffer_puts instead of calling
10519     BIO_write(b, ...).
10520
10521     In BIO_puts, increment b->num_write as in BIO_write.
10522     [Peter.Sylvester@EdelWeb.fr]
10523
10524  *) Fix BN_mul_word for the case where the word is 0. (We have to use
10525     BN_zero, we may not return a BIGNUM with an array consisting of
10526     words set to zero.)
10527     [Bodo Moeller]
10528
10529  *) Avoid calling abort() from within the library when problems are
10530     detected, except if preprocessor symbols have been defined
10531     (such as REF_CHECK, BN_DEBUG etc.).
10532     [Bodo Moeller]
10533
10534  *) New openssl application 'rsautl'. This utility can be
10535     used for low level RSA operations. DER public key
10536     BIO/fp routines also added.
10537     [Steve Henson]
10538
10539  *) New Configure entry and patches for compiling on QNX 4.
10540     [Andreas Schneider <andreas@ds3.etech.fh-hamburg.de>]
10541
10542  *) A demo state-machine implementation was sponsored by
10543     Nuron (http://www.nuron.com/) and is now available in
10544     demos/state_machine.
10545     [Ben Laurie]
10546
10547  *) New options added to the 'dgst' utility for signature
10548     generation and verification.
10549     [Steve Henson]
10550
10551  *) Unrecognized PKCS#7 content types are now handled via a
10552     catch all ASN1_TYPE structure. This allows unsupported
10553     types to be stored as a "blob" and an application can
10554     encode and decode it manually.
10555     [Steve Henson]
10556
10557  *) Fix various signed/unsigned issues to make a_strex.c
10558     compile under VC++.
10559     [Oscar Jacobsson <oscar.jacobsson@celocom.com>]
10560
10561  *) ASN1 fixes. i2d_ASN1_OBJECT was not returning the correct
10562     length if passed a buffer. ASN1_INTEGER_to_BN failed
10563     if passed a NULL BN and its argument was negative.
10564     [Steve Henson, pointed out by Sven Heiberg <sven@tartu.cyber.ee>]
10565
10566  *) Modification to PKCS#7 encoding routines to output definite
10567     length encoding. Since currently the whole structures are in
10568     memory there's not real point in using indefinite length
10569     constructed encoding. However if OpenSSL is compiled with
10570     the flag PKCS7_INDEFINITE_ENCODING the old form is used.
10571     [Steve Henson]
10572
10573  *) Added BIO_vprintf() and BIO_vsnprintf().
10574     [Richard Levitte]
10575
10576  *) Added more prefixes to parse for in the strings written
10577     through a logging bio, to cover all the levels that are available
10578     through syslog.  The prefixes are now:
10579
10580        PANIC, EMERG, EMR       =>      LOG_EMERG
10581        ALERT, ALR              =>      LOG_ALERT
10582        CRIT, CRI               =>      LOG_CRIT
10583        ERROR, ERR              =>      LOG_ERR
10584        WARNING, WARN, WAR      =>      LOG_WARNING
10585        NOTICE, NOTE, NOT       =>      LOG_NOTICE
10586        INFO, INF               =>      LOG_INFO
10587        DEBUG, DBG              =>      LOG_DEBUG
10588
10589     and as before, if none of those prefixes are present at the
10590     beginning of the string, LOG_ERR is chosen.
10591
10592     On Win32, the LOG_* levels are mapped according to this:
10593
10594        LOG_EMERG, LOG_ALERT, LOG_CRIT, LOG_ERR => EVENTLOG_ERROR_TYPE
10595        LOG_WARNING                             => EVENTLOG_WARNING_TYPE
10596        LOG_NOTICE, LOG_INFO, LOG_DEBUG         => EVENTLOG_INFORMATION_TYPE
10597
10598     [Richard Levitte]
10599
10600  *) Made it possible to reconfigure with just the configuration
10601     argument "reconf" or "reconfigure".  The command line arguments
10602     are stored in Makefile.ssl in the variable CONFIGURE_ARGS,
10603     and are retrieved from there when reconfiguring.
10604     [Richard Levitte]
10605
10606  *) MD4 implemented.
10607     [Assar Westerlund <assar@sics.se>, Richard Levitte]
10608
10609  *) Add the arguments -CAfile and -CApath to the pkcs12 utility.
10610     [Richard Levitte]
10611
10612  *) The obj_dat.pl script was messing up the sorting of object
10613     names. The reason was that it compared the quoted version
10614     of strings as a result "OCSP" > "OCSP Signing" because
10615     " > SPACE. Changed script to store unquoted versions of
10616     names and add quotes on output. It was also omitting some
10617     names from the lookup table if they were given a default
10618     value (that is if SN is missing it is given the same
10619     value as LN and vice versa), these are now added on the
10620     grounds that if an object has a name we should be able to
10621     look it up. Finally added warning output when duplicate
10622     short or long names are found.
10623     [Steve Henson]
10624
10625  *) Changes needed for Tandem NSK.
10626     [Scott Uroff <scott@xypro.com>]
10627
10628  *) Fix SSL 2.0 rollback checking: Due to an off-by-one error in
10629     RSA_padding_check_SSLv23(), special padding was never detected
10630     and thus the SSL 3.0/TLS 1.0 countermeasure against protocol
10631     version rollback attacks was not effective.
10632
10633     In s23_clnt.c, don't use special rollback-attack detection padding
10634     (RSA_SSLV23_PADDING) if SSL 2.0 is the only protocol enabled in the
10635     client; similarly, in s23_srvr.c, don't do the rollback check if
10636     SSL 2.0 is the only protocol enabled in the server.
10637     [Bodo Moeller]
10638
10639  *) Make it possible to get hexdumps of unprintable data with 'openssl
10640     asn1parse'.  By implication, the functions ASN1_parse_dump() and
10641     BIO_dump_indent() are added.
10642     [Richard Levitte]
10643
10644  *) New functions ASN1_STRING_print_ex() and X509_NAME_print_ex()
10645     these print out strings and name structures based on various
10646     flags including RFC2253 support and proper handling of
10647     multibyte characters. Added options to the 'x509' utility
10648     to allow the various flags to be set.
10649     [Steve Henson]
10650
10651  *) Various fixes to use ASN1_TIME instead of ASN1_UTCTIME.
10652     Also change the functions X509_cmp_current_time() and
10653     X509_gmtime_adj() work with an ASN1_TIME structure,
10654     this will enable certificates using GeneralizedTime in validity
10655     dates to be checked.
10656     [Steve Henson]
10657
10658  *) Make the NEG_PUBKEY_BUG code (which tolerates invalid
10659     negative public key encodings) on by default,
10660     NO_NEG_PUBKEY_BUG can be set to disable it.
10661     [Steve Henson]
10662
10663  *) New function c2i_ASN1_OBJECT() which acts on ASN1_OBJECT
10664     content octets. An i2c_ASN1_OBJECT is unnecessary because
10665     the encoding can be trivially obtained from the structure.
10666     [Steve Henson]
10667
10668  *) crypto/err.c locking bugfix: Use write locks (CRYPTO_w_[un]lock),
10669     not read locks (CRYPTO_r_[un]lock).
10670     [Bodo Moeller]
10671
10672  *) A first attempt at creating official support for shared
10673     libraries through configuration.  I've kept it so the
10674     default is static libraries only, and the OpenSSL programs
10675     are always statically linked for now, but there are
10676     preparations for dynamic linking in place.
10677     This has been tested on Linux and Tru64.
10678     [Richard Levitte]
10679
10680  *) Randomness polling function for Win9x, as described in:
10681     Peter Gutmann, Software Generation of Practically Strong
10682     Random Numbers.
10683     [Ulf Möller]
10684
10685  *) Fix so PRNG is seeded in req if using an already existing
10686     DSA key.
10687     [Steve Henson]
10688
10689  *) New options to smime application. -inform and -outform
10690     allow alternative formats for the S/MIME message including
10691     PEM and DER. The -content option allows the content to be
10692     specified separately. This should allow things like Netscape
10693     form signing output easier to verify.
10694     [Steve Henson]
10695
10696  *) Fix the ASN1 encoding of tags using the 'long form'.
10697     [Steve Henson]
10698
10699  *) New ASN1 functions, i2c_* and c2i_* for INTEGER and BIT
10700     STRING types. These convert content octets to and from the
10701     underlying type. The actual tag and length octets are
10702     already assumed to have been read in and checked. These
10703     are needed because all other string types have virtually
10704     identical handling apart from the tag. By having versions
10705     of the ASN1 functions that just operate on content octets
10706     IMPLICIT tagging can be handled properly. It also allows
10707     the ASN1_ENUMERATED code to be cut down because ASN1_ENUMERATED
10708     and ASN1_INTEGER are identical apart from the tag.
10709     [Steve Henson]
10710
10711  *) Change the handling of OID objects as follows:
10712
10713     - New object identifiers are inserted in objects.txt, following
10714       the syntax given in objects.README.
10715     - objects.pl is used to process obj_mac.num and create a new
10716       obj_mac.h.
10717     - obj_dat.pl is used to create a new obj_dat.h, using the data in
10718       obj_mac.h.
10719
10720     This is currently kind of a hack, and the perl code in objects.pl
10721     isn't very elegant, but it works as I intended.  The simplest way
10722     to check that it worked correctly is to look in obj_dat.h and
10723     check the array nid_objs and make sure the objects haven't moved
10724     around (this is important!).  Additions are OK, as well as
10725     consistent name changes.
10726     [Richard Levitte]
10727
10728  *) Add BSD-style MD5-based passwords to 'openssl passwd' (option '-1').
10729     [Bodo Moeller]
10730
10731  *) Addition of the command line parameter '-rand file' to 'openssl req'.
10732     The given file adds to whatever has already been seeded into the
10733     random pool through the RANDFILE configuration file option or
10734     environment variable, or the default random state file.
10735     [Richard Levitte]
10736
10737  *) mkstack.pl now sorts each macro group into lexical order.
10738     Previously the output order depended on the order the files
10739     appeared in the directory, resulting in needless rewriting
10740     of safestack.h .
10741     [Steve Henson]
10742
10743  *) Patches to make OpenSSL compile under Win32 again. Mostly
10744     work arounds for the VC++ problem that it treats func() as
10745     func(void). Also stripped out the parts of mkdef.pl that
10746     added extra typesafe functions: these no longer exist.
10747     [Steve Henson]
10748
10749  *) Reorganisation of the stack code. The macros are now all
10750     collected in safestack.h . Each macro is defined in terms of
10751     a "stack macro" of the form SKM_<name>(type, a, b). The
10752     DEBUG_SAFESTACK is now handled in terms of function casts,
10753     this has the advantage of retaining type safety without the
10754     use of additional functions. If DEBUG_SAFESTACK is not defined
10755     then the non typesafe macros are used instead. Also modified the
10756     mkstack.pl script to handle the new form. Needs testing to see
10757     if which (if any) compilers it chokes and maybe make DEBUG_SAFESTACK
10758     the default if no major problems. Similar behaviour for ASN1_SET_OF
10759     and PKCS12_STACK_OF.
10760     [Steve Henson]
10761
10762  *) When some versions of IIS use the 'NET' form of private key the
10763     key derivation algorithm is different. Normally MD5(password) is
10764     used as a 128 bit RC4 key. In the modified case
10765     MD5(MD5(password) + "SGCKEYSALT")  is used instead. Added some
10766     new functions i2d_RSA_NET(), d2i_RSA_NET() etc which are the same
10767     as the old Netscape_RSA functions except they have an additional
10768     'sgckey' parameter which uses the modified algorithm. Also added
10769     an -sgckey command line option to the rsa utility. Thanks to
10770     Adrian Peck <bertie@ncipher.com> for posting details of the modified
10771     algorithm to openssl-dev.
10772     [Steve Henson]
10773
10774  *) The evp_local.h macros were using 'c.##kname' which resulted in
10775     invalid expansion on some systems (SCO 5.0.5 for example).
10776     Corrected to 'c.kname'.
10777     [Phillip Porch <root@theporch.com>]
10778
10779  *) New X509_get1_email() and X509_REQ_get1_email() functions that return
10780     a STACK of email addresses from a certificate or request, these look
10781     in the subject name and the subject alternative name extensions and
10782     omit any duplicate addresses.
10783     [Steve Henson]
10784
10785  *) Re-implement BN_mod_exp2_mont using independent (and larger) windows.
10786     This makes DSA verification about 2 % faster.
10787     [Bodo Moeller]
10788
10789  *) Increase maximum window size in BN_mod_exp_... to 6 bits instead of 5
10790     (meaning that now 2^5 values will be precomputed, which is only 4 KB
10791     plus overhead for 1024 bit moduli).
10792     This makes exponentiations about 0.5 % faster for 1024 bit
10793     exponents (as measured by "openssl speed rsa2048").
10794     [Bodo Moeller]
10795
10796  *) Rename memory handling macros to avoid conflicts with other
10797     software:
10798          Malloc         =>  OPENSSL_malloc
10799          Malloc_locked  =>  OPENSSL_malloc_locked
10800          Realloc        =>  OPENSSL_realloc
10801          Free           =>  OPENSSL_free
10802     [Richard Levitte]
10803
10804  *) New function BN_mod_exp_mont_word for small bases (roughly 15%
10805     faster than BN_mod_exp_mont, i.e. 7% for a full DH exchange).
10806     [Bodo Moeller]
10807
10808  *) CygWin32 support.
10809     [John Jarvie <jjarvie@newsguy.com>]
10810
10811  *) The type-safe stack code has been rejigged. It is now only compiled
10812     in when OpenSSL is configured with the DEBUG_SAFESTACK option and
10813     by default all type-specific stack functions are "#define"d back to
10814     standard stack functions. This results in more streamlined output
10815     but retains the type-safety checking possibilities of the original
10816     approach.
10817     [Geoff Thorpe]
10818
10819  *) The STACK code has been cleaned up, and certain type declarations
10820     that didn't make a lot of sense have been brought in line. This has
10821     also involved a cleanup of sorts in safestack.h to more correctly
10822     map type-safe stack functions onto their plain stack counterparts.
10823     This work has also resulted in a variety of "const"ifications of
10824     lots of the code, especially "_cmp" operations which should normally
10825     be prototyped with "const" parameters anyway.
10826     [Geoff Thorpe]
10827
10828  *) When generating bytes for the first time in md_rand.c, 'stir the pool'
10829     by seeding with STATE_SIZE dummy bytes (with zero entropy count).
10830     (The PRNG state consists of two parts, the large pool 'state' and 'md',
10831     where all of 'md' is used each time the PRNG is used, but 'state'
10832     is used only indexed by a cyclic counter. As entropy may not be
10833     well distributed from the beginning, 'md' is important as a
10834     chaining variable. However, the output function chains only half
10835     of 'md', i.e. 80 bits.  ssleay_rand_add, on the other hand, chains
10836     all of 'md', and seeding with STATE_SIZE dummy bytes will result
10837     in all of 'state' being rewritten, with the new values depending
10838     on virtually all of 'md'.  This overcomes the 80 bit limitation.)
10839     [Bodo Moeller]
10840
10841  *) In ssl/s2_clnt.c and ssl/s3_clnt.c, call ERR_clear_error() when
10842     the handshake is continued after ssl_verify_cert_chain();
10843     otherwise, if SSL_VERIFY_NONE is set, remaining error codes
10844     can lead to 'unexplainable' connection aborts later.
10845     [Bodo Moeller; problem tracked down by Lutz Jaenicke]
10846
10847  *) Major EVP API cipher revision.
10848     Add hooks for extra EVP features. This allows various cipher
10849     parameters to be set in the EVP interface. Support added for variable
10850     key length ciphers via the EVP_CIPHER_CTX_set_key_length() function and
10851     setting of RC2 and RC5 parameters.
10852
10853     Modify EVP_OpenInit() and EVP_SealInit() to cope with variable key length
10854     ciphers.
10855
10856     Remove lots of duplicated code from the EVP library. For example *every*
10857     cipher init() function handles the 'iv' in the same way according to the
10858     cipher mode. They also all do nothing if the 'key' parameter is NULL and
10859     for CFB and OFB modes they zero ctx->num.
10860
10861     New functionality allows removal of S/MIME code RC2 hack.
10862
10863     Most of the routines have the same form and so can be declared in terms
10864     of macros.
10865
10866     By shifting this to the top level EVP_CipherInit() it can be removed from
10867     all individual ciphers. If the cipher wants to handle IVs or keys
10868     differently it can set the EVP_CIPH_CUSTOM_IV or EVP_CIPH_ALWAYS_CALL_INIT
10869     flags.
10870
10871     Change lots of functions like EVP_EncryptUpdate() to now return a
10872     value: although software versions of the algorithms cannot fail
10873     any installed hardware versions can.
10874     [Steve Henson]
10875
10876  *) Implement SSL_OP_TLS_ROLLBACK_BUG: In ssl3_get_client_key_exchange, if
10877     this option is set, tolerate broken clients that send the negotiated
10878     protocol version number instead of the requested protocol version
10879     number.
10880     [Bodo Moeller]
10881
10882  *) Call dh_tmp_cb (set by ..._TMP_DH_CB) with correct 'is_export' flag;
10883     i.e. non-zero for export ciphersuites, zero otherwise.
10884     Previous versions had this flag inverted, inconsistent with
10885     rsa_tmp_cb (..._TMP_RSA_CB).
10886     [Bodo Moeller; problem reported by Amit Chopra]
10887
10888  *) Add missing DSA library text string. Work around for some IIS
10889     key files with invalid SEQUENCE encoding.
10890     [Steve Henson]
10891
10892  *) Add a document (doc/standards.txt) that list all kinds of standards
10893     and so on that are implemented in OpenSSL.
10894     [Richard Levitte]
10895
10896  *) Enhance c_rehash script. Old version would mishandle certificates
10897     with the same subject name hash and wouldn't handle CRLs at all.
10898     Added -fingerprint option to crl utility, to support new c_rehash
10899     features.
10900     [Steve Henson]
10901
10902  *) Eliminate non-ANSI declarations in crypto.h and stack.h.
10903     [Ulf Möller]
10904
10905  *) Fix for SSL server purpose checking. Server checking was
10906     rejecting certificates which had extended key usage present
10907     but no ssl client purpose.
10908     [Steve Henson, reported by Rene Grosser <grosser@hisolutions.com>]
10909
10910  *) Make PKCS#12 code work with no password. The PKCS#12 spec
10911     is a little unclear about how a blank password is handled.
10912     Since the password in encoded as a BMPString with terminating
10913     double NULL a zero length password would end up as just the
10914     double NULL. However no password at all is different and is
10915     handled differently in the PKCS#12 key generation code. NS
10916     treats a blank password as zero length. MSIE treats it as no
10917     password on export: but it will try both on import. We now do
10918     the same: PKCS12_parse() tries zero length and no password if
10919     the password is set to "" or NULL (NULL is now a valid password:
10920     it wasn't before) as does the pkcs12 application.
10921     [Steve Henson]
10922
10923  *) Bugfixes in apps/x509.c: Avoid a memory leak; and don't use
10924     perror when PEM_read_bio_X509_REQ fails, the error message must
10925     be obtained from the error queue.
10926     [Bodo Moeller]
10927
10928  *) Avoid 'thread_hash' memory leak in crypto/err/err.c by freeing
10929     it in ERR_remove_state if appropriate, and change ERR_get_state
10930     accordingly to avoid race conditions (this is necessary because
10931     thread_hash is no longer constant once set).
10932     [Bodo Moeller]
10933
10934  *) Bugfix for linux-elf makefile.one.
10935     [Ulf Möller]
10936
10937  *) RSA_get_default_method() will now cause a default
10938     RSA_METHOD to be chosen if one doesn't exist already.
10939     Previously this was only set during a call to RSA_new()
10940     or RSA_new_method(NULL) meaning it was possible for
10941     RSA_get_default_method() to return NULL.
10942     [Geoff Thorpe]
10943
10944  *) Added native name translation to the existing DSO code
10945     that will convert (if the flag to do so is set) filenames
10946     that are sufficiently small and have no path information
10947     into a canonical native form. Eg. "blah" converted to
10948     "libblah.so" or "blah.dll" etc.
10949     [Geoff Thorpe]
10950
10951  *) New function ERR_error_string_n(e, buf, len) which is like
10952     ERR_error_string(e, buf), but writes at most 'len' bytes
10953     including the 0 terminator.  For ERR_error_string_n, 'buf'
10954     may not be NULL.
10955     [Damien Miller <djm@mindrot.org>, Bodo Moeller]
10956
10957  *) CONF library reworked to become more general.  A new CONF
10958     configuration file reader "class" is implemented as well as a
10959     new functions (NCONF_*, for "New CONF") to handle it.  The now
10960     old CONF_* functions are still there, but are reimplemented to
10961     work in terms of the new functions.  Also, a set of functions
10962     to handle the internal storage of the configuration data is
10963     provided to make it easier to write new configuration file
10964     reader "classes" (I can definitely see something reading a
10965     configuration file in XML format, for example), called _CONF_*,
10966     or "the configuration storage API"...
10967
10968     The new configuration file reading functions are:
10969
10970        NCONF_new, NCONF_free, NCONF_load, NCONF_load_fp, NCONF_load_bio,
10971        NCONF_get_section, NCONF_get_string, NCONF_get_numbre
10972
10973        NCONF_default, NCONF_WIN32
10974
10975        NCONF_dump_fp, NCONF_dump_bio
10976
10977     NCONF_default and NCONF_WIN32 are method (or "class") choosers,
10978     NCONF_new creates a new CONF object.  This works in the same way
10979     as other interfaces in OpenSSL, like the BIO interface.
10980     NCONF_dump_* dump the internal storage of the configuration file,
10981     which is useful for debugging.  All other functions take the same
10982     arguments as the old CONF_* functions with the exception of the
10983     first that must be a `CONF *' instead of a `LHASH *'.
10984
10985     To make it easier to use the new classes with the old CONF_* functions,
10986     the function CONF_set_default_method is provided.
10987     [Richard Levitte]
10988
10989  *) Add '-tls1' option to 'openssl ciphers', which was already
10990     mentioned in the documentation but had not been implemented.
10991     (This option is not yet really useful because even the additional
10992     experimental TLS 1.0 ciphers are currently treated as SSL 3.0 ciphers.)
10993     [Bodo Moeller]
10994
10995  *) Initial DSO code added into libcrypto for letting OpenSSL (and
10996     OpenSSL-based applications) load shared libraries and bind to
10997     them in a portable way.
10998     [Geoff Thorpe, with contributions from Richard Levitte]
10999
11000 Changes between 0.9.5 and 0.9.5a  [1 Apr 2000]
11001
11002  *) Make sure _lrotl and _lrotr are only used with MSVC.
11003
11004  *) Use lock CRYPTO_LOCK_RAND correctly in ssleay_rand_status
11005     (the default implementation of RAND_status).
11006
11007  *) Rename openssl x509 option '-crlext', which was added in 0.9.5,
11008     to '-clrext' (= clear extensions), as intended and documented.
11009     [Bodo Moeller; inconsistency pointed out by Michael Attili
11010     <attili@amaxo.com>]
11011
11012  *) Fix for HMAC. It wasn't zeroing the rest of the block if the key length
11013     was larger than the MD block size.
11014     [Steve Henson, pointed out by Yost William <YostW@tce.com>]
11015
11016  *) Modernise PKCS12_parse() so it uses STACK_OF(X509) for its ca argument
11017     fix a leak when the ca argument was passed as NULL. Stop X509_PUBKEY_set()
11018     using the passed key: if the passed key was a private key the result
11019     of X509_print(), for example, would be to print out all the private key
11020     components.
11021     [Steve Henson]
11022
11023  *) des_quad_cksum() byte order bug fix.
11024     [Ulf Möller, using the problem description in krb4-0.9.7, where
11025      the solution is attributed to Derrick J Brashear <shadow@DEMENTIA.ORG>]
11026
11027  *) Fix so V_ASN1_APP_CHOOSE works again: however its use is strongly
11028     discouraged.
11029     [Steve Henson, pointed out by Brian Korver <briank@cs.stanford.edu>]
11030
11031  *) For easily testing in shell scripts whether some command
11032     'openssl XXX' exists, the new pseudo-command 'openssl no-XXX'
11033     returns with exit code 0 iff no command of the given name is available.
11034     'no-XXX' is printed in this case, 'XXX' otherwise.  In both cases,
11035     the output goes to stdout and nothing is printed to stderr.
11036     Additional arguments are always ignored.
11037
11038     Since for each cipher there is a command of the same name,
11039     the 'no-cipher' compilation switches can be tested this way.
11040
11041     ('openssl no-XXX' is not able to detect pseudo-commands such
11042     as 'quit', 'list-XXX-commands', or 'no-XXX' itself.)
11043     [Bodo Moeller]
11044
11045  *) Update test suite so that 'make test' succeeds in 'no-rsa' configuration.
11046     [Bodo Moeller]
11047
11048  *) For SSL_[CTX_]set_tmp_dh, don't create a DH key if SSL_OP_SINGLE_DH_USE
11049     is set; it will be thrown away anyway because each handshake creates
11050     its own key.
11051     ssl_cert_dup, which is used by SSL_new, now copies DH keys in addition
11052     to parameters -- in previous versions (since OpenSSL 0.9.3) the
11053     'default key' from SSL_CTX_set_tmp_dh would always be lost, meaning
11054     you effectively got SSL_OP_SINGLE_DH_USE when using this macro.
11055     [Bodo Moeller]
11056
11057  *) New s_client option -ign_eof: EOF at stdin is ignored, and
11058     'Q' and 'R' lose their special meanings (quit/renegotiate).
11059     This is part of what -quiet does; unlike -quiet, -ign_eof
11060     does not suppress any output.
11061     [Richard Levitte]
11062
11063  *) Add compatibility options to the purpose and trust code. The
11064     purpose X509_PURPOSE_ANY is "any purpose" which automatically
11065     accepts a certificate or CA, this was the previous behaviour,
11066     with all the associated security issues.
11067
11068     X509_TRUST_COMPAT is the old trust behaviour: only and
11069     automatically trust self signed roots in certificate store. A
11070     new trust setting X509_TRUST_DEFAULT is used to specify that
11071     a purpose has no associated trust setting and it should instead
11072     use the value in the default purpose.
11073     [Steve Henson]
11074
11075  *) Fix the PKCS#8 DSA private key code so it decodes keys again
11076     and fix a memory leak.
11077     [Steve Henson]
11078
11079  *) In util/mkerr.pl (which implements 'make errors'), preserve
11080     reason strings from the previous version of the .c file, as
11081     the default to have only downcase letters (and digits) in
11082     automatically generated reasons codes is not always appropriate.
11083     [Bodo Moeller]
11084
11085  *) In ERR_load_ERR_strings(), build an ERR_LIB_SYS error reason table
11086     using strerror.  Previously, ERR_reason_error_string() returned
11087     library names as reason strings for SYSerr; but SYSerr is a special
11088     case where small numbers are errno values, not library numbers.
11089     [Bodo Moeller]
11090
11091  *) Add '-dsaparam' option to 'openssl dhparam' application.  This
11092     converts DSA parameters into DH parameters. (When creating parameters,
11093     DSA_generate_parameters is used.)
11094     [Bodo Moeller]
11095
11096  *) Include 'length' (recommended exponent length) in C code generated
11097     by 'openssl dhparam -C'.
11098     [Bodo Moeller]
11099
11100  *) The second argument to set_label in perlasm was already being used
11101     so couldn't be used as a "file scope" flag. Moved to third argument
11102     which was free.
11103     [Steve Henson]
11104
11105  *) In PEM_ASN1_write_bio and some other functions, use RAND_pseudo_bytes
11106     instead of RAND_bytes for encryption IVs and salts.
11107     [Bodo Moeller]
11108
11109  *) Include RAND_status() into RAND_METHOD instead of implementing
11110     it only for md_rand.c  Otherwise replacing the PRNG by calling
11111     RAND_set_rand_method would be impossible.
11112     [Bodo Moeller]
11113
11114  *) Don't let DSA_generate_key() enter an infinite loop if the random
11115     number generation fails.
11116     [Bodo Moeller]
11117
11118  *) New 'rand' application for creating pseudo-random output.
11119     [Bodo Moeller]
11120
11121  *) Added configuration support for Linux/IA64
11122     [Rolf Haberrecker <rolf@suse.de>]
11123
11124  *) Assembler module support for Mingw32.
11125     [Ulf Möller]
11126
11127  *) Shared library support for HPUX (in shlib/).
11128     [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE> and Anonymous]
11129
11130  *) Shared library support for Solaris gcc.
11131     [Lutz Behnke <behnke@trustcenter.de>]
11132
11133 Changes between 0.9.4 and 0.9.5  [28 Feb 2000]
11134
11135  *) PKCS7_encrypt() was adding text MIME headers twice because they
11136     were added manually and by SMIME_crlf_copy().
11137     [Steve Henson]
11138
11139  *) In bntest.c don't call BN_rand with zero bits argument.
11140     [Steve Henson, pointed out by Andrew W. Gray <agray@iconsinc.com>]
11141
11142  *) BN_mul bugfix: In bn_mul_part_recursion() only the a>a[n] && b>b[n]
11143     case was implemented. This caused BN_div_recp() to fail occasionally.
11144     [Ulf Möller]
11145
11146  *) Add an optional second argument to the set_label() in the perl
11147     assembly language builder. If this argument exists and is set
11148     to 1 it signals that the assembler should use a symbol whose
11149     scope is the entire file, not just the current function. This
11150     is needed with MASM which uses the format label:: for this scope.
11151     [Steve Henson, pointed out by Peter Runestig <peter@runestig.com>]
11152
11153  *) Change the ASN1 types so they are typedefs by default. Before
11154     almost all types were #define'd to ASN1_STRING which was causing
11155     STACK_OF() problems: you couldn't declare STACK_OF(ASN1_UTF8STRING)
11156     for example.
11157     [Steve Henson]
11158
11159  *) Change names of new functions to the new get1/get0 naming
11160     convention: After 'get1', the caller owns a reference count
11161     and has to call ..._free; 'get0' returns a pointer to some
11162     data structure without incrementing reference counters.
11163     (Some of the existing 'get' functions increment a reference
11164     counter, some don't.)
11165     Similarly, 'set1' and 'add1' functions increase reference
11166     counters or duplicate objects.
11167     [Steve Henson]
11168
11169  *) Allow for the possibility of temp RSA key generation failure:
11170     the code used to assume it always worked and crashed on failure.
11171     [Steve Henson]
11172
11173  *) Fix potential buffer overrun problem in BIO_printf().
11174     [Ulf Möller, using public domain code by Patrick Powell; problem
11175      pointed out by David Sacerdote <das33@cornell.edu>]
11176
11177  *) Support EGD <http://www.lothar.com/tech/crypto/>.  New functions
11178     RAND_egd() and RAND_status().  In the command line application,
11179     the EGD socket can be specified like a seed file using RANDFILE
11180     or -rand.
11181     [Ulf Möller]
11182
11183  *) Allow the string CERTIFICATE to be tolerated in PKCS#7 structures.
11184     Some CAs (e.g. Verisign) distribute certificates in this form.
11185     [Steve Henson]
11186
11187  *) Remove the SSL_ALLOW_ADH compile option and set the default cipher
11188     list to exclude them. This means that no special compilation option
11189     is needed to use anonymous DH: it just needs to be included in the
11190     cipher list.
11191     [Steve Henson]
11192
11193  *) Change the EVP_MD_CTX_type macro so its meaning consistent with
11194     EVP_MD_type. The old functionality is available in a new macro called
11195     EVP_MD_md(). Change code that uses it and update docs.
11196     [Steve Henson]
11197
11198  *) ..._ctrl functions now have corresponding ..._callback_ctrl functions
11199     where the 'void *' argument is replaced by a function pointer argument.
11200     Previously 'void *' was abused to point to functions, which works on
11201     many platforms, but is not correct.  As these functions are usually
11202     called by macros defined in OpenSSL header files, most source code
11203     should work without changes.
11204     [Richard Levitte]
11205
11206  *) <openssl/opensslconf.h> (which is created by Configure) now contains
11207     sections with information on -D... compiler switches used for
11208     compiling the library so that applications can see them.  To enable
11209     one of these sections, a pre-processor symbol OPENSSL_..._DEFINES
11210     must be defined.  E.g.,
11211        #define OPENSSL_ALGORITHM_DEFINES
11212        #include <openssl/opensslconf.h>
11213     defines all pertinent NO_<algo> symbols, such as NO_IDEA, NO_RSA, etc.
11214     [Richard Levitte, Ulf and Bodo Möller]
11215
11216  *) Bugfix: Tolerate fragmentation and interleaving in the SSL 3/TLS
11217     record layer.
11218     [Bodo Moeller]
11219
11220  *) Change the 'other' type in certificate aux info to a STACK_OF
11221     X509_ALGOR. Although not an AlgorithmIdentifier as such it has
11222     the required ASN1 format: arbitrary types determined by an OID.
11223     [Steve Henson]
11224
11225  *) Add some PEM_write_X509_REQ_NEW() functions and a command line
11226     argument to 'req'. This is not because the function is newer or
11227     better than others it just uses the work 'NEW' in the certificate
11228     request header lines. Some software needs this.
11229     [Steve Henson]
11230
11231  *) Reorganise password command line arguments: now passwords can be
11232     obtained from various sources. Delete the PEM_cb function and make
11233     it the default behaviour: i.e. if the callback is NULL and the
11234     usrdata argument is not NULL interpret it as a null terminated pass
11235     phrase. If usrdata and the callback are NULL then the pass phrase
11236     is prompted for as usual.
11237     [Steve Henson]
11238
11239  *) Add support for the Compaq Atalla crypto accelerator. If it is installed,
11240     the support is automatically enabled. The resulting binaries will
11241     autodetect the card and use it if present.
11242     [Ben Laurie and Compaq Inc.]
11243
11244  *) Work around for Netscape hang bug. This sends certificate request
11245     and server done in one record. Since this is perfectly legal in the
11246     SSL/TLS protocol it isn't a "bug" option and is on by default. See
11247     the bugs/SSLv3 entry for more info.
11248     [Steve Henson]
11249
11250  *) HP-UX tune-up: new unified configs, HP C compiler bug workaround.
11251     [Andy Polyakov]
11252
11253  *) Add -rand argument to smime and pkcs12 applications and read/write
11254     of seed file.
11255     [Steve Henson]
11256
11257  *) New 'passwd' tool for crypt(3) and apr1 password hashes.
11258     [Bodo Moeller]
11259
11260  *) Add command line password options to the remaining applications.
11261     [Steve Henson]
11262
11263  *) Bug fix for BN_div_recp() for numerators with an even number of
11264     bits.
11265     [Ulf Möller]
11266
11267  *) More tests in bntest.c, and changed test_bn output.
11268     [Ulf Möller]
11269
11270  *) ./config recognizes MacOS X now.
11271     [Andy Polyakov]
11272
11273  *) Bug fix for BN_div() when the first words of num and divisor are
11274     equal (it gave wrong results if (rem=(n1-q*d0)&BN_MASK2) < d0).
11275     [Ulf Möller]
11276
11277  *) Add support for various broken PKCS#8 formats, and command line
11278     options to produce them.
11279     [Steve Henson]
11280
11281  *) New functions BN_CTX_start(), BN_CTX_get() and BT_CTX_end() to
11282     get temporary BIGNUMs from a BN_CTX.
11283     [Ulf Möller]
11284
11285  *) Correct return values in BN_mod_exp_mont() and BN_mod_exp2_mont()
11286     for p == 0.
11287     [Ulf Möller]
11288
11289  *) Change the SSLeay_add_all_*() functions to OpenSSL_add_all_*() and
11290     include a #define from the old name to the new. The original intent
11291     was that statically linked binaries could for example just call
11292     SSLeay_add_all_ciphers() to just add ciphers to the table and not
11293     link with digests. This never worked because SSLeay_add_all_digests()
11294     and SSLeay_add_all_ciphers() were in the same source file so calling
11295     one would link with the other. They are now in separate source files.
11296     [Steve Henson]
11297
11298  *) Add a new -notext option to 'ca' and a -pubkey option to 'spkac'.
11299     [Steve Henson]
11300
11301  *) Use a less unusual form of the Miller-Rabin primality test (it used
11302     a binary algorithm for exponentiation integrated into the Miller-Rabin
11303     loop, our standard modexp algorithms are faster).
11304     [Bodo Moeller]
11305
11306  *) Support for the EBCDIC character set completed.
11307     [Martin Kraemer <Martin.Kraemer@Mch.SNI.De>]
11308
11309  *) Source code cleanups: use const where appropriate, eliminate casts,
11310     use void * instead of char * in lhash.
11311     [Ulf Möller]
11312
11313  *) Bugfix: ssl3_send_server_key_exchange was not restartable
11314     (the state was not changed to SSL3_ST_SW_KEY_EXCH_B, and because of
11315     this the server could overwrite ephemeral keys that the client
11316     has already seen).
11317     [Bodo Moeller]
11318
11319  *) Turn DSA_is_prime into a macro that calls BN_is_prime,
11320     using 50 iterations of the Rabin-Miller test.
11321
11322     DSA_generate_parameters now uses BN_is_prime_fasttest (with 50
11323     iterations of the Rabin-Miller test as required by the appendix
11324     to FIPS PUB 186[-1]) instead of DSA_is_prime.
11325     As BN_is_prime_fasttest includes trial division, DSA parameter
11326     generation becomes much faster.
11327
11328     This implies a change for the callback functions in DSA_is_prime
11329     and DSA_generate_parameters: The callback function is called once
11330     for each positive witness in the Rabin-Miller test, not just
11331     occasionally in the inner loop; and the parameters to the
11332     callback function now provide an iteration count for the outer
11333     loop rather than for the current invocation of the inner loop.
11334     DSA_generate_parameters additionally can call the callback
11335     function with an 'iteration count' of -1, meaning that a
11336     candidate has passed the trial division test (when q is generated
11337     from an application-provided seed, trial division is skipped).
11338     [Bodo Moeller]
11339
11340  *) New function BN_is_prime_fasttest that optionally does trial
11341     division before starting the Rabin-Miller test and has
11342     an additional BN_CTX * argument (whereas BN_is_prime always
11343     has to allocate at least one BN_CTX).
11344     'callback(1, -1, cb_arg)' is called when a number has passed the
11345     trial division stage.
11346     [Bodo Moeller]
11347
11348  *) Fix for bug in CRL encoding. The validity dates weren't being handled
11349     as ASN1_TIME.
11350     [Steve Henson]
11351
11352  *) New -pkcs12 option to CA.pl script to write out a PKCS#12 file.
11353     [Steve Henson]
11354
11355  *) New function BN_pseudo_rand().
11356     [Ulf Möller]
11357
11358  *) Clean up BN_mod_mul_montgomery(): replace the broken (and unreadable)
11359     bignum version of BN_from_montgomery() with the working code from
11360     SSLeay 0.9.0 (the word based version is faster anyway), and clean up
11361     the comments.
11362     [Ulf Möller]
11363
11364  *) Avoid a race condition in s2_clnt.c (function get_server_hello) that
11365     made it impossible to use the same SSL_SESSION data structure in
11366     SSL2 clients in multiple threads.
11367     [Bodo Moeller]
11368
11369  *) The return value of RAND_load_file() no longer counts bytes obtained
11370     by stat().  RAND_load_file(..., -1) is new and uses the complete file
11371     to seed the PRNG (previously an explicit byte count was required).
11372     [Ulf Möller, Bodo Möller]
11373
11374  *) Clean up CRYPTO_EX_DATA functions, some of these didn't have prototypes
11375     used (char *) instead of (void *) and had casts all over the place.
11376     [Steve Henson]
11377
11378  *) Make BN_generate_prime() return NULL on error if ret!=NULL.
11379     [Ulf Möller]
11380
11381  *) Retain source code compatibility for BN_prime_checks macro:
11382     BN_is_prime(..., BN_prime_checks, ...) now uses
11383     BN_prime_checks_for_size to determine the appropriate number of
11384     Rabin-Miller iterations.
11385     [Ulf Möller]
11386
11387  *) Diffie-Hellman uses "safe" primes: DH_check() return code renamed to
11388     DH_CHECK_P_NOT_SAFE_PRIME.
11389     (Check if this is true? OpenPGP calls them "strong".)
11390     [Ulf Möller]
11391
11392  *) Merge the functionality of "dh" and "gendh" programs into a new program
11393     "dhparam". The old programs are retained for now but will handle DH keys
11394     (instead of parameters) in future.
11395     [Steve Henson]
11396
11397  *) Make the ciphers, s_server and s_client programs check the return values
11398     when a new cipher list is set.
11399     [Steve Henson]
11400
11401  *) Enhance the SSL/TLS cipher mechanism to correctly handle the TLS 56bit
11402     ciphers. Before when the 56bit ciphers were enabled the sorting was
11403     wrong.
11404
11405     The syntax for the cipher sorting has been extended to support sorting by
11406     cipher-strength (using the strength_bits hard coded in the tables).
11407     The new command is "@STRENGTH" (see also doc/apps/ciphers.pod).
11408
11409     Fix a bug in the cipher-command parser: when supplying a cipher command
11410     string with an "undefined" symbol (neither command nor alphanumeric
11411     [A-Za-z0-9], ssl_set_cipher_list used to hang in an endless loop. Now
11412     an error is flagged.
11413
11414     Due to the strength-sorting extension, the code of the
11415     ssl_create_cipher_list() function was completely rearranged. I hope that
11416     the readability was also increased :-)
11417     [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE>]
11418
11419  *) Minor change to 'x509' utility. The -CAcreateserial option now uses 1
11420     for the first serial number and places 2 in the serial number file. This
11421     avoids problems when the root CA is created with serial number zero and
11422     the first user certificate has the same issuer name and serial number
11423     as the root CA.
11424     [Steve Henson]
11425
11426  *) Fixes to X509_ATTRIBUTE utilities, change the 'req' program so it uses
11427     the new code. Add documentation for this stuff.
11428     [Steve Henson]
11429
11430  *) Changes to X509_ATTRIBUTE utilities. These have been renamed from
11431     X509_*() to X509at_*() on the grounds that they don't handle X509
11432     structures and behave in an analogous way to the X509v3 functions:
11433     they shouldn't be called directly but wrapper functions should be used
11434     instead.
11435
11436     So we also now have some wrapper functions that call the X509at functions
11437     when passed certificate requests. (TO DO: similar things can be done with
11438     PKCS#7 signed and unsigned attributes, PKCS#12 attributes and a few other
11439     things. Some of these need some d2i or i2d and print functionality
11440     because they handle more complex structures.)
11441     [Steve Henson]
11442
11443  *) Add missing #ifndefs that caused missing symbols when building libssl
11444     as a shared library without RSA.  Use #ifndef NO_SSL2 instead of
11445     NO_RSA in ssl/s2*.c.
11446     [Kris Kennaway <kris@hub.freebsd.org>, modified by Ulf Möller]
11447
11448  *) Precautions against using the PRNG uninitialized: RAND_bytes() now
11449     has a return value which indicates the quality of the random data
11450     (1 = ok, 0 = not seeded).  Also an error is recorded on the thread's
11451     error queue. New function RAND_pseudo_bytes() generates output that is
11452     guaranteed to be unique but not unpredictable. RAND_add is like
11453     RAND_seed, but takes an extra argument for an entropy estimate
11454     (RAND_seed always assumes full entropy).
11455     [Ulf Möller]
11456
11457  *) Do more iterations of Rabin-Miller probable prime test (specifically,
11458     3 for 1024-bit primes, 6 for 512-bit primes, 12 for 256-bit primes
11459     instead of only 2 for all lengths; see BN_prime_checks_for_size definition
11460     in crypto/bn/bn_prime.c for the complete table).  This guarantees a
11461     false-positive rate of at most 2^-80 for random input.
11462     [Bodo Moeller]
11463
11464  *) Rewrite ssl3_read_n (ssl/s3_pkt.c) avoiding a couple of bugs.
11465     [Bodo Moeller]
11466
11467  *) New function X509_CTX_rget_chain() (renamed to X509_CTX_get1_chain
11468     in the 0.9.5 release), this returns the chain
11469     from an X509_CTX structure with a dup of the stack and all
11470     the X509 reference counts upped: so the stack will exist
11471     after X509_CTX_cleanup() has been called. Modify pkcs12.c
11472     to use this.
11473
11474     Also make SSL_SESSION_print() print out the verify return
11475     code.
11476     [Steve Henson]
11477
11478  *) Add manpage for the pkcs12 command. Also change the default
11479     behaviour so MAC iteration counts are used unless the new
11480     -nomaciter option is used. This improves file security and
11481     only older versions of MSIE (4.0 for example) need it.
11482     [Steve Henson]
11483
11484  *) Honor the no-xxx Configure options when creating .DEF files.
11485     [Ulf Möller]
11486
11487  *) Add PKCS#10 attributes to field table: challengePassword,
11488     unstructuredName and unstructuredAddress. These are taken from
11489     draft PKCS#9 v2.0 but are compatible with v1.2 provided no
11490     international characters are used.
11491
11492     More changes to X509_ATTRIBUTE code: allow the setting of types
11493     based on strings. Remove the 'loc' parameter when adding
11494     attributes because these will be a SET OF encoding which is sorted
11495     in ASN1 order.
11496     [Steve Henson]
11497
11498  *) Initial changes to the 'req' utility to allow request generation
11499     automation. This will allow an application to just generate a template
11500     file containing all the field values and have req construct the
11501     request.
11502
11503     Initial support for X509_ATTRIBUTE handling. Stacks of these are
11504     used all over the place including certificate requests and PKCS#7
11505     structures. They are currently handled manually where necessary with
11506     some primitive wrappers for PKCS#7. The new functions behave in a
11507     manner analogous to the X509 extension functions: they allow
11508     attributes to be looked up by NID and added.
11509
11510     Later something similar to the X509V3 code would be desirable to
11511     automatically handle the encoding, decoding and printing of the
11512     more complex types. The string types like challengePassword can
11513     be handled by the string table functions.
11514
11515     Also modified the multi byte string table handling. Now there is
11516     a 'global mask' which masks out certain types. The table itself
11517     can use the flag STABLE_NO_MASK to ignore the mask setting: this
11518     is useful when for example there is only one permissible type
11519     (as in countryName) and using the mask might result in no valid
11520     types at all.
11521     [Steve Henson]
11522
11523  *) Clean up 'Finished' handling, and add functions SSL_get_finished and
11524     SSL_get_peer_finished to allow applications to obtain the latest
11525     Finished messages sent to the peer or expected from the peer,
11526     respectively.  (SSL_get_peer_finished is usually the Finished message
11527     actually received from the peer, otherwise the protocol will be aborted.)
11528
11529     As the Finished message are message digests of the complete handshake
11530     (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can
11531     be used for external authentication procedures when the authentication
11532     provided by SSL/TLS is not desired or is not enough.
11533     [Bodo Moeller]
11534
11535  *) Enhanced support for Alpha Linux is added. Now ./config checks if
11536     the host supports BWX extension and if Compaq C is present on the
11537     $PATH. Just exploiting of the BWX extension results in 20-30%
11538     performance kick for some algorithms, e.g. DES and RC4 to mention
11539     a couple. Compaq C in turn generates ~20% faster code for MD5 and
11540     SHA1.
11541     [Andy Polyakov]
11542
11543  *) Add support for MS "fast SGC". This is arguably a violation of the
11544     SSL3/TLS protocol. Netscape SGC does two handshakes: the first with
11545     weak crypto and after checking the certificate is SGC a second one
11546     with strong crypto. MS SGC stops the first handshake after receiving
11547     the server certificate message and sends a second client hello. Since
11548     a server will typically do all the time consuming operations before
11549     expecting any further messages from the client (server key exchange
11550     is the most expensive) there is little difference between the two.
11551
11552     To get OpenSSL to support MS SGC we have to permit a second client
11553     hello message after we have sent server done. In addition we have to
11554     reset the MAC if we do get this second client hello.
11555     [Steve Henson]
11556
11557  *) Add a function 'd2i_AutoPrivateKey()' this will automatically decide
11558     if a DER encoded private key is RSA or DSA traditional format. Changed
11559     d2i_PrivateKey_bio() to use it. This is only needed for the "traditional"
11560     format DER encoded private key. Newer code should use PKCS#8 format which
11561     has the key type encoded in the ASN1 structure. Added DER private key
11562     support to pkcs8 application.
11563     [Steve Henson]
11564
11565  *) SSL 3/TLS 1 servers now don't request certificates when an anonymous
11566     ciphersuites has been selected (as required by the SSL 3/TLS 1
11567     specifications).  Exception: When SSL_VERIFY_FAIL_IF_NO_PEER_CERT
11568     is set, we interpret this as a request to violate the specification
11569     (the worst that can happen is a handshake failure, and 'correct'
11570     behaviour would result in a handshake failure anyway).
11571     [Bodo Moeller]
11572
11573  *) In SSL_CTX_add_session, take into account that there might be multiple
11574     SSL_SESSION structures with the same session ID (e.g. when two threads
11575     concurrently obtain them from an external cache).
11576     The internal cache can handle only one SSL_SESSION with a given ID,
11577     so if there's a conflict, we now throw out the old one to achieve
11578     consistency.
11579     [Bodo Moeller]
11580
11581  *) Add OIDs for idea and blowfish in CBC mode. This will allow both
11582     to be used in PKCS#5 v2.0 and S/MIME.  Also add checking to
11583     some routines that use cipher OIDs: some ciphers do not have OIDs
11584     defined and so they cannot be used for S/MIME and PKCS#5 v2.0 for
11585     example.
11586     [Steve Henson]
11587
11588  *) Simplify the trust setting structure and code. Now we just have
11589     two sequences of OIDs for trusted and rejected settings. These will
11590     typically have values the same as the extended key usage extension
11591     and any application specific purposes.
11592
11593     The trust checking code now has a default behaviour: it will just
11594     check for an object with the same NID as the passed id. Functions can
11595     be provided to override either the default behaviour or the behaviour
11596     for a given id. SSL client, server and email already have functions
11597     in place for compatibility: they check the NID and also return "trusted"
11598     if the certificate is self signed.
11599     [Steve Henson]
11600
11601  *) Add d2i,i2d bio/fp functions for PrivateKey: these convert the
11602     traditional format into an EVP_PKEY structure.
11603     [Steve Henson]
11604
11605  *) Add a password callback function PEM_cb() which either prompts for
11606     a password if usr_data is NULL or otherwise assumes it is a null
11607     terminated password. Allow passwords to be passed on command line
11608     environment or config files in a few more utilities.
11609     [Steve Henson]
11610
11611  *) Add a bunch of DER and PEM functions to handle PKCS#8 format private
11612     keys. Add some short names for PKCS#8 PBE algorithms and allow them
11613     to be specified on the command line for the pkcs8 and pkcs12 utilities.
11614     Update documentation.
11615     [Steve Henson]
11616
11617  *) Support for ASN1 "NULL" type. This could be handled before by using
11618     ASN1_TYPE but there wasn't any function that would try to read a NULL
11619     and produce an error if it couldn't. For compatibility we also have
11620     ASN1_NULL_new() and ASN1_NULL_free() functions but these are faked and
11621     don't allocate anything because they don't need to.
11622     [Steve Henson]
11623
11624  *) Initial support for MacOS is now provided. Examine INSTALL.MacOS
11625     for details.
11626     [Andy Polyakov, Roy Woods <roy@centicsystems.ca>]
11627
11628  *) Rebuild of the memory allocation routines used by OpenSSL code and
11629     possibly others as well.  The purpose is to make an interface that
11630     provide hooks so anyone can build a separate set of allocation and
11631     deallocation routines to be used by OpenSSL, for example memory
11632     pool implementations, or something else, which was previously hard
11633     since Malloc(), Realloc() and Free() were defined as macros having
11634     the values malloc, realloc and free, respectively (except for Win32
11635     compilations).  The same is provided for memory debugging code.
11636     OpenSSL already comes with functionality to find memory leaks, but
11637     this gives people a chance to debug other memory problems.
11638
11639     With these changes, a new set of functions and macros have appeared:
11640
11641       CRYPTO_set_mem_debug_functions()         [F]
11642       CRYPTO_get_mem_debug_functions()         [F]
11643       CRYPTO_dbg_set_options()                 [F]
11644       CRYPTO_dbg_get_options()                 [F]
11645       CRYPTO_malloc_debug_init()               [M]
11646
11647     The memory debug functions are NULL by default, unless the library
11648     is compiled with CRYPTO_MDEBUG or friends is defined.  If someone
11649     wants to debug memory anyway, CRYPTO_malloc_debug_init() (which
11650     gives the standard debugging functions that come with OpenSSL) or
11651     CRYPTO_set_mem_debug_functions() (tells OpenSSL to use functions
11652     provided by the library user) must be used.  When the standard
11653     debugging functions are used, CRYPTO_dbg_set_options can be used to
11654     request additional information:
11655     CRYPTO_dbg_set_options(V_CYRPTO_MDEBUG_xxx) corresponds to setting
11656     the CRYPTO_MDEBUG_xxx macro when compiling the library.
11657
11658     Also, things like CRYPTO_set_mem_functions will always give the
11659     expected result (the new set of functions is used for allocation
11660     and deallocation) at all times, regardless of platform and compiler
11661     options.
11662
11663     To finish it up, some functions that were never use in any other
11664     way than through macros have a new API and new semantic:
11665
11666       CRYPTO_dbg_malloc()
11667       CRYPTO_dbg_realloc()
11668       CRYPTO_dbg_free()
11669
11670     All macros of value have retained their old syntax.
11671     [Richard Levitte and Bodo Moeller]
11672
11673  *) Some S/MIME fixes. The OID for SMIMECapabilities was wrong, the
11674     ordering of SMIMECapabilities wasn't in "strength order" and there
11675     was a missing NULL in the AlgorithmIdentifier for the SHA1 signature
11676     algorithm.
11677     [Steve Henson]
11678
11679  *) Some ASN1 types with illegal zero length encoding (INTEGER,
11680     ENUMERATED and OBJECT IDENTIFIER) choked the ASN1 routines.
11681     [Frans Heymans <fheymans@isaserver.be>, modified by Steve Henson]
11682
11683  *) Merge in my S/MIME library for OpenSSL. This provides a simple
11684     S/MIME API on top of the PKCS#7 code, a MIME parser (with enough
11685     functionality to handle multipart/signed properly) and a utility
11686     called 'smime' to call all this stuff. This is based on code I
11687     originally wrote for Celo who have kindly allowed it to be
11688     included in OpenSSL.
11689     [Steve Henson]
11690
11691  *) Add variants des_set_key_checked and des_set_key_unchecked of
11692     des_set_key (aka des_key_sched).  Global variable des_check_key
11693     decides which of these is called by des_set_key; this way
11694     des_check_key behaves as it always did, but applications and
11695     the library itself, which was buggy for des_check_key == 1,
11696     have a cleaner way to pick the version they need.
11697     [Bodo Moeller]
11698
11699  *) New function PKCS12_newpass() which changes the password of a
11700     PKCS12 structure.
11701     [Steve Henson]
11702
11703  *) Modify X509_TRUST and X509_PURPOSE so it also uses a static and
11704     dynamic mix. In both cases the ids can be used as an index into the
11705     table. Also modified the X509_TRUST_add() and X509_PURPOSE_add()
11706     functions so they accept a list of the field values and the
11707     application doesn't need to directly manipulate the X509_TRUST
11708     structure.
11709     [Steve Henson]
11710
11711  *) Modify the ASN1_STRING_TABLE stuff so it also uses bsearch and doesn't
11712     need initialising.
11713     [Steve Henson]
11714
11715  *) Modify the way the V3 extension code looks up extensions. This now
11716     works in a similar way to the object code: we have some "standard"
11717     extensions in a static table which is searched with OBJ_bsearch()
11718     and the application can add dynamic ones if needed. The file
11719     crypto/x509v3/ext_dat.h now has the info: this file needs to be
11720     updated whenever a new extension is added to the core code and kept
11721     in ext_nid order. There is a simple program 'tabtest.c' which checks
11722     this. New extensions are not added too often so this file can readily
11723     be maintained manually.
11724
11725     There are two big advantages in doing things this way. The extensions
11726     can be looked up immediately and no longer need to be "added" using
11727     X509V3_add_standard_extensions(): this function now does nothing.
11728     [Side note: I get *lots* of email saying the extension code doesn't
11729      work because people forget to call this function]
11730     Also no dynamic allocation is done unless new extensions are added:
11731     so if we don't add custom extensions there is no need to call
11732     X509V3_EXT_cleanup().
11733     [Steve Henson]
11734
11735  *) Modify enc utility's salting as follows: make salting the default. Add a
11736     magic header, so unsalted files fail gracefully instead of just decrypting
11737     to garbage. This is because not salting is a big security hole, so people
11738     should be discouraged from doing it.
11739     [Ben Laurie]
11740
11741  *) Fixes and enhancements to the 'x509' utility. It allowed a message
11742     digest to be passed on the command line but it only used this
11743     parameter when signing a certificate. Modified so all relevant
11744     operations are affected by the digest parameter including the
11745     -fingerprint and -x509toreq options. Also -x509toreq choked if a
11746     DSA key was used because it didn't fix the digest.
11747     [Steve Henson]
11748
11749  *) Initial certificate chain verify code. Currently tests the untrusted
11750     certificates for consistency with the verify purpose (which is set
11751     when the X509_STORE_CTX structure is set up) and checks the pathlength.
11752
11753     There is a NO_CHAIN_VERIFY compilation option to keep the old behaviour:
11754     this is because it will reject chains with invalid extensions whereas
11755     every previous version of OpenSSL and SSLeay made no checks at all.
11756
11757     Trust code: checks the root CA for the relevant trust settings. Trust
11758     settings have an initial value consistent with the verify purpose: e.g.
11759     if the verify purpose is for SSL client use it expects the CA to be
11760     trusted for SSL client use. However the default value can be changed to
11761     permit custom trust settings: one example of this would be to only trust
11762     certificates from a specific "secure" set of CAs.
11763
11764     Also added X509_STORE_CTX_new() and X509_STORE_CTX_free() functions
11765     which should be used for version portability: especially since the
11766     verify structure is likely to change more often now.
11767
11768     SSL integration. Add purpose and trust to SSL_CTX and SSL and functions
11769     to set them. If not set then assume SSL clients will verify SSL servers
11770     and vice versa.
11771
11772     Two new options to the verify program: -untrusted allows a set of
11773     untrusted certificates to be passed in and -purpose which sets the
11774     intended purpose of the certificate. If a purpose is set then the
11775     new chain verify code is used to check extension consistency.
11776     [Steve Henson]
11777
11778  *) Support for the authority information access extension.
11779     [Steve Henson]
11780
11781  *) Modify RSA and DSA PEM read routines to transparently handle
11782     PKCS#8 format private keys. New *_PUBKEY_* functions that handle
11783     public keys in a format compatible with certificate
11784     SubjectPublicKeyInfo structures. Unfortunately there were already
11785     functions called *_PublicKey_* which used various odd formats so
11786     these are retained for compatibility: however the DSA variants were
11787     never in a public release so they have been deleted. Changed dsa/rsa
11788     utilities to handle the new format: note no releases ever handled public
11789     keys so we should be OK.
11790
11791     The primary motivation for this change is to avoid the same fiasco
11792     that dogs private keys: there are several incompatible private key
11793     formats some of which are standard and some OpenSSL specific and
11794     require various evil hacks to allow partial transparent handling and
11795     even then it doesn't work with DER formats. Given the option anything
11796     other than PKCS#8 should be dumped: but the other formats have to
11797     stay in the name of compatibility.
11798
11799     With public keys and the benefit of hindsight one standard format
11800     is used which works with EVP_PKEY, RSA or DSA structures: though
11801     it clearly returns an error if you try to read the wrong kind of key.
11802
11803     Added a -pubkey option to the 'x509' utility to output the public key.
11804     Also rename the EVP_PKEY_get_*() to EVP_PKEY_rget_*()
11805     (renamed to EVP_PKEY_get1_*() in the OpenSSL 0.9.5 release) and add
11806     EVP_PKEY_rset_*() functions (renamed to EVP_PKEY_set1_*())
11807     that do the same as the EVP_PKEY_assign_*() except they up the
11808     reference count of the added key (they don't "swallow" the
11809     supplied key).
11810     [Steve Henson]
11811
11812  *) Fixes to crypto/x509/by_file.c the code to read in certificates and
11813     CRLs would fail if the file contained no certificates or no CRLs:
11814     added a new function to read in both types and return the number
11815     read: this means that if none are read it will be an error. The
11816     DER versions of the certificate and CRL reader would always fail
11817     because it isn't possible to mix certificates and CRLs in DER format
11818     without choking one or the other routine. Changed this to just read
11819     a certificate: this is the best we can do. Also modified the code
11820     in apps/verify.c to take notice of return codes: it was previously
11821     attempting to read in certificates from NULL pointers and ignoring
11822     any errors: this is one reason why the cert and CRL reader seemed
11823     to work. It doesn't check return codes from the default certificate
11824     routines: these may well fail if the certificates aren't installed.
11825     [Steve Henson]
11826
11827  *) Code to support otherName option in GeneralName.
11828     [Steve Henson]
11829
11830  *) First update to verify code. Change the verify utility
11831     so it warns if it is passed a self signed certificate:
11832     for consistency with the normal behaviour. X509_verify
11833     has been modified to it will now verify a self signed
11834     certificate if *exactly* the same certificate appears
11835     in the store: it was previously impossible to trust a
11836     single self signed certificate. This means that:
11837     openssl verify ss.pem
11838     now gives a warning about a self signed certificate but
11839     openssl verify -CAfile ss.pem ss.pem
11840     is OK.
11841     [Steve Henson]
11842
11843  *) For servers, store verify_result in SSL_SESSION data structure
11844     (and add it to external session representation).
11845     This is needed when client certificate verifications fails,
11846     but an application-provided verification callback (set by
11847     SSL_CTX_set_cert_verify_callback) allows accepting the session
11848     anyway (i.e. leaves x509_store_ctx->error != X509_V_OK
11849     but returns 1): When the session is reused, we have to set
11850     ssl->verify_result to the appropriate error code to avoid
11851     security holes.
11852     [Bodo Moeller, problem pointed out by Lutz Jaenicke]
11853
11854  *) Fix a bug in the new PKCS#7 code: it didn't consider the
11855     case in PKCS7_dataInit() where the signed PKCS7 structure
11856     didn't contain any existing data because it was being created.
11857     [Po-Cheng Chen <pocheng@nst.com.tw>, slightly modified by Steve Henson]
11858
11859  *) Add a salt to the key derivation routines in enc.c. This
11860     forms the first 8 bytes of the encrypted file. Also add a
11861     -S option to allow a salt to be input on the command line.
11862     [Steve Henson]
11863
11864  *) New function X509_cmp(). Oddly enough there wasn't a function
11865     to compare two certificates. We do this by working out the SHA1
11866     hash and comparing that. X509_cmp() will be needed by the trust
11867     code.
11868     [Steve Henson]
11869
11870  *) SSL_get1_session() is like SSL_get_session(), but increments
11871     the reference count in the SSL_SESSION returned.
11872     [Geoff Thorpe <geoff@eu.c2.net>]
11873
11874  *) Fix for 'req': it was adding a null to request attributes.
11875     Also change the X509_LOOKUP and X509_INFO code to handle
11876     certificate auxiliary information.
11877     [Steve Henson]
11878
11879  *) Add support for 40 and 64 bit RC2 and RC4 algorithms: document
11880     the 'enc' command.
11881     [Steve Henson]
11882
11883  *) Add the possibility to add extra information to the memory leak
11884     detecting output, to form tracebacks, showing from where each
11885     allocation was originated: CRYPTO_push_info("constant string") adds
11886     the string plus current file name and line number to a per-thread
11887     stack, CRYPTO_pop_info() does the obvious, CRYPTO_remove_all_info()
11888     is like calling CYRPTO_pop_info() until the stack is empty.
11889     Also updated memory leak detection code to be multi-thread-safe.
11890     [Richard Levitte]
11891
11892  *) Add options -text and -noout to pkcs7 utility and delete the
11893     encryption options which never did anything. Update docs.
11894     [Steve Henson]
11895
11896  *) Add options to some of the utilities to allow the pass phrase
11897     to be included on either the command line (not recommended on
11898     OSes like Unix) or read from the environment. Update the
11899     manpages and fix a few bugs.
11900     [Steve Henson]
11901
11902  *) Add a few manpages for some of the openssl commands.
11903     [Steve Henson]
11904
11905  *) Fix the -revoke option in ca. It was freeing up memory twice,
11906     leaking and not finding already revoked certificates.
11907     [Steve Henson]
11908
11909  *) Extensive changes to support certificate auxiliary information.
11910     This involves the use of X509_CERT_AUX structure and X509_AUX
11911     functions. An X509_AUX function such as PEM_read_X509_AUX()
11912     can still read in a certificate file in the usual way but it
11913     will also read in any additional "auxiliary information". By
11914     doing things this way a fair degree of compatibility can be
11915     retained: existing certificates can have this information added
11916     using the new 'x509' options.
11917
11918     Current auxiliary information includes an "alias" and some trust
11919     settings. The trust settings will ultimately be used in enhanced
11920     certificate chain verification routines: currently a certificate
11921     can only be trusted if it is self signed and then it is trusted
11922     for all purposes.
11923     [Steve Henson]
11924
11925  *) Fix assembler for Alpha (tested only on DEC OSF not Linux or *BSD).
11926     The problem was that one of the replacement routines had not been working
11927     since SSLeay releases.  For now the offending routine has been replaced
11928     with non-optimised assembler.  Even so, this now gives around 95%
11929     performance improvement for 1024 bit RSA signs.
11930     [Mark Cox]
11931
11932  *) Hack to fix PKCS#7 decryption when used with some unorthodox RC2
11933     handling. Most clients have the effective key size in bits equal to
11934     the key length in bits: so a 40 bit RC2 key uses a 40 bit (5 byte) key.
11935     A few however don't do this and instead use the size of the decrypted key
11936     to determine the RC2 key length and the AlgorithmIdentifier to determine
11937     the effective key length. In this case the effective key length can still
11938     be 40 bits but the key length can be 168 bits for example. This is fixed
11939     by manually forcing an RC2 key into the EVP_PKEY structure because the
11940     EVP code can't currently handle unusual RC2 key sizes: it always assumes
11941     the key length and effective key length are equal.
11942     [Steve Henson]
11943
11944  *) Add a bunch of functions that should simplify the creation of
11945     X509_NAME structures. Now you should be able to do:
11946     X509_NAME_add_entry_by_txt(nm, "CN", MBSTRING_ASC, "Steve", -1, -1, 0);
11947     and have it automatically work out the correct field type and fill in
11948     the structures. The more adventurous can try:
11949     X509_NAME_add_entry_by_txt(nm, field, MBSTRING_UTF8, str, -1, -1, 0);
11950     and it will (hopefully) work out the correct multibyte encoding.
11951     [Steve Henson]
11952
11953  *) Change the 'req' utility to use the new field handling and multibyte
11954     copy routines. Before the DN field creation was handled in an ad hoc
11955     way in req, ca, and x509 which was rather broken and didn't support
11956     BMPStrings or UTF8Strings. Since some software doesn't implement
11957     BMPStrings or UTF8Strings yet, they can be enabled using the config file
11958     using the dirstring_type option. See the new comment in the default
11959     openssl.cnf for more info.
11960     [Steve Henson]
11961
11962  *) Make crypto/rand/md_rand.c more robust:
11963     - Assure unique random numbers after fork().
11964     - Make sure that concurrent threads access the global counter and
11965       md serializably so that we never lose entropy in them
11966       or use exactly the same state in multiple threads.
11967       Access to the large state is not always serializable because
11968       the additional locking could be a performance killer, and
11969       md should be large enough anyway.
11970     [Bodo Moeller]
11971
11972  *) New file apps/app_rand.c with commonly needed functionality
11973     for handling the random seed file.
11974
11975     Use the random seed file in some applications that previously did not:
11976          ca,
11977          dsaparam -genkey (which also ignored its '-rand' option),
11978          s_client,
11979          s_server,
11980          x509 (when signing).
11981     Except on systems with /dev/urandom, it is crucial to have a random
11982     seed file at least for key creation, DSA signing, and for DH exchanges;
11983     for RSA signatures we could do without one.
11984
11985     gendh and gendsa (unlike genrsa) used to read only the first byte
11986     of each file listed in the '-rand' option.  The function as previously
11987     found in genrsa is now in app_rand.c and is used by all programs
11988     that support '-rand'.
11989     [Bodo Moeller]
11990
11991  *) In RAND_write_file, use mode 0600 for creating files;
11992     don't just chmod when it may be too late.
11993     [Bodo Moeller]
11994
11995  *) Report an error from X509_STORE_load_locations
11996     when X509_LOOKUP_load_file or X509_LOOKUP_add_dir failed.
11997     [Bill Perry]
11998
11999  *) New function ASN1_mbstring_copy() this copies a string in either
12000     ASCII, Unicode, Universal (4 bytes per character) or UTF8 format
12001     into an ASN1_STRING type. A mask of permissible types is passed
12002     and it chooses the "minimal" type to use or an error if not type
12003     is suitable.
12004     [Steve Henson]
12005
12006  *) Add function equivalents to the various macros in asn1.h. The old
12007     macros are retained with an M_ prefix. Code inside the library can
12008     use the M_ macros. External code (including the openssl utility)
12009     should *NOT* in order to be "shared library friendly".
12010     [Steve Henson]
12011
12012  *) Add various functions that can check a certificate's extensions
12013     to see if it usable for various purposes such as SSL client,
12014     server or S/MIME and CAs of these types. This is currently
12015     VERY EXPERIMENTAL but will ultimately be used for certificate chain
12016     verification. Also added a -purpose flag to x509 utility to
12017     print out all the purposes.
12018     [Steve Henson]
12019
12020  *) Add a CRYPTO_EX_DATA to X509 certificate structure and associated
12021     functions.
12022     [Steve Henson]
12023
12024  *) New X509V3_{X509,CRL,REVOKED}_get_d2i() functions. These will search
12025     for, obtain and decode and extension and obtain its critical flag.
12026     This allows all the necessary extension code to be handled in a
12027     single function call.
12028     [Steve Henson]
12029
12030  *) RC4 tune-up featuring 30-40% performance improvement on most RISC
12031     platforms. See crypto/rc4/rc4_enc.c for further details.
12032     [Andy Polyakov]
12033
12034  *) New -noout option to asn1parse. This causes no output to be produced
12035     its main use is when combined with -strparse and -out to extract data
12036     from a file (which may not be in ASN.1 format).
12037     [Steve Henson]
12038
12039  *) Fix for pkcs12 program. It was hashing an invalid certificate pointer
12040     when producing the local key id.
12041     [Richard Levitte <levitte@stacken.kth.se>]
12042
12043  *) New option -dhparam in s_server. This allows a DH parameter file to be
12044     stated explicitly. If it is not stated then it tries the first server
12045     certificate file. The previous behaviour hard coded the filename
12046     "server.pem".
12047     [Steve Henson]
12048
12049  *) Add -pubin and -pubout options to the rsa and dsa commands. These allow
12050     a public key to be input or output. For example:
12051     openssl rsa -in key.pem -pubout -out pubkey.pem
12052     Also added necessary DSA public key functions to handle this.
12053     [Steve Henson]
12054
12055  *) Fix so PKCS7_dataVerify() doesn't crash if no certificates are contained
12056     in the message. This was handled by allowing
12057     X509_find_by_issuer_and_serial() to tolerate a NULL passed to it.
12058     [Steve Henson, reported by Sampo Kellomaki <sampo@mail.neuronio.pt>]
12059
12060  *) Fix for bug in d2i_ASN1_bytes(): other ASN1 functions add an extra null
12061     to the end of the strings whereas this didn't. This would cause problems
12062     if strings read with d2i_ASN1_bytes() were later modified.
12063     [Steve Henson, reported by Arne Ansper <arne@ats.cyber.ee>]
12064
12065  *) Fix for base64 decode bug. When a base64 bio reads only one line of
12066     data and it contains EOF it will end up returning an error. This is
12067     caused by input 46 bytes long. The cause is due to the way base64
12068     BIOs find the start of base64 encoded data. They do this by trying a
12069     trial decode on each line until they find one that works. When they
12070     do a flag is set and it starts again knowing it can pass all the
12071     data directly through the decoder. Unfortunately it doesn't reset
12072     the context it uses. This means that if EOF is reached an attempt
12073     is made to pass two EOFs through the context and this causes the
12074     resulting error. This can also cause other problems as well. As is
12075     usual with these problems it takes *ages* to find and the fix is
12076     trivial: move one line.
12077     [Steve Henson, reported by ian@uns.ns.ac.yu (Ivan Nejgebauer) ]
12078
12079  *) Ugly workaround to get s_client and s_server working under Windows. The
12080     old code wouldn't work because it needed to select() on sockets and the
12081     tty (for keypresses and to see if data could be written). Win32 only
12082     supports select() on sockets so we select() with a 1s timeout on the
12083     sockets and then see if any characters are waiting to be read, if none
12084     are present then we retry, we also assume we can always write data to
12085     the tty. This isn't nice because the code then blocks until we've
12086     received a complete line of data and it is effectively polling the
12087     keyboard at 1s intervals: however it's quite a bit better than not
12088     working at all :-) A dedicated Windows application might handle this
12089     with an event loop for example.
12090     [Steve Henson]
12091
12092  *) Enhance RSA_METHOD structure. Now there are two extra methods, rsa_sign
12093     and rsa_verify. When the RSA_FLAGS_SIGN_VER option is set these functions
12094     will be called when RSA_sign() and RSA_verify() are used. This is useful
12095     if rsa_pub_dec() and rsa_priv_enc() equivalents are not available.
12096     For this to work properly RSA_public_decrypt() and RSA_private_encrypt()
12097     should *not* be used: RSA_sign() and RSA_verify() must be used instead.
12098     This necessitated the support of an extra signature type NID_md5_sha1
12099     for SSL signatures and modifications to the SSL library to use it instead
12100     of calling RSA_public_decrypt() and RSA_private_encrypt().
12101     [Steve Henson]
12102
12103  *) Add new -verify -CAfile and -CApath options to the crl program, these
12104     will lookup a CRL issuers certificate and verify the signature in a
12105     similar way to the verify program. Tidy up the crl program so it
12106     no longer accesses structures directly. Make the ASN1 CRL parsing a bit
12107     less strict. It will now permit CRL extensions even if it is not
12108     a V2 CRL: this will allow it to tolerate some broken CRLs.
12109     [Steve Henson]
12110
12111  *) Initialize all non-automatic variables each time one of the openssl
12112     sub-programs is started (this is necessary as they may be started
12113     multiple times from the "OpenSSL>" prompt).
12114     [Lennart Bang, Bodo Moeller]
12115
12116  *) Preliminary compilation option RSA_NULL which disables RSA crypto without
12117     removing all other RSA functionality (this is what NO_RSA does). This
12118     is so (for example) those in the US can disable those operations covered
12119     by the RSA patent while allowing storage and parsing of RSA keys and RSA
12120     key generation.
12121     [Steve Henson]
12122
12123  *) Non-copying interface to BIO pairs.
12124     (still largely untested)
12125     [Bodo Moeller]
12126
12127  *) New function ANS1_tag2str() to convert an ASN1 tag to a descriptive
12128     ASCII string. This was handled independently in various places before.
12129     [Steve Henson]
12130
12131  *) New functions UTF8_getc() and UTF8_putc() that parse and generate
12132     UTF8 strings a character at a time.
12133     [Steve Henson]
12134
12135  *) Use client_version from client hello to select the protocol
12136     (s23_srvr.c) and for RSA client key exchange verification
12137     (s3_srvr.c), as required by the SSL 3.0/TLS 1.0 specifications.
12138     [Bodo Moeller]
12139
12140  *) Add various utility functions to handle SPKACs, these were previously
12141     handled by poking round in the structure internals. Added new function
12142     NETSCAPE_SPKI_print() to print out SPKAC and a new utility 'spkac' to
12143     print, verify and generate SPKACs. Based on an original idea from
12144     Massimiliano Pala <madwolf@comune.modena.it> but extensively modified.
12145     [Steve Henson]
12146
12147  *) RIPEMD160 is operational on all platforms and is back in 'make test'.
12148     [Andy Polyakov]
12149
12150  *) Allow the config file extension section to be overwritten on the
12151     command line. Based on an original idea from Massimiliano Pala
12152     <madwolf@comune.modena.it>. The new option is called -extensions
12153     and can be applied to ca, req and x509. Also -reqexts to override
12154     the request extensions in req and -crlexts to override the crl extensions
12155     in ca.
12156     [Steve Henson]
12157
12158  *) Add new feature to the SPKAC handling in ca.  Now you can include
12159     the same field multiple times by preceding it by "XXXX." for example:
12160     1.OU="Unit name 1"
12161     2.OU="Unit name 2"
12162     this is the same syntax as used in the req config file.
12163     [Steve Henson]
12164
12165  *) Allow certificate extensions to be added to certificate requests. These
12166     are specified in a 'req_extensions' option of the req section of the
12167     config file. They can be printed out with the -text option to req but
12168     are otherwise ignored at present.
12169     [Steve Henson]
12170
12171  *) Fix a horrible bug in enc_read() in crypto/evp/bio_enc.c: if the first
12172     data read consists of only the final block it would not decrypted because
12173     EVP_CipherUpdate() would correctly report zero bytes had been decrypted.
12174     A misplaced 'break' also meant the decrypted final block might not be
12175     copied until the next read.
12176     [Steve Henson]
12177
12178  *) Initial support for DH_METHOD. Again based on RSA_METHOD. Also added
12179     a few extra parameters to the DH structure: these will be useful if
12180     for example we want the value of 'q' or implement X9.42 DH.
12181     [Steve Henson]
12182
12183  *) Initial support for DSA_METHOD. This is based on the RSA_METHOD and
12184     provides hooks that allow the default DSA functions or functions on a
12185     "per key" basis to be replaced. This allows hardware acceleration and
12186     hardware key storage to be handled without major modification to the
12187     library. Also added low level modexp hooks and CRYPTO_EX structure and
12188     associated functions.
12189     [Steve Henson]
12190
12191  *) Add a new flag to memory BIOs, BIO_FLAG_MEM_RDONLY. This marks the BIO
12192     as "read only": it can't be written to and the buffer it points to will
12193     not be freed. Reading from a read only BIO is much more efficient than
12194     a normal memory BIO. This was added because there are several times when
12195     an area of memory needs to be read from a BIO. The previous method was
12196     to create a memory BIO and write the data to it, this results in two
12197     copies of the data and an O(n^2) reading algorithm. There is a new
12198     function BIO_new_mem_buf() which creates a read only memory BIO from
12199     an area of memory. Also modified the PKCS#7 routines to use read only
12200     memory BIOs.
12201     [Steve Henson]
12202
12203  *) Bugfix: ssl23_get_client_hello did not work properly when called in
12204     state SSL23_ST_SR_CLNT_HELLO_B, i.e. when the first 7 bytes of
12205     a SSLv2-compatible client hello for SSLv3 or TLSv1 could be read,
12206     but a retry condition occurred while trying to read the rest.
12207     [Bodo Moeller]
12208
12209  *) The PKCS7_ENC_CONTENT_new() function was setting the content type as
12210     NID_pkcs7_encrypted by default: this was wrong since this should almost
12211     always be NID_pkcs7_data. Also modified the PKCS7_set_type() to handle
12212     the encrypted data type: this is a more sensible place to put it and it
12213     allows the PKCS#12 code to be tidied up that duplicated this
12214     functionality.
12215     [Steve Henson]
12216
12217  *) Changed obj_dat.pl script so it takes its input and output files on
12218     the command line. This should avoid shell escape redirection problems
12219     under Win32.
12220     [Steve Henson]
12221
12222  *) Initial support for certificate extension requests, these are included
12223     in things like Xenroll certificate requests. Included functions to allow
12224     extensions to be obtained and added.
12225     [Steve Henson]
12226
12227  *) -crlf option to s_client and s_server for sending newlines as
12228     CRLF (as required by many protocols).
12229     [Bodo Moeller]
12230
12231 Changes between 0.9.3a and 0.9.4  [09 Aug 1999]
12232
12233  *) Install libRSAglue.a when OpenSSL is built with RSAref.
12234     [Ralf S. Engelschall]
12235
12236  *) A few more ``#ifndef NO_FP_API / #endif'' pairs for consistency.
12237     [Andrija Antonijevic <TheAntony2@bigfoot.com>]
12238
12239  *) Fix -startdate and -enddate (which was missing) arguments to 'ca'
12240     program.
12241     [Steve Henson]
12242
12243  *) New function DSA_dup_DH, which duplicates DSA parameters/keys as
12244     DH parameters/keys (q is lost during that conversion, but the resulting
12245     DH parameters contain its length).
12246
12247     For 1024-bit p, DSA_generate_parameters followed by DSA_dup_DH is
12248     much faster than DH_generate_parameters (which creates parameters
12249     where p = 2*q + 1), and also the smaller q makes DH computations
12250     much more efficient (160-bit exponentiation instead of 1024-bit
12251     exponentiation); so this provides a convenient way to support DHE
12252     ciphersuites in SSL/TLS servers (see ssl/ssltest.c).  It is of
12253     utter importance to use
12254         SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
12255     or
12256         SSL_set_options(s_ctx, SSL_OP_SINGLE_DH_USE);
12257     when such DH parameters are used, because otherwise small subgroup
12258     attacks may become possible!
12259     [Bodo Moeller]
12260
12261  *) Avoid memory leak in i2d_DHparams.
12262     [Bodo Moeller]
12263
12264  *) Allow the -k option to be used more than once in the enc program:
12265     this allows the same encrypted message to be read by multiple recipients.
12266     [Steve Henson]
12267
12268  *) New function OBJ_obj2txt(buf, buf_len, a, no_name), this converts
12269     an ASN1_OBJECT to a text string. If the "no_name" parameter is set then
12270     it will always use the numerical form of the OID, even if it has a short
12271     or long name.
12272     [Steve Henson]
12273
12274  *) Added an extra RSA flag: RSA_FLAG_EXT_PKEY. Previously the rsa_mod_exp
12275     method only got called if p,q,dmp1,dmq1,iqmp components were present,
12276     otherwise bn_mod_exp was called. In the case of hardware keys for example
12277     no private key components need be present and it might store extra data
12278     in the RSA structure, which cannot be accessed from bn_mod_exp.
12279     By setting RSA_FLAG_EXT_PKEY rsa_mod_exp will always be called for
12280     private key operations.
12281     [Steve Henson]
12282
12283  *) Added support for SPARC Linux.
12284     [Andy Polyakov]
12285
12286  *) pem_password_cb function type incompatibly changed from
12287          typedef int pem_password_cb(char *buf, int size, int rwflag);
12288     to
12289          ....(char *buf, int size, int rwflag, void *userdata);
12290     so that applications can pass data to their callbacks:
12291     The PEM[_ASN1]_{read,write}... functions and macros now take an
12292     additional void * argument, which is just handed through whenever
12293     the password callback is called.
12294     [Damien Miller <dmiller@ilogic.com.au>; tiny changes by Bodo Moeller]
12295
12296     New function SSL_CTX_set_default_passwd_cb_userdata.
12297
12298     Compatibility note: As many C implementations push function arguments
12299     onto the stack in reverse order, the new library version is likely to
12300     interoperate with programs that have been compiled with the old
12301     pem_password_cb definition (PEM_whatever takes some data that
12302     happens to be on the stack as its last argument, and the callback
12303     just ignores this garbage); but there is no guarantee whatsoever that
12304     this will work.
12305
12306  *) The -DPLATFORM="\"$(PLATFORM)\"" definition and the similar -DCFLAGS=...
12307     (both in crypto/Makefile.ssl for use by crypto/cversion.c) caused
12308     problems not only on Windows, but also on some Unix platforms.
12309     To avoid problematic command lines, these definitions are now in an
12310     auto-generated file crypto/buildinf.h (created by crypto/Makefile.ssl
12311     for standard "make" builds, by util/mk1mf.pl for "mk1mf" builds).
12312     [Bodo Moeller]
12313
12314  *) MIPS III/IV assembler module is reimplemented.
12315     [Andy Polyakov]
12316
12317  *) More DES library cleanups: remove references to srand/rand and
12318     delete an unused file.
12319     [Ulf Möller]
12320
12321  *) Add support for the free Netwide assembler (NASM) under Win32,
12322     since not many people have MASM (ml) and it can be hard to obtain.
12323     This is currently experimental but it seems to work OK and pass all
12324     the tests. Check out INSTALL.W32 for info.
12325     [Steve Henson]
12326
12327  *) Fix memory leaks in s3_clnt.c: All non-anonymous SSL3/TLS1 connections
12328     without temporary keys kept an extra copy of the server key,
12329     and connections with temporary keys did not free everything in case
12330     of an error.
12331     [Bodo Moeller]
12332
12333  *) New function RSA_check_key and new openssl rsa option -check
12334     for verifying the consistency of RSA keys.
12335     [Ulf Moeller, Bodo Moeller]
12336
12337  *) Various changes to make Win32 compile work:
12338     1. Casts to avoid "loss of data" warnings in p5_crpt2.c
12339     2. Change unsigned int to int in b_dump.c to avoid "signed/unsigned
12340        comparison" warnings.
12341     3. Add sk_<TYPE>_sort to DEF file generator and do make update.
12342     [Steve Henson]
12343
12344  *) Add a debugging option to PKCS#5 v2 key generation function: when
12345     you #define DEBUG_PKCS5V2 passwords, salts, iteration counts and
12346     derived keys are printed to stderr.
12347     [Steve Henson]
12348
12349  *) Copy the flags in ASN1_STRING_dup().
12350     [Roman E. Pavlov <pre@mo.msk.ru>]
12351
12352  *) The x509 application mishandled signing requests containing DSA
12353     keys when the signing key was also DSA and the parameters didn't match.
12354
12355     It was supposed to omit the parameters when they matched the signing key:
12356     the verifying software was then supposed to automatically use the CA's
12357     parameters if they were absent from the end user certificate.
12358
12359     Omitting parameters is no longer recommended. The test was also
12360     the wrong way round! This was probably due to unusual behaviour in
12361     EVP_cmp_parameters() which returns 1 if the parameters match.
12362     This meant that parameters were omitted when they *didn't* match and
12363     the certificate was useless. Certificates signed with 'ca' didn't have
12364     this bug.
12365     [Steve Henson, reported by Doug Erickson <Doug.Erickson@Part.NET>]
12366
12367  *) Memory leak checking (-DCRYPTO_MDEBUG) had some problems.
12368     The interface is as follows:
12369     Applications can use
12370         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON) aka MemCheck_start(),
12371         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_OFF) aka MemCheck_stop();
12372     "off" is now the default.
12373     The library internally uses
12374         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE) aka MemCheck_off(),
12375         CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE) aka MemCheck_on()
12376     to disable memory-checking temporarily.
12377
12378     Some inconsistent states that previously were possible (and were
12379     even the default) are now avoided.
12380
12381     -DCRYPTO_MDEBUG_TIME is new and additionally stores the current time
12382     with each memory chunk allocated; this is occasionally more helpful
12383     than just having a counter.
12384
12385     -DCRYPTO_MDEBUG_THREAD is also new and adds the thread ID.
12386
12387     -DCRYPTO_MDEBUG_ALL enables all of the above, plus any future
12388     extensions.
12389     [Bodo Moeller]
12390
12391  *) Introduce "mode" for SSL structures (with defaults in SSL_CTX),
12392     which largely parallels "options", but is for changing API behaviour,
12393     whereas "options" are about protocol behaviour.
12394     Initial "mode" flags are:
12395
12396     SSL_MODE_ENABLE_PARTIAL_WRITE   Allow SSL_write to report success when
12397                                     a single record has been written.
12398     SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER  Don't insist that SSL_write
12399                                     retries use the same buffer location.
12400                                     (But all of the contents must be
12401                                     copied!)
12402     [Bodo Moeller]
12403
12404  *) Bugfix: SSL_set_options ignored its parameter, only SSL_CTX_set_options
12405     worked.
12406
12407  *) Fix problems with no-hmac etc.
12408     [Ulf Möller, pointed out by Brian Wellington <bwelling@tislabs.com>]
12409
12410  *) New functions RSA_get_default_method(), RSA_set_method() and
12411     RSA_get_method(). These allows replacement of RSA_METHODs without having
12412     to mess around with the internals of an RSA structure.
12413     [Steve Henson]
12414
12415  *) Fix memory leaks in DSA_do_sign and DSA_is_prime.
12416     Also really enable memory leak checks in openssl.c and in some
12417     test programs.
12418     [Chad C. Mulligan, Bodo Moeller]
12419
12420  *) Fix a bug in d2i_ASN1_INTEGER() and i2d_ASN1_INTEGER() which can mess
12421     up the length of negative integers. This has now been simplified to just
12422     store the length when it is first determined and use it later, rather
12423     than trying to keep track of where data is copied and updating it to
12424     point to the end.
12425     [Steve Henson, reported by Brien Wheeler
12426      <bwheeler@authentica-security.com>]
12427
12428  *) Add a new function PKCS7_signatureVerify. This allows the verification
12429     of a PKCS#7 signature but with the signing certificate passed to the
12430     function itself. This contrasts with PKCS7_dataVerify which assumes the
12431     certificate is present in the PKCS#7 structure. This isn't always the
12432     case: certificates can be omitted from a PKCS#7 structure and be
12433     distributed by "out of band" means (such as a certificate database).
12434     [Steve Henson]
12435
12436  *) Complete the PEM_* macros with DECLARE_PEM versions to replace the
12437     function prototypes in pem.h, also change util/mkdef.pl to add the
12438     necessary function names.
12439     [Steve Henson]
12440
12441  *) mk1mf.pl (used by Windows builds) did not properly read the
12442     options set by Configure in the top level Makefile, and Configure
12443     was not even able to write more than one option correctly.
12444     Fixed, now "no-idea no-rc5 -DCRYPTO_MDEBUG" etc. works as intended.
12445     [Bodo Moeller]
12446
12447  *) New functions CONF_load_bio() and CONF_load_fp() to allow a config
12448     file to be loaded from a BIO or FILE pointer. The BIO version will
12449     for example allow memory BIOs to contain config info.
12450     [Steve Henson]
12451
12452  *) New function "CRYPTO_num_locks" that returns CRYPTO_NUM_LOCKS.
12453     Whoever hopes to achieve shared-library compatibility across versions
12454     must use this, not the compile-time macro.
12455     (Exercise 0.9.4: Which is the minimum library version required by
12456     such programs?)
12457     Note: All this applies only to multi-threaded programs, others don't
12458     need locks.
12459     [Bodo Moeller]
12460
12461  *) Add missing case to s3_clnt.c state machine -- one of the new SSL tests
12462     through a BIO pair triggered the default case, i.e.
12463     SSLerr(...,SSL_R_UNKNOWN_STATE).
12464     [Bodo Moeller]
12465
12466  *) New "BIO pair" concept (crypto/bio/bss_bio.c) so that applications
12467     can use the SSL library even if none of the specific BIOs is
12468     appropriate.
12469     [Bodo Moeller]
12470
12471  *) Fix a bug in i2d_DSAPublicKey() which meant it returned the wrong value
12472     for the encoded length.
12473     [Jeon KyoungHo <khjeon@sds.samsung.co.kr>]
12474
12475  *) Add initial documentation of the X509V3 functions.
12476     [Steve Henson]
12477
12478  *) Add a new pair of functions PEM_write_PKCS8PrivateKey() and
12479     PEM_write_bio_PKCS8PrivateKey() that are equivalent to
12480     PEM_write_PrivateKey() and PEM_write_bio_PrivateKey() but use the more
12481     secure PKCS#8 private key format with a high iteration count.
12482     [Steve Henson]
12483
12484  *) Fix determination of Perl interpreter: A perl or perl5
12485     _directory_ in $PATH was also accepted as the interpreter.
12486     [Ralf S. Engelschall]
12487
12488  *) Fix demos/sign/sign.c: well there wasn't anything strictly speaking
12489     wrong with it but it was very old and did things like calling
12490     PEM_ASN1_read() directly and used MD5 for the hash not to mention some
12491     unusual formatting.
12492     [Steve Henson]
12493
12494  *) Fix demos/selfsign.c: it used obsolete and deleted functions, changed
12495     to use the new extension code.
12496     [Steve Henson]
12497
12498  *) Implement the PEM_read/PEM_write functions in crypto/pem/pem_all.c
12499     with macros. This should make it easier to change their form, add extra
12500     arguments etc. Fix a few PEM prototypes which didn't have cipher as a
12501     constant.
12502     [Steve Henson]
12503
12504  *) Add to configuration table a new entry that can specify an alternative
12505     name for unistd.h (for pre-POSIX systems); we need this for NeXTstep,
12506     according to Mark Crispin <MRC@Panda.COM>.
12507     [Bodo Moeller]
12508
12509#if 0
12510  *) DES CBC did not update the IV. Weird.
12511     [Ben Laurie]
12512#else
12513     des_cbc_encrypt does not update the IV, but des_ncbc_encrypt does.
12514     Changing the behaviour of the former might break existing programs --
12515     where IV updating is needed, des_ncbc_encrypt can be used.
12516#endif
12517
12518  *) When bntest is run from "make test" it drives bc to check its
12519     calculations, as well as internally checking them. If an internal check
12520     fails, it needs to cause bc to give a non-zero result or make test carries
12521     on without noticing the failure. Fixed.
12522     [Ben Laurie]
12523
12524  *) DES library cleanups.
12525     [Ulf Möller]
12526
12527  *) Add support for PKCS#5 v2.0 PBE algorithms. This will permit PKCS#8 to be
12528     used with any cipher unlike PKCS#5 v1.5 which can at most handle 64 bit
12529     ciphers. NOTE: although the key derivation function has been verified
12530     against some published test vectors it has not been extensively tested
12531     yet. Added a -v2 "cipher" option to pkcs8 application to allow the use
12532     of v2.0.
12533     [Steve Henson]
12534
12535  *) Instead of "mkdir -p", which is not fully portable, use new
12536     Perl script "util/mkdir-p.pl".
12537     [Bodo Moeller]
12538
12539  *) Rewrite the way password based encryption (PBE) is handled. It used to
12540     assume that the ASN1 AlgorithmIdentifier parameter was a PBEParameter
12541     structure. This was true for the PKCS#5 v1.5 and PKCS#12 PBE algorithms
12542     but doesn't apply to PKCS#5 v2.0 where it can be something else. Now
12543     the 'parameter' field of the AlgorithmIdentifier is passed to the
12544     underlying key generation function so it must do its own ASN1 parsing.
12545     This has also changed the EVP_PBE_CipherInit() function which now has a
12546     'parameter' argument instead of literal salt and iteration count values
12547     and the function EVP_PBE_ALGOR_CipherInit() has been deleted.
12548     [Steve Henson]
12549
12550  *) Support for PKCS#5 v1.5 compatible password based encryption algorithms
12551     and PKCS#8 functionality. New 'pkcs8' application linked to openssl.
12552     Needed to change the PEM_STRING_EVP_PKEY value which was just "PRIVATE
12553     KEY" because this clashed with PKCS#8 unencrypted string. Since this
12554     value was just used as a "magic string" and not used directly its
12555     value doesn't matter.
12556     [Steve Henson]
12557
12558  *) Introduce some semblance of const correctness to BN. Shame C doesn't
12559     support mutable.
12560     [Ben Laurie]
12561
12562  *) "linux-sparc64" configuration (ultrapenguin).
12563     [Ray Miller <ray.miller@oucs.ox.ac.uk>]
12564     "linux-sparc" configuration.
12565     [Christian Forster <fo@hawo.stw.uni-erlangen.de>]
12566
12567  *) config now generates no-xxx options for missing ciphers.
12568     [Ulf Möller]
12569
12570  *) Support the EBCDIC character set (work in progress).
12571     File ebcdic.c not yet included because it has a different license.
12572     [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>]
12573
12574  *) Support BS2000/OSD-POSIX.
12575     [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>]
12576
12577  *) Make callbacks for key generation use void * instead of char *.
12578     [Ben Laurie]
12579
12580  *) Make S/MIME samples compile (not yet tested).
12581     [Ben Laurie]
12582
12583  *) Additional typesafe stacks.
12584     [Ben Laurie]
12585
12586  *) New configuration variants "bsdi-elf-gcc" (BSD/OS 4.x).
12587     [Bodo Moeller]
12588
12589
12590 Changes between 0.9.3 and 0.9.3a  [29 May 1999]
12591
12592  *) New configuration variant "sco5-gcc".
12593
12594  *) Updated some demos.
12595     [Sean O Riordain, Wade Scholine]
12596
12597  *) Add missing BIO_free at exit of pkcs12 application.
12598     [Wu Zhigang]
12599
12600  *) Fix memory leak in conf.c.
12601     [Steve Henson]
12602
12603  *) Updates for Win32 to assembler version of MD5.
12604     [Steve Henson]
12605
12606  *) Set #! path to perl in apps/der_chop to where we found it
12607     instead of using a fixed path.
12608     [Bodo Moeller]
12609
12610  *) SHA library changes for irix64-mips4-cc.
12611     [Andy Polyakov]
12612
12613  *) Improvements for VMS support.
12614     [Richard Levitte]
12615
12616
12617 Changes between 0.9.2b and 0.9.3  [24 May 1999]
12618
12619  *) Bignum library bug fix. IRIX 6 passes "make test" now!
12620     This also avoids the problems with SC4.2 and unpatched SC5.
12621     [Andy Polyakov <appro@fy.chalmers.se>]
12622
12623  *) New functions sk_num, sk_value and sk_set to replace the previous macros.
12624     These are required because of the typesafe stack would otherwise break
12625     existing code. If old code used a structure member which used to be STACK
12626     and is now STACK_OF (for example cert in a PKCS7_SIGNED structure) with
12627     sk_num or sk_value it would produce an error because the num, data members
12628     are not present in STACK_OF. Now it just produces a warning. sk_set
12629     replaces the old method of assigning a value to sk_value
12630     (e.g. sk_value(x, i) = y) which the library used in a few cases. Any code
12631     that does this will no longer work (and should use sk_set instead) but
12632     this could be regarded as a "questionable" behaviour anyway.
12633     [Steve Henson]
12634
12635  *) Fix most of the other PKCS#7 bugs. The "experimental" code can now
12636     correctly handle encrypted S/MIME data.
12637     [Steve Henson]
12638
12639  *) Change type of various DES function arguments from des_cblock
12640     (which means, in function argument declarations, pointer to char)
12641     to des_cblock * (meaning pointer to array with 8 char elements),
12642     which allows the compiler to do more typechecking; it was like
12643     that back in SSLeay, but with lots of ugly casts.
12644
12645     Introduce new type const_des_cblock.
12646     [Bodo Moeller]
12647
12648  *) Reorganise the PKCS#7 library and get rid of some of the more obvious
12649     problems: find RecipientInfo structure that matches recipient certificate
12650     and initialise the ASN1 structures properly based on passed cipher.
12651     [Steve Henson]
12652
12653  *) Belatedly make the BN tests actually check the results.
12654     [Ben Laurie]
12655
12656  *) Fix the encoding and decoding of negative ASN1 INTEGERS and conversion
12657     to and from BNs: it was completely broken. New compilation option
12658     NEG_PUBKEY_BUG to allow for some broken certificates that encode public
12659     key elements as negative integers.
12660     [Steve Henson]
12661
12662  *) Reorganize and speed up MD5.
12663     [Andy Polyakov <appro@fy.chalmers.se>]
12664
12665  *) VMS support.
12666     [Richard Levitte <richard@levitte.org>]
12667
12668  *) New option -out to asn1parse to allow the parsed structure to be
12669     output to a file. This is most useful when combined with the -strparse
12670     option to examine the output of things like OCTET STRINGS.
12671     [Steve Henson]
12672
12673  *) Make SSL library a little more fool-proof by not requiring any longer
12674     that SSL_set_{accept,connect}_state be called before
12675     SSL_{accept,connect} may be used (SSL_set_..._state is omitted
12676     in many applications because usually everything *appeared* to work as
12677     intended anyway -- now it really works as intended).
12678     [Bodo Moeller]
12679
12680  *) Move openssl.cnf out of lib/.
12681     [Ulf Möller]
12682
12683  *) Fix various things to let OpenSSL even pass ``egcc -pipe -O2 -Wall
12684     -Wshadow -Wpointer-arith -Wcast-align -Wmissing-prototypes
12685     -Wmissing-declarations -Wnested-externs -Winline'' with EGCS 1.1.2+
12686     [Ralf S. Engelschall]
12687
12688  *) Various fixes to the EVP and PKCS#7 code. It may now be able to
12689     handle PKCS#7 enveloped data properly.
12690     [Sebastian Akerman <sak@parallelconsulting.com>, modified by Steve]
12691
12692  *) Create a duplicate of the SSL_CTX's CERT in SSL_new instead of
12693     copying pointers.  The cert_st handling is changed by this in
12694     various ways (and thus what used to be known as ctx->default_cert
12695     is now called ctx->cert, since we don't resort to s->ctx->[default_]cert
12696     any longer when s->cert does not give us what we need).
12697     ssl_cert_instantiate becomes obsolete by this change.
12698     As soon as we've got the new code right (possibly it already is?),
12699     we have solved a couple of bugs of the earlier code where s->cert
12700     was used as if it could not have been shared with other SSL structures.
12701
12702     Note that using the SSL API in certain dirty ways now will result
12703     in different behaviour than observed with earlier library versions:
12704     Changing settings for an SSL_CTX *ctx after having done s = SSL_new(ctx)
12705     does not influence s as it used to.
12706
12707     In order to clean up things more thoroughly, inside SSL_SESSION
12708     we don't use CERT any longer, but a new structure SESS_CERT
12709     that holds per-session data (if available); currently, this is
12710     the peer's certificate chain and, for clients, the server's certificate
12711     and temporary key.  CERT holds only those values that can have
12712     meaningful defaults in an SSL_CTX.
12713     [Bodo Moeller]
12714
12715  *) New function X509V3_EXT_i2d() to create an X509_EXTENSION structure
12716     from the internal representation. Various PKCS#7 fixes: remove some
12717     evil casts and set the enc_dig_alg field properly based on the signing
12718     key type.
12719     [Steve Henson]
12720
12721  *) Allow PKCS#12 password to be set from the command line or the
12722     environment. Let 'ca' get its config file name from the environment
12723     variables "OPENSSL_CONF" or "SSLEAY_CONF" (for consistency with 'req'
12724     and 'x509').
12725     [Steve Henson]
12726
12727  *) Allow certificate policies extension to use an IA5STRING for the
12728     organization field. This is contrary to the PKIX definition but
12729     VeriSign uses it and IE5 only recognises this form. Document 'x509'
12730     extension option.
12731     [Steve Henson]
12732
12733  *) Add PEDANTIC compiler flag to allow compilation with gcc -pedantic,
12734     without disallowing inline assembler and the like for non-pedantic builds.
12735     [Ben Laurie]
12736
12737  *) Support Borland C++ builder.
12738     [Janez Jere <jj@void.si>, modified by Ulf Möller]
12739
12740  *) Support Mingw32.
12741     [Ulf Möller]
12742
12743  *) SHA-1 cleanups and performance enhancements.
12744     [Andy Polyakov <appro@fy.chalmers.se>]
12745
12746  *) Sparc v8plus assembler for the bignum library.
12747     [Andy Polyakov <appro@fy.chalmers.se>]
12748
12749  *) Accept any -xxx and +xxx compiler options in Configure.
12750     [Ulf Möller]
12751
12752  *) Update HPUX configuration.
12753     [Anonymous]
12754
12755  *) Add missing sk_<type>_unshift() function to safestack.h
12756     [Ralf S. Engelschall]
12757
12758  *) New function SSL_CTX_use_certificate_chain_file that sets the
12759     "extra_cert"s in addition to the certificate.  (This makes sense
12760     only for "PEM" format files, as chains as a whole are not
12761     DER-encoded.)
12762     [Bodo Moeller]
12763
12764  *) Support verify_depth from the SSL API.
12765     x509_vfy.c had what can be considered an off-by-one-error:
12766     Its depth (which was not part of the external interface)
12767     was actually counting the number of certificates in a chain;
12768     now it really counts the depth.
12769     [Bodo Moeller]
12770
12771  *) Bugfix in crypto/x509/x509_cmp.c: The SSLerr macro was used
12772     instead of X509err, which often resulted in confusing error
12773     messages since the error codes are not globally unique
12774     (e.g. an alleged error in ssl3_accept when a certificate
12775     didn't match the private key).
12776
12777  *) New function SSL_CTX_set_session_id_context that allows to set a default
12778     value (so that you don't need SSL_set_session_id_context for each
12779     connection using the SSL_CTX).
12780     [Bodo Moeller]
12781
12782  *) OAEP decoding bug fix.
12783     [Ulf Möller]
12784
12785  *) Support INSTALL_PREFIX for package builders, as proposed by
12786     David Harris.
12787     [Bodo Moeller]
12788
12789  *) New Configure options "threads" and "no-threads".  For systems
12790     where the proper compiler options are known (currently Solaris
12791     and Linux), "threads" is the default.
12792     [Bodo Moeller]
12793
12794  *) New script util/mklink.pl as a faster substitute for util/mklink.sh.
12795     [Bodo Moeller]
12796
12797  *) Install various scripts to $(OPENSSLDIR)/misc, not to
12798     $(INSTALLTOP)/bin -- they shouldn't clutter directories
12799     such as /usr/local/bin.
12800     [Bodo Moeller]
12801
12802  *) "make linux-shared" to build shared libraries.
12803     [Niels Poppe <niels@netbox.org>]
12804
12805  *) New Configure option no-<cipher> (rsa, idea, rc5, ...).
12806     [Ulf Möller]
12807
12808  *) Add the PKCS#12 API documentation to openssl.txt. Preliminary support for
12809     extension adding in x509 utility.
12810     [Steve Henson]
12811
12812  *) Remove NOPROTO sections and error code comments.
12813     [Ulf Möller]
12814
12815  *) Partial rewrite of the DEF file generator to now parse the ANSI
12816     prototypes.
12817     [Steve Henson]
12818
12819  *) New Configure options --prefix=DIR and --openssldir=DIR.
12820     [Ulf Möller]
12821
12822  *) Complete rewrite of the error code script(s). It is all now handled
12823     by one script at the top level which handles error code gathering,
12824     header rewriting and C source file generation. It should be much better
12825     than the old method: it now uses a modified version of Ulf's parser to
12826     read the ANSI prototypes in all header files (thus the old K&R definitions
12827     aren't needed for error creation any more) and do a better job of
12828     translating function codes into names. The old 'ASN1 error code embedded
12829     in a comment' is no longer necessary and it doesn't use .err files which
12830     have now been deleted. Also the error code call doesn't have to appear all
12831     on one line (which resulted in some large lines...).
12832     [Steve Henson]
12833
12834  *) Change #include filenames from <foo.h> to <openssl/foo.h>.
12835     [Bodo Moeller]
12836
12837  *) Change behaviour of ssl2_read when facing length-0 packets: Don't return
12838     0 (which usually indicates a closed connection), but continue reading.
12839     [Bodo Moeller]
12840
12841  *) Fix some race conditions.
12842     [Bodo Moeller]
12843
12844  *) Add support for CRL distribution points extension. Add Certificate
12845     Policies and CRL distribution points documentation.
12846     [Steve Henson]
12847
12848  *) Move the autogenerated header file parts to crypto/opensslconf.h.
12849     [Ulf Möller]
12850
12851  *) Fix new 56-bit DES export ciphersuites: they were using 7 bytes instead of
12852     8 of keying material. Merlin has also confirmed interop with this fix
12853     between OpenSSL and Baltimore C/SSL 2.0 and J/SSL 2.0.
12854     [Merlin Hughes <merlin@baltimore.ie>]
12855
12856  *) Fix lots of warnings.
12857     [Richard Levitte <levitte@stacken.kth.se>]
12858
12859  *) In add_cert_dir() in crypto/x509/by_dir.c, break out of the loop if
12860     the directory spec didn't end with a LIST_SEPARATOR_CHAR.
12861     [Richard Levitte <levitte@stacken.kth.se>]
12862
12863  *) Fix problems with sizeof(long) == 8.
12864     [Andy Polyakov <appro@fy.chalmers.se>]
12865
12866  *) Change functions to ANSI C.
12867     [Ulf Möller]
12868
12869  *) Fix typos in error codes.
12870     [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>, Ulf Möller]
12871
12872  *) Remove defunct assembler files from Configure.
12873     [Ulf Möller]
12874
12875  *) SPARC v8 assembler BIGNUM implementation.
12876     [Andy Polyakov <appro@fy.chalmers.se>]
12877
12878  *) Support for Certificate Policies extension: both print and set.
12879     Various additions to support the r2i method this uses.
12880     [Steve Henson]
12881
12882  *) A lot of constification, and fix a bug in X509_NAME_oneline() that could
12883     return a const string when you are expecting an allocated buffer.
12884     [Ben Laurie]
12885
12886  *) Add support for ASN1 types UTF8String and VISIBLESTRING, also the CHOICE
12887     types DirectoryString and DisplayText.
12888     [Steve Henson]
12889
12890  *) Add code to allow r2i extensions to access the configuration database,
12891     add an LHASH database driver and add several ctx helper functions.
12892     [Steve Henson]
12893
12894  *) Fix an evil bug in bn_expand2() which caused various BN functions to
12895     fail when they extended the size of a BIGNUM.
12896     [Steve Henson]
12897
12898  *) Various utility functions to handle SXNet extension. Modify mkdef.pl to
12899     support typesafe stack.
12900     [Steve Henson]
12901
12902  *) Fix typo in SSL_[gs]et_options().
12903     [Nils Frostberg <nils@medcom.se>]
12904
12905  *) Delete various functions and files that belonged to the (now obsolete)
12906     old X509V3 handling code.
12907     [Steve Henson]
12908
12909  *) New Configure option "rsaref".
12910     [Ulf Möller]
12911
12912  *) Don't auto-generate pem.h.
12913     [Bodo Moeller]
12914
12915  *) Introduce type-safe ASN.1 SETs.
12916     [Ben Laurie]
12917
12918  *) Convert various additional casted stacks to type-safe STACK_OF() variants.
12919     [Ben Laurie, Ralf S. Engelschall, Steve Henson]
12920
12921  *) Introduce type-safe STACKs. This will almost certainly break lots of code
12922     that links with OpenSSL (well at least cause lots of warnings), but fear
12923     not: the conversion is trivial, and it eliminates loads of evil casts. A
12924     few STACKed things have been converted already. Feel free to convert more.
12925     In the fullness of time, I'll do away with the STACK type altogether.
12926     [Ben Laurie]
12927
12928  *) Add `openssl ca -revoke <certfile>' facility which revokes a certificate
12929     specified in <certfile> by updating the entry in the index.txt file.
12930     This way one no longer has to edit the index.txt file manually for
12931     revoking a certificate. The -revoke option does the gory details now.
12932     [Massimiliano Pala <madwolf@openca.org>, Ralf S. Engelschall]
12933
12934  *) Fix `openssl crl -noout -text' combination where `-noout' killed the
12935     `-text' option at all and this way the `-noout -text' combination was
12936     inconsistent in `openssl crl' with the friends in `openssl x509|rsa|dsa'.
12937     [Ralf S. Engelschall]
12938
12939  *) Make sure a corresponding plain text error message exists for the
12940     X509_V_ERR_CERT_REVOKED/23 error number which can occur when a
12941     verify callback function determined that a certificate was revoked.
12942     [Ralf S. Engelschall]
12943
12944  *) Bugfix: In test/testenc, don't test "openssl <cipher>" for
12945     ciphers that were excluded, e.g. by -DNO_IDEA.  Also, test
12946     all available ciphers including rc5, which was forgotten until now.
12947     In order to let the testing shell script know which algorithms
12948     are available, a new (up to now undocumented) command
12949     "openssl list-cipher-commands" is used.
12950     [Bodo Moeller]
12951
12952  *) Bugfix: s_client occasionally would sleep in select() when
12953     it should have checked SSL_pending() first.
12954     [Bodo Moeller]
12955
12956  *) New functions DSA_do_sign and DSA_do_verify to provide access to
12957     the raw DSA values prior to ASN.1 encoding.
12958     [Ulf Möller]
12959
12960  *) Tweaks to Configure
12961     [Niels Poppe <niels@netbox.org>]
12962
12963  *) Add support for PKCS#5 v2.0 ASN1 PBES2 structures. No other support,
12964     yet...
12965     [Steve Henson]
12966
12967  *) New variables $(RANLIB) and $(PERL) in the Makefiles.
12968     [Ulf Möller]
12969
12970  *) New config option to avoid instructions that are illegal on the 80386.
12971     The default code is faster, but requires at least a 486.
12972     [Ulf Möller]
12973
12974  *) Got rid of old SSL2_CLIENT_VERSION (inconsistently used) and
12975     SSL2_SERVER_VERSION (not used at all) macros, which are now the
12976     same as SSL2_VERSION anyway.
12977     [Bodo Moeller]
12978
12979  *) New "-showcerts" option for s_client.
12980     [Bodo Moeller]
12981
12982  *) Still more PKCS#12 integration. Add pkcs12 application to openssl
12983     application. Various cleanups and fixes.
12984     [Steve Henson]
12985
12986  *) More PKCS#12 integration. Add new pkcs12 directory with Makefile.ssl and
12987     modify error routines to work internally. Add error codes and PBE init
12988     to library startup routines.
12989     [Steve Henson]
12990
12991  *) Further PKCS#12 integration. Added password based encryption, PKCS#8 and
12992     packing functions to asn1 and evp. Changed function names and error
12993     codes along the way.
12994     [Steve Henson]
12995
12996  *) PKCS12 integration: and so it begins... First of several patches to
12997     slowly integrate PKCS#12 functionality into OpenSSL. Add PKCS#12
12998     objects to objects.h
12999     [Steve Henson]
13000
13001  *) Add a new 'indent' option to some X509V3 extension code. Initial ASN1
13002     and display support for Thawte strong extranet extension.
13003     [Steve Henson]
13004
13005  *) Add LinuxPPC support.
13006     [Jeff Dubrule <igor@pobox.org>]
13007
13008  *) Get rid of redundant BN file bn_mulw.c, and rename bn_div64 to
13009     bn_div_words in alpha.s.
13010     [Hannes Reinecke <H.Reinecke@hw.ac.uk> and Ben Laurie]
13011
13012  *) Make sure the RSA OAEP test is skipped under -DRSAref because
13013     OAEP isn't supported when OpenSSL is built with RSAref.
13014     [Ulf Moeller <ulf@fitug.de>]
13015
13016  *) Move definitions of IS_SET/IS_SEQUENCE inside crypto/asn1/asn1.h
13017     so they no longer are missing under -DNOPROTO.
13018     [Soren S. Jorvang <soren@t.dk>]
13019
13020
13021 Changes between 0.9.1c and 0.9.2b  [22 Mar 1999]
13022
13023  *) Make SSL_get_peer_cert_chain() work in servers. Unfortunately, it still
13024     doesn't work when the session is reused. Coming soon!
13025     [Ben Laurie]
13026
13027  *) Fix a security hole, that allows sessions to be reused in the wrong
13028     context thus bypassing client cert protection! All software that uses
13029     client certs and session caches in multiple contexts NEEDS PATCHING to
13030     allow session reuse! A fuller solution is in the works.
13031     [Ben Laurie, problem pointed out by Holger Reif, Bodo Moeller (and ???)]
13032
13033  *) Some more source tree cleanups (removed obsolete files
13034     crypto/bf/asm/bf586.pl, test/test.txt and crypto/sha/asm/f.s; changed
13035     permission on "config" script to be executable) and a fix for the INSTALL
13036     document.
13037     [Ulf Moeller <ulf@fitug.de>]
13038
13039  *) Remove some legacy and erroneous uses of malloc, free instead of
13040     Malloc, Free.
13041     [Lennart Bang <lob@netstream.se>, with minor changes by Steve]
13042
13043  *) Make rsa_oaep_test return non-zero on error.
13044     [Ulf Moeller <ulf@fitug.de>]
13045
13046  *) Add support for native Solaris shared libraries. Configure
13047     solaris-sparc-sc4-pic, make, then run shlib/solaris-sc4.sh. It'd be nice
13048     if someone would make that last step automatic.
13049     [Matthias Loepfe <Matthias.Loepfe@AdNovum.CH>]
13050
13051  *) ctx_size was not built with the right compiler during "make links". Fixed.
13052     [Ben Laurie]
13053
13054  *) Change the meaning of 'ALL' in the cipher list. It now means "everything
13055     except NULL ciphers". This means the default cipher list will no longer
13056     enable NULL ciphers. They need to be specifically enabled e.g. with
13057     the string "DEFAULT:eNULL".
13058     [Steve Henson]
13059
13060  *) Fix to RSA private encryption routines: if p < q then it would
13061     occasionally produce an invalid result. This will only happen with
13062     externally generated keys because OpenSSL (and SSLeay) ensure p > q.
13063     [Steve Henson]
13064
13065  *) Be less restrictive and allow also `perl util/perlpath.pl
13066     /path/to/bin/perl' in addition to `perl util/perlpath.pl /path/to/bin',
13067     because this way one can also use an interpreter named `perl5' (which is
13068     usually the name of Perl 5.xxx on platforms where an Perl 4.x is still
13069     installed as `perl').
13070     [Matthias Loepfe <Matthias.Loepfe@adnovum.ch>]
13071
13072  *) Let util/clean-depend.pl work also with older Perl 5.00x versions.
13073     [Matthias Loepfe <Matthias.Loepfe@adnovum.ch>]
13074
13075  *) Fix Makefile.org so CC,CFLAG etc are passed to 'make links' add
13076     advapi32.lib to Win32 build and change the pem test comparison
13077     to fc.exe (thanks to Ulrich Kroener <kroneru@yahoo.com> for the
13078     suggestion). Fix misplaced ASNI prototypes and declarations in evp.h
13079     and crypto/des/ede_cbcm_enc.c.
13080     [Steve Henson]
13081
13082  *) DES quad checksum was broken on big-endian architectures. Fixed.
13083     [Ben Laurie]
13084
13085  *) Comment out two functions in bio.h that aren't implemented. Fix up the
13086     Win32 test batch file so it (might) work again. The Win32 test batch file
13087     is horrible: I feel ill....
13088     [Steve Henson]
13089
13090  *) Move various #ifdefs around so NO_SYSLOG, NO_DIRENT etc are now selected
13091     in e_os.h. Audit of header files to check ANSI and non ANSI
13092     sections: 10 functions were absent from non ANSI section and not exported
13093     from Windows DLLs. Fixed up libeay.num for new functions.
13094     [Steve Henson]
13095
13096  *) Make `openssl version' output lines consistent.
13097     [Ralf S. Engelschall]
13098
13099  *) Fix Win32 symbol export lists for BIO functions: Added
13100     BIO_get_ex_new_index, BIO_get_ex_num, BIO_get_ex_data and BIO_set_ex_data
13101     to ms/libeay{16,32}.def.
13102     [Ralf S. Engelschall]
13103
13104  *) Second round of fixing the OpenSSL perl/ stuff. It now at least compiled
13105     fine under Unix and passes some trivial tests I've now added. But the
13106     whole stuff is horribly incomplete, so a README.1ST with a disclaimer was
13107     added to make sure no one expects that this stuff really works in the
13108     OpenSSL 0.9.2 release.  Additionally I've started to clean the XS sources
13109     up and fixed a few little bugs and inconsistencies in OpenSSL.{pm,xs} and
13110     openssl_bio.xs.
13111     [Ralf S. Engelschall]
13112
13113  *) Fix the generation of two part addresses in perl.
13114     [Kenji Miyake <kenji@miyake.org>, integrated by Ben Laurie]
13115
13116  *) Add config entry for Linux on MIPS.
13117     [John Tobey <jtobey@channel1.com>]
13118
13119  *) Make links whenever Configure is run, unless we are on Windoze.
13120     [Ben Laurie]
13121
13122  *) Permit extensions to be added to CRLs using crl_section in openssl.cnf.
13123     Currently only issuerAltName and AuthorityKeyIdentifier make any sense
13124     in CRLs.
13125     [Steve Henson]
13126
13127  *) Add a useful kludge to allow package maintainers to specify compiler and
13128     other platforms details on the command line without having to patch the
13129     Configure script every time: One now can use ``perl Configure
13130     <id>:<details>'', i.e. platform ids are allowed to have details appended
13131     to them (separated by colons). This is treated as there would be a static
13132     pre-configured entry in Configure's %table under key <id> with value
13133     <details> and ``perl Configure <id>'' is called.  So, when you want to
13134     perform a quick test-compile under FreeBSD 3.1 with pgcc and without
13135     assembler stuff you can use ``perl Configure "FreeBSD-elf:pgcc:-O6:::"''
13136     now, which overrides the FreeBSD-elf entry on-the-fly.
13137     [Ralf S. Engelschall]
13138
13139  *) Disable new TLS1 ciphersuites by default: they aren't official yet.
13140     [Ben Laurie]
13141
13142  *) Allow DSO flags like -fpic, -fPIC, -KPIC etc. to be specified
13143     on the `perl Configure ...' command line. This way one can compile
13144     OpenSSL libraries with Position Independent Code (PIC) which is needed
13145     for linking it into DSOs.
13146     [Ralf S. Engelschall]
13147
13148  *) Remarkably, export ciphers were totally broken and no-one had noticed!
13149     Fixed.
13150     [Ben Laurie]
13151
13152  *) Cleaned up the LICENSE document: The official contact for any license
13153     questions now is the OpenSSL core team under openssl-core@openssl.org.
13154     And add a paragraph about the dual-license situation to make sure people
13155     recognize that _BOTH_ the OpenSSL license _AND_ the SSLeay license apply
13156     to the OpenSSL toolkit.
13157     [Ralf S. Engelschall]
13158
13159  *) General source tree makefile cleanups: Made `making xxx in yyy...'
13160     display consistent in the source tree and replaced `/bin/rm' by `rm'.
13161     Additionally cleaned up the `make links' target: Remove unnecessary
13162     semicolons, subsequent redundant removes, inline point.sh into mklink.sh
13163     to speed processing and no longer clutter the display with confusing
13164     stuff. Instead only the actually done links are displayed.
13165     [Ralf S. Engelschall]
13166
13167  *) Permit null encryption ciphersuites, used for authentication only. It used
13168     to be necessary to set the preprocessor define SSL_ALLOW_ENULL to do this.
13169     It is now necessary to set SSL_FORBID_ENULL to prevent the use of null
13170     encryption.
13171     [Ben Laurie]
13172
13173  *) Add a bunch of fixes to the PKCS#7 stuff. It used to sometimes reorder
13174     signed attributes when verifying signatures (this would break them),
13175     the detached data encoding was wrong and public keys obtained using
13176     X509_get_pubkey() weren't freed.
13177     [Steve Henson]
13178
13179  *) Add text documentation for the BUFFER functions. Also added a work around
13180     to a Win95 console bug. This was triggered by the password read stuff: the
13181     last character typed gets carried over to the next fread(). If you were
13182     generating a new cert request using 'req' for example then the last
13183     character of the passphrase would be CR which would then enter the first
13184     field as blank.
13185     [Steve Henson]
13186
13187  *) Added the new `Includes OpenSSL Cryptography Software' button as
13188     doc/openssl_button.{gif,html} which is similar in style to the old SSLeay
13189     button and can be used by applications based on OpenSSL to show the
13190     relationship to the OpenSSL project.
13191     [Ralf S. Engelschall]
13192
13193  *) Remove confusing variables in function signatures in files
13194     ssl/ssl_lib.c and ssl/ssl.h.
13195     [Lennart Bong <lob@kulthea.stacken.kth.se>]
13196
13197  *) Don't install bss_file.c under PREFIX/include/
13198     [Lennart Bong <lob@kulthea.stacken.kth.se>]
13199
13200  *) Get the Win32 compile working again. Modify mkdef.pl so it can handle
13201     functions that return function pointers and has support for NT specific
13202     stuff. Fix mk1mf.pl and VC-32.pl to support NT differences also. Various
13203     #ifdef WIN32 and WINNTs sprinkled about the place and some changes from
13204     unsigned to signed types: this was killing the Win32 compile.
13205     [Steve Henson]
13206
13207  *) Add new certificate file to stack functions,
13208     SSL_add_dir_cert_subjects_to_stack() and
13209     SSL_add_file_cert_subjects_to_stack().  These largely supplant
13210     SSL_load_client_CA_file(), and can be used to add multiple certs easily
13211     to a stack (usually this is then handed to SSL_CTX_set_client_CA_list()).
13212     This means that Apache-SSL and similar packages don't have to mess around
13213     to add as many CAs as they want to the preferred list.
13214     [Ben Laurie]
13215
13216  *) Experiment with doxygen documentation. Currently only partially applied to
13217     ssl/ssl_lib.c.
13218     See http://www.stack.nl/~dimitri/doxygen/index.html, and run doxygen with
13219     openssl.doxy as the configuration file.
13220     [Ben Laurie]
13221
13222  *) Get rid of remaining C++-style comments which strict C compilers hate.
13223     [Ralf S. Engelschall, pointed out by Carlos Amengual]
13224
13225  *) Changed BN_RECURSION in bn_mont.c to BN_RECURSION_MONT so it is not
13226     compiled in by default: it has problems with large keys.
13227     [Steve Henson]
13228
13229  *) Add a bunch of SSL_xxx() functions for configuring the temporary RSA and
13230     DH private keys and/or callback functions which directly correspond to
13231     their SSL_CTX_xxx() counterparts but work on a per-connection basis. This
13232     is needed for applications which have to configure certificates on a
13233     per-connection basis (e.g. Apache+mod_ssl) instead of a per-context basis
13234     (e.g. s_server).
13235        For the RSA certificate situation is makes no difference, but
13236     for the DSA certificate situation this fixes the "no shared cipher"
13237     problem where the OpenSSL cipher selection procedure failed because the
13238     temporary keys were not overtaken from the context and the API provided
13239     no way to reconfigure them.
13240        The new functions now let applications reconfigure the stuff and they
13241     are in detail: SSL_need_tmp_RSA, SSL_set_tmp_rsa, SSL_set_tmp_dh,
13242     SSL_set_tmp_rsa_callback and SSL_set_tmp_dh_callback.  Additionally a new
13243     non-public-API function ssl_cert_instantiate() is used as a helper
13244     function and also to reduce code redundancy inside ssl_rsa.c.
13245     [Ralf S. Engelschall]
13246
13247  *) Move s_server -dcert and -dkey options out of the undocumented feature
13248     area because they are useful for the DSA situation and should be
13249     recognized by the users.
13250     [Ralf S. Engelschall]
13251
13252  *) Fix the cipher decision scheme for export ciphers: the export bits are
13253     *not* within SSL_MKEY_MASK or SSL_AUTH_MASK, they are within
13254     SSL_EXP_MASK.  So, the original variable has to be used instead of the
13255     already masked variable.
13256     [Richard Levitte <levitte@stacken.kth.se>]
13257
13258  *) Fix 'port' variable from `int' to `unsigned int' in crypto/bio/b_sock.c
13259     [Richard Levitte <levitte@stacken.kth.se>]
13260
13261  *) Change type of another md_len variable in pk7_doit.c:PKCS7_dataFinal()
13262     from `int' to `unsigned int' because it's a length and initialized by
13263     EVP_DigestFinal() which expects an `unsigned int *'.
13264     [Richard Levitte <levitte@stacken.kth.se>]
13265
13266  *) Don't hard-code path to Perl interpreter on shebang line of Configure
13267     script. Instead use the usual Shell->Perl transition trick.
13268     [Ralf S. Engelschall]
13269
13270  *) Make `openssl x509 -noout -modulus' functional also for DSA certificates
13271     (in addition to RSA certificates) to match the behaviour of `openssl dsa
13272     -noout -modulus' as it's already the case for `openssl rsa -noout
13273     -modulus'.  For RSA the -modulus is the real "modulus" while for DSA
13274     currently the public key is printed (a decision which was already done by
13275     `openssl dsa -modulus' in the past) which serves a similar purpose.
13276     Additionally the NO_RSA no longer completely removes the whole -modulus
13277     option; it now only avoids using the RSA stuff. Same applies to NO_DSA
13278     now, too.
13279     [Ralf S.  Engelschall]
13280
13281  *) Add Arne Ansper's reliable BIO - this is an encrypted, block-digested
13282     BIO. See the source (crypto/evp/bio_ok.c) for more info.
13283     [Arne Ansper <arne@ats.cyber.ee>]
13284
13285  *) Dump the old yucky req code that tried (and failed) to allow raw OIDs
13286     to be added. Now both 'req' and 'ca' can use new objects defined in the
13287     config file.
13288     [Steve Henson]
13289
13290  *) Add cool BIO that does syslog (or event log on NT).
13291     [Arne Ansper <arne@ats.cyber.ee>, integrated by Ben Laurie]
13292
13293  *) Add support for new TLS ciphersuites, TLS_RSA_EXPORT56_WITH_RC4_56_MD5,
13294     TLS_RSA_EXPORT56_WITH_RC2_CBC_56_MD5 and
13295     TLS_RSA_EXPORT56_WITH_DES_CBC_SHA, as specified in "56-bit Export Cipher
13296     Suites For TLS", draft-ietf-tls-56-bit-ciphersuites-00.txt.
13297     [Ben Laurie]
13298
13299  *) Add preliminary config info for new extension code.
13300     [Steve Henson]
13301
13302  *) Make RSA_NO_PADDING really use no padding.
13303     [Ulf Moeller <ulf@fitug.de>]
13304
13305  *) Generate errors when private/public key check is done.
13306     [Ben Laurie]
13307
13308  *) Overhaul for 'crl' utility. New function X509_CRL_print. Partial support
13309     for some CRL extensions and new objects added.
13310     [Steve Henson]
13311
13312  *) Really fix the ASN1 IMPLICIT bug this time... Partial support for private
13313     key usage extension and fuller support for authority key id.
13314     [Steve Henson]
13315
13316  *) Add OAEP encryption for the OpenSSL crypto library. OAEP is the improved
13317     padding method for RSA, which is recommended for new applications in PKCS
13318     #1 v2.0 (RFC 2437, October 1998).
13319     OAEP (Optimal Asymmetric Encryption Padding) has better theoretical
13320     foundations than the ad-hoc padding used in PKCS #1 v1.5. It is secure
13321     against Bleichbacher's attack on RSA.
13322     [Ulf Moeller <ulf@fitug.de>, reformatted, corrected and integrated by
13323      Ben Laurie]
13324
13325  *) Updates to the new SSL compression code
13326     [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
13327
13328  *) Fix so that the version number in the master secret, when passed
13329     via RSA, checks that if TLS was proposed, but we roll back to SSLv3
13330     (because the server will not accept higher), that the version number
13331     is 0x03,0x01, not 0x03,0x00
13332     [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
13333
13334  *) Run extensive memory leak checks on SSL apps. Fixed *lots* of memory
13335     leaks in ssl/ relating to new X509_get_pubkey() behaviour. Also fixes
13336     in apps/ and an unrelated leak in crypto/dsa/dsa_vrf.c
13337     [Steve Henson]
13338
13339  *) Support for RAW extensions where an arbitrary extension can be
13340     created by including its DER encoding. See apps/openssl.cnf for
13341     an example.
13342     [Steve Henson]
13343
13344  *) Make sure latest Perl versions don't interpret some generated C array
13345     code as Perl array code in the crypto/err/err_genc.pl script.
13346     [Lars Weber <3weber@informatik.uni-hamburg.de>]
13347
13348  *) Modify ms/do_ms.bat to not generate assembly language makefiles since
13349     not many people have the assembler. Various Win32 compilation fixes and
13350     update to the INSTALL.W32 file with (hopefully) more accurate Win32
13351     build instructions.
13352     [Steve Henson]
13353
13354  *) Modify configure script 'Configure' to automatically create crypto/date.h
13355     file under Win32 and also build pem.h from pem.org. New script
13356     util/mkfiles.pl to create the MINFO file on environments that can't do a
13357     'make files': perl util/mkfiles.pl >MINFO should work.
13358     [Steve Henson]
13359
13360  *) Major rework of DES function declarations, in the pursuit of correctness
13361     and purity. As a result, many evil casts evaporated, and some weirdness,
13362     too. You may find this causes warnings in your code. Zapping your evil
13363     casts will probably fix them. Mostly.
13364     [Ben Laurie]
13365
13366  *) Fix for a typo in asn1.h. Bug fix to object creation script
13367     obj_dat.pl. It considered a zero in an object definition to mean
13368     "end of object": none of the objects in objects.h have any zeros
13369     so it wasn't spotted.
13370     [Steve Henson, reported by Erwann ABALEA <eabalea@certplus.com>]
13371
13372  *) Add support for Triple DES Cipher Block Chaining with Output Feedback
13373     Masking (CBCM). In the absence of test vectors, the best I have been able
13374     to do is check that the decrypt undoes the encrypt, so far. Send me test
13375     vectors if you have them.
13376     [Ben Laurie]
13377
13378  *) Correct calculation of key length for export ciphers (too much space was
13379     allocated for null ciphers). This has not been tested!
13380     [Ben Laurie]
13381
13382  *) Modifications to the mkdef.pl for Win32 DEF file creation. The usage
13383     message is now correct (it understands "crypto" and "ssl" on its
13384     command line). There is also now an "update" option. This will update
13385     the util/ssleay.num and util/libeay.num files with any new functions.
13386     If you do a:
13387     perl util/mkdef.pl crypto ssl update
13388     it will update them.
13389     [Steve Henson]
13390
13391  *) Overhauled the Perl interface (perl/*):
13392     - ported BN stuff to OpenSSL's different BN library
13393     - made the perl/ source tree CVS-aware
13394     - renamed the package from SSLeay to OpenSSL (the files still contain
13395       their history because I've copied them in the repository)
13396     - removed obsolete files (the test scripts will be replaced
13397       by better Test::Harness variants in the future)
13398     [Ralf S. Engelschall]
13399
13400  *) First cut for a very conservative source tree cleanup:
13401     1. merge various obsolete readme texts into doc/ssleay.txt
13402     where we collect the old documents and readme texts.
13403     2. remove the first part of files where I'm already sure that we no
13404     longer need them because of three reasons: either they are just temporary
13405     files which were left by Eric or they are preserved original files where
13406     I've verified that the diff is also available in the CVS via "cvs diff
13407     -rSSLeay_0_8_1b" or they were renamed (as it was definitely the case for
13408     the crypto/md/ stuff).
13409     [Ralf S. Engelschall]
13410
13411  *) More extension code. Incomplete support for subject and issuer alt
13412     name, issuer and authority key id. Change the i2v function parameters
13413     and add an extra 'crl' parameter in the X509V3_CTX structure: guess
13414     what that's for :-) Fix to ASN1 macro which messed up
13415     IMPLICIT tag and add f_enum.c which adds a2i, i2a for ENUMERATED.
13416     [Steve Henson]
13417
13418  *) Preliminary support for ENUMERATED type. This is largely copied from the
13419     INTEGER code.
13420     [Steve Henson]
13421
13422  *) Add new function, EVP_MD_CTX_copy() to replace frequent use of memcpy.
13423     [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
13424
13425  *) Make sure `make rehash' target really finds the `openssl' program.
13426     [Ralf S. Engelschall, Matthias Loepfe <Matthias.Loepfe@adnovum.ch>]
13427
13428  *) Squeeze another 7% of speed out of MD5 assembler, at least on a P2. I'd
13429     like to hear about it if this slows down other processors.
13430     [Ben Laurie]
13431
13432  *) Add CygWin32 platform information to Configure script.
13433     [Alan Batie <batie@aahz.jf.intel.com>]
13434
13435  *) Fixed ms/32all.bat script: `no_asm' -> `no-asm'
13436     [Rainer W. Gerling <gerling@mpg-gv.mpg.de>]
13437
13438  *) New program nseq to manipulate netscape certificate sequences
13439     [Steve Henson]
13440
13441  *) Modify crl2pkcs7 so it supports multiple -certfile arguments. Fix a
13442     few typos.
13443     [Steve Henson]
13444
13445  *) Fixes to BN code.  Previously the default was to define BN_RECURSION
13446     but the BN code had some problems that would cause failures when
13447     doing certificate verification and some other functions.
13448     [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]
13449
13450  *) Add ASN1 and PEM code to support netscape certificate sequences.
13451     [Steve Henson]
13452
13453  *) Add ASN1 and PEM code to support netscape certificate sequences.
13454     [Steve Henson]
13455
13456  *) Add several PKIX and private extended key usage OIDs.
13457     [Steve Henson]
13458
13459  *) Modify the 'ca' program to handle the new extension code. Modify
13460     openssl.cnf for new extension format, add comments.
13461     [Steve Henson]
13462
13463  *) More X509 V3 changes. Fix typo in v3_bitstr.c. Add support to 'req'
13464     and add a sample to openssl.cnf so req -x509 now adds appropriate
13465     CA extensions.
13466     [Steve Henson]
13467
13468  *) Continued X509 V3 changes. Add to other makefiles, integrate with the
13469     error code, add initial support to X509_print() and x509 application.
13470     [Steve Henson]
13471
13472  *) Takes a deep breath and start adding X509 V3 extension support code. Add
13473     files in crypto/x509v3. Move original stuff to crypto/x509v3/old. All this
13474     stuff is currently isolated and isn't even compiled yet.
13475     [Steve Henson]
13476
13477  *) Continuing patches for GeneralizedTime. Fix up certificate and CRL
13478     ASN1 to use ASN1_TIME and modify print routines to use ASN1_TIME_print.
13479     Removed the versions check from X509 routines when loading extensions:
13480     this allows certain broken certificates that don't set the version
13481     properly to be processed.
13482     [Steve Henson]
13483
13484  *) Deal with irritating shit to do with dependencies, in YAAHW (Yet Another
13485     Ad Hoc Way) - Makefile.ssls now all contain local dependencies, which
13486     can still be regenerated with "make depend".
13487     [Ben Laurie]
13488
13489  *) Spelling mistake in C version of CAST-128.
13490     [Ben Laurie, reported by Jeremy Hylton <jeremy@cnri.reston.va.us>]
13491
13492  *) Changes to the error generation code. The perl script err-code.pl
13493     now reads in the old error codes and retains the old numbers, only
13494     adding new ones if necessary. It also only changes the .err files if new
13495     codes are added. The makefiles have been modified to only insert errors
13496     when needed (to avoid needlessly modifying header files). This is done
13497     by only inserting errors if the .err file is newer than the auto generated
13498     C file. To rebuild all the error codes from scratch (the old behaviour)
13499     either modify crypto/Makefile.ssl to pass the -regen flag to err_code.pl
13500     or delete all the .err files.
13501     [Steve Henson]
13502
13503  *) CAST-128 was incorrectly implemented for short keys. The C version has
13504     been fixed, but is untested. The assembler versions are also fixed, but
13505     new assembler HAS NOT BEEN GENERATED FOR WIN32 - the Makefile needs fixing
13506     to regenerate it if needed.
13507     [Ben Laurie, reported (with fix for C version) by Jun-ichiro itojun
13508      Hagino <itojun@kame.net>]
13509
13510  *) File was opened incorrectly in randfile.c.
13511     [Ulf Möller <ulf@fitug.de>]
13512
13513  *) Beginning of support for GeneralizedTime. d2i, i2d, check and print
13514     functions. Also ASN1_TIME suite which is a CHOICE of UTCTime or
13515     GeneralizedTime. ASN1_TIME is the proper type used in certificates et
13516     al: it's just almost always a UTCTime. Note this patch adds new error
13517     codes so do a "make errors" if there are problems.
13518     [Steve Henson]
13519
13520  *) Correct Linux 1 recognition in config.
13521     [Ulf Möller <ulf@fitug.de>]
13522
13523  *) Remove pointless MD5 hash when using DSA keys in ca.
13524     [Anonymous <nobody@replay.com>]
13525
13526  *) Generate an error if given an empty string as a cert directory. Also
13527     generate an error if handed NULL (previously returned 0 to indicate an
13528     error, but didn't set one).
13529     [Ben Laurie, reported by Anonymous <nobody@replay.com>]
13530
13531  *) Add prototypes to SSL methods. Make SSL_write's buffer const, at last.
13532     [Ben Laurie]
13533
13534  *) Fix the dummy function BN_ref_mod_exp() in rsaref.c to have the correct
13535     parameters. This was causing a warning which killed off the Win32 compile.
13536     [Steve Henson]
13537
13538  *) Remove C++ style comments from crypto/bn/bn_local.h.
13539     [Neil Costigan <neil.costigan@celocom.com>]
13540
13541  *) The function OBJ_txt2nid was broken. It was supposed to return a nid
13542     based on a text string, looking up short and long names and finally
13543     "dot" format. The "dot" format stuff didn't work. Added new function
13544     OBJ_txt2obj to do the same but return an ASN1_OBJECT and rewrote
13545     OBJ_txt2nid to use it. OBJ_txt2obj can also return objects even if the
13546     OID is not part of the table.
13547     [Steve Henson]
13548
13549  *) Add prototypes to X509 lookup/verify methods, fixing a bug in
13550     X509_LOOKUP_by_alias().
13551     [Ben Laurie]
13552
13553  *) Sort openssl functions by name.
13554     [Ben Laurie]
13555
13556  *) Get the gendsa program working (hopefully) and add it to app list. Remove
13557     encryption from sample DSA keys (in case anyone is interested the password
13558     was "1234").
13559     [Steve Henson]
13560
13561  *) Make _all_ *_free functions accept a NULL pointer.
13562     [Frans Heymans <fheymans@isaserver.be>]
13563
13564  *) If a DH key is generated in s3_srvr.c, don't blow it by trying to use
13565     NULL pointers.
13566     [Anonymous <nobody@replay.com>]
13567
13568  *) s_server should send the CAfile as acceptable CAs, not its own cert.
13569     [Bodo Moeller <3moeller@informatik.uni-hamburg.de>]
13570
13571  *) Don't blow it for numeric -newkey arguments to apps/req.
13572     [Bodo Moeller <3moeller@informatik.uni-hamburg.de>]
13573
13574  *) Temp key "for export" tests were wrong in s3_srvr.c.
13575     [Anonymous <nobody@replay.com>]
13576
13577  *) Add prototype for temp key callback functions
13578     SSL_CTX_set_tmp_{rsa,dh}_callback().
13579     [Ben Laurie]
13580
13581  *) Make DH_free() tolerate being passed a NULL pointer (like RSA_free() and
13582     DSA_free()). Make X509_PUBKEY_set() check for errors in d2i_PublicKey().
13583     [Steve Henson]
13584
13585  *) X509_name_add_entry() freed the wrong thing after an error.
13586     [Arne Ansper <arne@ats.cyber.ee>]
13587
13588  *) rsa_eay.c would attempt to free a NULL context.
13589     [Arne Ansper <arne@ats.cyber.ee>]
13590
13591  *) BIO_s_socket() had a broken should_retry() on Windoze.
13592     [Arne Ansper <arne@ats.cyber.ee>]
13593
13594  *) BIO_f_buffer() didn't pass on BIO_CTRL_FLUSH.
13595     [Arne Ansper <arne@ats.cyber.ee>]
13596
13597  *) Make sure the already existing X509_STORE->depth variable is initialized
13598     in X509_STORE_new(), but document the fact that this variable is still
13599     unused in the certificate verification process.
13600     [Ralf S. Engelschall]
13601
13602  *) Fix the various library and apps files to free up pkeys obtained from
13603     X509_PUBKEY_get() et al. Also allow x509.c to handle netscape extensions.
13604     [Steve Henson]
13605
13606  *) Fix reference counting in X509_PUBKEY_get(). This makes
13607     demos/maurice/example2.c work, amongst others, probably.
13608     [Steve Henson and Ben Laurie]
13609
13610  *) First cut of a cleanup for apps/. First the `ssleay' program is now named
13611     `openssl' and second, the shortcut symlinks for the `openssl <command>'
13612     are no longer created. This way we have a single and consistent command
13613     line interface `openssl <command>', similar to `cvs <command>'.
13614     [Ralf S. Engelschall, Paul Sutton and Ben Laurie]
13615
13616  *) ca.c: move test for DSA keys inside #ifndef NO_DSA. Make pubkey
13617     BIT STRING wrapper always have zero unused bits.
13618     [Steve Henson]
13619
13620  *) Add CA.pl, perl version of CA.sh, add extended key usage OID.
13621     [Steve Henson]
13622
13623  *) Make the top-level INSTALL documentation easier to understand.
13624     [Paul Sutton]
13625
13626  *) Makefiles updated to exit if an error occurs in a sub-directory
13627     make (including if user presses ^C) [Paul Sutton]
13628
13629  *) Make Montgomery context stuff explicit in RSA data structure.
13630     [Ben Laurie]
13631
13632  *) Fix build order of pem and err to allow for generated pem.h.
13633     [Ben Laurie]
13634
13635  *) Fix renumbering bug in X509_NAME_delete_entry().
13636     [Ben Laurie]
13637
13638  *) Enhanced the err-ins.pl script so it makes the error library number
13639     global and can add a library name. This is needed for external ASN1 and
13640     other error libraries.
13641     [Steve Henson]
13642
13643  *) Fixed sk_insert which never worked properly.
13644     [Steve Henson]
13645
13646  *) Fix ASN1 macros so they can handle indefinite length constructed
13647     EXPLICIT tags. Some non standard certificates use these: they can now
13648     be read in.
13649     [Steve Henson]
13650
13651  *) Merged the various old/obsolete SSLeay documentation files (doc/xxx.doc)
13652     into a single doc/ssleay.txt bundle. This way the information is still
13653     preserved but no longer messes up this directory. Now it's new room for
13654     the new set of documentation files.
13655     [Ralf S. Engelschall]
13656
13657  *) SETs were incorrectly DER encoded. This was a major pain, because they
13658     shared code with SEQUENCEs, which aren't coded the same. This means that
13659     almost everything to do with SETs or SEQUENCEs has either changed name or
13660     number of arguments.
13661     [Ben Laurie, based on a partial fix by GP Jayan <gp@nsj.co.jp>]
13662
13663  *) Fix test data to work with the above.
13664     [Ben Laurie]
13665
13666  *) Fix the RSA header declarations that hid a bug I fixed in 0.9.0b but
13667     was already fixed by Eric for 0.9.1 it seems.
13668     [Ben Laurie - pointed out by Ulf Möller <ulf@fitug.de>]
13669
13670  *) Autodetect FreeBSD3.
13671     [Ben Laurie]
13672
13673  *) Fix various bugs in Configure. This affects the following platforms:
13674     nextstep
13675     ncr-scde
13676     unixware-2.0
13677     unixware-2.0-pentium
13678     sco5-cc.
13679     [Ben Laurie]
13680
13681  *) Eliminate generated files from CVS. Reorder tests to regenerate files
13682     before they are needed.
13683     [Ben Laurie]
13684
13685  *) Generate Makefile.ssl from Makefile.org (to keep CVS happy).
13686     [Ben Laurie]
13687
13688
13689 Changes between 0.9.1b and 0.9.1c  [23-Dec-1998]
13690
13691  *) Added OPENSSL_VERSION_NUMBER to crypto/crypto.h and
13692     changed SSLeay to OpenSSL in version strings.
13693     [Ralf S. Engelschall]
13694
13695  *) Some fixups to the top-level documents.
13696     [Paul Sutton]
13697
13698  *) Fixed the nasty bug where rsaref.h was not found under compile-time
13699     because the symlink to include/ was missing.
13700     [Ralf S. Engelschall]
13701
13702  *) Incorporated the popular no-RSA/DSA-only patches
13703     which allow to compile a RSA-free SSLeay.
13704     [Andrew Cooke / Interrader Ldt., Ralf S. Engelschall]
13705
13706  *) Fixed nasty rehash problem under `make -f Makefile.ssl links'
13707     when "ssleay" is still not found.
13708     [Ralf S. Engelschall]
13709
13710  *) Added more platforms to Configure: Cray T3E, HPUX 11,
13711     [Ralf S. Engelschall, Beckmann <beckman@acl.lanl.gov>]
13712
13713  *) Updated the README file.
13714     [Ralf S. Engelschall]
13715
13716  *) Added various .cvsignore files in the CVS repository subdirs
13717     to make a "cvs update" really silent.
13718     [Ralf S. Engelschall]
13719
13720  *) Recompiled the error-definition header files and added
13721     missing symbols to the Win32 linker tables.
13722     [Ralf S. Engelschall]
13723
13724  *) Cleaned up the top-level documents;
13725     o new files: CHANGES and LICENSE
13726     o merged VERSION, HISTORY* and README* files a CHANGES.SSLeay
13727     o merged COPYRIGHT into LICENSE
13728     o removed obsolete TODO file
13729     o renamed MICROSOFT to INSTALL.W32
13730     [Ralf S. Engelschall]
13731
13732  *) Removed dummy files from the 0.9.1b source tree:
13733     crypto/asn1/x crypto/bio/cd crypto/bio/fg crypto/bio/grep crypto/bio/vi
13734     crypto/bn/asm/......add.c crypto/bn/asm/a.out crypto/dsa/f crypto/md5/f
13735     crypto/pem/gmon.out crypto/perlasm/f crypto/pkcs7/build crypto/rsa/f
13736     crypto/sha/asm/f crypto/threads/f ms/zzz ssl/f ssl/f.mak test/f
13737     util/f.mak util/pl/f util/pl/f.mak crypto/bf/bf_locl.old apps/f
13738     [Ralf S. Engelschall]
13739
13740  *) Added various platform portability fixes.
13741     [Mark J. Cox]
13742
13743  *) The Genesis of the OpenSSL rpject:
13744     We start with the latest (unreleased) SSLeay version 0.9.1b which Eric A.
13745     Young and Tim J. Hudson created while they were working for C2Net until
13746     summer 1998.
13747     [The OpenSSL Project]
13748
13749
13750 Changes between 0.9.0b and 0.9.1b  [not released]
13751
13752  *) Updated a few CA certificates under certs/
13753     [Eric A. Young]
13754
13755  *) Changed some BIGNUM api stuff.
13756     [Eric A. Young]
13757
13758  *) Various platform ports: OpenBSD, Ultrix, IRIX 64bit, NetBSD,
13759     DGUX x86, Linux Alpha, etc.
13760     [Eric A. Young]
13761
13762  *) New COMP library [crypto/comp/] for SSL Record Layer Compression:
13763     RLE (dummy implemented) and ZLIB (really implemented when ZLIB is
13764     available).
13765     [Eric A. Young]
13766
13767  *) Add -strparse option to asn1pars program which parses nested
13768     binary structures
13769     [Dr Stephen Henson <shenson@bigfoot.com>]
13770
13771  *) Added "oid_file" to ssleay.cnf for "ca" and "req" programs.
13772     [Eric A. Young]
13773
13774  *) DSA fix for "ca" program.
13775     [Eric A. Young]
13776
13777  *) Added "-genkey" option to "dsaparam" program.
13778     [Eric A. Young]
13779
13780  *) Added RIPE MD160 (rmd160) message digest.
13781     [Eric A. Young]
13782
13783  *) Added -a (all) option to "ssleay version" command.
13784     [Eric A. Young]
13785
13786  *) Added PLATFORM define which is the id given to Configure.
13787     [Eric A. Young]
13788
13789  *) Added MemCheck_XXXX functions to crypto/mem.c for memory checking.
13790     [Eric A. Young]
13791
13792  *) Extended the ASN.1 parser routines.
13793     [Eric A. Young]
13794
13795  *) Extended BIO routines to support REUSEADDR, seek, tell, etc.
13796     [Eric A. Young]
13797
13798  *) Added a BN_CTX to the BN library.
13799     [Eric A. Young]
13800
13801  *) Fixed the weak key values in DES library
13802     [Eric A. Young]
13803
13804  *) Changed API in EVP library for cipher aliases.
13805     [Eric A. Young]
13806
13807  *) Added support for RC2/64bit cipher.
13808     [Eric A. Young]
13809
13810  *) Converted the lhash library to the crypto/mem.c functions.
13811     [Eric A. Young]
13812
13813  *) Added more recognized ASN.1 object ids.
13814     [Eric A. Young]
13815
13816  *) Added more RSA padding checks for SSL/TLS.
13817     [Eric A. Young]
13818
13819  *) Added BIO proxy/filter functionality.
13820     [Eric A. Young]
13821
13822  *) Added extra_certs to SSL_CTX which can be used
13823     send extra CA certificates to the client in the CA cert chain sending
13824     process. It can be configured with SSL_CTX_add_extra_chain_cert().
13825     [Eric A. Young]
13826
13827  *) Now Fortezza is denied in the authentication phase because
13828     this is key exchange mechanism is not supported by SSLeay at all.
13829     [Eric A. Young]
13830
13831  *) Additional PKCS1 checks.
13832     [Eric A. Young]
13833
13834  *) Support the string "TLSv1" for all TLS v1 ciphers.
13835     [Eric A. Young]
13836
13837  *) Added function SSL_get_ex_data_X509_STORE_CTX_idx() which gives the
13838     ex_data index of the SSL context in the X509_STORE_CTX ex_data.
13839     [Eric A. Young]
13840
13841  *) Fixed a few memory leaks.
13842     [Eric A. Young]
13843
13844  *) Fixed various code and comment typos.
13845     [Eric A. Young]
13846
13847  *) A minor bug in ssl/s3_clnt.c where there would always be 4 0
13848     bytes sent in the client random.
13849     [Edward Bishop <ebishop@spyglass.com>]
13850